Category: Articles

Retirement Plan Cybersecurity is now a top priority focus for the Securities & Exchange Commission (SEC) and the Department of Labor (DOL). In 2021, both agencies released guidelines and regulations addressing this important topic, and the trend will continue in the future. The DOL indicated that an audit program is forthcoming. For additional information on the DOL regulations, go to our website blog about cybersecurity and click on Department of Labor Issues Guidelines for ERISA Fiduciaries on Cybersecurity.

What can you do to ensure your data is safe? EJReynolds has taken definitive measures to safeguard our client information with our innovative cybersecurity commitment that will give you peace of mind knowing your most confidential information is safe and secure. Our advanced cybersecurity program stems from our core principles of trust, integrity, and ethics. We collect only the necessary information to consistently deliver the best products and services for our clients. All EJReynolds employees are required to complete ongoing extensive training programs on new threats and how to manage them. We have implemented security standards and processes to ensure that access to client information is limited to your EJReynolds Plan Consultant. 

Our best practice cybersecurity protocols include:

– Citrix ShareFile© – secure file sharing

EJReynolds’ secure file-sharing link provides a safe and secure way to transmit sensitive information online. This ensures that files are sent and received with bank-level encryption. You must register through ShareFile’s one-time enrollment process to send and receive files securely. We are aware this may be an initial inconvenience, but we want our clients’ information to remain protected.

– Two-factor authentication 

EJReynolds has implemented a two-factor authentication process for our Plan Consultants to access the network environment. This practice, 2FA for short, is the most advanced form of security from any type of password-based attack. EJReynolds’ employees must confirm a security code sent to an authenticator application when they log in every morning through another Cisco© product, Duo©. This process is implemented on the various applications that are used in our day-to-day administration of a plan, including our Customer Relationship Management (CRM) application, Government Forms, and Valuation System, even to open our email. You may already know, but the various investment platforms we work with have used this process for years. 

– Managed Detection & Response (MDR)

EJReynolds’ Firewall Security system protects our computer network from being attacked by online hackers, worms, viruses, etc. It is designed to stop unauthorized access to the company’s computer systems. Additionally, we have implemented an Application Control service that blocks the installation of any software on our workstations, unless specifically approved at the corporate level. MDR identifies indicators of compromise and isolates any affected computer. It uses Artificial Intelligence (AI) to watch what may be running on a computer. If suspicious behavior is detected, AI escalates the issue to a human IT manager, around the clock, 24/7, for review and if the behavior is related to a bad actor, the machine is quarantined from the network, limiting the scope of damage done.

– Industry-leading Threat Phishing and Email Protection

Proofpoint Email Protection is the industry-leading email gateway. It uses Nexus AI, an advanced machine learning technology. Email Protection accurately classifies, detects, and blocks threats, such as business email compromises.  It also provides advanced email filtering controls for phishing, spam, bulk graymail, and other unwanted email. This advanced threat protection helps to protect our organization from malicious attacks.

– DNS Content Filtering

With staff working remotely and on the go these days, DNS Filtering provides web content filtering wherever staff are located. This helps web surfing on company-issued computers as well as provides web defense against malicious websites. 

– Dark Web Monitoring

Dark web monitoring provides around-the-clock monitoring and alerting for compromised digital credentials, scouring millions of sources, including botnets, criminal chat rooms,

peer-to-peer networks, malicious websites, bulletin boards, and illegal market sites. All email addresses for EJReynolds’ employees, including the personal accounts for certain officers and managers, are monitored on the “Dark Web” for breaches in security. We are notified immediately if these critical assets are compromised, affording the chance to secure them before they may be used for identity theft, data breaches, or other crimes.

– Continuous training

Since 2017, all employees have been required to complete extensive training programs through KnowBe4.com©, a nationally recognized leader in security awareness training. Along with monthly training on the latest ERISA rules and regulations, each employee must complete training sessions in cybersecurity. 

Hackers constantly change their tactics; EJReynolds is constantly training our staff to prepare for these situations.

Our commitment to your security is just one more reason to trust your retirement plan administration to EJReynolds. For our latest Cyber Security Updates, go to www.ejreynoldsinc.com/cybersecurity.  

