Missouri bans advisors from using credential sharing to manage 401(k)s

Missouri has turned its warnings on credential sharing into a formal rule, barring advisors from using third-party technology to manage clients’ held-away 401(k) assets. The rule amends the state’s regulation on dishonest or unethical business practices.

Missouri appears to be the first state to write the prohibition into regulation. The Missouri Securities Division adopted the change unaltered from its July 2026 proposal, despite objections from St. Louis-based brokerage Stifel, the 401(k) fintech Pontera and several banking groups, according to an order published Oct. 15 by the Missouri Register. 

“The division believes that a system that allows an IA or an IAR to have access to a Missouri investor’s held-away accounts without the approval of the account custodian presents several regulatory issues related to account security, potential violations of user agreements between customers and providers, custody of funds, and recordkeeping,” the division wrote in its published order.

Credential sharing is when a client hands their 401(k) username and password to a third-party software such as Pontera, which then logs into the recordkeeper’s website as the client so the advisor can view, trade or rebalance the account without the recordkeeper’s direct involvement.

Stifel and Pontera object

Geoffrey Valentino, commenting on behalf of Stifel, Nicholas & Company, said the amendment creates uncertainty about client-authorized methods of accessing accounts. He urged the division to “balance investor choice, access to investment advice, and strong cybersecurity safeguards.”

Kajal Patel, commenting on behalf of Pontera, described the firm as a provider that lets advisors “review client information and communicate their rebalancing recommendations to recordkeepers.” Pontera argued the rule could eliminate a secure method of managing accounts. It sought an exemption for cases where clients authorize access, credentials are encrypted, and advisors do not use or retain client identifying information.

The division said it “shares the goal of facilitating good relationships between Missouri investors and their IAs or IARs” – referring to investment advisers and investment adviser representatives – but made no changes.

Custodians moved first

The rule lands after the largest recordkeepers had already clamped down. Fidelity began blocking credential-sharing systems in 2024. Schwab asked clients to reset their login credentials in November 2025, amid Pontera’s public dispute with Fidelity over access.

Alex Barned is executive director at Absolute Capital, an SEC-registered RIA whose held-away platform competes with Pontera. He told InvestmentNews at Schwab IMPACT in Boston that Missouri went further than its peers. States such as Ohio and Nebraska have previously issued alerts and guidance on advisors’ use of third-party platforms that rely on clients’ login credentials.

“Missouri is the first one to come out with that concrete type of structure and just say no,” Barned said. He noted that federal regulators have not yet taken a position. “SEC has yet to opine still on this. So we’ll see what happens there,” he said.

Barned said Missouri’s decision rests on three concerns.

“One, what is the liability to the client in terms of cyber risk for things? Number two was accounts beyond the account being managed could be viewed. So if they’re at a particular custodian, there might be a 401(k), and there might be other accounts taking place. And then the third part is the record keeper not being aware as to what’s taking place,” Barned said.

He said Missouri’s rule still leaves advisors a path forward to get permission to access 401(k) assets.

“Missouri gave the clause, if the advisor and the record keeper and the client are all aware and all say this is fine, go for it,” Barned said.

Barned argued advisors have misjudged the intentions of Fidelity and Schwab.

“A lot of advisors seem to think whether it’s Fidelity or Schwab, ‘Oh, the record keeper is against this.’ They’re not. They’re actually really trying to proliferate it,” he said. Instead, the friction often comes from plan sponsors whose plan documents bar outside advisor.

“So Fidelity has got to go ahead and manage the fact that they’ve got a document out there that says, ‘Hey, no advisor should be involved,’ but now there are,” Barned said.

‘Through the front door’

Absolute Capital instead connects directly with recordkeepers without using client credentials, and follows each plan’s rules, including fee caps.

“Because we go through the front door, the fidelities of the world know we’re there. We’re following the plan rules,” Barned said.

He described credential sharing as backdoor access that shifts risk onto advisors.

“What the credential sharing services are trying to do, they’re not going to get registered. They’re not going to be regulated. They’re going to put the fiduciary liability on the advisor, and they’re going to say, ‘You go do it,’” Barned said.

The bigger obstacle, he said, is federal law, specifically the Employee Retirement Income Security Act of 1974 (ERISA).

“There’s rules in place that are going to need to get changed, and the big one of those rules is frankly ERISA. It just says the sponsor, the Verizons and AT&Ts and Marriotts of the world, they’re still the ones that make the rules to that pot of money,” he said