The Rosenbaum Law Firm P.C. Blog

Working with a plan sponsor recently, I was helping sort out a late Form 5500 issue. Pretty routine stuff, until I learned they’d already heard from the IRS about it a year ago. A year! It reminded me of my mother-in-law, who’d never tell you she was sick when it happened, but would casually drop the news six to twelve months later, like it was an afterthought. (“Oh, did I mention I had surgery last spring?”)

That kind of delayed disclosure doesn’t just cause family headaches, it causes plan headaches.

Your 401(k) provider, whether it’s a TPA, ERISA attorney, or recordkeeper, can’t fix what they don’t know. We’re not mind readers, and we don’t have a magic portal into your inbox. If the DOL or IRS sends you a letter, tell us. Immediately. The longer you sit on it, the worse the problem gets, and the fewer options we have to make it right.

Providers are supposed to be your retirement plan experts, but we can’t help you if we don’t know what’s going on. Silence is not a strategy. Communication is.

So next time you get a notice, an inquiry, or even a nagging sense that something might be off, loop in your plan team early. They’ll thank you, and you’ll avoid turning a fixable issue into a full-blown regulatory migraine.

Because in the 401(k) world, just like in family life, the sooner you talk about the problem, the easier it is to solve.

The U.S. Department of Labor has announced plans to revisit and likely revise the fiduciary-advice rule in 2026, signaling significant potential shifts for plan sponsors and advisers.

Here are my key takeaways:

· At issue is the definition of “fiduciary adviser” under ERISA. The current rule — known as the “Retirement Security Rule” — is still tied up in litigation in the 5th Circuit.

· The DOL’s regulatory agenda offers little detail on exactly how the rule will change, stating only that the new regulation “will ensure that the regulation is based on the best reading of the statute.”

· Two realistic pathways:

1. Rescind the existing rule outright, reverting to the 1975 standard.

2. Rewrite the rule: either amend the current structure or overhaul it from scratch.

· A wrinkle: the DOL may also seek to consolidate multiple guidance items (like Prohibited Transaction Exemption 2020-02) into one coherent fiduciary framework. That would help reduce fragmentation and confusion.

· Timing and priorities matter. With ESG, alternatives, government funding, and staffing constraints all in play, it’s far from guaranteed the DOL will finalize a new rule by its target date.

Why this matters If your role involves advising, sponsoring, or managing retirement plans, this rulemaking could alter who is deemed a fiduciary, what advice triggers fiduciary status, how compensation is treated, and how plan fiduciaries oversee advisers. Governance, contracts, disclosures, and adviser-selection processes may all need revision.

My takeaway While the exact form remains unclear, the fiduciary landscape is headed for change. Plan sponsors and advisers should stay ahead: revisit current adviser arrangements, consider where fiduciary risk may exist now, and plan for adjustments to governance and oversight. The fiduciary bar may not get lowered, it might just shift.

I’m encouraged by the DOL’s issuance of Advisory Opinion 2025-04A, which affirms that a managed-account strategy incorporating a lifetime income component can qualify as a Qualified Default Investment Alternative (QDIA). This is an important milestone for defined-contribution plans.

Here are a few thoughts for retirement-plan sponsors and fiduciaries:

1. Broadening default investment design The Opinion confirms that default investment options can now include more than traditional target-date or balanced funds, specifically, a managed account that gradually allocates into an income-generating portfolio (including annuity-type guarantees) can qualify as a QDIA. Plan fiduciaries should review whether their current default offering aligns with this evolving landscape.

2. Liquidity and transferability remain essential One of the keys to the DOL’s comfort was that the program preserved participant rights: the ability to transfer or withdraw assets without surrender penalties and full notice disclosures were built in. Fiduciaries considering lifetime-income default options must ensure these structural features are present, the devil is always in the details.

3. Fiduciary diligence in selecting insurers and guarantees Even though lifetime-income components (including variable annuities or GLWB-type features) are now more clearly permissible, the Opinion emphasizes the continuing duty of prudent selection and monitoring of insurers and guarantee structures. Adopting the safe harbor frameworks for annuity-provider selection remains best practice.

