ERISA 401(k) Rules: Vesting, Fiduciary Duties, and 2026 Limits

ERISA 401(k) rules are the federal standards that govern how a private employer’s 401(k) plan is written, funded, invested, disclosed, and paid out. The Employee Retirement Income Security Act of 1974 sets the minimums; the Internal Revenue Code sets the tax limits. For 2026, you can defer up to $24,500 of your own pay into a 401(k), with an $8,000 catch-up at age 50 and a larger $11,250 catch-up for ages 60 through 63.¹ Everything else, from what your employer must tell you to how creditors are kept away from your balance, sits inside ERISA.

Which 401(k) Plans ERISA Actually Covers

ERISA reaches employee benefit plans established or maintained by private-sector employers engaged in interstate commerce, and by unions representing those workers.² Most private companies, nonprofits, and partnerships that run a 401(k) fall inside that umbrella. A plan needs at least one common-law employee to qualify, so a solo owner-only plan generally does not.

Several categories sit outside ERISA entirely: government plans, church plans that have not elected coverage, plans maintained solely to comply with workers’ compensation or unemployment laws, and plans maintained outside the United States mainly for nonresident aliens.² If you work for a state agency, a public school, or a house of worship, the retirement plan on your paycheck is probably operating under a different framework and the protections below may not apply the same way.

2026 Contribution Limits

The IRS adjusts elective deferral limits each year. For 2026:¹

Under age 50: $24,500 in employee deferrals.
Age 50 and over: an extra $8,000 catch-up, for a $32,500 employee total.
Ages 60 through 63: a larger $11,250 catch-up instead of the standard $8,000, for a $35,750 employee total.

These numbers cover only what you contribute. Employer matching and profit-sharing go on top and are subject to a separate, higher overall cap.

Vesting: When Employer Money Becomes Yours

Your own contributions are 100% vested the moment they hit the plan. Employer contributions can be put on a vesting schedule, but ERISA caps how long the wait can be.³ For a 401(k), the plan must use one of two schedules or something more generous:

Cliff vesting: 0% for the first two years, then 100% after three years of service.
Graded vesting: 20% after two years, 40% after three, 60% after four, 80% after five, and 100% after six.

A year of service generally means at least 1,000 hours in a 12-month period. You also become fully vested automatically if you reach the plan’s normal retirement age or the plan terminates.³

Long-Term Part-Time Workers

Under SECURE 2.0, part-time employees who work at least 500 hours in each of two consecutive years must be allowed to make elective deferrals. Employers do not have to match or profit-share for these workers, but each 500-hour year counts toward vesting. Anyone who hits the 1,000-hour threshold participates as a regular employee.

Automatic Enrollment

If your employer set up a new 401(k) after December 29, 2022, SECURE 2.0 requires automatic enrollment starting with the 2025 plan year. The default deferral rate must be at least 3% of pay and escalate each year until it reaches at least 10%. You can always opt out or pick a different rate.

The mandate does not apply to businesses that have existed for three years or fewer, employers with ten or fewer employees, or government and church plans. Older plans established before the cutoff are also exempt, though many adopted automatic enrollment on their own.

Fiduciary Duties You Can Rely On

Anyone with discretionary authority over the plan’s assets or administration is a fiduciary. That covers plan administrators, investment committee members, and often the employer itself. ERISA holds them to a demanding standard: they must act with the care and skill a knowledgeable person would use in similar circumstances, act solely for the benefit of participants and beneficiaries, and diversify investments to minimize the risk of large losses unless it is clearly imprudent to do so.⁴

A fiduciary who breaches these duties is personally liable to restore any losses the plan suffered and to disgorge any profits gained from misusing plan assets. Courts can also order removal.⁵ The Department of Labor can assess a civil penalty equal to 20% of amounts recovered through a settlement or court order.⁶

There is one safe harbor worth understanding. If the plan lets you direct your own investments and you actually exercise that control, the fiduciary is generally not on the hook for losses tied to your choices.⁴ That is how most modern 401(k)s work. The fiduciary still has to build a reasonable investment menu and monitor it over time. Fiduciary duty now also reaches cybersecurity: plan officials must vet recordkeepers’ security practices and protect participant data.⁷

What the Plan Must Tell You

ERISA requires plan administrators to give you enough information to understand your benefits and check on the plan’s health.⁸ The core documents are:

The Summary Plan Description, which explains eligibility, vesting, contribution formulas, and distribution rules in plain language.
The Summary Annual Report, a yearly financial snapshot of the plan.
A Summary of Material Modifications when the plan changes. For a change that is not a material reduction in benefits, the deadline is 210 days after the end of the plan year in which it was adopted; material reductions must be communicated sooner.

