A 401(k) is managed by five distinct parties working under federal law: the employer that sponsors the plan, a plan administrator who runs it day to day, a trustee who holds the money, a recordkeeper (often paired with a third-party administrator) that tracks every transaction, and investment professionals who build and monitor the fund menu. The Employee Retirement Income Security Act (ERISA) assigns duties to each role and holds anyone with real control over plan money or plan decisions to a fiduciary standard.
The Employer as Plan Sponsor
The company that offers the 401(k) is the plan sponsor. The sponsor writes the rules: who is eligible, what the match formula looks like, and how vesting works. Those rules live in a written plan document that functions as the plan’s legal rulebook.1Internal Revenue Service. Plan Disclosure Documents – Understanding Your Employer’s Retirement Plan
The sponsor can amend the plan or terminate it, but while it exists the plan must be operated exactly as the document says. Drifting from the written terms, or letting the document fall out of date, can cost the plan its tax-advantaged status; if the IRS disqualifies a plan, vested balances can become immediately taxable. Sponsors who catch mistakes can usually fix them through the IRS Voluntary Correction Program, with user fees generally between $1,500 and $3,500 depending on plan assets.2Internal Revenue Service. Voluntary Correction Program (VCP) – General Description
The sponsor also owes every participant a Summary Plan Description explaining, in plain language, how the plan works and how to file a claim. New participants must receive it within 90 days of coverage, and updates must go out on set timeframes whenever the plan is amended.3U.S. Department of Labor. Reporting and Disclosure Guide for Employee Benefit Plans
The Plan Administrator
The plan administrator handles operations. In smaller companies the employer fills the role directly; larger plans hand it to an internal committee or an outside firm. The administrator reads the plan document to decide day-to-day questions: whether an employee has met the service requirements to join, what percentage a departing worker is vested in, and whether a request for a loan or hardship withdrawal qualifies.
The administrator is also the plan’s communications hub. Federal law requires annual funding notices, benefit statements, and tax disclosures to go out on schedule, and failing to deliver them can result in daily per-participant penalties under ERISA.4U.S. Department of Labor. Technical Release No. 1991-1 Delivery can be electronic (email, text, or a plan website) as long as participants keep the right to request paper copies and to opt out.3U.S. Department of Labor. Reporting and Disclosure Guide for Employee Benefit Plans
One sensitive duty falls squarely on the administrator: qualified domestic relations orders. When a divorce decree divides a retirement account, the administrator reviews the court order, decides whether it meets federal requirements, and processes the split to the former spouse or other payee.5U.S. Department of Labor. QDROs Chapter 1 – Qualified Domestic Relations Orders: An Overview
The Trustee
All 401(k) assets are held in a trust, separate from the employer’s operating accounts and out of reach of the company’s creditors. The trustee holds legal title to those assets and is responsible for safeguarding them for participants.
The trustee is a fiduciary, and so is anyone else who exercises discretionary control over plan management, plan assets, or plan administration.6U.S. Department of Labor. Fiduciary Responsibilities ERISA holds fiduciaries to the care, skill, and diligence a knowledgeable person would use in a similar situation, often described as the highest standard of care in law. Fiduciaries must act solely in the interest of participants; they cannot put the employer’s interests first, and they cannot deal with the plan on behalf of a party that has a business or personal connection to it (a “prohibited transaction”).
The consequences of a breach are personal. A fiduciary who causes losses through a breach must repay the plan out of their own pocket, disgorge any profits made by misusing plan assets, and can be removed from the role.7Office of the Law Revision Counsel. 29 U.S. Code 1109 – Liability for Breach of Fiduciary Duty Theft, embezzlement, or willful violations can bring criminal fines and up to five years in prison.8U.S. Department of Labor. Enforcement Manual – Criminal Investigations Program
Separately, ERISA requires every person who handles plan funds to be covered by a fidelity bond equal to at least 10 percent of the funds handled in the prior year, with a minimum of $1,000 and a cap of $500,000 per plan ($1,000,000 for plans holding employer stock). The bond protects the plan against theft or dishonesty; it does not cover honest mistakes.9U.S. Department of Labor. Protect Your Employee Benefit Plan With an ERISA Fidelity Bond
The Recordkeeper and Third-Party Administrator
The recordkeeper runs the infrastructure participants actually see. It operates the portal where you check your balance, change your contribution rate, update beneficiaries, and move money between funds. Behind each click it executes trades and credits the right dollars to the right account.