4. Education and communication matter more than ever When you mix “accumulation” vehicles with “decumulation” features (i.e., lifetime income), participants and sponsors need clear education: how the income guarantee works, what happens if withdrawals exceed the guaranteed amount, what options exist for beneficiaries. Without proper communication, the risk is misunderstanding and unintended behaviour.

5. Opportunities for sponsors to differentiate This development opens the door for plan sponsors who want to move beyond “just a target-date fund” in their default lineup. Offering a managed-account QDIA with a lifetime-income component may help address the growing concern that participants will outlive their savings. On the flip side, cost, governance and operational complexity require thoughtful vetting.

In short: the regulatory door is now more clearly open for default investment offerings that combine accumulation and guaranteed lifetime income features — but as always, the fiduciary bar isn’t lowered. Sponsors should proceed deliberately: update governance charters, review vendor capabilities, ensure participant notice and liquidity rights, and reinforce education.

If your plan or committee is evaluating a QDIA redesign or adding a managed-account + lifetime-income option, I’d be happy to discuss the key checklist items and governance implications.

I love networking on LinkedIn. Some of the best connections I’ve made in this business, people I actually trust and respect, started with a simple connection request. The platform is an incredible tool for building professional relationships, sharing insights, and even a little self-promotion (in moderation, of course). But like everything else in life, there’s a right way and a wrong way to do it.

And as you know, I’m a little like Larry David when it comes to pet peeves. One of my biggest? The connection request that’s immediately followed by a sales pitch. You know the one: “Thanks for connecting, Ary! Have you ever considered a cash balance plan for your firm?” The same firm where I’ve spent the last few decades writing about, speaking on, and consulting about, yes, retirement plans.

It’s like asking a chef if they’ve ever heard of salt.

I’m not in sales, but even I know that approach doesn’t work. When someone pitches me right after connecting, it feels like that door-to-door salesperson who knocks just as I’m sitting down to dinner. I don’t answer my front door when I know someone’s selling something. So why would I respond to a cold digital knock from someone who clearly didn’t take ten seconds to see who they’re talking to?

Sales, like trust, takes time. The people I rely on, the TPAs, recordkeepers, and advisors I refer clients to, are relationships that were built over years. Real relationships. They weren’t built by a one-click “connect” followed by a canned pitch. They were built by consistency, relevance, and mutual respect.

If you’re going to use LinkedIn to sell, do it the right way. Start by engaging. Comment on posts. Offer insight. Build a rapport. And when the time is right, make your pitch relevant. Know who you’re talking to and why your service might actually help them. If you’re reaching out to an ERISA attorney, don’t ask if they’ve ever thought about having a cash balance plan—unless you’re looking for an answer that starts with sarcasm.

LinkedIn is about relationships, not transactions. If you treat it like a quick sale, you’ll end up with a lot of ignored messages. But if you treat it like a place to build trust, you’ll find yourself surrounded by the best kind of network, one built on genuine connections, not cold calls.

I love networking on LinkedIn. Some of the best connections I’ve made in this business, people I actually trust and respect, started with a simple connection request. The platform is an incredible tool for building professional relationships, sharing insights, and even a little self-promotion (in moderation, of course). But like everything else in life, there’s a right way and a wrong way to do it.

And as you know, I’m a little like Larry David when it comes to pet peeves. One of my biggest? The connection request that’s immediately followed by a sales pitch. You know the one: “Thanks for connecting, Ary! Have you ever considered a cash balance plan for your firm?” The same firm where I’ve spent the last few decades writing about, speaking on, and consulting about, yes, retirement plans.

It’s like asking a chef if they’ve ever heard of salt.

I’m not in sales, but even I know that approach doesn’t work. When someone pitches me right after connecting, it feels like that door-to-door salesperson who knocks just as I’m sitting down to dinner. I don’t answer my front door when I know someone’s selling something. So why would I respond to a cold digital knock from someone who clearly didn’t take ten seconds to see who they’re talking to?

Sales, like trust, takes time. The people I rely on, the TPAs, recordkeepers, and advisors I refer clients to, are relationships that were built over years. Real relationships. They weren’t built by a one-click “connect” followed by a canned pitch. They were built by consistency, relevance, and mutual respect.

