Operating a Small-Business 401(k) Plan

Adapted from 401(k) Plans For Small Businesses, published by the U.S. Department of Labor; selected section: Operating a 401(k) Plan. The source text is reproduced with headings and formatting adjusted for this guide.

Operating a 401(k) Plan

Once you establish a 401(k) plan, you assume certain responsibilities in operating it. If you hired someone to help set up your plan, that arrangement also may include help in operating the plan. If not, you'll need to decide whether to manage the plan yourself or to hire a professional or financial institution to take care of some or most aspects of operating the plan.

Elements of operating 401(k) plans include:

• Participation
• Contributions
• Vesting
• Nondiscrimination
• Investing the contributions
• Fiduciary responsibilities
• Disclosing plan information to participants
• Reporting to government agencies
• Distributing plan benefits

Participation

Typically, a plan includes a mix of rank-and-file employees and owners/managers. However, a 401(k) plan may exclude some employees if they:

• Are younger than 21,
• Have completed less than 1 year of service,
• Are covered by a collective bargaining agreement, if retirement benefits were the subject of good faith bargaining, or
• Are certain nonresident aliens.

Contributions

In all 401(k) plans, participants can contribute through salary deductions. You can decide how much your business contributes to participants' accounts in the plan.

Traditional 401(k) Plan

If you decide to contribute to your 401(k) plan, you have options. You can contribute a percentage of each employee's compensation (a nonelective contribution), you can match the amount your employees contribute (a matching contribution), or you can do both.

For example, you may decide to add a matching contribution – say, 50 percent – to an employee's contribution, which results in a 50-cent increase for every dollar the employee sets aside.

Using a matching contribution formula will provide employer contributions only to employees who contribute to the 401(k) plan. If you choose to make nonelective contributions, the employer contribution goes to each eligible participant, whether or not the participant decides to contribute to their 401(k) plan account.

Under a traditional 401(k) plan, you have the flexibility of changing the amount of employer contributions each year, according to business conditions.

Safe Harbor 401(k) Plan

Under a safe harbor plan, you can match each eligible employee's contribution, dollar for dollar, up to 3 percent of the employee's compensation, and 50 cents on the dollar for the employee's contribution that exceeds 3 percent, but not 5 percent, of the employee's compensation.

Alternatively, you can make a nonelective contribution equal to 3 percent of compensation to each eligible employee's account.

Each year you must make either the matching contributions or the nonelective contributions. The plan document will specify which contributions will be made, and this information must be provided to employees before the beginning of each year.

Roth Contributions

401(k) plans may permit employees to make after-tax contributions through salary deduction. These designated Roth contributions, as well as gains and losses, are accounted for separately from pretax contributions. However, designated Roth contributions are treated the same as pretax contributions for most aspects of plan operations, such as contribution limits.

A 401(k) plan may allow participants to transfer certain amounts in the plan to their designated Roth account in the plan.

Contribution Limits

Employer and employee contributions and forfeitures (nonvested employer contributions of terminated participants) are subject to a per-employee overall annual limit. This limit is the lesser of:

• 100 percent of the employee's compensation, or
• $72,000 for 2026.

In addition, the amount employees can contribute under any 401(k) plan is limited to $24,500 for 2026. This includes both pre-tax employee salary deferrals and after-tax designated Roth contributions (if permitted under the plan).

All 401(k) plans may allow catch-up contributions of $8,000 for 2026 for employees 50 to 59. Employees age 60 to 63 are allowed higher catchup limits of $11,250 in 2026.

Vesting

Employee salary deferrals are immediately 100 percent vested – that is, the money that an employee has contributed to the plan cannot be forfeited. When an employee leaves employment, they are entitled to that money, plus any investment gains (or minus losses).

In safe harbor 401(k) plans, all required employer contributions are always 100 percent vested. In traditional 401(k) plans, you can design your plan so that employer contributions vest over time, according to a vesting schedule.

Nondiscrimination

To preserve the tax benefits of a 401(k) plan, the plan must provide substantive benefits for rank-and-file employees, not just business owners and managers. These requirements are called nondiscrimination rules and compare both plan participation and contributions of rank-and-file employees to owners/managers.