A third-party administrator (TPA) handles the compliance work that keeps the plan in good standing. Central to the job is annual nondiscrimination testing, which checks that contributions by rank-and-file employees are proportional to those made by owners and highly paid managers. When a plan fails, the TPA works with the sponsor to correct the imbalance, often by refunding excess contributions to higher earners.10Internal Revenue Service. 401(k) Plan Fix-It Guide – The Plan Failed the 401(k) ADP and ACP Nondiscrimination Tests
The TPA also prepares Form 5500, the annual report every 401(k) must file electronically with the Department of Labor.11U.S. Department of Labor. Form 5500 Series Plans with 100 or more participants at the start of the plan year generally file the full form and must engage an independent CPA to audit the plan’s financials; smaller plans file a simplified version.12U.S. Department of Labor. Instructions for Form 5500
Because the recordkeeper holds Social Security numbers, bank details, and account balances, the Department of Labor treats cybersecurity as a fiduciary issue. Sponsors and other fiduciaries are expected to vet a recordkeeper’s security program before signing a contract and monitor it afterward, including multi-factor authentication, encryption of data in storage and in transit, third-party security audits, and breach-response protocols.13U.S. Department of Labor. Cybersecurity Program Best Practices
Investment Managers and Advisors
Professional investment managers build the fund menu inside the plan: equity funds, bond funds, target-date funds, and other asset classes chosen to give participants a workable set of choices at different risk levels. They run performance reviews and use benchmarks to decide when a fund should be replaced for underperformance or excessive cost.
Menu selection is not a one-and-done decision. In Tibble v. Edison International, the U.S. Supreme Court held that fiduciaries have a continuing duty, separate from the initial pick, to monitor each fund and remove imprudent options over time.14Justia U.S. Supreme Court Center. Tibble v. Edison Int’l, 575 U.S. 523 (2015) Advisors typically support that duty with benchmarking reports comparing plan fees to industry averages, an increasingly important safeguard given that excessive-fee lawsuits have produced settlements in the tens of millions of dollars.
Who Pays the Fees
Someone always pays for the work these parties do, and ERISA draws a clear line between two kinds of expenses:
- Settlor expenses—costs of designing, creating, or terminating the plan—must be paid by the employer out of its own funds. Plan design studies and consulting on whether to keep the plan are typical examples.
- Administrative expenses—costs of running the plan after it exists—can generally be paid from plan assets if they are reasonable. Recordkeeping, nondiscrimination testing, benefit calculations, participant communications, and compliance amendments fall here.
When one invoice covers both kinds of work, the fiduciary has to get an itemized breakdown before paying any portion from plan assets.15U.S. Department of Labor. Guidance on Settlor v. Plan Expenses
Federal rules also require that participants in plans where they direct their own investments get a detailed fee disclosure at least once a year. For every fund, the plan must show the expense ratio and the dollar cost per $1,000 invested. Account-level charges such as loan fees, brokerage commissions, and transfer fees have to be listed separately, and the disclosure must remind participants that fees can substantially reduce long-term account growth.16eCFR. 29 CFR 2550.404a-5 – Fiduciary Requirements for Disclosure in Participant-Directed Individual Account Plans
What to Do if Something Looks Wrong
Start by asking for documents. You have the right to request the Summary Plan Description, the latest Form 5500, and the trust agreement from the plan administrator, and courts can penalize an administrator who fails to produce requested documents within 30 days.
If a problem persists, you can file a complaint with the Department of Labor’s Employee Benefits Security Administration (EBSA) online, through a regional office, or by phone at 1-866-444-3272. Filing costs nothing. EBSA reviews every complaint and, if it finds a violation, will try to resolve it—sometimes informally with the plan, sometimes through a formal investigation.
You can also sue under ERISA. If a fiduciary’s breach caused losses, a participant can bring a civil action to recover those losses for the plan and force the fiduciary to return any profits made from misusing plan assets.7Office of the Law Revision Counsel. 29 U.S. Code 1109 – Liability for Breach of Fiduciary Duty Equitable remedies—such as an injunction stopping a prohibited transaction—are available for other ERISA violations. Knowing which party handles which piece of your plan is what makes any of this actionable: it tells you whose conduct to question and who has to answer for it.