ERISA Fiduciary Duties, IRS Nondiscrimination Testing and Correction Programs, DOL Contribution Deposit Timing, Form 5500 and 8955-SSA Deadlines and SECURE 2.0 Provisions: Compliance for US Retirement Plan Software

This article is part of our series on Custom Retirement Plan Administration Platform Development for US TPAs And Recordkeepers: Building a Contribution, Compliance Testing And Filing System

Introduction: Compliance Here Is a Document Plus a Calendar

Retirement plan software compliance comes down to two things: following the plan document and meeting a calendar of deadlines that do not move.

Most of what goes wrong is not exotic. The IRS’s published lists of common plan mistakes are dominated by operational errors: compensation defined differently from the document, eligible employees not enrolled, matches miscalculated, deposits late, limits exceeded. Each is a gap between the document and what payroll did.

That makes retirement plan software compliance an architecture question. A platform that models the document precisely, validates every payroll against it and tracks every deadline prevents most failures. One that does not produces them faster.

This article covers the fiduciary duties, testing and correction, deposit timing, annual filings and SECURE 2.0 provisions that define retirement plan software compliance in 2026.

This is educational content, not legal or tax advice. Confirm positions with ERISA counsel and credentialed retirement plan professionals. Compliance is the regulatory layer of the full custom software development guide to retirement plan administration software development, and it reaches into every web application development surface the sponsor and participant touch.

ERISA Fiduciary Duties and the Administrator’s Role

ERISA requires fiduciaries to act prudently, solely in participants’ interest, to diversify investments and to follow the plan documents. It also prohibits certain transactions between plans and parties in interest, which is why late deposits matter.

Duties attach to functions rather than titles. The sponsor and named fiduciaries hold them by default, and a service provider becomes a fiduciary when it contracts for that role or exercises discretionary authority over plan administration or assets.

Most TPA services are ministerial. Some TPAs serve as plan administrator under section 3(16), which transfers responsibilities by contract and carries real liability, and the disclosures required under section 408(b)(2) describe the role a provider takes.

Investment advice is a separate question. The DOL’s 2024 rule expanding who counts as an investment advice fiduciary was vacated, and in 2026 the agency reinstated the 1975 five-part test. Verify the current position before writing about advice or rollovers.

For software: record role allocations as the service agreement defines them, and never present the platform or provider as assuming duties it has not contracted for.

IRS Nondiscrimination Testing and Correction Programs

What the Tests Cover

The ADP and ACP tests for deferrals and for matching and after-tax contributions; minimum coverage under section 410(b); general nondiscrimination under section 401(a)(4) where allocation formulas require it; top-heavy rules under section 416; and individual limits on elective deferrals and annual additions. Safe harbor designs are deemed to satisfy certain tests if their conditions are met throughout the year. Limits and thresholds are indexed annually and are not published here.

Why Correction Timing Matters

A failed ADP or ACP test has statutory correction windows. Corrections after the first window can bring excise tax, and failures not corrected within the longer window become qualification failures handled through the IRS correction program. Verify current rules for each method before relying on specifics.

EPCRS After SECURE 2.0

The Employee Plans Compliance Resolution System has three parts: self-correction, voluntary correction with IRS approval, and audit closing agreements. SECURE 2.0 section 305 expanded self-correction to many eligible inadvertent failures, and Notice 2023-43 provides interim guidance while the governing revenue procedure awaits update. Choosing a correction method belongs with credentialed professionals and the sponsor, and the current version should be verified.

DOL Contribution Deposit Timing and the Correction Program

Amounts withheld from participants’ pay become plan assets on the earliest date they can reasonably be segregated from the employer’s general assets.

For pension plans the regulation sets an outer limit of the 15th business day of the following month, and the DOL’s position is that this is a maximum rather than a safe harbor: if an employer can deposit sooner, it must.

Plans with fewer than 100 participants have a safe harbor: deposits within seven business days of withholding are timely.

Late deposits are prohibited transactions requiring lost earnings to be restored, can carry an excise tax, and must be reported on Form 5500.

