Chamber Comments on DOL's Retirement Savings Lost and Found

Lost and Found Comment Letter v 2

Download

Chantel Sheaks
Vice President, Retirement Policy, U.S. Chamber of Commerce

Published

June 20, 2024

June 18, 2024

Mr. James Butikofer
U.S. Department of Labor
Employee Benefits Security Administration
Office of Research and Analysis

Dear Mr. Butikofer:

On April 16, 2024, the Department of Labor (DOL) published an information collection request (ICR) in which it seeks to collect information on a voluntary basis to establish the Retirement Savings Lost and Found searchable database as provided for in Section 303 of the SECURE 2.0 Act (SECURE 2.0). The U.S. Chamber of Commerce (Chamber) is supportive of the concept of a system that allows participants to locate the plan administrator of a plan where an individual has a deferred vested benefit. However, we are concerned with DOL's overreach in requesting information that is beyond Section 303 and unnecessary to effectuate the system. We also are concerned with DOL's suggestion that it would investigate plan administrators who do not voluntarily provide the information in the ICR. We suggest DOL reevaluate what data it needs to effectuate the database and how it can work with other agencies and the private sector to lessen the burden on plan administrators in establishing the database.

Background

Section 303 of SECURE 2.0 added a new section 523 to ERISA, entitled the Retirement Savings Lost and Found.¹ Section 523(a) directs the Secretary of Labor to establish an online searchable database no later than December 29, 2024. The purpose of the database is:

To allow individuals to obtain the contact information of the administrator of a plan in which they may have participated;
To allow the Secretary of Labor to assist participants in locating an individual's plan; and
To allow the Secretary to make any necessary changes to the administrator's contact information because of certain events.²

Section 523(c) of ERISA provides that for plan years beginning after December 31, 2023, the administrator of a plan to which the vesting standards of ERSIA section 203 apply, "shall submit to the Secretary, at such time and in such form and manner as is prescribed in regulations" the following:

The information in subparagraphs (A) and (B) of Code section 6057(a)(2), which is:
The information required under paragraphs 1-4 of Code section 6057(b), which is:
The name and taxpayer identification of each participant or former participant in the plan:

There is nothing in the statue that directs or provides that DOL can obtain additional information for the database from plan administrators, including information for plan years before the 2024 plan year. As noted above, DOL's regulatory authority is to direct how and in what form the information is to be provided.

ICR

In the ICR Background section, DOL states that in its experience, there are many reasons plan administrators lose track of participants and beneficiaries. For example, DOL notes that plans may not be able to communicate with individuals who have separated from service because of inadequate recordkeeping practices, ineffective processes for communicating with separated participants and beneficiaries, and faulty processes for searching for participants and beneficiaries for whom they have incorrect or incomplete information. DOL fails to note many plan sponsors actively seek out participants for payment, however, many participants and beneficiaries do not update their contact information after they leave and there are many individuals who will not respond to plan communications, even where the contact information is correct. This is especially true for very small accounts.

In the ICR, DOL notes that the Internal Revenue Service (IRS) has much of the information needed for the database from the Forms 8955 (Forms SSA), but the IRS will not provide this information based on concerns with Code Section 6103.⁴ As such, DOL is requesting voluntary participation through the ICR for not only the information listed in the statute, but also significant other information not listed in ERISA Section 523, such as the date of birth, mailing addresses, email addresses, telephone numbers, the amount of each and nature of the benefit of separated vested participants and beneficiaries and the identification of a separated, vested participants of normal retirement age or older who have been unresponsive to plan communications or whose contact information the plan has reason to believe is no longer accurate. A full list of the additional information DOL is requesting is listed in Appendix A. None of the additional information is needed for the database, and, arguably, even some of the data listed in the statute is unnecessary, such as the account number of an IRA for mandatory cashouts.

Section 303 of SECURE 2.0 did not amend ERISA to provide a penalty for not providing the information in Section 523. In the ICR, DOL insinuates that if plans do not voluntarily provide this information, they have the authority to obtain this information through an audit. Specifically, DOL "notes that, in addition to the specific grant of authority in section 523(e) of ERISA ... the Department has general authority to investigate and collect information under other sections of ERISA, including sections 504 and 505 of ERISA, as well as to verify participants' and beneficiaries' identities under the Retirement Savings Lost and Found online searchable database."