Traditional 401(k) plans are subject to annual testing to ensure that the contributions made for rank-and-file employees are proportional to contributions made for owners and managers. In most cases, safe harbor 401(k) plans are not subject to annual nondiscrimination testing.

Investing the Contributions

After you decide on the type of 401(k) plan, you can consider the variety of investment options. In designing a plan, you will need to decide whether you will permit your employees to direct the investment of their accounts or if you will manage the monies on their behalf.

If you allow participants to direct their investments, you must decide what investment options to make available. Depending on the plan design you choose, you may want to hire someone either to determine the investment options or to manage the plan's investments. Continually monitoring the investment options ensures that your selections remain in the best interests of your plan and its participants.

Fiduciary Responsibilities

Many of the actions needed to operate a 401(k) plan involve fiduciary decisions. This is true whether you hire someone to manage the plan for you or do some or all of the plan management yourself. Controlling the assets of the plan or using discretion in administering and managing the plan makes you and the entity you hire a plan fiduciary. Providing investment advice for a fee also makes someone a fiduciary. Hiring someone to perform fiduciary functions is itself a fiduciary act. Fiduciary status is based on the functions performed for the plan, not a title.

Some decisions for a plan are business decisions, rather than fiduciary decisions. For instance, the decisions to establish a plan, to include certain features in a plan, to amend a plan, and to terminate a plan are business decisions. When making these decisions, you are acting on behalf of your business, not the plan, and therefore, you would not be a fiduciary. However, when you take steps to implement these decisions, you (or those you hire) are acting on behalf of the plan and, in carrying out these actions, may be a fiduciary.

Basic Responsibilities

Fiduciaries are in a position of trust with respect to the participants and beneficiaries in the plan. The fiduciary's responsibilities include:

• Acting solely in the interest of the participants and their beneficiaries;
• Acting for the exclusive purpose of providing benefits to workers participating in the plan and their beneficiaries;
• Paying only reasonable plan expenses;
• Carrying out duties with the care, skill, prudence, and diligence of a prudent person familiar with such matters;
• Following the plan documents; and
• Diversifying plan investments.

These are the responsibilities that fiduciaries need to keep in mind. The responsibility to be prudent covers a wide range of functions needed to operate a plan. Because all these functions must be carried out in the same way a prudent person would, you may want to consult experts in investments, accounting, and other fields, as appropriate.

In addition, for some functions, there are specific rules that help guide the fiduciary. For example, the deductions from employees' paychecks for contribution to the plan must be deposited with the plan as soon as reasonably possible, but no later than the 15th business day of the month following the payday. If you can reasonably make the deposits in a shorter time frame, you must do so.

For plans with fewer than 100 participants, salary reduction contributions deposited with the plan no later than the 7th business day following withholding by the employer will be considered contributed in compliance with the law.

For all contributions — employee and employer (if any) — the plan must designate a fiduciary, typically the trustee, to make sure that contributions due to the plan are transmitted. If the plan and other documents are not clear on this, the trustee generally has this responsibility. In addition, you (or those you hire) will need to update the plan document for changes in the law.

Limiting Liability

With these responsibilities, there is also some potential liability. However, you can take actions to limit your liability and demonstrate that you carried out your responsibilities properly.

The fiduciary responsibilities cover the process used to carry out the plan functions rather than simply the results. For example, if you or someone you hire makes the investment decisions for the plan, an investment does not have to be a “winner” if it was part of a prudent overall diversified investment portfolio for the plan. Because a fiduciary needs to carry out activities through a prudent process, you should document the decision-making process to demonstrate the rationale at the time a decision was made.

In addition to the steps above, there are other ways to limit potential liability. The plan can be set up to give participants control of investments in their accounts. For participants to have control, they must have sufficient information on the specifics of their investment options. If properly executed, this type of plan limits your liability for participants' investment decisions. You can also hire a service provider or providers to handle some or most of the fiduciary functions, setting up the agreement so that the person or entity then assumes liability.

Hiring a Service Provider

Even if you do hire a financial institution or retirement plan professional to manage the plan, you retain some fiduciary responsibility for the decision to select and keep that person or entity as the plan's service provider. So, you should document your selection process and monitor the services provided to determine if you need to make a change.

