ERISA Fiduciary Duties: Loyalty, Prudence, and Prohibited Transactions

ERISA fiduciary duties are the four core obligations that Section 404 of the Employee Retirement Income Security Act of 1974 places on anyone who manages a private-sector retirement or health plan: loyalty to participants, prudence in decision-making, diversification of investments, and faithful administration of the plan’s written terms.¹ Breach any one of them and you can be held personally liable to repay every dollar the plan lost, plus a 20 percent civil penalty on any DOL recovery, and willful violations carry criminal fines and up to 10 years in prison.²

Who Counts as a Fiduciary

ERISA uses a functional test, not a job-title test. You are a fiduciary if you exercise discretionary authority or control over how the plan is managed or how its assets are invested, provide investment advice for a fee, or hold discretionary responsibility over plan administration.³ What your business card says doesn’t matter. If you pick the funds on the investment menu, negotiate the recordkeeper’s contract, or decide how to interpret plan terms when paying out benefits, the law treats you as a fiduciary for those acts.

The functional approach catches more people than employers realize. A company officer who signs off on investment lineup changes is a fiduciary for that decision even if a committee technically runs the plan day to day. Outside consultants who recommend specific funds for a fee also fall inside the definition. The scope matters because fiduciary status carries personal financial exposure that ordinary corporate roles do not.

The Duty of Loyalty

Every fiduciary decision must be made solely in the interest of plan participants and their beneficiaries, and for the exclusive purpose of providing benefits and covering reasonable plan expenses.⁴ This is the exclusive benefit rule, and it is absolute. You cannot steer the plan toward an investment because it helps the sponsoring company, choose a service provider because they give the employer a discount on unrelated business, or use plan assets to benefit yourself.

The practical test courts apply is whether a disinterested fiduciary in the same position would have made the same choice. An employer might receive an incidental benefit from a well-run plan, such as better employee retention, but that benefit can never be the reason behind an administrative decision. When personal or corporate interests creep in, even subtly, loyalty is compromised.

Keeping Plan Fees Reasonable

Overpaying for plan services is one of the most common loyalty violations and drives a wave of ongoing litigation. Every dollar leaving the plan in fees is a dollar that is not growing for participants. The duty requires you to make sure fees for recordkeeping, advisory services, and administration are reasonable relative to the services actually delivered.

Federal regulations require covered service providers, meaning any provider that reasonably expects to receive $1,000 or more from the plan, to give you detailed written disclosures before you sign a contract. Those disclosures must describe all direct compensation paid from the plan, all indirect compensation from any other source, any fees triggered by terminating the contract, and how compensation will be received.⁵ Revenue sharing, 12b-1 fees, and similar indirect channels must be spelled out. Bundled providers must give a good-faith estimate of the recordkeeping cost alone.

Collecting the disclosures is only half the job. You then have to benchmark them against what other providers charge for plans of similar size. A fiduciary who gathers the paperwork but never uses it to evaluate whether the plan is getting a fair deal has not satisfied the duty.

The Duty of Prudence

The prudence standard requires you to act with the care, skill, and diligence that a knowledgeable person familiar with such matters would use in managing a similar plan.⁴ The law does not grade on a curve for inexperience. If you lack the knowledge to evaluate a particular investment or insurance product, the prudent thing to do is hire someone who has it.

Courts focus on the process you followed at the time of the decision, not whether the investment eventually made or lost money. A fund that drops 30 percent does not automatically prove imprudence, and a fund that doubles does not prove you were careful. What matters is whether you did the homework first: gathered relevant information, considered alternatives, weighed risks against the plan’s specific needs, and made a reasoned choice based on what you knew then.

Documentation is where most fiduciaries either protect themselves or hang themselves. Keep written records of committee meetings, the options you evaluated, the data you relied on, and why you chose one path over another. If litigation hits five years later, the court will reconstruct your decision from the paper trail. A thin file works against the fiduciary even when the underlying decision was reasonable.

Prudence is also ongoing. You cannot pick a set of investments or a recordkeeper and then ignore them for a decade. Economic conditions change, fund managers leave, fee structures shift. Regular monitoring, at least annually, and often quarterly, is expected. If an investment or provider stops meeting the criteria that justified its original selection, you have an affirmative duty to make a change.

The Duty to Diversify

Fiduciaries must diversify plan investments to minimize the risk of large losses, unless it is clearly prudent not to do so.⁴ The law sets no specific allocation formula. Instead, you have to evaluate the plan’s purpose, the size of its assets, and current market conditions, then spread the money across enough different positions that a downturn in one sector does not wipe out the fund.

The exception for concentration is extremely narrow. Courts treat it as a high bar requiring compelling evidence, not just a reasonable argument. Heavy concentrations in employer stock attract particular scrutiny: the same economic event that hurts the company’s stock price can trigger layoffs, meaning participants can lose their jobs and their retirement savings at the same time.

