What Is a 401(k) Fiduciary? Roles, Duties, and Liability

A 401k fiduciary is any person or entity that exercises discretionary authority over a retirement plan’s management, its investments, or its administration, and under the Employee Retirement Income Security Act of 1974 that role carries personal liability for losses caused by a breach of duty. Federal law applies a functional test: what matters is what you actually do, not what your title says or what a service contract calls you. If you pick the plan’s investment lineup, hire its service providers, or interpret its terms, you are a fiduciary whether you meant to take on the role or not.

Who Counts as a Fiduciary

ERISA identifies three paths to fiduciary status: exercising discretionary authority or control over the plan’s management or assets, providing investment advice for compensation, or holding discretionary responsibility over plan administration.¹ Any one of the three is enough. You do not need to check all three boxes.

The investment advice path has a nuance worth understanding. Under the federal regulation defining fiduciary status, a person qualifies when they make professional investment recommendations on a regular basis, under circumstances that would lead a reasonable investor to believe the advice reflects expert judgment tailored to their situation.² A one-off comment at a conference does not trigger fiduciary status. Ongoing, compensated advice that shapes how the plan invests does.

People who handle only routine administrative tasks are generally not fiduciaries. Processing payroll contributions, preparing the annual Form 5500, or calculating benefits from a fixed formula are ministerial jobs. The dividing line is discretion. Follow a predetermined formula and you are ministerial; start interpreting plan terms or making judgment calls about how assets get managed and you have crossed into fiduciary territory.³

The Main Fiduciary Roles

Federal law recognizes several distinct fiduciary categories. Knowing which one applies to you, or which one you have hired, determines where your liability starts and stops.

Plan Administrator Under Section 3(16)

The plan administrator is whoever the plan document names. If the document does not name anyone, the plan sponsor, usually the employer, automatically becomes the administrator.¹ The administrator handles operations: government filings, participant disclosures, and running the plan according to its written terms and federal law. Many small business owners do not realize they hold this role by default.

Investment Adviser Under Section 3(21)

A 3(21) fiduciary provides investment recommendations but does not have the final say. This is a co-fiduciary arrangement: the adviser suggests which funds to include on the plan’s menu, and the plan sponsor or committee decides whether to accept those recommendations. The sponsor keeps responsibility for reviewing and approving investment decisions.

Investment Manager Under Section 3(38)

A 3(38) investment manager takes on a larger share of the liability. This fiduciary has the power to select, monitor, and replace plan investments without needing approval from anyone else. In exchange for that discretion, the law imposes qualifications: a 3(38) manager must be a registered investment adviser, a bank, or an insurance company qualified in more than one state, and must acknowledge fiduciary status in writing.¹ Hiring a 3(38) shifts investment-related liability away from the plan sponsor, though the sponsor still has a duty to choose and monitor the manager carefully.

Core Duties That Govern Every Decision

Four obligations run through every fiduciary decision. These are enforceable standards, and violating any one of them can trigger personal liability.

Duty of Loyalty

Every fiduciary decision must serve the exclusive purpose of providing benefits to plan participants and their beneficiaries. The plan’s interests come first, ahead of the employer’s, the fiduciary’s own, or any service provider’s. When negotiating recordkeeper fees or selecting a plan auditor, the question is what is best for the people whose retirement money is at stake, not what is easiest for the company.⁴ Plan expenses must be reasonable, and any costs charged against plan assets should be genuinely necessary to run the plan.

Duty of Prudence

ERISA measures a fiduciary’s conduct against what a knowledgeable person in the same position would do, someone “familiar with such matters” and acting with the same care and diligence for a similar plan.⁴ This is often called the “prudent expert” standard, because it benchmarks you against a professional with relevant expertise. If you lack that expertise, and most plan sponsors do when it comes to investment selection, the prudent move is to hire someone who has it.

Prudence is about process, not outcomes. A fund that loses value does not automatically mean the fiduciary failed. But choosing that fund without researching alternatives, comparing fees, or documenting why it was a reasonable choice absolutely can. The Department of Labor has made clear that fiduciaries should document their decision-making to demonstrate a thorough evaluation process.³

Duty to Diversify

Fiduciaries must diversify plan investments to minimize the risk of large losses, unless it would be clearly imprudent to do so under the specific circumstances.⁴ In practice, that means offering investment options across different asset classes so participants are not overexposed to any single stock, sector, or market. A plan offering only company stock and a money market fund would have a hard time meeting this standard.