The DOL’s Voluntary Fiduciary Correction Program provides relief, and its 2025 update, effective March 17, 2025, added a self-correction component for late participant contributions and loan repayments meeting defined limits on lost earnings and timing. Self-correction does not remove the obligation to report late deposits on Form 5500.

For the platform: record withholding and deposit dates for every payroll, compute timeliness rather than accept it as input, surface lateness promptly, and carry it into the annual filing.

Form 5500 and Form 8955-SSA Deadlines

Form 5500 is the annual return for ERISA plans, filed with the DOL and shared with the IRS and PBGC, due by the last day of the seventh month after the plan year ends, with Form 5558 extending that by up to two and a half months. Smaller plans may qualify for the shorter Form 5500-SF, and large plans generally require an independent audit.

Filing is electronic through EFAST2, using the DOL’s web filing or software that passed its third-party certification testing.

Form 8955-SSA reports separated participants with deferred vested benefits so the Social Security Administration can tell them later what they are owed, and it shares the Form 5500 due date and extension.

The electronic route is changing. The IRS is retiring FIRE: it stopped accepting new FIRE transmitter applications in July 2026, and from the 2027 filing season IRIS is the only electronic intake for information returns, including Form 1099-R. Verify the current IRIS specifications for Form 8955-SSA.

Late filings carry penalties from both agencies, and the DOL runs a delinquent filer program. Penalty amounts are inflation-adjusted and not published here.

SECURE 2.0 Provisions in Motion in 2026

Roth catch-up: since January 1, 2026, catch-up contributions for participants whose prior-year FICA wages from the employer exceeded an indexed threshold must be Roth. Final regulations issued September 2025 apply from 2027, with a good-faith standard in 2026. A plan cannot require all catch-ups to be Roth, and a plan without a Roth feature must bar affected participants from catch-ups.

Automatic enrollment: 401(k) and 403(b) plans established after December 29, 2022 must automatically enroll for plan years beginning after December 31, 2024, with exceptions including small and new employers. Final regulations went to White House review in June 2026; verify status.

Long-term part-time employees: two consecutive years with at least 500 hours creates eligibility to defer.

Paper statements: defined contribution plans must furnish at least one paper benefit statement per year, starting with plan years beginning after December 31, 2025. The DOL proposed amendments to its electronic disclosure safe harbors in February 2026 with temporary good-faith enforcement relief.

Amendments: discretionary SECURE and SECURE 2.0 amendments are generally due December 31, 2026 for most plans, but the IRS clarified in September 2026 that required amendments follow Required Amendments List timing, so that date is not universal.

How each of these lands as a provision, data field, notice or deadline is mapped in Retirement Plan Software Features: The 2026 Feature Checklist.

Data Security, Privacy and Controls

Retirement plan data is among the most sensitive a business holds: Social Security numbers, compensation, beneficiaries, bank details, sometimes divorce orders or hardship documentation.

The DOL’s cybersecurity best practices apply to plan fiduciaries and service providers, and in 2024 it confirmed they cover all ERISA plans. Plan auditors commonly rely on a recordkeeper’s SOC 1 report, and many providers also undergo SOC 2 examination.

This is privacy and security law, not HIPAA: a plan does not become a HIPAA covered entity by holding medical bills submitted with a hardship request. State breach notification laws apply, and recordkeepers that are financial institutions or SEC-registered entities may carry additional obligations; verify per entity.

Establishing this compliance scope before architecture is fixed is covered in Scoping Before Coding: How a Technology Consultant De-Risks a Custom Administration Platform.

Conclusion

Platforms that model the plan document precisely, compute deposit timeliness from source dates, preserve every test run, keep correction decisions with credentialed people and the sponsor, and track a filing route that is changing under them end up with a compliance record that holds up when an auditor or agency asks.

This is educational content, not legal or tax advice. Confirm your position with ERISA counsel and credentialed retirement plan professionals before relying on any of it, and brief the software companies in the United States quoting you on where the platform’s job stops.

If you are scoping a platform that will be held to the plan document, the tax code and DOL rules at once, settling provision modeling, deposit evidence and the 2026 changes before architecture is fixed is what keeps compliance from becoming a correction.

FAQ