Pontera's anti-Fidelity manifesto misses key 401(k) risks, argues Absolute Capital CEO

In the wake of the acrimonious 401(k) custody battle that exploded between Pontera and Fidelity earlier this month, a veteran of the fintech and RIA space is offering a third perspective – suggesting that the debate around credential sharing goes beyond just advisors, custodians, and retirement plan investors.

Brenden Gebben, CEO of Absolute Capital, has spent more than two decades working with advisors and custodians across the country. Unlike other fintech providers, Absolute Capital holds out its ability to leverage its expertise as an RIA. Through its Workplace Investment Navigator platform – which features more than 350 portfolio managers and models – it offers investment advisors to compliantly manage held-away client assets without the security issues of client credential utilization.

Along with Pontera, Future Capital, and Plan Confidence, Gebben's firm is one of only four providers listed on Michael Kitces' Fintech directory under the Held-Away Assets category.

In a recent conversation with InvestmentNews, he noted that advocates of “freedom” – the ability for clients to choose how and with whom their retirement assets are managed – and those emphasizing “protection” actually share some common ground.

"I think everyone agrees in the marketplace that, yes, it would be great to help clients with what could be their most important asset – their 401(k)," Gebben said. 

Advisors welcome 'through the front door'

According to Gebben, many clients rely on their workplace retirement plans as their single most valuable asset. At the same time, he's found that retirement plan participants take on inappropriate levels of investing risk when left without an advisor.   

“A lot of times you get that first look before you’re helping the client. Greater than 50% of the time, it’s what I call mis-risk aligned,” he said, explaining that clients are often taking on either too much or too little risk as they approach retirement.

In a widely read open letter against Fidelity, Pontera argued that the retirement plan giant was restricting its customers' ability to work with outside advisors by blocking online access to their 401(k) accounts. It painted the move as "an anticompetitive power grab" forcing Fidelity plan participants to work only with in-house advisors as it seeks to protect its economic interests.

Read more: Fidelity to limit 401(k) access by third parties

Gebben pushed back on the idea, pointing to his own experience partnering with Fidelity and other custodians.

"We found that not to be true at all,” he said. “If it’s the right plan and you have the right registrations and things built out, they will welcome you through the front door."

Credentials, compliance, and audit trails

The crux of the debate between Pontera and Fidelity revolves around the practice of credential sharing. Pontera argues that clients should be allowed to share their login credentials freely with a third party, without restriction, as they look to let external advisors manage their retirement plans.

While logging into a financial institution's portals using client credentials can result in increased cybersecurity liability for advisors, Pontera claims to offset that risk by offering advisors the ability to rebalance within held-away accounts without letting them know the clients' account credentials.

"Just as several budgeting and other financial apps already do for consumers, Pontera has built secure technology to aggregate, display, and manage financial account information with retirement savers’ explicit approval," the Compliance section of Pontera's website reads, highlighting its security practices, SOC 2 Compliance Certification, and its own commitment to client protection.

But according to Gebben, fintechs largely rely on client credentials to aggregate account data, describing a "one-way push" system that allows advisors to view, but not touch client accounts. The math of liability changes when advisors start taking actions on behalf of clients.

"It’s not only [that] the data is coming out. You’re turning around doing something with the data, logging in as the client, and there’s no audit trail,” Gebben said, arguing that such access can amount to "impersonation" as there's no clear record of who's making decisions on the account.

On that point, Pontera says it's able to keep an audit trail of advisors' rebalancing activity and the reasons for each change made through the platform. Advisors are also given a means to separate their own actions from those taken directly by the client, which would prevent doubts over which party made a particular rebalancing action within the retirement account. 

Spare a thought for the plan sponsors

Adding to the complexity, Gebben says each retirement plan has a governing document that dictates whether third-party advisors can access accounts. That means even with agreements in place between a fintech provider and a 401(k) custodian, there still needs to be buy-in from the plan sponsor for a third-party advisory arrangement to be above board.

As it stands, Gebben estimates Absolute Capital would be able to provide third-party advisor access for one-half of plan participants across the country, though that number is growing as more plan sponsors update their policies.

From a regulatory perspective, the ethical and compliance lines for RIAs also vary by state, based on notices from Washington, Ohio, and New Jersey over the past year.

Ohio clarified that accessing a client's account using their own identifying verification is "a breach of the investment adviser’s fiduciary duty." Washington stopped short of that, saying third-party platform use is "is likely a dishonest or unethical business practice," while New Jersey said it "may be a breach of fiduciary duty" within the state.

"As your firm grows, there's more you need to do to scale and stay compliant. Your complexities grow, and as those complexities grow, your liability could grow," Gebben said. "A lot of times, advisors are just busy with their day-to-day, so this is probably not going to be high on their compliance radar ... But they naturally want to do the right thing by the client."