At the end of 2022, a new appropriations bill which contained the new SECURE 2.0 Act became Law. The Act is an expansion of the Setting Every Community Up for Retirement Enhancement (SECURE) Act of 2019. The legislation provides ninety-six changes that impact retirement plans, some taking years to fully implement. Today, I wanted to bring to your attention two that will impact plans immediately and change the design of future retirement plans.

While the original SECURE Act (passed at the end of 2019) raised the age at which retirees and owners must begin taking Required Minimum Distributions (RMDs) from age 70 ½ to age 72, SECURE 2.0 raises that age to 73 effective January 1, 2023. If a person turned 72 in 2022, they must take their first RMD by April 1, 2023. A person turning age 72 in 2023 has until April 1, 2025, to take their first RMD, the year after they attain age 73. Remember, when a retiree reaches the age at which they must begin taking RMDs, they can elect to take their first RMD in that year or defer until April 1^st of the following year. If they defer the distribution until April 1^st, they must take another RMD by the end of that year, for a total of two distributions. Eventually (by 2033), the age at which the RMDs begin will increase to age 75. Owners and certain family members are still required to take an RMD at their required beginning date, even if they continue to work, while non-owners have until they separate from service.

Another change brought on by SECURE 2.0 is the requirement that 401(k) and 403(b) plans feature automatic enrollment for employees of companies that sponsor such plans. Starting with plan years beginning after December 31, 2024, plan sponsors must provide for automatic enrollment into their plans starting at a contribution rate of at least 3% of earnings. In addition, plans must also include automatic escalations of the amount of deferral by participants.  The escalator must increase annually by 1% up to at least 10% but not more than 15% of the employee’s pay. Employees can affirmatively elect a different contribution, or opt out entirely, but new plans must include these features.

While this new requirement may concern plan sponsors, there are quite a few exceptions which effectively make the automatic enrollment feature only apply to new plans of larger entities. As written, SECURE 2.0 impacts only new plans that start on or after January 1, 2025. Further, the law exempts plans sponsored by small businesses with 10 or fewer employees, new businesses less than 3-years-old, churches and church related entities, and governmental entity plans.

So, while automatic enrollment has been gaining ground in the retirement plan world, many plan sponsors in the small plan market have not implemented them, and they may not be subject to these new rules. Plans that have trouble passing discrimination testing may want to add an automatic enrollment feature to increase participation even if not required to offer it under SECURE 2.0. Alternatively, plans may be designed to automatically enroll participants at 10%. Most participants will either opt out, affirmatively elect a lower percentage, or remain in at 10%, relieving the Sponsor of the burden of auto-escalation.

Obviously, both changes will require amended language to the Plan Document, as well as modifications to some investment platforms. We are still waiting on final  regulations to clarify these points. EJReynolds will continue to update you as more guidance is issued regarding these and other aspects of the SECURE Act 2.0. If you have any questions about these, or any portion of SECURE 2.0, please contact your EJReynolds’ plan consultant.

Audits and examinations of Employee Plans have been rare over the last decade due to IRS funding. Even now, Plan Sponsors under audit or their representatives are forced to mail hard copies of the requested materials, or send via fax, since the IRS is not set up to receive secured emails. But the Consolidated Appropriations Act of 2022 provided an additional $675 million in funding to the IRS, bringing the total budget to over $12.5 billion. The new budget revealed that over $5 billion will fund additional tax enforcement, meaning audits may soon be on the rise. An announcement made Friday seems to reinforce that point.

In the June 3, 2022, issue of the IRS Employee Plans News, the IRS announced a new pre-audit compliance “opportunity” for employer-sponsored retirement plans selected for audit beginning immediately (the “Pilot Program”). Under the Pilot Program, the IRS will send an initial letter to plan sponsors whose retirement plans have been selected for a random audit. This letter will explain that the plan sponsor has 90 days to identify and voluntarily correct any compliance issues with the plan and notify the IRS of the corrective actions taken through the Employee Plans Compliance Resolution System (EPCRS). This is a welcome departure from the long-time voluntary correction principle that allowed voluntary correction only until the IRS had identified the plan for audit. The IRS will evaluate whether to continue the program and/or include it in its EPCRS program at the end of the Pilot Program (although the newsletter did not say when the end of the Pilot Program will be).