If you’re going to use LinkedIn to sell, do it the right way. Start by engaging. Comment on posts. Offer insight. Build a rapport. And when the time is right, make your pitch relevant. Know who you’re talking to and why your service might actually help them. If you’re reaching out to an ERISA attorney, don’t ask if they’ve ever thought about having a cash balance plan—unless you’re looking for an answer that starts with sarcasm.

LinkedIn is about relationships, not transactions. If you treat it like a quick sale, you’ll end up with a lot of ignored messages. But if you treat it like a place to build trust, you’ll find yourself surrounded by the best kind of network, one built on genuine connections, not cold calls.

When I was younger, I wanted to get along. I really did. I wanted to keep the peace, stay out of trouble, and believe that if I worked hard and did the right thing, people would notice. They don’t. Not in school, not at work, and certainly not in life. I thought silence was maturity, that it showed restraint. What I didn’t realize then was that silence looks a lot like consent, and people mistake consent for weakness.

That’s one of the hardest lessons I’ve ever learned: when you don’t speak up, people assume you agree. And when you stay quiet long enough, you start to disappear.

In Full Circle, I wrote about the moments that define us, the ones that make you realize no one’s coming to save you, no one’s going to hand you what you deserve. You have to ask. You have to demand. Because waiting politely for fairness is a fool’s errand. Fairness doesn’t show up on its own; you have to drag it to the table.

I was never handed anything. Anything I truly wanted, a position, a promotion, a fair shake, I had to fight for. Whether it was trying to get a role at a synagogue youth service as a teenager or earning a raise at work, I learned that “deserving” something and actually getting it are two very different things. Very few people in power reward you just because you worked hard. They reward the people who make noise.

When I worked as a lawyer for a school board, I noticed that everyone was getting bonuses, everyone but me. A few years earlier, I had earned one, so I knew how the system worked. But this time, nothing. I asked why. I was told some nonsense about “budget constraints,” even though the same constraints didn’t apply to the others. So I demanded one. And I got it. Not because they suddenly recognized my value, but because I didn’t let it go.

It wasn’t the money that mattered; it was the principle. You either set the tone for how people treat you, or they’ll set it for you.

The same thing happened later at my synagogue. A friend of mine, a nice person, but not qualified, was about to be handed a paid position she wasn’t entitled to. Everyone else stayed quiet because it was easier. I didn’t. I spoke up. Because fairness only works when someone enforces it. And more often than not, that “someone” ends up being me.

Then came Oceanside. I watched people on the school board destroy what generations had built, not through malice, but through incompetence and self-interest. Positions were handed out like candy to friends and relatives. Contracts were given to cronies. The schools, and the kids, paid the price. So I spoke up again. Not because it was fun. Not because I wanted attention. But because silence was no longer an option.

And that’s the point I’ve reached in life, I’m fine not getting along if it means standing for something. It’s easy to stay quiet, especially when speaking up makes you the odd one out. But I’ve made my peace with that. I’m not built to look the other way.

Some people call it being difficult. I call it being awake.

The older I get, the more I realize how rare that is. Most people convince themselves that keeping quiet is the smart move, that rocking the boat just makes you a target. But you can’t steer the ship from the passenger seat. You either take the wheel or you drift wherever the current takes you.

That’s why I still believe in being the last Boy Scout, the one who follows the code when everyone else is cutting corners, the one who speaks when everyone else whispers. It’s lonely sometimes, but integrity often is.

I don’t regret the times I spoke up, even when it cost me something. What I regret are the moments I didn’t. Because the truth is, every time you swallow your voice, you give away a little piece of yourself. And if you do that long enough, there’s not much left to defend.

So no, I don’t go along to get along anymore. I don’t wait for fairness or hope someone notices the work. I ask. I push. I demand. Not because I’m angry, because I’ve seen what happens when you don’t.

The Boy Scout in me still believes in doing the right thing. The lawyer in me knows you sometimes have to fight for it. And the older, wiser version of me — the one who’s been around long enough to see how things really work, knows this: getting along is overrated. Standing up is everything.

Because in the end, I’d rather be remembered for making noise than for staying quiet while everything around me went wrong.

Working on an IRS audit is hard enough. But what’s even harder? When you discover the plan sponsor disposed of—or claims to have disposed of, the very records the IRS is demanding.