DOL states that the information may be provided as an attachment to the 2023 Form 5500 and filed through eFAST, but it would not be considered part of the Form 5500 filing. The 2023 Form 5500 for calendar year plans is due by July 31, 2024 (or October 15, with an extension). The ICR did not provide a sample of how this information would be provided with the Form 5500, what the format would be, or what security precautions would be taken. However, DOL stated that in the future it would provide the spreadsheet file template (CSV format), and it will make available a model format plan administrators could use to submit the information.

Although the statute clearly states that administrators are only required to provide the statutory information for plan years beginning after December 31, 2023, DOL requested the statutory and other information retroactive to the date the plan became subject to ERISA, which for many plans would be 1975.

Discussion

The purpose of the Lost and Found database is to allow individuals to obtain the contact information of the administrator of a plan in which they have a deferred vested benefit, to allow the Secretary to assist in this, and to allow the Secretary to make changes to the administrators' contact information. There is relatively little information DOL needs to build a database that fulfills this purpose. Specifically, the only information needed is the participant's name, the plan name and the plan's contact information, and any updates to the latter two. Any additional information for verification could be obtained when the participant contacts the plan. It is unclear why DOL believes it needs the additional information listed in Appendix A or the authority under which they believe they should obtain it for the database. As such, any voluntary data disclosure should be limited what is listed in the statute (however, see our comments below with respect to IRA account numbers.)

Section 523 specifically provides that the administrator should provide the listed information to DOL for plan years beginning after December 31, 2023, and only prospective information. However, in the ICR, DOL states that the plan administrator should provide information dating back to the date ERISA first applies to the plan. For many legacy plans, this would result in the administrator providing data from the past 49 years ago. This seems an impossible task given that ERISA Section 107 requires retention of records for 6 years from the date of filing, including the Forms 8955. Given that section 523 specifically states that the information is only for plan years after December 31, 2023, any future request for information should be limited plan years after December 31, 2023 and after.⁵

In the ICR, DOL claims that the proposed ICR does not impose any new record keeping requirements, and it expects plans that follow best practices will already have much of this additional information on file. Unfortunately, this statement does not recognize that although plans' record keepers may have some of this information, it is not in a format that easily can be transmitted to DOL. This means that the record keepers will need to compile the information in the format DOL requires. This is not automatic, and systems will need to be created to do this. This will cost recordkeepers money, which will be passed onto plans, which can then be passed onto participants.⁶ Obviously the more information DOL requests, the more expensive it will be to provide that information and the more in administrative expenses will be charged to each participant's account.⁷

With respect to participants who were cashed out and whose vested benefits were rolled over into IRAs, the statute provides that the administrator provide the name and taxpayer identification number (TIN) of such individual and the name and address of the designated trustee and the account number of the IRA. During the legislative process, the Chamber was concerned with the privacy and security risks of providing the IRA account numbers (especially when the TIN and name is provided). We remain concerned with this, and request that any data collection with respect to such individuals be limited to the participant's name and the designated IRA trustee.⁸

Much of the information that is both in the statute and in the ICR is considered personally identifiable information, which is any data that can be used to identify, locate, or contact a person. We are concerned with respect to the additional information DOL is requesting, including date of birth, mailing address, email address, and telephone number of each participant and designated beneficiary. Some have expressed concern that releasing this information without the participant's consent may implicate state privacy laws or could subject the plan sponsor or record keeper to a breach of fiduciary duty claim. In any subsequent request, DOL should explain the interaction between state privacy laws and an administrator or its delegate divulging this information without a participant's consent. In addition, DOL should discuss the fiduciary implications of divulging PII without a participant's consent and provide a safe harbor for doing so, especially if the information is compromised or incomplete.

In the ICR, DOL indicates that even though this is voluntary, if a plan does not provide the information, DOL "has general authority to investigate and collect information under other sections of ERISA, including sections 504 and 505⁹ of ERISA, as well as to verify participants' and beneficiaries' identities under the Retirement Savings Lost and Found online searchable database." There is nothing in Section 523 that would require DOL to verify participants' and beneficiaries' identities. The database merely is a tool for participants to search to see if they may be eligible for a deferred vested benefit and then subsequently contact the administrator for further details.

