The Department of Labor issued three pieces of cybersecurity guidance, entitled (i) Tips for Hiring a Service Provider with Strong Cybersecurity Practices, (ii) Cybersecurity Program Best Practices, and (iii) Online Security Tips.  Importantly, the Department noted that “[r]esponsible plan fiduciaries have an obligation to ensure proper mitigation of cybersecurity risks.”  Stated another way, in the DOL’s view, a plan fiduciary can be personally liable for a cybersecurity breach if fiduciary obligations were not adequately discharged.

Central to the guidance is the Department’s view that plan sponsors should hire service providers that “follow strong cybersecurity practices.”  In this vein, the guidance sets forth standards that plan sponsors should meet when contracting with service providers.  According to the DOL, a service contract should require ongoing compliance with cybersecurity and information standards, and a plan sponsor should “beware contract provisions that limit the service provider’s responsibility for IT breaches.”  The guidance goes on to suggest that the following terms should be included in a service agreement:

Information Security Reporting. The contract should require the service provider to annually obtain a third party audit to determine compliance with information security policies and procedures.  

Clear Provisions on the Use and Sharing of Information and Confidentiality.  The contract should spell out the service provider’s obligation to keep private information private, prevent the use or disclosure of confidential information without written permission, and meet a strong standard of care to protect confidential information against loss, misuse, or unauthorized access, disclosure or modification.

Notification of Security Breaches. The contract should identify breach notification timing and ensure the service provider’s cooperation to investigate and reasonably address the cause of the breach.

Compliance with Record Retention, Privacy and Information Security Laws.  The contract should specify the service provider’s obligations to meet all applicable federal, state, and local laws pertaining to the privacy, confidentiality, or security of participants’ personal information. 

Insurance.  The contract should require insurance coverage such as professional liability, errors and omissions, cyber liability, privacy breach, fidelity bond and blanket crime.  The DOL states that a plan sponsor should understand the terms and limits of any coverage before relying upon it as protection from loss.

Efforts to ensure that the above service agreement provisions are in place are good steps that a plan sponsor or administrator could take toward satisfying ERISA cybersecurity fiduciary obligations.

Congress has enacted the Coronavirus Aid, Relief and Economic Security Act (the “Act”), which allows or requires changes to retirement plans.  The following is a summary of the material provisions.

Coronavirus-Related Distribution.  The Act permits a plan to allow a participant who is a “qualified individual” to take a penalty free plan distribution of up to $100,000 before December 31, 2020. The distribution is taxable unless it is repaid within a three-year period.  A “qualified individual” is someone who certifies that (i) they have been diagnosed with COVID-19, (ii) a spouse or dependent has been diagnosed with COVID-19, (iii) they have experienced adverse financial consequences as a result of being quarantined, loss of work or business losses or (iv) they have suffered other consequences as may be set forth in regulations.

Loan Increase.  A plan may permit a qualified individual to receive a plan loan of up to $100,000 and 100% of the participant’s account balance. This amount is essentially twice what is ordinarily available.  A plan may make an increased loan available until September 23, 2020.

Suspension of Loan Repayments.  A plan must permit a qualified individual to delay for at least one year the due date of any loan repayment coming due on or prior to December 31, 2020.  Interest will continue to accrue and any subsequent payments must be adjusted to reflect the modified due date and interest accruing during the delay.

Waiver of Required Minimum Distributions.  For all participants, required minimum distributions are waived for any distribution that would otherwise be required to be made in calendar year 2020.

The Act does not require formal plan amendments until December 31, 2022, at the earliest, for calendar year plans, as long as the plan is administered in accordance with applicable changes made prior to that date.

Congress has enacted the Families First Coronavirus Response Act and the Coronavirus Aid, Relief and Economic Security Act, which require a group health plan to cover coronavirus testing and mitigation services and vaccines.  The following is a summary of the material provisions.

Coverage of Diagnostic Testing.  Effective March 27, 2020, a plan must cover the cost of a diagnostic test for the detection of the virus that causes COVID-19 and the administration of such a test that (i) is approved, cleared or authorized under the Federal Food, Drug and Cosmetic Act, (ii) the test developer has requested, or intends to request, emergency use authorization under the Federal Food, Drug and Cosmetic Act, (iii) is developed in and authorized by a State or (iv) the United States Secretary of Health and Human Services determines appropriate.  A plan must cover such test at 100%.  It cannot impose any deductible, copayment or coinsurance, require prior authorization or impose other medical management requirements.