Participants who suffer losses from an undiversified portfolio can sue to recover the difference between what their account is actually worth and what it would have been worth under a properly diversified strategy. These cases often turn on whether the assets in the portfolio were so correlated that they effectively moved in lockstep.

Participant-Directed Plans and 404(c)

Most 401(k) plans let participants choose their own investments from a menu. When a plan meets the requirements of Section 404(c), fiduciaries are not liable for losses that result from a participant’s own investment choices.⁶ To qualify, the plan must offer at least three diversified options with meaningfully different risk-and-return profiles, allow participants to move money between them at least once every three months, and give them enough information to make informed decisions, including a clear notice about the shift of responsibility.

The safe harbor has an important limit. It does not protect you from claims that you selected or retained imprudent investment options on the menu itself. Choosing the menu and monitoring the funds on it remain fiduciary acts subject to the full prudence and loyalty standards.

The Duty to Follow the Plan Document

Fiduciaries must administer the plan in accordance with its written terms, so long as those terms are consistent with ERISA.⁴ The plan document controls eligibility rules, vesting schedules, benefit calculations, and distribution procedures. Paying a benefit the plan doesn’t authorize, or denying one that it does, creates liability for the resulting harm.

The qualifier is critical: federal law overrides the plan document whenever the two conflict. If the written terms contain an illegal provision, say a vesting schedule slower than the statutory minimum, or a clause permitting a transaction ERISA prohibits, you must follow the law, not the document. Blindly applying a plan provision that violates ERISA is itself a fiduciary breach.

Keeping the plan document and the Summary Plan Description current matters more than many sponsors realize. When plan terms drift out of sync with actual operations or with changes in the law, participants receive inaccurate information about their rights, and fiduciaries end up making ad hoc decisions without clear written authority.

Benefit Claim Deadlines

The duty to follow plan documents intersects with federal claims-procedure rules whenever a benefit request is denied. Federal regulations set minimum timelines every plan must follow. For most pension and retirement plans, a participant must have at least 60 days to file an appeal after receiving a denial notice. Group health plans must allow at least 180 days.⁷

Once an appeal is filed, the plan administrator generally has 60 days to decide pension-type claims. Disability claims have a 45-day deadline. Urgent health care claims get 72 hours. During the appeal, the participant has the right to submit additional documents and evidence, and the reviewer must consider all of it, even material that was not part of the original denial. For health plan appeals, the reviewer must be someone other than the person who made the initial denial and cannot simply defer to that person’s conclusion.

Prohibited Transactions

Beyond the four core duties, ERISA flatly bans certain categories of transactions between a plan and parties in interest, a term that covers the employer, its officers, plan service providers, unions, and their relatives and affiliates. A fiduciary may not cause the plan to buy or sell property with a party in interest, lend plan money to one, or transfer plan assets for one’s benefit.⁸ These prohibitions are structural: they apply even when the transaction is at a fair price and the fiduciary’s motives are pure.

The law also bars fiduciaries from dealing with plan assets for their own account, acting on behalf of anyone whose interests are adverse to the plan, or receiving personal consideration from any party in connection with a plan transaction.

Exemptions That Make Operations Possible

A strict reading of these rules would make running a plan impossible. You could not even pay a recordkeeper, since the recordkeeper becomes a party in interest once they hold a contract with the plan. ERISA carves out specific exemptions to cover the necessary work:⁹

Reasonable service arrangements with parties in interest for legal, accounting, recordkeeping, or other necessary services, provided the compensation is reasonable.
Participant loans available on a reasonably equivalent basis to all participants, at a reasonable interest rate, adequately secured, and made under the plan’s written loan provisions.
Interest-bearing deposits at a bank that serves as plan fiduciary, when specific conditions are met.
Life, health, or annuity contracts purchased from a qualified insurer, provided the plan pays no more than adequate consideration.

The Department of Labor can also grant individual or class exemptions for transactions not covered by the statutory list. Administrative exemptions come with their own conditions, and relying on one without verifying every condition is a fast path to liability.

When Another Fiduciary Breaches

Responsibility does not stop at your own actions. You can be held liable for another fiduciary’s breach in three situations: you knowingly participated in it or helped conceal it; your own failure to fulfill your duties enabled the other person to commit it; or you knew about the breach and did not make reasonable efforts to fix it.¹⁰

The third scenario catches people off guard. If you sit on an investment committee and another member pushes through a decision you believe violates ERISA, staying silent and going along is not a defense. Once you have knowledge of the problem, the law expects affirmative steps: objecting on the record, escalating to the plan sponsor, or in some cases reporting to the Department of Labor. Ignoring a breach you know about is treated as participating in it.