ERISA Section 504 gives the Secretary of Labor the authority to make an investigation to determine whether any person has violated or is about to violate any provision of ERISA or any regulation and in connection with the investigation require the "submission of reports, books, and records, and the filing of data in support of any information required to be filed with the Secretary." Nothing in SECURE 2.0 added a penalty or other enforcement against plan administrators for not providing information to DOL for the database, and the ICR is voluntary. As such, it is unclear how DOL would have authority to investigate whether an administrator is violating a voluntary provision.

We believe that there could be more effective ways of building the Lost and Found database rather than requiring administrators to provide significant amounts of data that are not needed for the database's purpose and most of which are not in the administrator's control. First, we believe the IRS and DOL could work together to obtain the information (or most of it). For example, the IRS could provide the Form 8955 without an individual's TIN. In the instructions to Form 8955, the IRS explicitly states that "This information may also be disclosed ... to the Department of Labor or the Pension Benefit Guarantee Corporation for use in administering ERISA...."¹⁰ Building and populating the Lost and Found database certainly would be part of administering ERISA.

Alternatively, plan administrators may be able to file the Form 8955 with DOL on a going forward basis. We also believe that there could be other private sector solutions. As noted above, most of this data is not in the administrator's immediate control. Instead, it is housed with the recordkeeper. We suggest that DOL partner with recordkeepers and other third-party administrators to determine whether there is a private sector solution that will meet the purpose of the Lost and Found by allowing participants to search online for deferred vested benefits.

Conclusion

We appreciate the need to create an online database where individuals could determine whether they may have deferred vested benefit. However, we are concerned the ICR is overly broad in the data it is requesting and could cost administrators significant time and money to produce all of the data, most of which is not necessary for the Lost and Found database. We suggest that DOL reevaluate what actually is needed for the database, and work with other agencies and the private sector to determine the most efficient way to create the database.

Sincerely,

Chantel Sheaks
Vice President, Retirement Policy
U.S. Chamber of Commerce

Appendix A

Below is the list of information DOL is requesting that plans voluntarily provide under the ICR. The highlighted items are not included in the statute.

Plans With Separated Vested Participants

1. Name and plan number of plan as reflected on the most recent Form 5500. If the plan had names other than the name on the most recent Form 5500, provide the prior names and plan numbers and include the date of change.

2. Name, employer identification number (EIN), mailing address, and telephone number of the plan administrator as reflected on the most recent Form 5500. If the plan had plan administrators other than the plan administrator on the most recent Form 5500, provide the names and EINs of the prior plan administrators and include the date of change.

3. Name, EIN, mailing address, and telephone number of the plan sponsor as reflected on the most recent Form 5500, if different than the plan administrator. If the plan had plan sponsors other than the plan sponsor on the most recent Form 5500, provide the names and EINs of the prior plan sponsors and include the date of change.

4. Name, date of birth, mailing address, email address, telephone number, and social security number (SSN) of each separated vested participant.

5. Nature, form, and amount of benefit of each separated vested participant.

6. If the vested benefit of each such separated vested participant was fully paid in a form other than an annuity (i.e., lump sum payout) to the separated vested participant, provide the date and the amount of the distribution.

7. If an annuity form of benefit, state whether the separated vested participant has begun receiving benefits, the date of the annuity commencement, and the monthly benefit.

8. Name, date of birth, mailing address, email address, telephone number, and SSN of any separated vested participant of normal retirement age or older that is owed a vested benefit, and who has been unresponsive to plan communications about their benefits or whose contact information as set forth in paragraph 4 above, the plan has reason to believe is no longer accurate.

9. Name, date of birth, mailing address, email address, telephone number, and SSN of any designated beneficiary of the separated vested participant.

10. With respect to any participant whose benefit was transferred to the plan in the manner described in Line 9 of the Form 8955-SSA, provide the name and plan number of the transferor plan. Include the date of transfer to the plan.

Plans That Distributed Benefits Under Section 401(a)(31)(B) of the Internal Revenue Code

1. Name of plan and plan number as reflected on the most recent Form 5500. If the plan had names other than the name on the most recent Form 5500, provide the prior names and plan numbers to include the date of change.

2. Name, EIN, mailing address, and telephone number of the plan administrator as reflected on the most recent Form 5500. If the plan had plan administrators other than the plan administrator on the most recent Form 5500, provide the names and EINs of the prior plan administrators and include the date of change.