Duty to Follow Plan Documents

Fiduciaries must manage the plan according to its governing documents, as long as those documents are consistent with ERISA.⁴ The plan document is the roadmap for eligibility, contributions, vesting, and distributions. Deviating from its terms, even with good intentions, can create a breach. Fiduciaries should review the document periodically to make sure it still matches how the plan actually operates.

Monitoring Investments and Service Providers

Selecting good funds and competent providers is not a one-time task. Fiduciaries have an ongoing duty to monitor both, which means periodically reviewing fund performance against appropriate benchmarks, checking whether fees remain competitive, and evaluating whether providers are still delivering value.

When hiring or reviewing providers, the DOL recommends surveying multiple candidates, asking each for the same information, and documenting the comparison.³ A fiduciary who picked a recordkeeper a decade ago and never checked whether the fees still make sense is sitting on avoidable risk. Most fiduciary litigation in recent years has centered on exactly this issue: participants suing because their plan paid above-market fees for services cheaper providers offered at equal or better quality. A fee reasonable when the plan had 50 participants and $2 million in assets may not be reasonable at 500 participants and $30 million.

Prohibited Transactions

Federal law bans specific categories of transactions between a plan and parties with a close relationship to it: the employer, plan officers, service providers, and certain family members. These rules apply regardless of whether the deal happens to be financially beneficial to the plan.

The prohibited categories include selling or leasing property between the plan and a party in interest, lending money or extending credit between them, and transferring plan assets for the benefit of a related party.⁵ A company that borrows from its own 401k plan has committed a prohibited transaction even if it pays the money back with interest.

Self-dealing rules are equally strict. A fiduciary cannot use plan assets for personal benefit, act on behalf of someone whose interests conflict with the plan’s, or receive personal compensation from any party in connection with a plan transaction.⁵ These are per se violations. The government does not need to prove the plan lost money or that the fiduciary intended harm. The transaction itself is the violation.

Statutory Exemptions

Several exemptions let plans engage in transactions that would otherwise be prohibited:

Participant loans, as long as loans are available on a reasonably equivalent basis to all participants, carry a reasonable interest rate, are adequately secured, and follow the plan’s loan provisions.
Reasonable service arrangements, allowing the plan to hire a party in interest for necessary legal, accounting, or recordkeeping services when the compensation is reasonable.
Bank deposits with a bank that also serves as a plan fiduciary, provided the deposits earn a reasonable interest rate and specific conditions are met.
Insurance contracts purchased from a qualified insurer that happens to be a party in interest, as long as the plan pays no more than adequate consideration.

These exemptions come from the statute itself.⁶ The DOL also grants class and individual exemptions for transaction types outside the statutory list.

Co-Fiduciary Liability

Most 401k plans have more than one fiduciary, and when one of them breaches, the others are not automatically off the hook. Federal law imposes co-fiduciary liability in three situations:

You knowingly participate in another fiduciary’s breach, or knowingly help conceal it.
Your own failure to fulfill your fiduciary responsibilities makes the other fiduciary’s breach possible.
You learn about another fiduciary’s breach and do not take reasonable steps to remedy it.

The third scenario catches people off guard.⁷ If a committee member notices that the plan’s investment adviser is steering assets toward funds that pay the adviser higher commissions, staying silent creates liability. The statute requires “reasonable efforts under the circumstances to remedy the breach,” which might mean raising the issue with the committee, consulting legal counsel, or reporting to the DOL. Hoping someone else handles it is not enough.

Personal Liability for a Breach

The consequences of a breach hit the individual, not just the plan or the company. A fiduciary who violates ERISA is personally liable to restore any losses the plan suffered and must return any profits they personally gained from misusing plan assets.⁸ A court can order you to repay lost investment growth, refund excessive fees, or surrender undisclosed commissions, all from your own pocket.

Courts can also grant broader relief, including permanent removal from the fiduciary role. Removal is not limited to the current plan; it can effectively disqualify someone from serving in a fiduciary capacity for any ERISA plan going forward.⁸

On top of restoration and disgorgement, the Department of Labor must assess a civil penalty equal to 20 percent of the applicable recovery amount in any case involving a fiduciary breach or knowing participation in one.⁹ The penalty is mandatory. The DOL cannot waive it unless the fiduciary corrects the violation through an approved program.

Deadline for Fiduciary Breach Claims

A lawsuit for fiduciary breach must be filed before the earlier of two deadlines: six years from the last action that constituted the breach (or, for a failure to act, the latest date the fiduciary could have corrected it), or three years from the date the person bringing the claim first had actual knowledge of the breach.¹⁰ The three-year clock usually matters more for participants, because knowledge of excessive fees or conflicted advice often comes years after the fact. If the breach involves fraud or concealment, the deadline extends to six years from the date the breach was actually discovered.