Rapid Coverage of Preventive Services and Vaccines for Coronavirus.  Effective on the date that is 15 days after an appropriate recommendation from the United States Centers for Disease Control and Prevention, a plan must cover without cost sharing (including deductibles, copayments and coinsurance) any qualifying coronavirus preventive service.  The term “qualifying coronavirus preventive service” means an item, service or immunization that is intended to prevent or mitigate COVID-19 and that is (i) an evidence based item or service that has in effect a rating of “A” or “B” in the current recommendations of the United States Preventive Services Task Force, or (ii) an immunization that has in effect a recommendation from the Advisory Committee on Immunization Practices of the Centers for Disease Control and Prevention with respect to the individual involved.

The SECURE Act contains several requirements and optional provisions that 401(k) plan sponsors will need to consider and implement.  The following describes provisions of the Act that will require plan amendments when and if adopted.

Penalty Free Distribution in Cases of Birth or Adoption.   The Act permits a plan to provide a $5,000 distribution to a participant within one year following a birth or adoption of a child.  No early distribution penalty applies.  In cases of adoption, any child up to age 18 or who is physically or mentally incapable of self-support is considered an “eligible adoptee.”  The Act allows for repayment of the distribution. This optional provision of the Act is now effective.

Required Beginning Date Increased to Age 72.  The Internal Revenue Code prohibits a plan participant from indefinitely deferring receipt of plan distributions (and corresponding taxable income).  For those who attain age 70½ in 2019 or earlier, the Code requires a participant to receive minimum distributions on the later of the date the individual retires or April 1 of the following year.  Five percent owners are not able to defer distributions until retirement.  Effective for participants who attain age 70½ on or after January 1, 2020, the required beginning date age is raised to 72.

Modification of Beneficiary Distribution Timing Rules.  Prior to January 1, 2020 a death benefit beneficiary could stretch benefit payments over their lifetime in order to defer taxable income for as long as possible. Now, a death benefit must generally be completely distributed within 10 years of the participant’s death. Exceptions include spouses, disabled or chronically ill beneficiaries, minor children until the age of 18 and beneficiaries not more than 10 years younger than the participant.  This provision will require a plan amendment.

Required Participation for Part-Time Employees.  A 401(k) plan will be required to allow any employee who has attained 21 years of age and worked at least 500 hours for three consecutive years to participate in the plan.  These employees can be excluded from non-discrimination, coverage and top-heavy testing.  The required participation only applies to elective deferrals, so there will be no requirement to provide these employees with matching or profit sharing contributions. The provision is effective January 1, 2021 for calendar year plans, but no period of employment before January 1, 2021 will count towards participation eligibility.

The Act does not require formal plan amendments until December 31, 2022, at the earliest, for calendar year plans, as long as the plan is administered in accordance with applicable changes prior to that date. It is anticipated that the IRS will issue regulations related to the foregoing and all other provisions of the Act.        

By enacting the long-awaited SECURE Act, a bipartisan Congress and the President have finally and formally acknowledged the ability of unrelated employers to come together and enjoy the benefits associated with participation in a common 401(k) plan.  The advantages of multiple employer plan participation include delegation of plan administration and related fiduciary responsibility and the ability to rely on third party professionals to select investment options.  The end result makes it easier for small businesses to offer their employees a higher quality plan that can take advantage of economies of scale on the same basis as much larger employers.

One of the most desirable aspects of the Act is the ability of a plan to remove a non-conforming employer from participation without jeopardizing the tax qualification of the entire plan.  Certain requirements need to be met, but they do not appear to be particularly onerous. The IRS will issue regulations that should clarify the nature of them.  This portion of the Act will become effective for plan years beginning after December 31, 2020.

By choosing to participate in a multiple employer plan, smaller employers will be able to avoid some or all of the separate reporting, bonding and disclosure requirements that otherwise would apply.  At the same time, multiple employer plans themselves will be easier to administer and can achieve protection from employer acts that could cause risk to the plan and other participating employers.

The IRS has issued final regulations reflecting changes made to the rules governing hardship withdrawals from 401(k) plans. The following summarizes the changes that a plan sponsor will need to make or consider.

Effective January 1, 2020, a plan may no longer suspend deferrals for those who receive a hardship distribution.  The prior regulations required a plan to suspend a participant’s deferral contributions for six months after taking a hardship distribution.

