Advisory Council asks DOL to clarify ERISA’s recordkeeping rules 

September 10, 2024

The ERISA Advisory Council’s report on recordkeeping in the electronic age uncovers a lack of clarity about legal requirements for safeguarding retirement plan records. A series of eight council recommendations aim to enhance plan sponsors’ and fiduciaries’ understanding of applicable record-retention periods and improve oversight of vendors that create and maintain plan data. The report also provides insights about the challenges plan officials face when changing vendors or navigating corporate mergers and acquisitions. While the council doesn’t have authority to issue guidance, plan officials may benefit from the report’s thorough discussion of record-retention and vendor-oversight practices.

Two ERISA provisions establish general retention requirements for broad categories of plan records:

• Section 107 applies to any person required to file a report under Title I of ERISA or certify information in a report. These parties must maintain a copy of the report and sufficient information and data for the report to be “verified, explained, or clarified, and checked for accuracy and completeness" for at least six years from the filing date.
• Section 209 requires plan sponsors to maintain records "sufficient to determine the benefits due or which may become due” to employees, with potential civil penalties for violations. Unlike Section 107, this provision doesn’t specify a particular record-retention time frame. Although the statute expressly authorizes the Department of Labor (DOL) to prescribe regulations for these requirements, the agency hasn’t given guidance on what specific records sponsors must maintain or for how long.

In 2002 DOL issued regulations allowing parties subject to these provisions to retain records electronically in a recordkeeping system that meets certain standards, including “reasonable controls to ensure the integrity, accuracy, authenticity and reliability” of the data.

Most of the report’s recommendations aim to help sponsors and fiduciaries understand their recordkeeping obligations, including the appropriate retention periods for specific categories of plan records. Other recommendations seek to clarify vendors’ roles and responsibilities and improve plan officials’ vendor oversight practices.

The council believes plan officials should retain certain types of records for at least seven years after plan termination and payment of all accrued benefits. The report explains that this retention period would help support plan audits and inquiries, as well as position sponsors and fiduciaries to respond to benefit claims and lawsuits. Several of the council’s recommendations pursue more clarity on these requirements.

More detailed DOL guidance on record retention. Two recommendations seek DOL guidance confirming that this retention period would apply to an extensive list of documentation relating to participants’ eligibility and benefits, including payroll and employment records; documents such as birth, marriage and divorce certificates; election forms; benefit payment registers; and participant benefit statements. The council’s suggested retention period would also apply to plan information, like plan documents and summary plan descriptions, IRS determination and opinion letters, and records such as trust statements and minutes of investment or fiduciary committee meetings. The council also encourages DOL to consult with ERISA plan auditors to identify other documents that should be covered and determine whether a shorter retention period may be appropriate for certain categories of records.

Ability to outsource record maintenance. The council says this DOL guidance should confirm that plan officials may continue to contract with vendors (such as recordkeepers, payroll processors or human resource information systems companies) to maintain records, including after plan termination. For instance, the report suggests that the sponsor of a terminating defined benefit (DB) plan could contract with the annuity provider or another vendor to maintain plan records for the requisite retention period.

Encourage record-retention policies. The report recommends that DOL encourage sponsors and fiduciaries to adopt written record-retention policies. The council also suggested DOL consider developing a customizable model record-retention policy.

Educational outreach for small plans. To address concerns that sponsors and fiduciaries lack awareness of their record-retention obligations, the council asks DOL to consider an educational campaign. The council specifically notes that the campaign should include education about data requirements for terminating DB plans.

Although sponsors and fiduciaries have primary responsibility for compliance with ERISA’s record-retention requirements, most plan records are created and maintained electronically by third-party vendors. The council heard testimony indicating that sponsors and fiduciaries may not fully understand their own recordkeeping responsibilities versus those of their vendors and found a wide disparity in service providers’ contracts. Several of the report’s recommendations aim to clarify the roles and obligations of sponsors, fiduciaries and vendors.

Require provisions in vendor contracts. The council found that vendor agreements often fail to adequately address the vendor’s contractual responsibilities, particularly for cooperating with the transfer of records after plan-level transactions like recordkeeper transitions or DB plan pension risk transfers. The council recommends DOL mandate that vendor contracts include provisions that allow fiduciaries to periodically monitor the vendor, provide plan officials with access to participant data (for at least seven years after contract termination) and require the vendor on contract termination to transfer all records to the successor vendor in a reasonable period of time.

Educate sponsors about vendor controls. The council determined that a vendor’s lack of sufficient operating controls can jeopardize the “reliability, accuracy, completeness and authenticity” of electronic plan records. The council believes DOL should educate sponsors and fiduciaries about obtaining system and organizational controls (SOC) reports to assess a vendor’s controls during the initial vendor selection and ongoing monitoring process. DOL should also educate sponsors about the need to implement the complementary user entity controls (CUECs) required by the vendor.

Clarify vendor’s potential fiduciary status. Long-standing DOL guidance maintains that persons performing “ministerial functions” for a plan within a framework of policies, practices and procedures established by someone else aren’t ERISA fiduciaries. Noting some courts have applied this guidance to shield recordkeepers from fiduciary status — even when they may perform more than ministerial functions — the council recommends that DOL clarify that vendors may be fiduciaries, depending on the facts and circumstances.

• Recordkeeping in the electronic age (ERISA Advisory Council, March 4, 2024)