Cybersecurity poses a major risk to 401(k) plans, and there is chasm in guidance on how plan fiduciaries should address it, according to a report released Monday from the Government Accountability Office.
In the report made public by several members of Congress, the GAO analyzed feedback from dozens of retirement plan service providers and sponsors. It pointed to several instances of 401(k) accounts being fraudulently raided by thieves, events that have been well-publicized through the private litigation that followed.
But the GAO concluded that plan sponsors, record keepers and others have little to go on as far as guidance from the Department of Labor, and that it also isn’t clear whether fiduciaries have responsibility to minimize cybersecurity risks, according to the report.
“GAO is making two recommendations to DOL to formally state whether it is a fiduciary’s responsibility to mitigate cybersecurity risks in DC plans and to establish minimum expectations for addressing cybersecurity risks in DC plans,” the report stated. “DOL agreed with GAO’s second recommendation, but did not state whether it agreed or disagreed with the first one.”
The report illuminates the web of personal information shared among plan sponsors, record keepers, custodians, third-party administrators and payroll service providers. The information includes names, Social Security numbers, birthdates, addresses, usernames, passwords, asset data and account numbers. The storage and sharing of that data amounts to a mountain of risks.
Among the stakeholders the GAO interviewed, 21 of 22 said that assuring cybersecurity is in fact a fiduciary duty.
How fiduciaries should go about that is currently a bit of a mystery.
“DOL officials told GAO that the agency intends to issue guidance addressing cybersecurity-related issues, but they were unsure when it would be issued,” the report read. “Until DOL clarifies responsibilities for fiduciaries and provides minimum cybersecurity expectations, participants’ data and assets will remain at risk.”
In 2019, the year that Congress commissioned the GAO report, there were roughly half a million reports to the FBI of suspected cybercrimes, with associated losses of more than $3.5 billion, according to the report. With 106 million people participating in 401(k)s and assets of about $6.3 trillion in the system in 2018, that is a big target for cyberfraud, the GAO noted.
Sen. Patty Murray, D-Wash., said in a statement that she would be working with the Biden administration and Congress to further address cybersecurity for 401(k)s.
“It’s clear that in too many ways, the policies we have to protect families as they plan for the future are stuck in the past,” Murray said in the announcement. “This report confirms cybersecurity and retirement security go hand in hand, and it’s time we make sure we have policies that reflect that reality.”
Chicago-based Mesirow Fiduciary Solutions adds flexPATH's plan-level outsourced fiduciary book, boosting its retirement market reach to $164 billion.
Also, Raymond James's employee advisor channel adds breakaways from Wells Fargo and Stifel, while UBS welcomes an ex-Morgan Stanley duo in Indiana.
It promised guaranteed principal and 10% monthly returns. The SEC says it invested nothing.
Ten years after entering the fee-based annuity market, MassMutual Ascend says nearly half its lifetime sales came in the past two years alone – but barriers remain among fee-only advisors.
Amplify, WealthReach, Zeplyn and Zocks have unveiled partnerships aimed at automating portfolio management, content creation, account opening, and client communication.
Northern Trust’s Ken Lassner shows advisors how to convert volatility into after-tax portfolio gains
Dan Biagini of American Equity says the steady decline of pensions, longer lifespans and a reset in interest rates are rewriting how advisors build retirement income
