A 401(k) recordkeeper is the company a plan sponsor hires to track every dollar flowing into and out of the retirement plan, maintain individual account balances, and run the technology participants use to manage their investments. For a plan with hundreds or thousands of employees, the recordkeeper processes contribution allocations, investment trades, loans, and distributions on a daily basis. Handling that volume in-house would be impractical for most employers, and the consequences of getting it wrong range from compliance failures to IRS penalties of up to $250 per day for a single late filing.
What a Recordkeeper Does Day to Day
The central job is accounting for every participant’s money. Each pay period, the recordkeeper receives contribution data from the employer, breaks it down by source (employee deferrals, employer match, profit sharing), and allocates those dollars according to each participant’s investment elections. For 2026, the recordkeeper must track whether each participant stays within the $24,500 annual deferral limit, the $8,000 catch-up limit for participants age 50 and older, and the $11,250 enhanced catch-up limit for those ages 60 through 63 created by SECURE 2.0.1Internal Revenue Service. 401(k) Limit Increases to $24,500 for 2026, IRA Limit Increases to $7,500
Once contributions land, the recordkeeper executes trades across the plan’s investment menu. When a participant switches from a bond fund to an index fund, the recordkeeper processes that transaction. At the end of each trading day, gains and losses are applied to individual accounts. The recordkeeper also maintains the plan’s vesting schedule, calculating how much of each participant’s employer-funded balance they actually own based on years of service.
Money flows out of the plan too. The recordkeeper processes participant loans by calculating the maximum borrowable amount, setting up a repayment schedule, and tracking each payment. Hardship withdrawals require the recordkeeper to verify the request meets IRS criteria, which demand both an immediate and heavy financial need and a withdrawal limited to the amount necessary to cover it. Qualifying events under the IRS safe harbor include medical expenses, costs tied to buying a primary home, post-secondary tuition, preventing eviction or foreclosure, and funeral expenses.2Internal Revenue Service. Retirement Topics – Hardship Distributions Full distributions at retirement, termination, or required minimum distribution age also flow through the recordkeeper’s system.
Reporting the Plan Depends On
The recordkeeper generates the data that keeps a plan in good standing with regulators. Federal rules require that participants receive quarterly disclosures showing the dollar amount of fees charged to their accounts and a description of the services those fees cover.3eCFR. 29 CFR 2550.404a-5 – Fiduciary Requirements for Disclosure in Participant-Directed Individual Account Plans Most recordkeepers bundle these required disclosures into broader quarterly statements that also show contribution history, current balance, and vested percentage.
The recordkeeper’s data is also the backbone of the plan’s annual Form 5500 filing. Every plan subject to ERISA must file this return, which reports the plan’s financial condition and operations to the Department of Labor, the IRS, and the Pension Benefit Guaranty Corporation.4U.S. Department of Labor. Form 5500 Series The recordkeeper compiles the financial schedules attached to the return. Missing the filing deadline triggers an IRS penalty of $250 per day, up to $150,000 per return, and the Department of Labor can impose separate civil penalties on top of that.5Internal Revenue Service. Penalty Relief Program for Form 5500-EZ Late Filers The recordkeeper doesn’t sign Form 5500, but if its data is late or wrong, the plan sponsor bears the consequences.
New Tracking Duties Under SECURE 2.0
Recent legislation has expanded what recordkeepers need to track. SECURE 2.0 requires automatic enrollment for 401(k) plans established after December 29, 2022, with plan years beginning on or after January 1, 2025. Covered plans must automatically enroll new participants at a deferral rate between 3% and 10%, then increase that rate by at least 1% annually until it reaches between 10% and 15%. Small employers with 10 or fewer employees and businesses less than three years old are exempt.1Internal Revenue Service. 401(k) Limit Increases to $24,500 for 2026, IRA Limit Increases to $7,500 The recordkeeper’s system must flag eligible employees, apply the correct starting rate, execute the annual escalation, and track opt-outs without manual employer intervention.
SECURE 2.0 also allows employers to make matching contributions based on an employee’s student loan payments rather than traditional deferrals. The recordkeeper must track these qualified student loan payments, confirm they don’t exceed the annual deferral limit (reduced by any actual elective deferrals the employee made), and ensure matching contributions are calculated correctly.6Internal Revenue Service. Guidance Under Section 110 of the SECURE 2.0 Act with Respect to Matching Contributions Made on Account of Qualified Student Loan Payments Parallel tracking across payroll deferrals and external loan payments is a new data challenge for recordkeeping systems.