For a service contract or arrangement to be reasonable, service providers must give you certain information about the services they will provide to your plan and all of the compensation they will receive. This information will assist you in understanding the services, assessing the reasonableness of the compensation (direct and indirect), and determining any conflicts of interest that may impact the service provider's performance.

Some additional items to consider in selecting a plan service provider:

• Information about the firm itself: affiliations, financial condition, experience with 401(k) plans, and assets under its control
• A description of business practices: how plan assets will be invested if the firm will manage plan investments or how participant investment directions will be handled
• Information about the quality of prospective providers: the identity, experience, and qualifications of the professionals who will be handling the plan's account; any recent litigation or enforcement action that has been taken against the firm; the firm's experience or performance record; if the firm plans to work with any of its affiliates in handling the plan's account; and whether the firm has fiduciary liability insurance

If your service provider is responsible for maintaining plan records and keeping participant data confidential and plan accounts secure, use a service provider who follows strong cybersecurity practices. To prudently select and monitor such a service provider, ask for:

• Information about a firm's business practices: its information security standards, practices, policies, and annual audit results available to plan clients; how it validates its practices; and whether it has insurance policies that cover losses caused by cybersecurity and identity theft breaches (whether caused by internal or external threats)
• Information about the quality of the firm's services: its track record in the industry, including security incidents, other litigation, and legal proceedings related to its services; and for prior security breaches, what happened and how it responded

For more tips for hiring a service provider with strong cybersecurity practices, including terms and provisions recommended for inclusion in service provider contracts, visit DOL's cybersecurity website.

For information on cybersecurity best practices that service providers should follow, see DOL's website.

Once hired, you should continue to monitor your service provider.

• Evaluate any notices the service provider furnishes about possible changes to their compensation and the other information they provided when hired (or when the contract or arrangement was renewed);
• Review the service provider's performance;
• Read any reports they provide;
• Check actual fees charged;
• Ask about policies and practices (such as trading, investment turnover, and proxy voting); and
• Follow up on participant complaints.

For more information, see Understanding Retirement Plan Fees and Expenses.

Providing Information in Participant-Directed Plans

When plans allow participants to direct their investments, fiduciaries need to take steps regularly to make participants aware of their related rights and responsibilities. This includes providing plan- and investment-related information, including information about fees and expenses that participants need to make informed decisions about the management of their individual accounts.

You (or those you hire) must provide that information to participants before they can first direct their investment in the plan and annually thereafter. The investment-related information needs to be presented in a format, such as a chart, that allows for comparison of the plan's investment options. A model chart is available.

If you use information provided by a service provider that you rely on reasonably and in good faith, you will be protected from liability for the completeness and accuracy of the information.

Prohibited Transactions and Exemptions

Some transactions are prohibited under the law to prevent dealings with parties that have certain connections to the plan, self-dealing, or conflicts of interest that could harm the plan. However, there are several exceptions under the law, and additional exemptions may be granted by the U.S. Department of Labor if protections for the plan are in place in conducting the transactions.

One exemption allows fiduciary investment advisers to provide investment advice to participants who direct the investments in their accounts. The exemption applies to buying, selling, or holding an investment related to the advice, as well as to receiving related fees and other compensation by a fiduciary adviser. Please see DOL's website for more information.

Another exemption in the law permits you to offer loans to participants through your plan. If you do, the loan program must be carried out in a way that protects the plan and all other participants. Each loan request decision is treated as a plan investment and considered accordingly.

Bonding

Anyone handling plan funds or other plan property generally must be covered by a fidelity bond to protect the plan against loss resulting from fraud and dishonesty by those covered by the bond.

Disclosing Plan Information to Participants

Plan disclosure documents keep participants informed about how the plan operates, alert them to changes in the plan's structure and operations, and give them a chance to make decisions and take timely action on their accounts.

The summary plan description (SPD) is a plain-language explanation of the plan and must be comprehensive enough to inform participants of their rights and responsibilities. It also informs participants about the plan features and what to expect of the plan.

Among other things, the SPD must include information about:

• When and how employees become eligible to participate in the 401(k) plan,
• The contributions to the plan,
• How long it takes to become vested,
• When employees are eligible to receive their benefits,
• How to file a claim for those benefits, and
• Participants' basic rights and responsibilities under the Employee Retirement Income Security Act (ERISA).

