A 401(k) plan runs on three roles that federal law treats as separate jobs with separate consequences. The plan sponsor is the employer that decides to offer the plan and sets its basic design. The plan administrator is the person or entity named in the plan document to handle compliance, filings, and participant communications. Fiduciaries are anyone who exercises discretionary authority over the plan or its assets, and they carry personal liability under ERISA for how they do that work. The duties of a 401(k) plan sponsor, administrator, and fiduciary overlap in practice — one employer can occupy all three positions at once — but each role attaches to a different set of obligations, and understanding where each begins and ends is what determines who answers when something goes wrong.
What the Sponsor Does and Where Its Protection Ends
The sponsor is the employer, and its core decisions are what the Department of Labor calls “settlor functions”: whether to offer a plan at all, how generous the match will be, what the vesting schedule looks like, and whether to amend or terminate the plan later.1U.S. Department of Labor. Guidance on Settlor v. Plan Expenses These are business decisions, not fiduciary ones. A sponsor that caps its match at 3% or chooses a six-year graded vesting schedule over three-year cliff vesting is making a settlor call, and participants cannot challenge it as a fiduciary breach.2Internal Revenue Service. Retirement Topics – Vesting
That protection has a hard edge. Once the sponsor moves from designing the plan to selecting the people and firms who will run it, the line shifts. Choosing a recordkeeper, an investment platform, or a custodian that will handle plan assets is treated as a fiduciary act. A sponsor that picks an expensive, poorly performing provider and never revisits the decision can face fiduciary liability for the selection, even though the initial choice to offer a 401(k) at all remained a pure business decision.
Sponsors of plans established after December 29, 2022, also have a design constraint they cannot opt out of. Under Section 414A of the Internal Revenue Code, new plans must automatically enroll eligible employees at a default rate between 3% and 10% of compensation, with 1% annual increases until the rate reaches at least 10% and no more than 15%.3Federal Register. Automatic Enrollment Requirements Under Section 414A Plans that existed before that date are exempt, along with SIMPLE 401(k)s, governmental and church plans, and plans maintained by businesses operating fewer than three years or normally employing ten or fewer workers.
What the Administrator Has to Do Every Year
The plan administrator is whoever the plan document names as responsible for running the plan. If nobody is named, the sponsor becomes the administrator by default under federal regulation.4eCFR. 29 CFR 2510.3-16 – Definition of Plan Administrator Many employers do not realize this, which means they are carrying the full weight of administrative compliance without having consciously accepted it.
The Form 5500 Filing
The most visible obligation is the annual Form 5500, which gives the DOL and IRS a detailed financial snapshot of the plan. For 2026, the penalty for missing the filing deadline is $2,739 per day with no statutory annual cap. Plans that are late but have not yet received a DOL notice can use the Delinquent Filer Voluntary Compliance Program, which drops the penalty to $10 per day, capped at $750 per filing for small plans and $2,000 per filing for large plans.5U.S. Department of Labor. Delinquent Filer Voluntary Compliance (DFVC) Program The gap between the two figures is reason enough to catch a missed filing before the DOL catches it first.
Plans with 120 or more participants who hold account balances at the start of the plan year must include an independent audit by a qualified public accountant with the Form 5500. The rule for counting participants changed for plan years beginning on or after January 1, 2023. Previously all eligible participants were counted; now only those actually holding a balance are. Some plans dropped below the audit threshold as a result, but administrators should verify the count each year rather than assume the small-plan exemption still applies.
Fee and Investment Disclosures
Administrators of participant-directed plans deliver disclosures on a set schedule. Annual disclosures explain general administrative fees that may be charged to accounts, individual fees such as loan processing charges, and investment information for each available fund, including the total expense ratio expressed as both a percentage and a dollar amount per $1,000 invested. Quarterly statements then show the actual dollar amounts deducted from each participant’s account during the preceding quarter.6eCFR. 29 CFR 2550.404a-5 – Fiduciary Requirements for Disclosure in Participant-Directed Individual Account Plans
Every participant also receives a Summary Plan Description. And if the plan is going to shut down participant access for any period — a blackout during a recordkeeper change, for example — notice must go out at least 30 days but not more than 60 days before the blackout starts.7eCFR. 29 CFR 2520.101-3 – Notice of Blackout Periods Under Individual Account Plans If an emergency makes the 30-day window impossible, the notice must go out as soon as reasonably possible with an explanation of why the advance timeline could not be met.
