An FSA plan administrator is responsible for every operational and compliance task that keeps a flexible spending account legally valid and tax-advantaged: drafting the plan document, running enrollment, funding the account through payroll, adjudicating claims, handling forfeitures, offering COBRA, protecting health data under HIPAA, passing nondiscrimination tests, and filing federal reports. For plan year 2026, the health FSA contribution limit is $3,400 per employee and the maximum carryover, if the plan allows one, is $680.1Internal Revenue Service. Revenue Procedure 2025-32 Missing any one of these obligations can strip the tax-exempt status from the entire plan and leave both the employer and every participant with an unexpected tax bill.
The Written Plan Document and SPD
Nothing else works without this. Federal law defines a cafeteria plan as a written plan in which all participants are employees who may choose among cash and qualified benefits.2Office of the Law Revision Counsel. 26 USC 125 – Cafeteria Plans Without an executed plan document, the IRS treats contributions as ordinary taxable wages, and there is no way to fix that retroactively.
The plan document names eligible employee classes, the election process, the plan year, and the contribution ceiling. The Summary Plan Description translates those terms for participants. Under ERISA, the administrator must deliver the SPD to each participant within 90 days of the date coverage begins.3U.S. Department of Labor. Reporting and Disclosure Guide for Employee Benefit Plans
These documents need active maintenance. When federal limits change, when the plan design shifts, or when eligibility rules move, the administrator must formally amend the plan document and, for material changes, issue an updated SPD. Adoption usually requires a corporate resolution or a signed agreement from an authorized officer.
Enrollment and Election Changes
During annual open enrollment, the administrator gives each eligible employee the information needed to make an election, records the chosen contribution, confirms eligibility against the plan document, and locks the election for the plan year. Once the window closes, elections are generally irrevocable.
The main exception is a qualifying life event: marriage, divorce, birth or adoption, or a change in employment status that affects benefit eligibility. The employee typically has 30 days from the event to request a change. The administrator collects supporting documentation, verifies the request falls within the permitted window, and either approves or denies it. Approving an undocumented request and denying a valid one both create compliance exposure.
Clean enrollment data also feeds nondiscrimination testing later in the year. If the participant records are wrong going in, the test results are unreliable coming out.
The Uniform Coverage Rule for Health FSAs
A health FSA must make the participant’s full annual election available for reimbursement from the first day of the coverage period, regardless of how much has been deducted so far.4Internal Revenue Service. Chief Counsel Advice 201012060 If an employee elects $3,400 and incurs a $3,400 medical expense in January, the plan must pay the full amount even though only one or two payroll deductions have hit.
That creates a real employer exposure. If the employee leaves in February, the employer has paid out far more than it collected and generally cannot recover the difference. The administrator should surface this risk during plan design. Some employers cap contributions below the IRS maximum to limit it, but the uniform coverage requirement itself is non-negotiable, and the plan cannot base reimbursement on the amount contributed to date.4Internal Revenue Service. Chief Counsel Advice 201012060
Dependent care FSAs work on a pay-as-you-go model, so reimbursements can be limited to what has actually been contributed at the time of the claim. An administrator managing both account types has to track each under its own rules.
Payroll Coordination and Year-End Balances
Once elections are locked, the administrator works with payroll to make sure the correct pre-tax amount comes out of each paycheck for the full year. Over-deducting means the employer owes a correction. Under-deducting means the election is not being funded as promised, and a mid-year catch-up creates its own problems.
Handling year-end depends on which unused-fund option the plan adopted. The default rule is use-it-or-lose-it: money in the account at the end of the plan year is forfeited.5Internal Revenue Service. Publication 969 – Health Savings Accounts and Other Tax-Favored Health Plans The plan can soften this with one of two alternatives, but not both. A grace period extends the spending deadline by up to two and a half months after the plan year ends. A carryover provision lets participants roll up to $680 of unused funds into the next plan year.1Internal Revenue Service. Revenue Procedure 2025-32
Most plans also set a run-out period after the plan year, typically around 90 days, during which participants can submit claims for expenses incurred before year-end. The run-out is optional and set by the employer, but once written into the plan it must be enforced consistently.
Handling Forfeited Funds
Forfeited balances do not simply vanish, and the employer cannot pocket them in a health FSA subject to ERISA. Permissible uses include paying reasonable plan administration expenses, reducing participant salary deductions for the next plan year, increasing employee coverage elections, or distributing the funds to participants as taxable cash.
One restriction applies to every method: the amount returned to any individual cannot be tied to what that person forfeited. Distributions must be uniform, such as equal per-capita amounts or a flat percentage applied to all participants alike. Returning “their” dollars to a specific employee would undo the use-it-or-lose-it rule. Whatever method the employer picks, the plan document must specifically authorize it, so the administrator should confirm the language before the first dollar is forfeited.
