The Secure Act 2.0 involves many benefit-related matters including changes to the prior law. The relief offered by this act applies both to affected participants and their beneficiaries as well as the fiduciaries responsible for plan operations, including the employer which sponsors the plan; however, this is not blanket relief.

Courts are now sorting out who is responsible when an impostor diverts a participant's retirement funds with fraudulent distribution requests.

Can the employer, as the plan sponsor, be held responsible when an outside service provider honors a suspicious distribution request?

One federal court recently dismissed such a case against the employer because the plan's website provider was alleged to have processed and authorized a fraudulent online distribution request without adequate participant confirmation. However, employers are plan fiduciaries with a duty to select and monitor the performance of plan service providers. This opens the door to potential claims against employers for their alleged failure to pick service providers with adequate cyber security practices - even if the employer's own data systems are secure and well maintained.

What should an employer do about this?

Former participants in a 401(k) profit sharing plan have filed suit in Federal court in New Jersey seeking recovery of investment losses allocated to their accounts by the employer-sponsor.

We’ve all read about the lawsuits questioning an employer’s 401(k) investment fund selections and related claims of excessive fund costs. And typically a plan’s professional investment advisor (yes – you should have one unless you have an investment professional on staff) meets with company representatives periodically to discuss a detailed report on fund investment performance and any recommended changes in the plan’s investment fund selections. So, your 401(k) plan files bulge with investment-related materials (and they should!). But what about the rest of an employer’s 401(k) responsibilities?

Employers with 25 or more employees in Illinois will be subject to the Secure Choice Savings Program Act (the “Act”) if they do not already have an employer sponsored retirement arrangement like a 401(k) plan. For such employers with 500 or more Illinois employees that have been in business for at least two years, the compliance deadline is November 1, 2018. By that date, these employers must register at the Secure Choice website here and enroll their employees. Subject employers with fewer than 500 Illinois employees have compliance dates deferred until July 1, 2019 (100-499 employees) and November 1, 2019 (25-99 employees).

Your retirement plan may have an outside third party administrator (TPA) to assist with plan administration. However, a TPA typically is not a fiduciary to the plan and does not act as “plan administrator” (that’s usually the employer itself as provided in a typical TPA services agreement). This leaves the employer ultimately responsible for the plan’s compliance with all applicable legal requirements. So, even if your TPA makes a mistake, the employer is likely on the hook for any resulting liability because the TPA’s services agreement usually imposes damage limits and employer indemnities that protect the TPA.