Let’s not kid ourselves: that’s a hostage to fortune. You can’t defend what you can’t prove. And you can’t explain away a missing spreadsheet from 2015 just because “we thought we didn’t need it anymore.” That’s not a defense, it’s an admission of negligence.

Here’s the cold, simple truth:

1. Plan sponsors have to keep the records. The IRS, under the retirement plan rules, requires you to furnish complete, accurate records — in paper or electronic form — when asked.

2. Some records must live forever (or close to it). ERISA doesn’t just say “six years and toss the rest.” Under § 209, you must keep whatever records are necessary to determine a participant’s benefit—because benefits last a lifetime.

3. You can’t rely on your service provider to fix your mess. Even if you’re using a great TPA or administrator, the legal obligation rests squarely on you (the sponsor). If they purge or misplace records, you’re still on the hook.

4. “We destroyed it” won’t cut it. If you destroyed records you were legally required to preserve, that invites the IRS (or DOL) to assume the worst. For missing records, the burden often shifts to you, prove a negative.

5. The remedy is always: don’t let this happen in the first place. A written records-retention policy. Regular backups. Migrations when switching providers. Indexing. Document control. All that boring but essential stuff.

Bottom line (no fluff): If you’re a plan sponsor and you have been lax about recordkeeping — and now you’re facing an IRS audit, you’re already behind. The only hope is that you have partial records, internal logs, or corroborating evidence. But don’t count on miracles.

If your plan is still relatively clean, double down now. Clean up your document retention policy. Audit your backups. Make sure nothing gets tossed unless you can legally toss it. Because in an audit, the IRS doesn’t want excuses. They want proof.

2025 has already been a roller coaster for plan sponsors—regulatory change, cybersecurity threats, shifting fiduciary standards. But—brace yourselves—2026 is going to test all the work you thought you had under control.

Here’s how I see it, and what your checklist should look like if you want to survive (or better yet, thrive).

Why 2026 Will Be a Pressure Cooker

Let’s call it what it is: a confluence of evolving risk factors, new rules dragging behind them, and expectations from participants that are growing by the day.

· Alternative assets in 401(k)s Private markets are starting to creep into 401(k) menus. That sounds exciting—diversified returns, innovative options—until you factor in the administrative mess. Valuation challenges, liquidity issues, communication demands, and oversight obligations make this a fiduciary minefield.

· SECURE 2.0’s creeping obligations The law continues to phase in. In 2026, catch-up contributions for certain high earners must default to Roth (after-tax) treatment. That’s a fundamental change. And tax rules, notices, and disclosures will be even tighter.

· Fiduciary litigation and forfeiture scrutiny Lawsuits targeting how plan sponsors use forfeitures or handle fees are on the rise. Courts and plaintiffs are asking hard questions: Are you applying forfeitures properly? Are your fees justified and documented? You’ll need your process, your benchmarking, and your records airtight.

· Cyber risk meets ERISA AI-powered phishing and cyberattacks aren’t the future—they’re now. And regulators are watching. A breach that impacts plan assets or personal data can become a fiduciary liability. You’ll be judged not just on whether you had security, but whether it was adequate, tested, and maintained.

· Regulatory and oversight intensity Expect enforcement activity to ramp up. Reporting and disclosures will be revisited, interpretations challenged, and compliance gaps exposed.

Your 2026 Preparedness Checklist (Ary Rosenbaum Style)

Because “winging it” is no longer an option. Here’s how to brace for the turbulence:

1. Inventory what must change List all SECURE 2.0 provisions coming online next year—catch-up defaults, Roth conversions, employer match rules. Mark deadlines. Assign responsibility.

2. Review your investment menu If you’re considering alternative or private funds, get due diligence documents, valuation

methodologies, liquidity terms, and suitability analysis. Don’t treat these as accessories—they’re central.

3. Benchmark and document your fees Establish your fee benchmarking process now. Engage independent reviews. Record why you selected each provider. Document comparisons and decisions. Lawyers and plaintiffs love missing memos.

4. Sharpen cybersecurity and tech oversight Security can’t be a checkbox. You need continuous, demonstrable vigilance—third-party audits, penetration testing, staff training, and vendor oversight. And make sure you have cyber and fiduciary liability insurance in place.

