The Rosenbaum Law Firm P.C. Blog

With new guidance by the Department of Labor (DOL) on cybersecurity, it’s important to determine whether your plan provider meets that guidance.

The DOL provided information on best cybersecurity practices to plan fiduciaries, recordkeepers, and other service providers regarding their responsibilities for managing cybersecurity risks. While you should look at how you meet these requirements, you need to do the same.

Best practices include:

• Maintaining a formal, well-documented cybersecurity program.
• Conducting prudent annual risk assessments.
• Having a reliable annual third-party audit of security controls.
• Clearly defining and assigning information security roles and responsibilities.
• Having strong access control procedures.
• Ensuring that any assets or data stored in a cloud or managed by a third-party service provider are subject to appropriate security reviews and independent security assessments.
• Conducting periodic cybersecurity awareness training.
• Implementing and managing a secure system development life cycle (SDLC) program.
• Having an effective business resiliency program addressing business continuity, disaster recovery, and incident response.
• Encrypting sensitive data, stored and in transit.
• Implementing strong technical controls following best security practices.
• Appropriately respond to any past cybersecurity incidents.

One of the biggest consolidators in the third-party administration (TPA) business has found itself being acquired.

Funds managed by Stone Point Capital, along with GIC, Singapore’s sovereign wealth fund, have entered into an agreement to purchase Ascensus from its current private equity ownership group led by Genstar Capital, Aquiline Capital Partners, and Atlas Merchant Capital. Genstar Capital and Aquiline Capital Partners will maintain a minority stake in Ascensus after the sale.

The transaction is expected to close in the third quarter of 2021.

The Internal Revenue Service (IRS) released some new guidance on the temporary partial plan termination rules thanks to COVID under the Taxpayer Certainty and Disaster Tax Relief Act of 2020 (the Act).

Usually, there is a presumption that a partial plan termination has taken place within a qualified plan when an employer’s turnover rate is at least 20 percent during the plan year. Partial plan termination requires those participants covered under the plan to be fully vested in employer contributions.

The Act stated that a partial plan termination doesn’t occur “during any plan year which includes the period beginning on March 13, 2020, and ending on March 31, 2021, if the number of active participants covered by the plan on March 31, 2021, is at least 80 percent of the number of active participants covered by the plan on March 13, 2020.” The guidance gives some relief to employers that eventually re-hire employees as they recover from COVID restrictions.

The new guidance addresses the following points.

• “Active participant covered by the plan” is determined based upon a reasonable, good-faith interpretation of the term. When only part of the plan year falls between March 13, 2020, and March 31, 2021, the Act “applies to any partial termination determination for that entire plan year.” The IRS provides this example: “If a plan has a calendar year plan year, the 80% partial termination in [the Act] applies to both the January 1 to December 31, 2020 plan year and the January 1 to December 31, 2021 plan year because both plan years include a part of the statutory determination period of March 13, 2020, to March 31, 2021.”
• The Act doesn’t require the same individuals to be covered on the beginning and end dates, only that the number counted on March 31, 2021, includes all individuals who are active participants covered by the plan on said date. So that means that the employer has to hire employees, not the same employees who were terminated.
• The reduction in the number of active participants isn’t solely limited to reductions related to the COVID-19 pandemic, it could be for a variety of reasons.

We still have a retirement crisis in this country as people don’t have enough retirement savings and so many people don’t have access to a retirement plan at work. The Georgetown University Center for Retirement Initiatives estimates there are 57 million private-sector workers which represent 46% of the population working in the private sector, that don’t have access to a retirement plan at their workplace.

This is the market for pooled employer plans (PEPs), companies with zero retirement plans that may want one if they don’t have to deal with the fiduciary headaches by joining a PEP. While some existing plans may join a PEP, I think the bulk of the adopting employers that join a PEP are going to be employers that don’t have a plan in place or are in one of those states that will require to either offer one or a State IRA program.

Whether it’s a single employer plan, a multiple employer plan (MEP), a pooled employer plan (PEP), or a plan provider, they can always be a target for ERISA litigation.

What makes a target? Size. ERISA litigators need to eat and a small, $400k 401(k) plan isn’t a big enough target to feed them. That’s why we’re finally seeing MEPs being sued because they’re flush with assets. PEPs will eventually be a target, it’s just going to take hundreds of millions of dollars to become a sufficient target.

When it comes to COVID, I had one major phobia and that was getting my hair cut. My ENT doctor understood my fear, too close of proximity and for a prolonged time. I also didn’t like how my hair looked when I cut my own. So I waited until two weeks after my second vaccine shot. I decided to venture out to the barbershop I’ve been using for the last few years.