Ways to Limit Your Exposure

Section 404(c) for Participant-Directed Plans

When a plan lets participants choose their own investments, as most 401k plans do, fiduciaries can limit their liability for losses that result from those choices. To qualify, the plan must offer a broad range of investment alternatives with meaningfully different risk and return profiles, let participants move money between options with reasonable frequency, and provide enough information for informed decisions.¹¹ The plan must also notify participants that it intends to comply with 404(c) and that fiduciaries may be relieved of liability for losses resulting from participant investment instructions.

This protection covers the participant’s actual choices, not the fiduciary’s decision about which options to put on the menu. Offer six vetted funds and a participant picks the worst performer, and 404(c) protects you. Put a poorly vetted, high-fee fund on the menu in the first place, and it does not.

Qualified Default Investment Alternatives

Many employees get automatically enrolled without ever choosing an investment. The Pension Protection Act of 2006 created a safe harbor for the default investment those contributions go into, called a Qualified Default Investment Alternative, or QDIA. When a fiduciary selects a qualifying default and meets the notice requirements, they are shielded from liability for losses on defaulted contributions. Target-date funds are the most common QDIA. Plans with automatic enrollment must designate one; plans without auto-enrollment can still adopt one, and without a QDIA the fiduciary absorbs full liability for default investment outcomes.

Fidelity Bonds and Fiduciary Liability Insurance

ERISA requires every person who handles plan funds to be covered by a fidelity bond. The bond must equal at least 10 percent of the funds handled during the preceding year, with a minimum of $1,000 and a maximum of $500,000. For plans that hold employer securities or that operate as pooled employer plans, the cap increases to $1,000,000.¹² The bond protects the plan against losses from fraud, theft, or embezzlement by plan officials. It does not cover honest mistakes, poor investment judgment, or administrative errors.

That gap is where fiduciary liability insurance comes in. It is not required by law, but it covers claims arising from negligent management decisions such as failing to diversify, hiring an incompetent provider, or making administrative errors, and typically pays legal defense costs, settlements, and judgments. For a plan fiduciary, especially a small business owner who may not fully appreciate the scope of the exposure, this coverage alongside the mandatory bond is a straightforward way to limit personal financial risk.

The Voluntary Fiduciary Correction Program

The DOL runs a Voluntary Fiduciary Correction Program that lets fiduciaries self-correct certain violations before they escalate into enforcement. The program covers 19 specific transaction types, including late deposits of employee contributions, improper loans with parties in interest, purchases or sales of assets involving related parties, defaulted participant loans, excessive compensation payments, and improper plan expenses.¹³

Fiduciaries who complete the correction process and submit a proper application receive a no-action letter from the DOL, meaning the agency will not pursue civil enforcement for the corrected violation. The letter also confirms that the DOL will not impose the 20 percent civil penalty under Section 502(l) on the amount repaid to the plan.¹³ Late deposits of employee contributions are the most common correction, and also one of the most common accidental violations, particularly for smaller employers without automated payroll systems. If you discover a problem, fixing it through the VFCP before the DOL discovers it on audit is almost always the better path.

1
Office of the Law Revision Counsel. 29 USC 1002 – Definitions
2
eCFR. 29 CFR 2510.3-21 – Definition of Fiduciary
3
U.S. Department of Labor. Meeting Your Fiduciary Responsibilities
4
Office of the Law Revision Counsel. 29 USC 1104 – Fiduciary Duties
5
Office of the Law Revision Counsel. 29 USC 1106 – Prohibited Transactions
6
Office of the Law Revision Counsel. 29 USC 1108 – Exemptions From Prohibited Transactions
7
Office of the Law Revision Counsel. 29 USC 1105 – Liability for Breach of Co-Fiduciary
8
Office of the Law Revision Counsel. 29 USC 1109 – Liability for Breach of Fiduciary Duty
9
Office of the Law Revision Counsel. 29 USC 1132 – Civil Enforcement
10
Office of the Law Revision Counsel. 29 USC 1113 – Limitation of Actions
11
eCFR. 29 CFR 2550.404c-1 – ERISA Section 404(c) Plans
12
Office of the Law Revision Counsel. 29 USC 1112 – Bonding
13
U.S. Department of Labor. Voluntary Fiduciary Correction Program