Also effective January 1, 2020, the regulations require any participant who applies for a hardship distribution to represent in writing that he or she has insufficient cash or other liquid assets available to satisfy the financial need.  The plan administrator cannot have any actual knowledge contrary to the representation.

The Regulations contain some optional provisions.  To take these into account, a plan sponsor will need to consider the following:

1. Whether to permit a participant to take a hardship withdrawal from earnings on deferral contributions.  The prior regulations only permit a participant to take a withdrawal from principal.  The new regulations allow a plan to permit a participant to take a hardship withdrawal from deferral earnings.
2. Whether a participant will still need to take any available plan loan before taking a hardship distribution.  Many plans currently require a participant to take any available loan before a hardship withdrawal.The new regulations will permit an amendment to remove the requirement.
3. Whether to allow a hardship distribution for expenses and losses incurred by the participant on account of a disaster declared by FEMA.The new regulations allow a plan to permit a disaster-related hardship withdrawal for a participant who is living or working within an area FEMA designates for individual assistance.
4. Whether to allow hardship distributions for medical care, tuition and burial or funeral expenses related to a primary plan beneficiary who is not a spouse, child or dependent.The new regulations formally acknowledge hardship eligibility for these primary beneficiary expenses.

Implementation of the above requires (i) a timely plan amendment, (ii) a summary of material modifications to the plan’s SPD or an updated SPD and (iii) a form of participant representation.

Much has been written about changes the recent Tax Cuts and Jobs Act (the “Act”) will make to the world of employee benefits and executive compensation.  Rather than copy what is already out there, I thought it appropriate to comment on a few areas at this time.

401(k) Plans

There was concern that the Act in its final form would change the 401(k) system as we know it by eliminating the ability to make before-tax contributions.  While this did not happen, it would have been a substantial revenue raiser, and I would not be surprised to see the concept resurface in the future.

Be that as it may, the Act makes one 401(k) plan-related change by allowing a terminating employee to defer a deemed distribution of an outstanding loan amount until the day that employee’s tax return is due for the year of distribution.  This allows the terminating employee some extra time to transfer the amount of the unpaid loan to the plan or IRA to which the former employee rolled over the remaining account balance and avoid the income tax and potential penalty that would otherwise become due.

A plan sponsor should ensure that its loan policy and plan documents either can be read to support this new provision or it should make the necessary changes.  This provision is effective for plan distributions occurring on and after January 1, 2018.

 Roth and the Qualified Business Income Deduction

One of the conventional reasons why one would want to choose to make retirement contributions on an after-tax basis is an anticipation that come distribution time, the participant’s tax rate will be higher.  Back in the day when people seemed concerned about budget deficits (this wasn’t very long ago), there was a group who thought that at some point, tax rates would have to increase to accommodate the debt.  This concern led some to choose Roth or other after-tax contributions in order to beat any future increase.

The Act’s new pass-through business income deduction will allow eligible business owners to significantly reduce their effective tax rates by deducting up to 20% of their business income.  This new deduction may make Roth or other after tax contributions more attractive by making it more likely that the income tax rate a business owner is subject to in retirement will be greater than the rate that owner is subject to at the present.  This sounds like a good topic to address with the tax advisor this season.  The new deduction went into effect for tax years beginning after December 31, 2017.

 Repeal of the Individual Mandate

The Act repealed the Affordable Care Act individual medical coverage mandate beginning in 2019.  Note that the mandate still applies in 2018.  Also note that the coverage mandate still applies to larger employers.  Regardless, beginning in 2019, the mandate repeal will give individuals more flexibility as to the coverage, if any, they will choose.  The hope is that this will provide small business owners and those who purchase coverage on the individual market with cheaper alternatives than those available through the exchanges or even some employers.  A recent Executive Order and Department of Labor guidance is intended to facilitate this type of innovation by encouraging association type plans and the ability to purchase coverage across state lines.  The former will provide individuals and small businesses with large employer purchasing power.  The latter will allow the purchase of insurance without having to pay for undesired state-mandated coverages.

In a perfect world this innovation will provide small businesses and individuals who don’t quite fit into the present system with the ability to save money while minimizing disruption to the existing system.  Legislative adjustments are likely necessary.  I hope the policymakers can put politics aside, understand the problem at hand and work together to ensure that all interests are protected to the extent feasible.

