A 401(k) plan runs on several types of fiduciaries, each defined by a different section of the Employee Retirement Income Security Act. The three most commonly named are the 3(21) investment advisor, who recommends investments while the employer keeps final say; the 3(38) investment manager, who has discretionary authority to buy and sell plan assets on the employer’s behalf; and the 3(16) plan administrator, who handles the plan’s day-to-day compliance work. Sitting above all of them is the named fiduciary identified in the plan document, who is responsible for selecting and monitoring everyone else. Which type you’re dealing with determines how much authority the outside party actually has and how much personal liability shifts away from the employer.
How ERISA Decides Who Counts as a Fiduciary
ERISA uses a functional test rather than a job title. A person becomes a fiduciary the moment they do any one of three things: exercise discretionary authority or control over plan management or plan assets, provide investment advice to the plan for compensation, or hold discretionary authority over plan administration.1Office of the Law Revision Counsel. 29 USC 1002 – Definitions A company owner who changes the plan’s contribution formula has acted as a fiduciary through that decision alone. The Department of Labor treats plan trustees, plan administrators, and investment committee members as fiduciaries by default.2U.S. Department of Labor. Fiduciary Responsibilities
Whoever fits the definition owes plan participants a “prudent person” duty and must act solely in their interest while keeping plan expenses reasonable.3Office of the Law Revision Counsel. 29 U.S. Code 1104 – Fiduciary Duties A fiduciary who breaches that duty is personally liable for any losses the plan suffers and must give back any profits made through misuse of plan assets.4Office of the Law Revision Counsel. 29 USC 1109 – Liability for Breach of Fiduciary Responsibility Personal, not corporate. That’s the reason the distinctions among fiduciary types matter in practice.
3(21) Investment Advisors
A 3(21) fiduciary, named after ERISA § 3(21), provides investment recommendations to the plan for a fee. The defining feature is that the employer retains final decision-making authority. The advisor suggests which funds should be on the 401(k) menu, but the plan sponsor decides whether to accept the recommendation before anything changes.1Office of the Law Revision Counsel. 29 USC 1002 – Definitions
This creates a co-fiduciary relationship. The advisor takes fiduciary responsibility for the quality of the advice; the employer keeps fiduciary responsibility for accepting or rejecting it. Most small and mid-sized plans start here. The advisor usually helps build an Investment Policy Statement covering objectives, risk tolerance, fund selection criteria, and performance benchmarks, and the employer still has to actually review the recommendations. A committee that rubber-stamps every suggestion without independent analysis has not reduced its own liability at all.
Service providers in this role must disclose all direct and indirect compensation under ERISA § 408(b)(2). The fee notice has to be furnished before the service contract begins and updated within 60 days of any material change, so the plan sponsor has enough information to judge whether the fees are reasonable.
3(38) Investment Managers
A 3(38) fiduciary is a different animal. Instead of recommending investments, this entity has full discretionary authority to buy, sell, and manage plan assets without getting prior approval for each decision.5Legal Information Institute. 29 USC 1002 – Definitions That produces a genuine transfer of liability: the plan trustee is not liable for the investment manager’s acts or omissions regarding the assets under the manager’s control.
Not just anyone can serve in this role. ERISA limits it to registered investment advisers under the Investment Advisers Act of 1940, banks, or insurance companies qualified in more than one state, and the manager must acknowledge fiduciary status in writing.5Legal Information Institute. 29 USC 1002 – Definitions Without that written acknowledgment, the arrangement doesn’t qualify as a 3(38) relationship and no liability has actually shifted.
The transfer isn’t total. The plan sponsor still has a duty to prudently select the investment manager and to monitor performance and fees over time. Hire a 3(38) manager and never review their track record again, and the monitoring failure is the employer’s breach, not the manager’s. The difference from a 3(21) arrangement is that the sponsor evaluates the manager’s overall performance rather than scrutinizing each individual fund selection.
3(16) Plan Administrators
ERISA defines the plan administrator as the person or entity named in the plan document to run day-to-day operations. If the plan document doesn’t name one, the plan sponsor is the administrator by default.6Legal Information Institute. 29 USC 1002 – Definitions The role handles the compliance machinery: filing the annual Form 5500 with the Department of Labor, distributing Summary Plan Descriptions, processing loan requests and hardship withdrawals, handling qualified domestic relations orders in divorce cases, and keeping the plan document current with legislative changes such as the SECURE 2.0 Act.