The IRS established the EPCRS Program over 30 years ago. This voluntary program allows plan sponsors to correct operational errors without plan disqualification. Over the years, the IRS has updated the Program, adding items to the list of failures that may be corrected without additional disclosure under the Self Correction Procedure (SCP). Certain failures required a submission for a letter of forgiveness under the Voluntary Compliance Procedure (VCP). They also extended the time in which you can use either program to correct certain errors in plan operation. Prior to the release of the Pilot Program, once a plan was under review (audit), the only solution a Plan Sponsor had was Audit Closing Agreement Program or Audit CAP, which imposed stricter penalties and required greater user fees than either the SCP or VCP.

The program as described in the announcement provides powerful incentives to encourage plan sponsors to voluntarily comply in the 90 days following receipt of the initial letter. The first is a reduction in the sanctions involved in the audit process. Traditionally, sanctions for compliance issues discovered in a retirement plan audit are calculated under the IRS’s Audit CAP program which considers the nature, extent, and severity of the failure, and are based on a percentage of plan assets, which can be extremely expensive even for a small plan covering a limited number of employees. Audit CAP fees typically started at the taxes on Plan Disqualification and negotiated down from there.

Under the Pilot Program, if a plan sponsor responds to the initial audit letter with compliance items it has identified and the fixes it has implemented, the IRS will not assess sanctions for failures eligible for self-correction and will assess sanctions for corrections made in accordance with its published Voluntary Correction Program based on the user fees applicable to that program (which currently max out at $3,500, a figure significantly lower than most Audit CAP sanction fees). The announcement also indicates that if a plan sponsor responds to the initial letter, the IRS will determine whether to issue a closing letter or to conduct a limited or full scope audit. How it will make that determination has not been disclosed, but plan sponsors may have some ability to limit an impending audit or avoid an audit completely by responding to the initial letter in a way that demonstrates full compliance.

EJReynolds can represent Plan Sponsors going through such a review and can negotiate directly with the IRS on fees and sanctions. Plan sponsors that receive an initial letter should immediately contact their retirement plan consultant to begin the process of identifying compliance failures, taking any appropriate corrective actions, and preparing a summary of the compliance issues and corrections made for the IRS. Operational and plan document errors discovered by a plan sponsor should receive priority for timely correction to ensure any compliance issue resolution within 90 days of the receipt of an initial letter.

As of June 1, 2022, the IRS has started sending these audit letters. If you or your client have received an initial letter or have questions, please contact your EJReynolds Plan Consultant immediately. We are here to help.

Since most 401(k) plans have a calendar year plan year end, now is the best time to review testing deadlines for the upcoming Plan Year. In general, 401(k) plans must be tested annually to demonstrate that they do not discriminate in favor of highly compensated employees or provide benefits that exceed certain statutory or regulatory limits. If a plan “fails” any of the required tests, the plan sponsor must take corrective actions, and there are established deadlines for correcting certain failures.

The following is a brief summary of these deadlines:

• March 15th – Deadline for issuing corrective distributions to correct ADP/ACP testing failures. Of course, this does not apply to Safe Harbor 401(k) plans, as those automatically satisfy the ADP/ACP testing.

In general, corrective distributions must be issued within 2 ½ months following the close of the plan year to avoid a 10% excise tax imposed on the excess amounts. Plan sponsors of 401(k) plans that include an automatic enrollment feature that satisfies certain requirements have up to 6 months to issue corrective distributions without incurring the excise tax.

In either situation, correct distributions must be issued no later than the last day of the plan year following the plan year in which the testing failure occurred to protect the qualified status of the plan.