As ERISA fiduciary law continues to develop, it is useful to think about areas involving fiduciary decision-making and a decision-making method that provides liability insulation.  Some areas involving fiduciary decision-making include plan investments in general, the decision to include revenue sharing funds in a plan, the payment of plan expenses, and as Department of Labor Bulletin 2016-1 reminds us, investment policy statement preparation, proxy voting, and investments involving environmental, social and governance (“ESG”) factors.

Case law has developed to the point where it is fairly safe to say that a court would likely not second guess a decision in one of the areas above (or any fiduciary decision for that matter) as long as it is deliberated and well-reasoned by knowledgeable fiduciaries.  In other words, courts are more concerned with process than outcomes.  Thus, to all fiduciaries reading this, a good conversation may not only be enjoyable, but it could be a great insurance policy.  Join in on the conversation at meetings, ask questions to gain an understanding of the topics discussed, and don’t be afraid to disagree if something doesn’t sound right to you.  Committee meeting minutes should reflect this type of well-reasoned decision-making process.

Department of Labor Bulletin 2016-1 acknowledges that an investment policy statement may contain provisions on proxy voting and policies regarding ESG factors.  Regarding proxies, the Bulletin states that a responsible fiduciary must vote proxies on issues that may affect the value of the plan’s investments.  The Department has withdrawn prior guidance suggesting that a fiduciary should perform a cost-benefit analysis in every circumstance and not vote a proxy unless the expected economic benefits of voting exceed the cost of voting.

The Bulletin also seeks to further clarify the degree to which fiduciaries should consider non-economic factors in their decision-making. Department of Labor Bulletin 2008-2 essentially stated that a fiduciary should never consider non-economic factors.  The Department now rejects that approach.  Bulletin 2016-1 states that “plan fiduciaries may not increase expenses, sacrifice investment returns, or reduce the security of plan benefits in order to promote collateral goals.”  However, a fiduciary is not prohibited from recognizing the possible financial benefits that may be associated with considering ESG issues.

Based on the foregoing, fiduciaries should examine and revise their investment policy statements as needed, update proxy voting policies to be consistent with the Bulletin, and remove any language that suggests a fiduciary cannot consider the potential economic benefits involved with considering ESG issues in the investment decision-making process. Feel free to call Tomasek Law Office if you need help with this exercise.

The IRS has abandoned existing procedures related to obtaining and relying upon favorable determination letters and developed new guidance on the topic.  In light of the new guidance, the following describes how an employer could ensure to the extent possible that its individually designed or preapproved retirement plan retains favorable tax status.

A.  Individually Designed Plans.

If an individually designed plan sponsor’s EIN ends in 1 or 6, it is a “Cycle A” filer and should submit an application for a favorable determination letter on or before January 31, 2017.  The determination letter program is closed for all others except for applications submitted upon initial qualification, plan termination, and other circumstances as IRS may determine in the future, including significant law changes, new approaches to plan design, or the inability of a sponsor to convert to a preapproved plan.

According to the IRS, a plan sponsor can rely on its existing determination letter with regard to any plan provision not affected by a change in the law.  The IRS intends to notify plan sponsors of law changes by publishing an annual Required Amendments List that sets forth law changes that may require plan amendments.  In addition to the RAL, the IRS intends to publish an annual Operational Compliance List that will allow a sponsor to maintain operational compliance prior to the time that it must amend its plan for the law change.

Thus, a plan sponsor maintaining an individually designed plan can ensure continued tax qualification by amending its plan in accordance with RALs and operating the plan in compliance with OCLs.  A plan sponsor may have to produce an opinion of counsel to this effect in situations where determination letters are currently requested, such as corporate transactions and rollovers.

If an employer currently maintaining an individually designed plan wishes to adopt a preapproved plan and file a determination letter request, the IRS has extended the deadline to do so until April 30, 2017.

B.  Preapproved Plans.

The general opinion and determination letter procedures applicable to preapproved plans are little changed. An employer that restated its preapproved plan prior to May 1, 2016 could expect another plan restatement window and determination letter application period to open sometime around 2020. In the meantime, in order to ensure that its preapproved plan remains tax qualified, an employer should execute interim amendments provided by the preapproved plan vendor and consult the IRS Operational Compliance List on an annual basis to ensure that it continues to operate its plan in compliance with any law changes. Any employer maintaining a preapproved plan should ensure that the preapproved plan vendor expressly assumes by contract all potential liability associated with maintaining the plan’s qualified status in form.