How a Recordkeeper Differs From the Custodian and TPA
Three entities handle most of the operational work behind a 401(k), and confusing them leads to real problems when something goes wrong.
Recordkeeper vs. Custodian
The custodian holds the actual money. It is responsible for safeguarding plan assets, settling securities transactions, and holding cash and investments in trust. The recordkeeper maintains the ledger that says which participant owns what share of those assets. When a participant changes investments, the recordkeeper sends instructions to the custodian, the custodian executes the trade, and the recordkeeper updates the account balance. The recordkeeper knows the numbers; the custodian holds the funds.
Recordkeeper vs. Third-Party Administrator
The Third-Party Administrator (TPA) handles plan design and compliance testing. The TPA runs the annual nondiscrimination tests that ensure highly compensated employees aren’t benefiting disproportionately compared to rank-and-file workers. The two main tests are the Actual Deferral Percentage (ADP) test, which compares deferral rates, and the Actual Contribution Percentage (ACP) test, which compares matching and after-tax contributions.7Internal Revenue Service. 401(k) Plan Fix-It Guide – The Plan Failed the 401(k) ADP and ACP Nondiscrimination Tests The TPA also conducts top-heavy testing for smaller plans and interprets the plan document to confirm operations match the written terms.
Many large financial institutions bundle recordkeeping and TPA services into a single contract. That simplifies vendor management but can obscure which function you’re paying for. Even bundled, the responsibilities remain distinct: the recordkeeper processes transactions and maintains data, and the TPA tests compliance and advises on plan design.
Is the Recordkeeper a Fiduciary
Usually, no. A recordkeeper performing purely administrative tasks is generally not an ERISA fiduciary. Under ERISA, fiduciary status depends on function: a person becomes a fiduciary by exercising discretionary authority over plan management, controlling plan assets, or providing investment advice for compensation that serves as a primary basis for investment decisions.8eCFR. 29 CFR 2510.3-21 – Definition of Fiduciary A recordkeeper that follows participant instructions and processes transactions per the plan document typically doesn’t cross that threshold.
The practical implication for plan sponsors is important. If the recordkeeper makes an error that costs a participant money, the plan sponsor as fiduciary may bear responsibility for selecting and monitoring that recordkeeper. You can’t delegate fiduciary liability by outsourcing administration. Some recordkeepers voluntarily accept limited fiduciary status for specific services, like selecting the plan’s default investment option. Ask explicitly which services, if any, the recordkeeper performs in a fiduciary capacity and get the answer in writing. Federal regulations require covered service providers to disclose their fiduciary status as part of their initial fee disclosure to the plan.9eCFR. 29 CFR 2550.408b-2 – General Statutory Exemption for Services or Office Space
Fees: What You Pay and What You Don’t See
Recordkeeper compensation comes in two forms. One is easy to see; the other isn’t.
Direct Fees
Direct fees are charges the plan or participants pay straight to the recordkeeper. They are typically structured as either an asset-based fee (a percentage of total plan assets, often in the range of 0.10% to 0.50% annually) or a per-participant fee (a flat dollar amount per eligible employee per year). Some recordkeepers charge a combination of both. These fees appear on invoices and are straightforward to compare across providers.
Indirect Fees and Revenue Sharing
Indirect fees are harder to spot. The most common form is revenue sharing, where the mutual funds or other investments on the plan’s menu pay a portion of their expense ratios back to the recordkeeper. These payments go by various names: sub-transfer agent fees, shareholder servicing fees, 12b-1 fees. The money comes from the fund’s operating expenses, which means participants pay for it through slightly lower investment returns rather than through a visible line item on their statement.
Revenue sharing isn’t inherently problematic, but it creates a potential conflict of interest. A recordkeeper that earns more from certain funds has an incentive to include those funds on the investment menu. It also makes fee comparisons difficult. A recordkeeper quoting a low direct fee might be making up the difference through revenue sharing from expensive fund options. The total cost to participants matters, not the sticker price on the recordkeeper’s invoice.