• April 15th – Due date for issuing corrective distributions for excess deferrals (i.e. participant deferrals made in excess of 402(g) limit –  $19,500 for 2021). If the excess amount, plus related earnings, is not distributed by this date, the participant is in effect taxed on the excess amount twice, both in the year the excess occurred and the year of the distribution. (Note: This deadline is the same, regardless of plan year).
• June 30th – Extended due date for issuing corrective distributions for ADP/ACP testing failures under “eligible automatic contribution arrangement” 401(k) plans; the 10% excise tax applies to distributions made after this date.
• October 15th – Deadline for adopting a retroactive plan amendment to correct a coverage or nondiscrimination testing failure (if applicable). The amendment must be adopted no later than 9 ½ months following the close of the plan year in which the failure occurred, as provided for under specific applicable regulations.
• December 31st – Final deadline for issuing corrective distributions for ADP/ACP testing failures for the prior year (or for making a Qualified Non-Elective Contribution/Qualified Matching Contribution to correct the failure).

The deadlines 401(k) plan sponsors must observe are numerous and complex; the deadlines listed above are not meant to be comprehensive, but rather, represent critical dates related to the correction of specific plan testing failures.

Please contact our Plan Consultants to learn more about how these rules impact your plan and participants!

Earlier this year, the DOL published long-anticipated guidance on the use of “ESG” factors in evaluating retirement plan investment options. The notice of proposed rulemaking attempts to settle the recent regulatory game of ping pong surrounding use of ESG factors by setting forth proposed regulations that would revise certain fiduciary duty requirements.

So, what exactly are ESG factors? The acronym “ESG” stands for Environmental, Social, And Governance. The term “ESG factors” denotes consideration of how a potential target investment values and responds to environmental, social, and governance matters. For example:

• Environmental: How an entity is addressing potential climate-change-related factors.
• Social: Entity’s workforce practices, progress on diversity and inclusion, and labor relations.
• Governance: Entity’s board composition, executive compensation, transparency in corporate decision-making, and avoidance of criminal and civil liability.

Over the years, there has been a lot of back and forth about whether plan fiduciaries may consider ESG factors when evaluating a potential investment or whether that would violate certain fiduciary duties under ERISA.

The proposed regulations make it clear that DOL believes ESG factors not only could be considered when evaluating investments for retirement plans, but often would be required considerations in the analysis of plan investments. The proposal clarifies that fiduciaries evaluating investment options may consider any factor that is material to an economic risk-return analysis—including ESG factors (which the guidance says are “often” material factors that could impact investment performance). The proposal also includes some proposed revisions to duties associated with the exercise of proxy voting and other shareholder rights for plan investments.

Notably, this is only a proposed rule and there are not any immediate deadlines. However, it is a clear indication of the Department of Labor’s current interpretation of fiduciary obligations. We encourage you to meet with clients now to discuss these changes. Clients may have been following this ESG debate for years and be eager to learn how it will impact their fiduciary duties (and how you are responding if you are a fiduciary to their plan).

Whether it’s a discussion about plan design strategies that best meet your clients’ needs or talking more about the latest legislative news impacting your retirement practice, the retirement plan design specialists at EJReynolds look forward to helping you achieve more sales success through partnering together with us.

Thank you for the privilege of working with you and please feel free to call us for assistance in meeting your retirement plan sales and servicing needs.

To satisfy annual reporting requirements under Title I and Title IV of ERISA and the Internal Revenue Code, The U.S. Department of Labor (DOL), Internal Revenue Service (IRS), and Pension Benefit Guaranty Corporation created the Form 5500 Series. Form 5500 satisfies the yearly requirement for pension and employee benefit Plan Administrators to file a report detailing the plan’s financial condition, investments, and operations. It is generally required to be filed by the last day of the seventh month following the end of the plan year (unless an extension has been granted).

During a “normal” year, plans that operate on a calendar year are required to file Form 5500 with related attachments no later than July 31^st. If the corporate return is on extension, the Form 5500 may be filed by the due date of the corporate return, with a copy of the extension attached. Additionally, the Plan may request an automatic extension till October 15^th on a Form 5558 filed by the original due date (July 31^st). If we did not receive a signed copy of a client’s return by July 31^st, we applied for the extension on their behalf.

During 2020, because of unforeseen circumstances due to COVID-19, Plan Sponsors were granted an extension of time for certain off-calendar year plan returns that were originally due in April and May, but no additional time was granted due specifically to the pandemic since then. Likewise, there have been many disasters over the years that caused the October 15^th deadline to be extended due to hurricanes, flooding and wildfires, just to name a few.

