There is no Pontera lawsuit. Despite the sharp public rhetoric between Pontera and Fidelity Investments over access to 401(k) accounts, neither company has filed suit, and Pontera has not brought a formal regulatory complaint against Fidelity, Charles Schwab, or any other recordkeeper that has blocked its platform. The conflict is a business and regulatory standoff, fought through custodial policy changes, state securities advisories, and an open letter campaign.
What the Dispute Is About
Pontera is a fintech company whose platform lets financial advisors manage clients’ 401(k), 403(b), and other workplace retirement accounts that the advisor doesn’t directly custody.1Pontera. About Pontera It does this through credential-based aggregation: the client supplies their retirement account login, and Pontera’s system uses those credentials to connect the advisor to the account. Pontera says its platform is certified under SOC 2 Type II and ISO 27001 and that advisors never see the client’s actual username and password.2401k Specialist. Held Away Assets Fidelity Pontera Feud Highlights Different Perspectives on Access vs Security That credential-sharing method is the heart of the fight.
Why Fidelity Blocked Pontera
In September 2024, Fidelity started blocking platforms that rely on credential sharing from reaching customer retirement accounts.3Wealth Management. Pontera CEO Criticizes Fidelity for Blocking Its Third-Party 401(k) Advice Services Fidelity’s position: once a client hands over login credentials, those credentials sit outside Fidelity’s security infrastructure, and because the same credentials unlock the client’s entire Fidelity relationship rather than just the 401(k), the practice raises the overall security risk.4PlanAdviser. Pontera Fidelity Fight Over Third-Party Access to Plan Data Fidelity also argued that credential sharing routes around the plan sponsors who hold fiduciary responsibility under ERISA.2401k Specialist. Held Away Assets Fidelity Pontera Feud Highlights Different Perspectives on Access vs Security A Fidelity spokesperson told InvestmentNews that customers remained free to work with outside advisors through methods that don’t involve sharing passwords, such as self-directed brokerage accounts.5InvestmentNews. Pontera Cries Anti-Competitive, Fidelity Cites Cyber Safety in Credential-Sharing Showdown
Pontera’s response came through the press rather than the courts. CEO Yoav Zurel accused Fidelity of an “anticompetitive power grab,” and on October 10, 2025, he published a roughly 3,000-word open letter addressed to Fidelity’s 33 million plan participants.6RIABiz. Pontera’s Last-Bid Gambit to Turn Fidelity Credential-Sharing Ban Into an Investor Rights Issue Falls Flat Zurel framed the dispute as a consumer rights issue and argued that employees cannot choose their 401(k) provider, which effectively makes them captive customers.7Pontera. The Battle Over 401(k)s Freedom vs Captivity He also said Pontera had offered to build a secure API connection and been rejected; Fidelity denied that account.5InvestmentNews. Pontera Cries Anti-Competitive, Fidelity Cites Cyber Safety in Credential-Sharing Showdown
Why Pontera Has Not Sued
Legal commentary points to a theory problem. Ari Sonneberg, an ERISA attorney with Wagner Law Group, said Pontera would need to develop a “novel theory” to bring a viable claim, because existing law does not clearly require recordkeepers to grant third-party fintechs access to plan accounts. Recordkeepers do have fiduciary duties to provide access to plan investments, Sonneberg noted, but stretching that duty to require access for an outside fintech is a stretch.6RIABiz. Pontera’s Last-Bid Gambit to Turn Fidelity Credential-Sharing Ban Into an Investor Rights Issue Falls Flat
Pontera has repeatedly declined to say whether it intends to escalate through litigation or through an appeal to the Department of Labor.6RIABiz. Pontera’s Last-Bid Gambit to Turn Fidelity Credential-Sharing Ban Into an Investor Rights Issue Falls Flat As of early 2026, the SEC had not weighed in on credential sharing.
State Regulators: Advisories, Not Enforcement
State securities regulators have been active, but none of their actions have escalated to formal enforcement proceedings or lawsuits. The groundwork sits in a 2019 amendment to the North American Securities Administrators Association’s Model Rule on Unethical Business Practices, which prohibits advisors from accessing client accounts using the client’s own login credentials. It carves out an exception for read-only aggregation tools that operate with the custodian’s agreement and where the advisor never sees the password.8NASAA. Model Rule – Investment Adviser Prohibited Conduct Pontera executes trades, so it does not sit cleanly inside that exception.
Actions so far:
- Washington (late 2023): the Department of Financial Institutions sent letters to roughly 10 advisors directing them to stop using the application, citing potential violations of state unethical-business-practice rules.9Wealth Management. Ohio Cautions State Advisors Using Platforms to Access 401(k)s, Other Held Away Assets
- Missouri (May 2024): the Securities Division issued a warning letter to about 45 state-registered advisory firms, calling use of credential-based tools without the financial institution’s approval “dishonest and unethical.”10Wealth Management. Missouri Regulators Send Warning Letter to Advisors Using Data Aggregation Tech
- Nebraska and Ohio (March 2025): both states issued alerts, including concerns that third-party access could interfere with custodians’ anti-money laundering and Bank Secrecy Act compliance. Ohio’s Division of Securities characterized its alert as informal guidance, not an enforcement action, and spokesperson James Crawford said the division was in “productive conversations” with platform representatives.9Wealth Management. Ohio Cautions State Advisors Using Platforms to Access 401(k)s, Other Held Away Assets
- Colorado (May 2025): issued an advisory specifically naming Pontera.11Naylor Network. Regulatory Warnings Regarding Third-Party Platforms
Oregon, Michigan, and New Jersey have issued related alerts or guidance flagging credential sharing as potentially problematic.6RIABiz. Pontera’s Last-Bid Gambit to Turn Fidelity Credential-Sharing Ban Into an Investor Rights Issue Falls Flat Pontera communications director Joseph Giannone said the company is in “active dialogue with regulators who seek clarity” about how its technology works.10Wealth Management. Missouri Regulators Send Warning Letter to Advisors Using Data Aggregation Tech State-level warnings remain advisory rather than enforceable orders.
What’s Changed Since the Open Letter
Within weeks of Zurel’s open letter, Charles Schwab, which provides custody for retirement plans administered by Vanguard, Voya Financial, and Nationwide, began restricting credential sharing as well, citing security concerns.12Barron’s Advisor. Schwab Fidelity 401(k) Advisors Retirement Plan Pontera Credential Sharing Rather than isolating Fidelity, the campaign appeared to encourage other recordkeepers to follow.
In April 2026, the American Benefits Council wrote to Ohio’s Division of Securities warning that proposed state rules on credential sharing could “interfere with plan sponsors’ efforts to follow federal cybersecurity guidance” and might themselves “pose cybersecurity risks to participants.”13American Benefits Council. Comment Letters The debate has broadened into an industry argument over who controls access to retirement account data and on what terms. So far, that argument is being conducted through open letters, regulatory guidance, and custodial policy changes, not in any courtroom.