How to Offer a 401(k) to Employees: Costs, Setup, and Compliance

To offer a 401(k) to your employees, you pick a plan type, sign the required plan documents, hire a recordkeeper and administrator, configure payroll to withhold and deposit contributions on time, and file an annual return with the government. For 2026, employees can defer up to $24,500 of pre-tax pay, and federal tax credits can cover most of what a small employer spends getting a plan off the ground. The work has more moving parts than it looks, but each piece is manageable in the right order.

Choose the Plan Type First

Your plan type sets your annual cost, your testing obligations, and how much flexibility you have with contributions. Three structures cover almost every small business.

Traditional 401(k)

A traditional 401(k) gives you the most flexibility in designing contribution formulas and eligibility rules. The catch is annual nondiscrimination testing. Every year the plan must pass the Actual Deferral Percentage (ADP) and Actual Contribution Percentage (ACP) tests, which compare how much highly compensated employees save relative to everyone else.¹ If rank-and-file employees aren’t deferring enough, the plan fails, and you have two and a half months after the plan year ends to distribute the excess contributions back to highly compensated employees. Miss that window and the employer owes a 10% excise tax on the excess.²

For 2026, employee deferrals are capped at $24,500. Workers age 50 and older can add $8,000 in catch-up contributions, and those between 60 and 63 get a higher catch-up limit of $11,250 under SECURE 2.0.³ All contributions combined — employee deferrals, employer match, and profit sharing — cannot exceed $72,000 for the year.

Safe Harbor 401(k)

A Safe Harbor 401(k) skips the annual testing by committing you to a guaranteed employer contribution. You pay a predictable amount and the plan automatically passes the ADP and ACP tests no matter how unevenly employees participate.⁴

The most common Safe Harbor formula matches 100% of the first 3% of pay an employee defers, plus 50% of the next 2%. You can instead skip matching and contribute 3% of compensation for every eligible employee whether they defer or not. Deferral limits are the same as a traditional 401(k). For most small businesses where the owner is also the highest-paid employee, Safe Harbor is the path of least resistance: you guarantee the testing passes instead of hoping it does.

SIMPLE 401(k)

Businesses with 100 or fewer employees that want the lightest administrative load can use a SIMPLE 401(k). The 2026 deferral cap is lower, at $17,000, with a $4,000 catch-up at age 50, but the plan skips nondiscrimination testing and simplifies reporting.³ You must either match employee contributions dollar-for-dollar up to 3% of pay or contribute 2% of compensation for every eligible employee.⁵

The restrictions are real. You cannot maintain any other retirement plan alongside a SIMPLE 401(k), and all contributions vest immediately.⁵ Employees who leave after six months walk away with everything. If you want to use vesting as a retention tool, a traditional or Safe Harbor plan gives you that option.

Tax Credits That Offset the Cost

The cost of launching a 401(k) scares off many small business owners, but federal tax credits now cover a significant share of what you spend. Under SECURE 2.0, eligible employers can claim a credit of up to $5,000 per year for three years to cover ordinary startup costs like plan administration, employee education, and provider fees.⁶

The credit depends on your headcount. Employers with 50 or fewer employees can recover 100% of eligible startup costs, up to the greater of $500 or $250 multiplied by the number of non-highly-compensated eligible employees, capped at $5,000. Employers with 51 to 100 employees get 50% under the same formula.

A separate credit covers actual employer contributions you make to employee accounts, up to $1,000 per participating employee per year for up to five years. For employers with 50 or fewer workers, that credit equals 100% of the contribution in the first two years, then phases down over the remaining three. Businesses with 51 to 100 employees receive a reduced version.⁶ Between the two credits, a small employer can recoup thousands of dollars in the early years, making the net cost far lower than the sticker price.

Design the Eligibility, Vesting, and Matching Rules

With your plan type picked, you set the rules that decide who participates, when they own employer contributions, and how much you contribute.