Since the implementation of certain sections of the Setting Every Community Up for Retirement Enhancement (SECURE) Act of 2019, a corporation, partnership, or individual may adopt a Qualified Plan by the due date of their return. This was to keep parity with Simplified Employee Pensions (SEPs) and Individual Retirement Accounts (IRAs), which may be adopted and funded well after the end of the calendar year. In a move no one saw coming, the IRS recently ruled that plans adopted after the end of the year will not have a Form 5500 filing requirement until the second year of the plan. This means that if you retroactively adopted a plan in 2021 by the due date of your return for 2020, you could take the deduction on the 2020 return, but the first Form 5500 will not be due until the 2021 Plan Year return is due. We assume the Form will be changed to somehow indicate that this occurred.

The SECURE Act also increased penalties for late filing of the Form 5500 from $25 per day to $250 per day, with a cap increased from $15,000 to $150,000. There were no changes to the user fees for the Department of Labor Delinquent Filer Voluntary Compliance Program that provides relief from these penalties if the Plan Sponsor comes forward voluntarily and brings these late filings current.

At this time, we will operate under the pretense that other deadlines will remain in place with the understanding they may change. The following is a partial list of upcoming ERISA Plan Compliance deadlines:

• July 31: The IRS’s above-mentioned Form 5500 due date for plans that end on December 31. This is also the deadline to file Form 5558 for those requesting an extension to October 15, 2021.
• September 15: Form 5500 due for plans eligible for an automatic extension linked to a corporate tax extension.
• September 30: Summary annual reports due to participants from plans with a December 31 year-end – i.e., due nine months after the plan year-end or two months after filing Form 5500.
• October 15: IRS deadline for filing Form 5500 after plan files Form 5558 to request an extension.
• November 15: Summary annual reports due to participants if the Form 5500 deadline was extended because of a corporate tax filing extension.
• December 1: Deadline for delivery of certain disclosures to participants including Safe Harbor Matching Notice, Fee Disclosure Notice on participant directed plans, Automatic Enrollment or Automatic Escalation notice for certain Automatic Contribution Arrangement 401(k) plans and the Notice of Qualified Default Investment Alternatives (QDIA Notice).
• December 15: Extended deadline for providing summary annual reports to participants if the Form 5500 deadline was extended because of filing Form 5558.

The Form Series 5500 Series has always been a document of Public Record since the enactment of ERISA, meaning that the data reported may be used as a research, compliance, and disclosure tool for the DOL, and a disclosure document for plan participants and beneficiaries. With the information now readily available on the internet at www.efast.dol.gov, it is also a source of information and data for use by other Federal agencies, Congress, and the private sector to assess employee benefit, tax and economic trends and policies.

If you would like to learn more about ERISA deadlines, please contact us and we will be happy to assist you. Call 954-431-1774.

Plan theft is a perennial hot-button issue in the benefit plan arena. This is for good reason. Recent estimates show that defined contribution plans alone hold over $6.3 trillion for 106 million participants. This makes plans a target for thieves—for example thieves may steal a participant’s identity and submit a request for a distribution. When the participant discovers the missing funds (sometimes years later), they often turn to the plan sponsor looking to be made whole (such as in the highly publicized Estee Lauder case).

Recent DOL guidance noted that mitigating cybersecurity risk is a fiduciary duty and specifically notes that plan fiduciaries should understand and guard against identity theft. You can help your plan sponsor clients meet their fiduciary obligations and protect their participants.

Here are some questions you can discuss with your clients to help them evaluate their processes and combat the risk of plan theft:

· Who is in charge of approving distributions and loans? How do they ensure the person requesting the distribution or loan is the actual participant or beneficiary?

· Are all changes to employee data (such as changed address, marriage/divorce, etc.) passed along to the plan’s TPA or recordkeeper?

· How are address changes verified? Is there extra verification when a change is made close in time to a loan or distribution request?

· Are prudent processes in place to mitigate identity theft and cybersecurity incidents? What do password requirements look like? Is multifactor authentication required?

· Does the client know what steps to take if they suspect theft or another cybersecurity incident has occurred?

EJReynold’s takes cybersecurity and identity theft very seriously. Give us a call today to discuss ways we can help protect your plan’s assets and to review practical steps you can take to reduce the risk of plan theft.

