How an anti-terrorism law is hurting auto IRAs

Despite all the potential for state-sponsored auto IRA programs to get more people saving for retirement, there is an unusual hurdle they face: decades-old, anti-terrorism legislation.

On its face, the Customer Identification Program, part of the 2001 USA Patriot Act, seems straightforward – it’s designed to prevent money laundering that could finance terrorism. But its consequences for the relatively new state auto IRA programs have been severe, with as much as 46 percent of people being excluded from automatic enrollment in the IRAs because they fail the CIP check, according to a recent report by the Bipartisan Policy Center.

That can happen simply because a person’s address cannot be verified. Regulators addressed that issue when it comes to 401(k)s and other defined-contribution plans, exempting those from the CIP, the report noted.

“The first state auto IRA program launched in 2017, well after the CIP rules were finalized. As a result, the programs are subject to the rules even though their design does not lend itself to illicit activity,” the report read.

“Program data shows that 29 percent to 46 percent of potential state program participants fail the CIP check and are not automatically enrolled. More than 2 million people have failed a CIP check in the seven state programs launched prior to 2024.”

To date, there are $1.8 billion invested in state-facilitated retirement programs, including auto IRAs, across 941,000 accounts, data from the Georgetown Center for Retirement Initiatives show. Presumably, those figures could be significantly higher, if auto enrollment for some workers had not been held up by the Patriot Act provisions.

About a third of people fail CIP verification because of address issues, just one of four factors used by third parties in the process, the Bipartisan Policy Center said. The other necessary data are name, date of birth, and Social Security Number, or Individual Taxpayer Identification Number.”

One of the major state auto IRA program administrators, Vestwell, has seen failure rates in verifying participants on the scale cited by the Bipartisan Policy Center, CEO Aaron Schumm said.

“We have been enhancing our CIP processes to try and reduce the failure rate as much as possible,” Schumm said in an email.

“On the whole, we are obviously very supportive of any solutions that allow for more people to save for their retirement. All of the state programs that we power are focused on helping as many workers in their state open up retirement savings accounts,” he said. “But protecting savers is also paramount.”

The CIP verification issue needs to be fixed, said Andrea Feirstein, managing director of AKF Consulting, a firm that works with states in building and running their programs.

“My understanding is that the CIP rules have stopped enrollments in many instances. And when it fails, I believe the program administrator is precluded from going back to the employer,” due to privacy reasons, Feirstein said in an email. “The real question is whether CIP should even apply to a program that auto-enrolls individuals.”

The issue could be fixed by regulation or legislation that would simply exempt auto IRA programs from CIP verification, much as 401(k)s and other plans have, the Bipartisan Policy Center stated. Alternatively, legislators or regulators could move to reduce the number of verifying data necessary for the CIP process, the organization said.

“Requiring state programs to match only three pieces of information (name, date of birth, and SSN/ITIN) or match a phone number instead of an address, for example, could significantly reduce CIP failures.”