Eligibility

Federal law lets you require employees to reach age 21 and complete one year of service (at least 1,000 hours) before becoming eligible.⁷ You can be more generous, but you cannot set the bar higher.

Under SECURE 2.0, long-term part-time employees must be allowed to make elective deferrals after completing two consecutive 12-month periods in which they work at least 500 hours each year, once they reach age 21.⁸ If you employ workers who consistently put in 10 to 15 hours a week, they may qualify sooner than you expect.

Vesting

Employee deferrals are always 100% vested; workers own that money immediately.⁷ For employer matching contributions, you have two options. Cliff vesting means employees own nothing until they hit three years of service, then become fully vested. Graded vesting means ownership builds gradually, starting at 20% after two years and reaching 100% after six.⁹ SIMPLE 401(k) plans require immediate vesting on all contributions.

Matching Formula

Your match is the single biggest factor in whether employees actually participate. A common approach is matching 50% of deferrals up to 6% of pay, so an employee deferring 6% of a $50,000 salary gets $1,500 from the employer. Some businesses use a discretionary match instead, deciding each year based on profitability. Safe Harbor plans lock you into a specific formula, while traditional 401(k)s give you annual flexibility at the cost of testing risk.

Know Whether Automatic Enrollment Applies

If you are establishing a new 401(k), federal law may require automatic enrollment. Under SECURE 2.0, any new plan adopted after December 29, 2022 must automatically enroll eligible employees unless it falls into an exempted category.¹⁰ The exemptions cover a lot of small businesses:

Businesses with fewer than 10 employees
Businesses in operation for less than three years
SIMPLE 401(k) plans
Governmental and church plans

If the mandate applies, the initial default contribution rate must be between 3% and 10% of compensation, increasing by 1% each year until it reaches at least 10%, with a ceiling of 15%.¹⁰ Employees can always opt out or change their rate. Final regulations haven’t taken effect, but new plans should be designed with auto-enrollment in mind from the start.

Put the Plan Documents in Place

A 401(k) plan does not legally exist until you have the right paperwork. Three documents form the backbone.

The plan document is the comprehensive legal text that governs everything: eligibility, contribution formulas, loans, hardship withdrawals, and distributions. The IRS requires every qualified plan to operate under a written document.⁴ Most providers offer a pre-approved version the IRS has already reviewed, so you don’t have to draft hundreds of pages from scratch.

The adoption agreement is the shorter document where you plug in your specific choices: company name, EIN, eligibility waiting period, vesting schedule, matching formula, and plan year. It’s the customization layer on top of the pre-approved plan document.

The Summary Plan Description (SPD) translates the plan into language employees can read. It explains how the plan works, what benefits are available, and how to file or appeal a claim. For a brand-new plan, you must distribute the SPD to participants within 120 days of the plan becoming subject to ERISA. New hires joining an existing plan must receive it within 90 days of becoming eligible.

Hire the Service Providers

Running a 401(k) in-house isn’t realistic for most small businesses. You’ll typically work with two or three outside professionals. A recordkeeper tracks account balances, processes investment selections, and generates participant statements. A third-party administrator (TPA) handles compliance, including nondiscrimination testing and government filings. Some providers bundle both roles. A financial advisor or investment consultant helps you select the investment lineup, typically a mix of index funds, actively managed funds, and target-date funds geared to different retirement horizons.

As the plan sponsor, you carry fiduciary responsibility for the plan’s operations, meaning you must act in participants’ best interests when selecting and monitoring investments and providers.⁴ Many owners underestimate this. You are personally on the hook if you ignore excessive fees or let an underperforming provider coast for years without review.

Federal law also requires a fidelity bond for every person who handles plan funds. The bond must cover at least 10% of the plan assets handled in the prior year, with a minimum of $1,000 and a maximum of $500,000.¹¹ Fiduciary liability insurance is separate and optional, but worth considering.