Please contact us at 954.431.1774 and we will be happy to assist you.

Have you been talking with prospective clients about adopting a new 401(k) plan? Even in today’s  environment, many businesses are thriving and want to secure deductions for the 2021 Tax Year. If so, the deadline for adopting a safe harbor 401(k) plan for 2021 is quickly approaching, so now would be a great time to schedule a follow-up conversation!

Safe harbor 401(k) plans are attractive for many employers (especially small employers) because they provide relief from certain plan testing requirements. Specifically, a safe harbor plan is generally exempt from ADP/ACP testing enabling the plan’s highly compensated employees to maximize elective deferrals, i.e., 401(k) deferrals/Roth contributions, without concern over the non-highly compensated employees’ level of participation. Safe harbor plans may also be exempt from the top-heavy requirements if certain conditions are met.

What is the deadline for adopting a safe harbor 401(k) plan?

In general, the deadline for adopting a new safe harbor 401(k) plan is October 1, 2021. There are, however, certain notice requirements that must be satisfied, and eligible employees must be provided a reasonable period to make their deferral elections. In a new plan, the rule is that all eligible employees must have at least three months to make elective deferrals under the plan, so planning is key! Remember, most investment platforms take 30-45 days to be ready to accept contributions.

 Are there limits on the amounts that can be deferred?

No. There are no restrictions (other than the normal limits) placed on the amounts that can be deferred during this three-month period. As a result, owners, key employees and any other participants would still have time to make elective deferrals of $19,500 (plus $6,500 for participants aged 50 or older). This, of course, assumes they will have enough compensation to do so within this time period.

 What are the contribution requirements?

The plan must make either a safe harbor matching or safe harbor nonelective contribution. The basic safe harbor matching contribution formula is 100% on the first 3% of deferrals, plus 50% on the next 2% (maximum of 4% match). Alternatively, an enhanced safe harbor matching formula can be used, which is most commonly 100% on the first 4% of deferrals. Safe harbor nonelective contributions must be at least 3% of each participant’s compensation, regardless of whether they elect to make deferrals. Note that safe harbor contributions (match or nonelective) must be 100% vested, subject to the same distribution restrictions as elective deferrals, and cannot be subject to any allocation conditions, e.g., employment on the last day of the plan year. Auto-enrolled plans have their own safe harbor plan design with either a matching contribution of 100% of the first 1% of salary deferred plus 50% of the next 5% of salary deferred, or a non-elective contribution of 2% across the board to all eligible employees. The Auto-enrolled safe harbor contributions may be on a vesting schedule if they are 100% vested after two years of service, but the same requirement of no other allocation conditions apply.

 What about the SECURE Act changes to Non-elective Safe Harbor Plans?

While it is true that the Setting Every Community Up for Retirement Enhancement (SECURE) Act of 2019 does allow a plan to be amended at any time to become a safe harbor non-elective plan, even up until the due date of the corporate tax return for that plan year, the plan must still satisfy the other requirements of a safe harbor plan. The main requirement is that the plan must be established by October 1^st of the tax year for which the deferrals are made (on a calendar year basis). This means that the Plan Sponsor cannot wait until December 1^st to establish the plan and then retroactively amend the plan to be a safe harbor non-elective plan to have the Highly Compensated Employees defer the maximum dollar amount.

 Tax credit available for Small Employers

As an incentive to establish a new 401(k) plan, the SECURE Act added provisions for small employers (generally, businesses with no more than 100 employees) to receive a tax credit of up to $5,000 (per year, for the first three years) to help defray the costs associated with establishing and maintaining a plan. An additional credit of $500 per year is available for new or existing plans adding an automatic enrollment feature.

 Which design is best?

One-size does not fit all. It really depends on the goals of the employer and demographics of the workforce. The plan must be in effect for at least three months, and as stated before, most investment platforms will require 30-45 days to be ready to accept deposits. The good news is that EJReynolds can assist you in determining what will work best for your clients after considering their unique needs! Please contact us to learn more.

If you would like to learn more about these rules, please contact us and we will be happy to assist you. Call 954.431.1774