The financial exposure for administrative failures is real. The IRS imposes a penalty of $250 per day, up to $150,000, for each late Form 5500 filing under IRC § 6652(e).7Internal Revenue Service. Penalty Relief Program for Form 5500-EZ Late Filers The DOL can impose separate civil penalties on top of that, and persistent compliance failures can lead to plan disqualification, with severe tax consequences for every participant.
Plans with 100 or more participants with account balances at the beginning of the plan year generally must include audited financial statements with their Form 5500, prepared by an independent CPA. An 80-120 transition rule provides some breathing room: a plan that filed as “small” the prior year can keep doing so until it hits 121 participants, and a plan that filed as “large” must keep doing so until it drops below 100.
Many employers outsource the 3(16) role to a third-party administrator. Doing so transfers fiduciary liability for those operational tasks, but the employer keeps the duty to select and monitor the TPA, the same as with any other fiduciary delegation.
Named Fiduciaries and the Duty That Never Delegates
Every ERISA plan must name at least one fiduciary in its written plan document. This “named fiduciary” has authority to control and manage the plan’s operation and administration, and is usually a company officer, an HR director, or a committee of employees.8Office of the Law Revision Counsel. 29 USC 1102 – Establishment of Plan Named fiduciaries are the only people authorized to appoint 3(38) investment managers.
Even after a business hires outside 3(21) advisors, 3(38) managers, and 3(16) administrators, the named fiduciary keeps a duty that cannot be handed off: prudently selecting those providers and monitoring their ongoing performance. If an investment manager consistently underperforms relevant benchmarks and the committee does nothing, the inaction is itself a breach. Same for fees. A committee that never benchmarks what the plan pays against competitive alternatives is failing its monitoring duty.
Documentation is the named fiduciary’s best protection. Committee minutes, records of provider searches and fee comparisons, the Investment Policy Statement, and written rationale for any decision to retain or replace a service provider should all be kept for at least six years after the filing date. Courts evaluating fiduciary conduct look for evidence of a deliberate process, not perfect outcomes.
Co-Fiduciary Liability
ERISA doesn’t just hold each fiduciary accountable for their own actions. Under 29 U.S.C. § 1105, a fiduciary can be liable for another fiduciary’s breach in three situations: knowingly participating in or concealing the breach, failing in their own duties in a way that enabled the other fiduciary to commit the breach, or knowing about the breach and not making reasonable efforts to fix it.9Office of the Law Revision Counsel. 29 USC 1105 – Liability for Breach of Co-Fiduciary
This is where the monitoring obligation gets teeth. If a plan committee learns that the 3(16) administrator has been making errors on participant distributions and decides it’s not worth the hassle of finding a replacement, and those errors eventually cause losses, the committee members face personal liability not just for their own inaction but for the administrator’s underlying mistakes. The “reasonable efforts to remedy” standard doesn’t require perfection, but it does require action: raising the issue, documenting the concern, and following through on a corrective plan. When responsibilities overlap or nobody can point to who was supposed to handle a particular task, everyone in the chain is exposed.
Fidelity Bond and Fiduciary Liability Insurance
These two are constantly confused, and only one is required. ERISA requires every plan with more than one participant to carry a fidelity bond covering anyone who handles plan funds or property. The bond must equal at least 10% of plan assets handled, with a minimum of $1,000 and a maximum of $500,000. Plans that hold employer stock or operate as pooled employer plans face a higher ceiling of $1,000,000.10Office of the Law Revision Counsel. 29 USC 1112 – Bonding The bond amount is recalculated at the start of each plan year based on assets from the preceding reporting year.
The fidelity bond protects the plan against losses from fraud or theft by people who handle plan funds. Fiduciary liability insurance is different: it protects the fiduciaries themselves against claims for breach of duty. ERISA requires the bond but does not require fiduciary liability insurance.11U.S. Department of Labor. Protect Your Employee Benefit Plan With an ERISA Fidelity Bond Given the personal liability fiduciaries face for plan losses, the optional coverage is worth serious consideration.