I walk into the barbershop and the owner isn’t there, but the other barber was, working on someone. The only problem was the barber wasn’t wearing a mask. Despite being vaccinated, it’s not something I’d be willing to accept, and I walked out. I will never come back. Regardless of your views about COVID, it’s unacceptable to me.

With clients, all it takes is to do something wrong one time to scare them away for good. While everyone should get a second chance, I didn’t give my barber a second chance, and many clients won’t give you a second chance if things go south. That’s why it’s important to never scare away for any point or reason.

My latest newsletter for retirement plan professionals can be found here.

My latest. article on JDSupra.com can be found here.

If you know about a thing or two about plan administration, you know about the top-heavy rules. The top-heavy rules generally ensure that the lower-paid employees receive a minimum benefit if the plan is top-heavy. A plan is top-heavy when, as of the last day of the prior plan year, the total value of the plan accounts of key employees is more than 60% of the total value of the plan assets.

This article isn’t actually about the top-heavy rules, but it deals with a different form of top-heavy, it’s the problems of organizations that are top-heavy in the fact that they have too many generals on top and not enough soldiers to do the work of the organization.

I once belonged to a not-for-profit organization, where 25 core members worked hard and the problem was that there were about 36 positions of power in the organization. The problem is that you have too many people interested in the power of the position or just the title of the position and not enough people who would help in the work of organizing events or fundraising. Being someone that was heavily involved in organizing events, this was problematic when dealing with people who want the honor and the glory, but don’t want to do the work to justify it.

Positions of power can be a problem for those who want the title and don’t want to do any of the work that they think is too menial for their position. It reminds me of a woman that the first third-party administration form (TPA) I ever worked with, hired as a plan administrator. This administrator came in on her first day of work and there was nothing for her to do. So another administrator asked her to make copies of some plan documents and reports The woman quit that day, apparently making copies was too much to ask of a plan administrator. Organizations that have too many people in leadership and not enough day-to-day employees will recognize many times that the leadership doesn’t want to get their hands dirty and do the work necessary to keep the organization moving.

That TPA was a failure as a stand-alone business and was a failure again after being purchased by a national consulting firm because it had 6 owners who became senior management upon the sale to a national consulting firm and only about half of them had a strong work ethic to be there every day from 9-5 pm. The problem with too much leadership is not only are they top-heavy in titles, but they’re also top-heavy in salaries. A TPA that had 70 employees didn’t have enough revenue to pay those 6 “managing directors” and have that national consulting firm pay off the financing used to purchase that business. It’s a lot like the law firms I was a member of that had way too many partners when compared to the number of associates it had. It creates a financial problem when you have too few associates to support the work of the partners and the billable hours need to be churned out to support those at the top. That’s why mid-sized law firms never do as well as larger firms that have much more associates than partners.

For an organization in the retirement plan business, you need enough people to do the heavy lifting to help the people at the top manage the business and grow it. Top-heavy organizations have a tough time making ends meet because their overhead supporting all these generals has a huge price to pay.

I write a lot because social media gets my name out there at a much lower cost than hiring a public relations. director. I know because I’ve been there and done that. I write articles, I blog, and I started this crazy website.

Ever since I started my practice 6 years ago, I have two email newsletters sent out to all my contacts including plan sponsors and one geared towards financial advisors. Over time, I’ve gained contacts and lost some. I think my latest number is 12,000 subscribers and maybe I get a 20% open rate for my emails.

The most important thing about emails is that it’s through Constant Contact, so there is an easy unsubscribe button. I understand people’s time is limited and maybe they don’t have time to read my emails and I understand that. I don’t take offense when people I’ve networked with or worked with in the past decide to unsubscribe. It’s not personal, it’s business.

When you network and you meet people through LinkedIn, I assume that I’m going to be added to their mailing list. I assume that because that’s what I do. From time to time, I’ll check the emails as a courtesy and I don’t unsubscribe from these emails even for the financial advisor that asked me to do an online meeting with her 5 years ago and has done nothing with me since. Retirement plan business is a relationship-driven business, so I don’t want to offend anyone or hurt their feelings.

That being said, if you send emails out, have an unsubscribe button. This isn’t organized crime or my old synagogue; people have a right to quit. If they don’t want your emails, they should have the ability to unsubscribe. If you don’t offer that ability, then you’re going to peeve a heck of a lot of potential clients and fellow plan providers.

I’m certainly passive-aggressive when I state that I have two financial advisors who consistently barrage me with emails without unsubscribe buttons. It wouldn’t be so bad to get an email now and then, but a daily email? I have one financial advisor who sends me 3-4 email updates a day. I don’t have the heart to tell them to stop bothering me, so I’m partly to blame for not setting them straight.

Your emails aren’t the Hotel California where people can check-in but never leave. This isn’t some cult; you need to let people have the opportunity to opt-out of receiving your emails.