Claim Substantiation
Claims are the most labor-intensive piece of the job. Every reimbursement request has to be substantiated against IRS rules for eligible medical expenses. The administrator reviews each submission for the date of service, the type of expense, the provider’s name, and the out-of-pocket cost. Over-the-counter items need extra scrutiny, since not everything sold at a pharmacy qualifies.
When participants use an FSA debit card at a merchant with an Inventory Information Approval System, the transaction can be substantiated automatically because the system filters purchases to eligible items at the point of sale. Transactions outside that system still require manual substantiation with receipts. The debit card makes life easier for participants but does not remove the administrator’s verification duty for flagged or unsubstantiated charges.
When a claim fails documentation standards, the administrator issues a denial notice explaining what was missing and giving the participant a deadline to supply corrected information. Clear, timely denials reduce disputes. Vague or silent rejections generate them.
COBRA for Health FSAs
When an employee has a qualifying event such as termination or a reduction in hours, the administrator must offer COBRA continuation coverage for the health FSA.6U.S. Department of Labor. Consolidated Omnibus Budget Reconciliation Act (COBRA) The obligation is to send the election notice on time regardless of whether continuation looks economically attractive to the former employee. Skipping the notice because the balance looks unfavorable is not a permitted call. If the former employee elects coverage and pays the required premiums, the administrator continues processing claims.
HIPAA Privacy and Business Associate Agreements
A health FSA that qualifies as an employee welfare benefit plan and pays for medical care is a group health plan under HIPAA, so it must comply with the Privacy and Security Rules.7U.S. Department of Health and Human Services. Is a Flexible Spending Account or a Cafeteria Plan a Covered Entity A narrow exception exists for self-administered plans with fewer than 50 participants; most employers with meaningful FSA participation will not qualify.
When the employer uses a third-party administrator, that TPA is a business associate under HIPAA because it handles protected health information on behalf of the plan. The Privacy Rule requires a written Business Associate Agreement before the TPA touches any participant data.8U.S. Department of Health and Human Services. Business Associates The BAA spells out how the TPA will safeguard the information, what it can and cannot do with the data, and what happens after a breach.
Nondiscrimination Testing
The tax-exempt status of an FSA depends on the plan not disproportionately favoring highly compensated employees, key employees, or owners. The administrator must run nondiscrimination tests annually to confirm the plan passes.9Internal Revenue Service. Employee Plans Compliance Resolution System – Chapter 702 For a Section 125 cafeteria plan, the three core tests are the eligibility test, the contributions and benefits test, and the key employee concentration test, which caps nontaxable benefits going to key employees at 25% of the total. Health FSAs face their own eligibility and benefits tests on top of the cafeteria plan tests.
If a plan fails, the consequence falls on the favored group: highly compensated or key employees have to include their FSA benefits in taxable income for the year. There is no rerun. Running preliminary tests mid-year gives the administrator time to adjust participation or contribution patterns before results are locked.
Form 5500 and PCORI Fees
Plans with 100 or more participants at the start of the plan year must file Form 5500 with the Department of Labor. The filing is due by the last day of the seventh month after the plan year ends, which is July 31 for a calendar-year plan. The penalty for failing to file can reach $2,739 per day until the complete report is submitted, and the figure is adjusted for inflation periodically.10Department of Labor. 2025 Instructions for Form 5500 Annual Return/Report of Employee Benefit Plan Plans under 100 participants that meet the small-plan criteria are generally exempt, but the administrator should verify each year, since participation can shift.
Self-insured health FSAs also owe the Patient-Centered Outcomes Research Institute fee. For plan years ending after September 30, 2025, and before October 1, 2026, the fee is $3.84 per covered life.11Internal Revenue Service. Patient-Centered Outcomes Research Trust Fund Fee Questions and Answers The administrator reports and pays the PCORI fee on Form 720 by July 31 of the year following the end of the plan year. It is a separate obligation from Form 5500, and forgetting one while remembering the other is a common mistake.
Records and Audit Readiness
ERISA requires anyone subject to a reporting obligation to keep records for at least six years after the filing date of the documents those records support.12U.S. Department of Labor. Recordkeeping in the Electronic Age – ERISA Advisory Council Written Statement For an FSA, that means holding plan documents, SPDs, enrollment records, claims substantiation files, nondiscrimination test results, and Form 5500 filings for six years at a minimum.
The documents an auditor will request are predictable: the signed plan document and every amendment, proof of on-time SPD distribution, payroll records showing pre-tax deductions, claims files with receipts and substantiation decisions, nondiscrimination test worksheets, and copies of every government filing. Organizing these by plan year from the start turns an audit into hours of work instead of weeks.