What a Breach Costs You

A fiduciary who breaches any ERISA duty is personally liable to repay the plan for every dollar it lost and to hand over any profits the fiduciary personally made by using plan assets. Courts can also order removal from the fiduciary role and impose whatever other relief they consider appropriate.² Personally liable means what it sounds like: your own savings, your home equity, and your other assets are on the table.

On top of the plan-restoration obligation, the Department of Labor must assess a civil penalty equal to 20 percent of the recovery amount whenever it settles a fiduciary-breach case or a court orders repayment in a DOL enforcement action.¹¹ A $500,000 plan recovery adds a $100,000 penalty on top.

Criminal prosecution is reserved for willful violations. Anyone who knowingly violates the reporting, disclosure, or fiduciary provisions of ERISA faces a fine of up to $100,000 and up to 10 years in prison. For organizations rather than individuals, the maximum fine rises to $500,000.¹² Embezzlement and theft from a plan fall under these criminal provisions. These cases are not common, but the DOL and Department of Justice pursue them regularly enough that fiduciaries who treat plan assets as a personal piggy bank should expect consequences.

Fixing a Breach Before It Escalates

Mistakes happen, and both the IRS and the Department of Labor run structured programs that let plan sponsors fix errors before they turn into audits, lawsuits, or plan disqualification.

The IRS Employee Plans Compliance Resolution System covers operational and plan-document errors, such as failing to follow the plan’s terms, missing required amendments, or loan administration problems. Minor operational errors can be fixed under the Self-Correction Program without contacting the IRS or paying a fee, as long as you had compliance procedures in place; significant operational failures can also be self-corrected if caught within two years of the end of the plan year in which they occurred. Issues that cannot be self-corrected go through the Voluntary Correction Program, where you submit the mistake and proposed fix to the IRS, pay a user fee, and receive a formal Compliance Statement. If the IRS finds the problem during an audit, correction moves to the Audit Closing Agreement Program, which carries a monetary sanction at least as large as the Voluntary Correction Program fee would have been.¹³

The Department of Labor’s Voluntary Fiduciary Correction Program addresses fiduciary breaches rather than plan-document errors. It covers a defined list of correctable transactions, including late remittance of employee contributions, prohibited loans to parties in interest, improper purchases or sales of plan assets, overpayment for services, and benefit miscalculations based on incorrect asset valuations.¹⁴ Late forwarding of participant contributions is the single most common correction under this program, and since 2025 it can be handled under a streamlined self-correction component without filing a full application with the DOL.

Bonding and Fiduciary Insurance

Every person who handles plan funds must be covered by a fidelity bond. The bond amount is set at the start of each plan year and must equal at least 10 percent of the funds that person handled in the prior year, with a minimum of $1,000 and a standard maximum of $500,000. Plans that hold employer stock or that operate as pooled employer plans must carry bonds up to $1,000,000.¹⁵

A fidelity bond protects the plan, not the fiduciary. It covers losses from fraud, theft, and embezzlement, meaning dishonest acts by the bonded person. It does not cover honest mistakes like selecting an underperforming fund or miscalculating a distribution. For that exposure, fiduciaries need separate fiduciary liability insurance, which is optional but increasingly common. Fiduciary liability insurance covers defense costs, settlements, and court-ordered damages arising from breach claims, and it protects the fiduciary’s personal assets. Two different products, two different problems, and one does not substitute for the other.

1
U.S. Department of Labor. Employee Retirement Income Security Act (ERISA)
2
Office of the Law Revision Counsel. 29 USC 1109 – Liability for Breach of Fiduciary Responsibility
3
Office of the Law Revision Counsel. 29 USC 1002 – Definitions
4
Office of the Law Revision Counsel. 29 USC 1104 – Fiduciary Duties
5
eCFR. 29 CFR 2550.408b-2 – General Statutory Exemption for Services or Office Space
6
eCFR. 29 CFR 2550.404c-1 – ERISA Section 404(c) Plans
7
eCFR. 29 CFR 2560.503-1 – Claims Procedure
8
Office of the Law Revision Counsel. 29 USC 1106 – Prohibited Transactions
9
Office of the Law Revision Counsel. 29 USC 1108 – Exemptions From Prohibited Transactions
10
Office of the Law Revision Counsel. 29 USC 1105 – Liability for Breach by Co-Fiduciary
11
Office of the Law Revision Counsel. 29 USC 1132 – Civil Enforcement
12
Office of the Law Revision Counsel. 29 USC 1131 – Criminal Penalties
13
Internal Revenue Service. EPCRS Overview
14
Federal Register. Voluntary Fiduciary Correction Program
15
Office of the Law Revision Counsel. 29 USC 1112 – Bonding