5. Update fiduciary processes and governance Are your committee minutes current? Are consultant recommendations documented? Are fiduciary decisions memorialized? If not, fix it now. Compliance is as much about process as it is about numbers.

6. Strengthen participant communication Changes to investments, Roth defaults, or fees need to be clearly explained. Don’t let notices drown in legalese. Participants will remember confusion more than compliance.

7. Run scenario audits Ask “what if” questions: What if valuations are late? What if a vendor fails? What if there’s a data breach? If you can’t show mitigation steps, you’re vulnerable.

8. Lock down insurance coverage The ERISA bond is required, but fiduciary and cyber liability coverage are essential. Review policy limits and exclusions before 2026 hits.

9. Engage your entire team This isn’t just HR’s problem. Involve finance, IT, and legal. Cross-functional communication and accountability matter more than ever.

10. Document every change Keep a log of every update—policies, vendors, disclosures, or processes. Future auditors or plaintiffs will want that paper trail.

Final Thought: Don’t Be Surprised by Tomorrow’s Fire

In Full Circle, I talked about how life teaches you the lessons nobody hands you. This is one of those lessons for plan sponsors: no matter how good things look today, the environment never stays still.

2026 will test your resilience, your foresight, and your willingness to invest in guardrails—not just for compliance, but for trust. The sponsors that survive and thrive won’t be those who cut corners; they’ll be the ones who leaned in early, documented everything, and treated fiduciary responsibility as a mission, not a burden.

It’s not enough to react. You have to anticipate. So take your checklist, tighten your processes, build your defenses, and make sure that when the heat comes, you’re not caught flat-footed.

Because if there’s one guarantee about 2026, it’s this: change is coming—and it will punish those who weren’t ready.

Well, here’s a headline you didn’t see coming… or maybe you did, because this is exactly the kind of thing government loves to roll out quietly until everyone’s scrambling. New York is launching a mandatory state-retirement savings program this fall.

Yes, “mandatory.” That means certain employers in New York that don’t already provide a qualified retirement plan will be forced to register in this “Secure Choice” program, upload employee data, and begin payroll deductions. Enrollments will start automatically (3% of gross pay, unless workers opt out).

So what’s the real deal here?

· Many small businesses in New York will suddenly have a new compliance headache. They’ll need to juggle registration deadlines and set up systems to handle deductions they’ve never handled before.

· Existing TPAs, advisors, and recordkeepers should see opportunity — or risk — depending on how they respond. This isn’t just regulation; it’s redistribution of who holds the relationship.

· Clients will want answers: “How does this affect my retirement-plan options?” “Is this better or worse than what I might do on my own?”

For those of you watching from outside New York: pay attention. These state programs are multiplying. What starts in one state often becomes the blueprint elsewhere.

If you’re a New York employer without a plan, skip the panic. But don’t skip the plan. This new regime doesn’t mean your only choice is a state plan. We still have tools, custom plans, and smarter ways to help your employees.

If you’re a service provider: think two steps ahead. Be ready to help clients navigate this mess, even those who didn’t ask for help, yet. Because invariably, they will.

If you ask me, the state is taking aim at the gap between workers who have access to retirement plans and those who don’t. But the risk for them is that a one-size fits all “state plan” will disappoint. And that disappointment will open the door for those of us still building trust, not mandates.

So, Creative Planning just bought SageView Advisory. Another week, another acquisition in the retirement plan world. At this point, consolidation is like the weather forecast, inevitable and rarely surprising.

Every few months, one big advisory firm swallows another, and the press releases always sound the same: “We’re thrilled to join forces to provide enhanced client value.” Translation: someone got a nice payday, and now everyone has to figure out how to merge two very different cultures.

Here’s the thing, bigger doesn’t always mean better. Clients don’t care about scale; they care about service. If a merger means their calls go to voicemail longer or their reports take an extra week, that “enhanced value” tagline gets old fast.

Still, I can’t fault either side. This is the business now, grow or get eaten. Just remember, for those of us still independent, this is where we can stand out: being personal, nimble, and actually answering the phone.

Because while big firms buy growth, the rest of us still earn it.