Nondiscrimination Testing
Each year the administrator runs nondiscrimination tests to confirm the plan does not disproportionately benefit highly compensated employees. For 2026, a highly compensated employee is anyone who earned more than $160,000 from the employer during the prior year.8Internal Revenue Service. Notice 2025-67 – 2026 Amounts Relating to Retirement Plans and IRAs Failing forces the plan to refund excess contributions to higher-paid employees or make additional contributions to everyone else. Uncorrected, the plan risks losing its tax-qualified status.
Who Counts as a Fiduciary
Fiduciary status is not a job title. Under ERISA, anyone who exercises discretionary authority over plan management or assets, or who provides investment advice for compensation, is a fiduciary by function.9GovInfo. 29 CFR 2510.3-21 – Definition of Fiduciary That means a member of the company’s investment committee, an outside adviser recommending fund changes, and in some cases a human resources director approving hardship withdrawals can all be fiduciaries, whether or not anyone gave them that label.
The Prudent Man Standard
ERISA requires fiduciaries to act “with the care, skill, prudence, and diligence under the circumstances then prevailing that a prudent man acting in a like capacity and familiar with such matters would use.”10Office of the Law Revision Counsel. 29 USC 1104 – Fiduciary Duties The measurement is against a knowledgeable professional, not a reasonable layperson. A committee member who rubber-stamps investment decisions without reviewing performance data or comparing fees is not acting prudently, even if the investments happen to perform well.
The statute also imposes a duty of loyalty: every decision must be made solely in the interest of participants and for the exclusive purpose of providing benefits or defraying reasonable plan expenses. Fiduciaries must also diversify the plan’s investments to minimize the risk of large losses. Process matters as much as outcome. A court reviewing a challenged decision looks at whether the fiduciary followed a prudent process, not whether the investment happened to make money.
Personal Liability and How to Limit It
A fiduciary who breaches any ERISA duty is personally liable to restore all losses the plan suffered as a result and to give back any profits the fiduciary personally gained from using plan assets.11Office of the Law Revision Counsel. 29 USC 1109 – Liability for Breach of Fiduciary Duty Courts can order the fiduciary removed and impose any other equitable relief they find appropriate. Liability is not limited to intentional wrongdoing. Honest mistakes flowing from a sloppy process trigger the same exposure.
Appointing an ERISA Section 3(38) investment manager shifts some of that exposure. A 3(38) manager takes discretionary control over investment decisions and accepts fiduciary liability for those choices. The fiduciary who hired the manager still has a duty to monitor performance and confirm the manager continues to follow the plan’s investment policy. Delegation reduces liability. It does not eliminate it.
The Value of a Paper Trail
The single best defense against a fiduciary breach claim is documentation of the process behind each decision. Investment committee minutes should record what information was reviewed, what alternatives were considered, and why the committee reached its conclusion. Fee benchmarking should happen at least annually, comparing the plan’s administrative and investment costs against similar-sized plans. When a committee decides to keep a fund on the menu despite mediocre performance, the reasoning goes on paper alongside the decision. If the DOL audits the plan or a participant sues, those records are what separate defensible judgment calls from actionable negligence.
The 404(c) Safe Harbor
Fiduciaries in participant-directed plans can limit exposure through ERISA’s Section 404(c) safe harbor. When a participant independently controls the investments in their own account, plan fiduciaries are not liable for losses that are the “direct and necessary result” of that participant’s choices.12eCFR. 29 CFR 2550.404c-1 – ERISA Section 404(c) Plans This is why most 401(k) plans are structured as participant-directed accounts rather than trustee-directed ones.
The safe harbor has limits. It does not relieve fiduciaries of the duty to prudently select and monitor the investment options offered on the plan menu. A fiduciary who loads the fund lineup with expensive, underperforming options gets no 404(c) shelter simply because participants chose among those bad options. The safe harbor also does not apply if a participant’s instruction would violate the plan documents, jeopardize tax-qualified status, or result in a prohibited transaction with the sponsor.
Co-Fiduciary Liability
ERISA does not let fiduciaries look the other way when a colleague drops the ball. A fiduciary becomes liable for another fiduciary’s breach in three situations:13Office of the Law Revision Counsel. 29 USC 1105 – Liability for Breach of Co-Fiduciary
- Knowingly participating in or helping conceal the other fiduciary’s breach.
- Enabling the breach through the fiduciary’s own failure to meet ERISA standards.
- Knowing about the breach and failing to make reasonable efforts to remedy it.
The third one catches people off guard. An investment committee member who notices a colleague steering plan business to a related party and says nothing has potential personal liability, even without any involvement in the transaction itself. Silence can be as costly as the breach.