The SPD should include an explanation about the administrative expenses that will be paid by the plan. The plan administrator must give this document to participants when they join the plan and to beneficiaries when they first receive benefits. SPDs must also be redistributed periodically during the life of the plan.

A summary of material modifications (SMM) informs participants of changes made to the plan or to the information in the SPD. When such changes occur, all participants must automatically receive either an SMM or an updated SPD within a specified number of days after the change.

An individual benefit statement shows:

• The total plan benefits earned by a participant,
• Vested benefits,
• The value of each investment in the account,
• Information describing the ability to direct investments, and
• For plans with participant direction, an explanation of the importance of a diversified portfolio.

Plans that provide for participant-directed accounts must furnish quarterly individual benefit statements. Plans that do not provide for participant direction must furnish statements annually.

As noted above, plans that allow participants to direct the investments in their accounts must provide participants with plan and investment information, including information about fees and expenses, before they can first direct investments and annually thereafter. At least quarterly, they also must provide participants with information on the fees and expenses actually paid. The initial plan-related information may be distributed as part of the SPD provided when a participant joins the plan as long as it is provided before the participant can first direct investments. The information provided quarterly may be included with the individual benefit statement.

A summary annual report is a narrative of the plan's annual return/report, the Form 5500, filed with the Federal Government (see Reporting to Government Agencies for more information). The plan administrator must furnish it to participants annually.

A blackout period notice gives employees advance notice when a blackout period occurs, typically when plans change recordkeepers or investment options, or when plans add participants because of corporate mergers or acquisitions. During a blackout period, participants' rights to direct investments, take loans, or obtain distributions are suspended.

You can furnish these disclosures in paper or electronically. To provide them electronically, you may either post them on a plan website or email them to plan participants, after notifying participants that disclosures will be furnished electronically. There are a number of protections for participants receiving electronic disclosures, including the right to request paper copies of disclosures or to opt out of electronic delivery. You also need to take reasonable steps to protect the confidentiality of participants' personal information online. For more information, see DOL's website.

Reporting to Government Agencies

In addition to the disclosure documents that provide information to participants, plans must also report certain information to Government entities.

Form 5500 Annual Return/Report of Employee Benefit Plans

Plans must file an annual return/report with the Federal Government, in which information about the plan and its operation is disclosed to the IRS and the U.S. Department of Labor.

Depending on the number and type of participants covered, most 401(k) plans must file one of the following forms:

• Form 5500, Annual Return/Report of Employee Benefit Plan
• Form 5500-SF, Short Form Annual Return/Report of Small Employee Benefit Plan
• Form 5500-EZ, Annual Return of One-Participant (Owners and Their Spouses) Retirement Plan

Plans file the Form 5500 or Form 5500-SF electronically through a web-based system called EFAST2. These returns/reports are made available to the public. One-participant plans or foreign plans may file Form 5500-EZ electronically on EFAST2 or on paper with the IRS. Form 5500-EZ returns are not made available to the public.

One-participant plans (which cover only sole proprietors – whether incorporated or not — partners, and spouses) with total assets of $250,000 or less at the end of the plan year are exempt from the annual filing requirement. However, you must file a final return/report if you terminate the plan, regardless of the value of the plan's assets.

Form 1099-R

Form 1099-R, Distributions From Pensions, Annuities, Retirement or Profit-Sharing Plans, IRAs, Insurance Contracts, etc. is generally used to report distributions (including rollovers) from a retirement plan. It is given to both the IRS and recipients of distributions from the plan during the year.

Form 8955-SSA

Form 8955-SSA, Annual Registration Statement Identifying Separated Participants with Deferred Vested Benefits, is used to report separated participants with deferred vested benefits under the plan. It is filed with the IRS. The information is generally given to the Social Security Administration and to each deferred vested participant in an individual statement by the plan administrator.

This guide concerns U.S. workplace benefits and the federal rules described by the Department of Labor. The type of plan, its governing documents, and the facts of a claim matter. Government, church, and other excluded plans may follow different rules.

Source and scope

401(k) Plans For Small Businesses — U.S. Department of Labor. Accessed October 28, 2026. This public domain federal guidance is an educational reference; use the source publication and the applicable plan or employment documents for the full context and later updates. Fynoptic is independent and is not endorsed by the Department of Labor.