Federal regulations require recordkeepers and other covered service providers to disclose all direct and indirect compensation they expect to receive, including identification of who pays the indirect compensation and the arrangement under which it’s paid.9eCFR. 29 CFR 2550.408b-2 – General Statutory Exemption for Services or Office Space This disclosure goes to the plan’s responsible fiduciary, not to participants directly. On the participant side, quarterly fee statements must show the actual dollar amount deducted from each account and describe what services those deductions covered. If some plan expenses were paid through revenue sharing rather than direct charges, the statement must note that as well.3eCFR. 29 CFR 2550.404a-5 – Fiduciary Requirements for Disclosure in Participant-Directed Individual Account Plans
When the Recordkeeper Makes Mistakes
Recordkeeper errors are more common than most plan sponsors realize. Typical mistakes include failing to enroll eligible employees on time, applying the wrong deferral percentage, miscalculating employer matching contributions, and processing loans that violate plan terms.10Internal Revenue Service. Retirement Plan Errors Eligible for Self-Correction Left uncorrected, these errors can disqualify the entire plan, causing every participant to lose the tax-deferred status of their account.
The IRS provides a framework called the Employee Plans Compliance Resolution System (EPCRS) for fixing errors before they become catastrophic. EPCRS offers three paths depending on severity and timing:11Internal Revenue Service. Correcting Plan Errors
- The Self-Correction Program (SCP) is for operational errors the plan sponsor identifies and corrects on its own, without filing anything with the IRS.
- The Voluntary Correction Program (VCP) is for errors too significant or too old for self-correction, requiring a formal application to the IRS.
- The Audit Closing Agreement Program (Audit CAP) applies to errors discovered during an IRS audit, where the correction terms are negotiated with the examining agent.
The plan sponsor is ultimately responsible for catching these errors, which is why regular audits of recordkeeper data matter. A good recordkeeper will flag discrepancies proactively, but the fiduciary obligation to monitor rests with the sponsor.
Choosing or Switching a Recordkeeper
Selecting a recordkeeper is a fiduciary decision, so the plan sponsor must document the selection process and demonstrate it was prudent. The evaluation should cover:
- Total cost. Add up direct fees, revenue sharing, and transaction-level charges (loan processing fees, distribution fees) and compare the all-in cost across providers, not just the headline number.
- Technology quality. Run through common tasks on the participant website and mobile app, like changing contribution rates, taking a loan, and checking balances. A frustrating interface depresses participation.
- Service model. Determine whether the plan gets a dedicated account manager or shares one across dozens of plans, and how quickly the provider resolves payroll discrepancies.
- Security. Request the most recent SOC 1 Type 2 report, which is an independent audit of internal controls conducted under the SSAE 18 attestation standard, and review the findings. The Department of Labor has published 12 cybersecurity best practices directed at recordkeepers and other service providers handling retirement plan data, and selecting a recordkeeper with strong practices is part of a plan fiduciary’s duty of prudence.12U.S. Department of Labor. Cybersecurity Program Best Practices
- SECURE 2.0 readiness. Confirm the system handles auto-enrollment escalation, student loan match tracking, and the age-based catch-up contribution tiers.
- Error track record. Ask for data on processing error rates and the provider’s internal correction procedures.
Benchmark the recordkeeper at least every three to five years by soliciting competitive bids, even if the current provider is working well. Industry fees have dropped significantly over the past decade, and a plan that hasn’t shopped in years may be overpaying.
If you do switch, ERISA requires written notice of the blackout period during which participants temporarily lose the ability to manage their accounts. The notice must go out at least 30 days, but no more than 60 days, before the last date participants can exercise their usual account rights.13eCFR. 29 CFR 2520.101-3 – Notice of Blackout Periods Under Individual Account Plans The notice must explain why the blackout is happening, describe which rights are suspended (investment changes, loans, distributions), provide expected start and end dates, and include contact information for someone who can answer participant questions. If the sponsor can’t provide 30 days’ notice because of unforeseeable circumstances, the notice must explain why the advance period fell short.
Data integrity during the handoff is the single biggest risk in a conversion. Reconciling every participant balance, loan status, and vesting percentage across two systems is painstaking work, so designate an internal point person to verify that the transferred data matches the outgoing recordkeeper’s final reports before the new system goes live.