Fidelity Bonds Versus Fiduciary Insurance
ERISA requires every person who handles plan funds to be covered by a fidelity bond. The bond amount must be at least 10% of the plan assets the person handles, with a minimum of $1,000 and a maximum of $500,000. Plans holding employer securities must carry bonds up to $1,000,000.14Office of the Law Revision Counsel. 29 USC 1112 – Bonding The bond protects the plan against fraud and theft, covers embezzlement and misappropriation, and must come from a surety on the Treasury Department’s approved list. No deductibles are allowed.
Fidelity bonds and fiduciary liability insurance are different things, and plans often need both. The bond covers the plan if someone steals from it. Fiduciary liability insurance covers the fiduciaries themselves when accused of a breach of duty — imprudent investment selection, failure to monitor fees, inadequate disclosures. That insurance is optional under ERISA, but personal liability for a fiduciary breach can reach a person’s home and savings, and standard business errors-and-omissions policies generally do not cover ERISA fiduciary claims.
Prohibited Transactions
Federal law bars certain transactions between the plan and “disqualified persons,” a category that includes fiduciaries, the sponsoring employer, service providers, and their family members. Prohibited transactions include selling or leasing property to the plan, lending money to or from the plan, and using plan assets for a fiduciary’s own benefit.15Office of the Law Revision Counsel. 26 USC 4975 – Tax on Prohibited Transactions
The penalty is aggressive. The IRS imposes an initial excise tax of 15% of the amount involved for each year the transaction remains uncorrected. If the transaction is not unwound by the end of the IRS correction period, the tax jumps to 100% of the amount involved. Those penalties fall on the disqualified person, not the plan, but the plan itself can lose tax-qualified status if the violation is severe. Most prohibited transaction problems come from sloppy procedures rather than intentional self-dealing. A company accidentally directs plan business to a fiduciary’s relative. A service provider receives undisclosed indirect compensation. The rules do not require bad intent.
When Third Parties Are Involved
Most employers outsource the technical work to outside specialists: recordkeepers who track contributions and balances, third-party administrators who handle compliance testing and government filings, custodians who hold the plan’s investments. These providers generally perform ministerial tasks, following established rules rather than exercising discretionary judgment, and so they do not automatically become fiduciaries under ERISA.16U.S. Department of Labor. Understanding Your Fiduciary Responsibilities – Section: Who Is a Fiduciary? Status changes if a provider starts exercising discretion over benefit eligibility or investment decisions.
The practical consequence: when a recordkeeper makes a data-entry error or a TPA miscalculates a required minimum distribution, the plan’s named fiduciaries still have the responsibility to catch and correct the mistake. Good providers make the obligation easier to meet. They do not transfer it.
Before signing a contract with a covered plan, service providers must give the responsible fiduciary written disclosures about their fees, compensation arrangements, and potential conflicts of interest. Those disclosures cover direct compensation paid by the plan, indirect compensation from third parties like fund companies, and any fees triggered by terminating the arrangement.17eCFR. 29 CFR 2550.408b-2 – General Statutory Exemption for Services or Office Space Reviewing them is both a fiduciary duty and a condition for the contract to qualify for ERISA’s prohibited transaction exemption. A fiduciary who signs without reading, or who ignores red flags about indirect compensation, has a hard time defending that decision later.
Fixing Mistakes Before They Compound
Errors happen — missed deferral deposits, failed nondiscrimination tests, incorrect hardship distributions, operational failures that do not match the plan document. The IRS offers a structured path to fix them through the Employee Plans Compliance Resolution System, which has three tracks:18Internal Revenue Service. Correcting Plan Errors
- The Self-Correction Program lets plans correct certain operational failures without filing with the IRS or paying a fee, as long as the plan has favorable determination letter status and the correction happens within a reasonable period.
- The Voluntary Correction Program handles errors that cannot be self-corrected. The plan submits a formal application and correction proposal to the IRS, typically with a compliance fee.
- The Audit Closing Agreement Program applies when errors surface during an IRS audit, with negotiated correction terms and potential penalties.
Late Form 5500 filings have their own separate off-ramp: the DOL’s Delinquent Filer Voluntary Compliance Program cuts the penalty from $2,739 per day to $10 per day, but only if the administrator files before the DOL sends a notice of failure.5U.S. Department of Labor. Delinquent Filer Voluntary Compliance (DFVC) Program Using these correction programs proactively is almost always cheaper and less disruptive than waiting for a government audit to force the issue.