4. Name, date of birth, mailing address, email address, telephone number and SSN of each participant or former participant with respect to whom any amount of the vested benefit was distributed under section 401(a)(31)(B) of the Code.

5. With respect to such participant or former participant, the name of the designated trustee or issuer described in section 401(a)(31)(B) of the Code.

6. With respect to such participant or former participant, the address of the designated trustee or issuer described in section 401(a)(31)(B) of the Code.

7. With respect to such participant or former participant, the amount of the distribution.

8. With respect to such participant or former participant, the account number of the individual retirement plan to which the amount was distributed.

9. With respect to such participant or former participant, the name, date of birth, mailing address, email address, telephone number, and SSN of any designated beneficiary.

Plans That Distributed Annuities under 2510.3-3(d)(2)(ii)

2. Name, EIN, mailing address, and telephone number of the current plan administrator as reflected on the most recent Form 5500. If the plan had plan administrators other than the plan administrator on the most recent Form 5500, provide the names and EINs of the prior plan administrators and include the date of change.

3. Name, EIN, mailing address, and telephone number of plan sponsor as reflected on the most recent Form 5500, if different than the plan administrator. If the plan had plan sponsors other than the plan sponsor on the most recent Form 5500, provide the names and EINs of the prior plan sponsors and include the date of change.

4. Name, date of birth, SSN, mailing address, email address, and telephone number of each participant or former participant with respect to whom an annuity contract, described in 29 CFR 2510.3-3(d)(2)(ii), was distributed.

5. With respect to such participant or former participant, the name of the issuer of the annuity contract.

6. With respect to such participant or former participant, the address of the issuer of the annuity contract.

7. With respect to such participant or former participant, the contract or certificate number.

With respect to such participantor former participant, the name, date of birth, mailing, address, email address, telephone number, and SSN of any designated

¹ Codified at 29 U.S.C. §1153.

² ERISA § 523(a); 29 U.S.C. § 1153(a).

³ The legislative text appears to assume that the IRS would have provided DOL the information in the Forms SSA and this information would be used to remove anyone from the data base who had received their deferred vested benefit.

⁴ In our May 9, 2023 letter to DOL, the U.S. Chamber stated that because much of this information is already required to be provided to the IRS, DOL should coordinate with the IRS to obtain the information. This information should not fall within 26 U.S.C. Section 6103 and, therefore, IRS should be able to disclose it and coordinate with DOL because the Form SSA and the information on it should not be considered a tax return or return information. Even if some information is within Section 6103, arguably IRS could redact such information, such as the tax identification number.

⁵ ERISA Section 209 requires plan sponsors to maintain records sufficient to determine the benefits due, for "as long as they may be relevant to a determination of benefit entitlements." However, it does not contain a specific timeframe.

⁶ DOL has stated that reasonable administrative expenses can be paid from the plan, including required disclosures. See "Guidance on Settlor v. Plan Expenses" available at https://www.dol.gov/agencies/ebsa/about-ebsa/our-activities/resource-center/advisory-opinions/settlor-expense-guidanee

⁷ There is also concern that contractually recordkeepers are not able to release confidential and personally identifiable information to outside third parties.

⁸ Given the most recent Office of Inspector General DOL cyber security report, we remain concerned with the integrity of personally identifiable information being provided to and stored by DOL, including, but not limited to IRA account numbers. See "Report: DOL Information Security Needs Improvement", Noah Zuss, Dec. 13, 2023 available at https://www.plansponsor.com/report-dol-information-security-needsimprovement/#:-:text=An%20audit%20of%20the%20Department%20of%20Labor's%20program%20determined%20it%20is%20ineffective.&text=A%20yearly%20audit%20found%20that,Act%20requirem ents%20and%20other%20guidance.

⁹ ERISA Section 505 allows the Secretary of Labor to "prescribe such regulations as he finds necessary or appropriate to carry out the provisions of this subchapter. Among other things, such regulations may define accounting, technical and trade terms used in such provisions; may prescribe forms; and may provide for the keeping of books and records, and for the inspection of such books and records (subject to section 1134(a) and (b) of this title)." Nothing in this section appears to give DOL authority to demand the information in ERISA Section 523.

¹⁰ Form 8955 Instructions available at https://www.irs.gov/instructions/i8955ssa