If you do not have your Summary Plan Description, request one from the plan administrator. It is the first document you will need in almost any dispute.

If Your Claim Is Denied

Every ERISA plan must have reasonable procedures for filing benefit claims and appealing denials.⁹ A written denial has to explain why. The critical piece most participants miss: you generally must exhaust the plan’s internal appeal before you can sue. Skip the appeal and go straight to court, and a judge will most likely dismiss the case. The narrow futility exception is hard to prove; a belief that the plan will deny you again does not qualify.

The specific deadlines and steps live inside your Summary Plan Description. Read them before you file a claim, not after a denial arrives, because the appeal window is short and running.

Creditor Protection

ERISA requires every covered plan to prohibit assignment or transfer of benefits.¹⁰ In practice, your 401(k) is off-limits to ordinary creditors. A civil judgment against you cannot be collected by garnishing the account. The Supreme Court held in Patterson v. Shumate that this anti-alienation rule survives bankruptcy, so your ERISA-qualified savings stay protected even when other assets are being liquidated.¹¹

Two exceptions apply. A Qualified Domestic Relations Order can send part of your balance to a spouse, former spouse, child, or dependent for child support, alimony, or property division in divorce.¹² A federal tax lien can also reach the account. Outside those two situations, the protection holds.

Loans, Early Withdrawals, and Required Distributions

Not every 401(k) allows loans, but plans that do must follow IRS limits. You can borrow up to 50% of your vested balance, capped at $50,000. If half your vested balance is under $10,000, the plan may allow borrowing up to $10,000.¹³ Borrow more than the limit and the excess is treated as a taxable distribution. Repayment must generally be made in substantially level installments, at least quarterly, over five years. Loans used to buy your primary home get a longer window. Leave the job with a balance outstanding, and if you do not repay by that year’s tax filing deadline, the remainder is treated as a distribution.

Withdrawals before age 59½ usually add a 10% tax on top of the regular income tax. Exceptions exist for separation from service after age 55, certain medical expenses, disability, and qualified domestic relations orders, among others.¹⁴ Check the list before pulling money early; the penalty is often avoidable.

At the other end of your working life, required minimum distributions must begin by April 1 of the year after you turn 73. SECURE 2.0 pushes the age to 75 for anyone who turns 73 after December 31, 2032.¹⁵ Missing an RMD triggers a steep excise tax on the amount you should have taken. Still working past the RMD age and own less than 5% of the company? Many plans let you delay RMDs from that employer’s plan until you actually retire.

1
Internal Revenue Service. 401(k) Limit Increases to $24,500 for 2026, IRA Limit Increases to $7,500
2
Office of the Law Revision Counsel. 29 USC 1003 – Coverage
3
Internal Revenue Service. Retirement Topics – Vesting
4
Office of the Law Revision Counsel. 29 U.S. Code 1104 – Fiduciary Duties
5
Office of the Law Revision Counsel. 29 USC 1109 – Liability for Breach of Fiduciary Duty
6
Office of the Law Revision Counsel. 29 USC 1132 – Civil Enforcement
7
U.S. Department of Labor. US Department of Labor Updates Cybersecurity Guidance for Plan Sponsors, Fiduciaries, Recordkeepers, Plan Participants
8
Office of the Law Revision Counsel. 29 U.S. Code 1021 – Duty of Disclosure and Reporting
9
U.S. Department of Labor. Benefit Claims Procedure Regulation FAQs
10
Office of the Law Revision Counsel. 29 U.S. Code 1056 – Form and Payment of Benefits
11
Justia U.S. Supreme Court. Patterson v. Shumate, 504 U.S. 753 (1992)
12
Office of the Law Revision Counsel. 29 USC 1056 – Form and Payment of Benefits
13
eCFR. 26 CFR 1.72(p)-1 – Loans Treated as Distributions
14
Internal Revenue Service. Retirement Topics – Exceptions to Tax on Early Distributions
15
Congressional Research Service. Required Minimum Distribution (RMD) Rules for Original Owners