Connect Payroll and Deposit Contributions on Time

Once the plan document and adoption agreement are signed, the mechanical work begins. Payroll needs to be configured to withhold the correct percentage from each participating employee’s paycheck before federal income tax is calculated. These deductions reduce taxable wages for federal income tax purposes but still count as wages for Social Security and Medicare withholding.⁴

Timing matters. For plans with fewer than 100 participants, the Department of Labor provides a safe harbor: deposits are considered timely if employee contributions reach the plan’s trust account within seven business days of being withheld from paychecks.¹² Late deposits are treated as prohibited transactions. The employer must make affected employees whole by paying lost earnings, and the DOL can impose additional penalties. This is one of the most common compliance failures for small plans and is entirely avoidable with proper payroll coordination.

Before contributions start flowing, distribute the SPD and a formal enrollment notice to eligible employees. Give them enough time to review the plan, choose a deferral percentage, and select investments through the provider’s portal. Once the first payroll deductions are processed and deposited into the trust, the plan is operational.

Handle the Annual Filings and Testing

Launching the plan is the beginning of an ongoing compliance obligation, not the end of a project. Every year, you must file a Form 5500 annual return with the Department of Labor and IRS. Plans with fewer than 100 participants at the start of the plan year can typically use the shorter Form 5500-SF, provided all assets are held with regulated financial institutions and meet the definition of eligible plan assets.¹³

Penalties for missing the filing are steep: $250 per day, up to $150,000 per return.¹⁴ Your TPA should handle the filing, but the responsibility sits with you as sponsor. Calendar the deadline and confirm it’s done.

Traditional 401(k) plans also require annual ADP and ACP nondiscrimination testing. If the plan fails, you generally have two and a half months after the plan year ends to correct the problem, usually by returning excess deferrals to highly compensated employees or making additional contributions to everyone else.¹ Safe Harbor and SIMPLE 401(k) plans skip this testing, which is a large part of their appeal.

Fix Operational Mistakes Through EPCRS

Operational errors happen: a missed contribution, an employee who should have been eligible but was not enrolled, a deferral calculated on the wrong compensation figure. The IRS Employee Plans Compliance Resolution System (EPCRS) lets plan sponsors correct these mistakes and avoid plan disqualification.¹⁵

Many common errors can be self-corrected without filing anything with the IRS, provided you act within a reasonable timeframe and make affected employees whole. More significant problems may require a formal voluntary correction submission. The key is catching mistakes early. A plan that loses its tax-qualified status retroactively exposes every participant’s account to immediate taxation, an outcome that is devastating for employees and creates enormous liability for the employer. Building a regular internal audit into your annual routine is the simplest way to keep small errors from compounding.

1
Internal Revenue Service. The Plan Failed the 401(k) ADP and ACP Nondiscrimination Tests
2
Office of the Law Revision Counsel. 26 USC 4979 – Tax on Certain Excess Contributions
3
Internal Revenue Service. 401(k) Limit Increases to $24,500 for 2026, IRA Limit Increases to $7,500
4
Internal Revenue Service. 401(k) Plan Overview
5
Internal Revenue Service. Choosing a Retirement Plan – SIMPLE 401(k) Plan
6
Internal Revenue Service. Retirement Plans Startup Costs Tax Credit
7
Internal Revenue Service. 401(k) Plan Qualification Requirements
8
Federal Register. Long-Term, Part-Time Employee Rules for Cash or Deferred Arrangements Under Section 401(k)
9
U.S. Department of Labor. FAQs About Retirement Plans and ERISA
10
Federal Register. Automatic Enrollment Requirements Under Section 414A
11
U.S. Department of Labor. Protect Your Employee Benefit Plan With an ERISA Fidelity Bond
12
U.S. Department of Labor. Employee Contributions Fact Sheet
13
U.S. Department of Labor. Instructions for Form 5500-SF
14
Internal Revenue Service. Penalty Relief Program for Form 5500-EZ Late Filers
15
Internal Revenue Service. EPCRS Overview