Interest in cryptocurrency in 401(k) plans has grown as regulatory guidance changes and employers look for ways to expand retirement options. In May 2025, the Department of Labor (DOL) rescinded its prior “extreme care” guidance, shifting to a neutral stance on digital assets in retirement plans. However, GAO analysis of 2022 recordkeeper data found that crypto asset investments accounted for substantially less than 1% of the 401(k) market, and adoption remains limited (U.S. Government Accountability Office, 2024).

For employers and plan committees, the challenge is to evaluate new investment opportunities while maintaining strict ERISA compliance and fiduciary prudence. For deeper regulatory background or policy updates, visit our 401(k) resources.

The Short Answer: What Sponsors Can (and Can’t) Do Now

The DOL’s policy shift means plan sponsors now have flexibility, but ongoing scrutiny remains, and every step taken with crypto in a 401(k) must be documented, justified, and continually monitored for compliance. By rescinding its previous guidance, the department “restores the Department's historical approach by neither endorsing, nor disapproving of, plan fiduciaries who conclude that the inclusion of cryptocurrency in a plan's investment menu is appropriate” (DOL, Compliance Assistance Release 2025-01).

Fiduciaries must still adhere to ERISA’s duties of prudence and loyalty. For more details on current guidance, visit our 401(k) resources.

Start with Governance: Building a Compliant Committee Workflow

A compliant governance process is the foundation for any plan considering cryptocurrency in 401(k) plans. Committees should:

1. Define Roles: Assign responsibility for investment decisions, documentation, and ongoing monitoring.

2. Document Processes: Keep records of every discussion, analysis, and decision about digital assets.

3. Schedule Reviews: Set intervals for reviewing crypto options and their performance.

4. Demonstrate Prudence: Maintain records that show decisions are based on research and not trends.

Consider keeping a log or audit trail of discussions, third-party advice, and risk analyses to demonstrate a reasoned decision-making process.

A structured workflow demonstrates to regulators that your process meets ERISA standards. For more on policy and provider checklists, see our crypto in the 401(k) process guide.

Who Decides, Who Documents, Who Monitors

It’s essential to assign clear responsibilities to committee members. ERISA defines a fiduciary as anyone with discretionary authority over plan management or assets. Each key decision—whether to add, monitor, or remove crypto options—should be assigned and documented.

Assigning separate individuals for decision-making, documentation, and monitoring can reduce conflicts of interest and strengthen oversight.

What “Prudence” Looks Like in Practice (Process Checklist)

Prudence, as outlined by the DOL, means basing decisions on a careful risk and return analysis, considering economic effects, and documenting every step (DOL, Final Rule on Prudence and Loyalty, 2022). This includes due diligence, reviewing alternative options, and ongoing monitoring to confirm crypto remains appropriate.

Part of prudent oversight includes staying current with regulatory changes and providing continuing education for committee members. For more detail, see our investment policy statement (IPS) guide.

Define the Exposure Method: Choosing the Right Crypto Path

There’s more than one way to offer cryptocurrency in 401(k) plans, and each path has its own compliance implications. The most common exposure methods are:

• ETFs or Funds: These track crypto assets and trade on established exchanges, simplifying custody and reporting.

• Trusts: Specialized vehicles holding cryptocurrency for investors.

• Direct Investments: Allowing participants to purchase and hold crypto themselves, often through a self-directed brokerage window.

Direct cryptocurrency exposure may also raise additional legal and operational risks, such as challenges with secure custody, cybersecurity threats, and unclear valuation standards.

For more on implementing risk controls, see our risk controls for crypto.

ETF/Fund Exposure Paths vs. Other Structures

ETF and fund-based approaches are currently the most common due to their regulatory clarity and ease of integration.

Major plan providers, including Fidelity, have primarily implemented fund-based or trust-based models to contain risk and streamline compliance.

Direct investment structures require additional due diligence, especially regarding custody and participant access.

ETF/fund structures generally reduce operational complexity, but sponsors must still evaluate provider controls and reporting.

What to Confirm with Any Vendor

When selecting a provider, due diligence is critical. Confirm:

• Custody Arrangements: How are digital assets stored and protected?

• Fee Transparency: Are all costs clear and reasonable?

• Trading Controls: What limits or processes are in place to manage risk?

• Participant Education: Does the vendor offer educational resources?

• Regulatory Reporting: Are all compliance and reporting obligations met?

• Regulatory Cooperation: Does the provider have a clean compliance record and proactive engagement with regulators?

For a full checklist, see 20 due-diligence questions to ask a crypto 401(k) provider.

Update Policy and Documentation: IPS and Decision Memos

Updating your investment policy statement (IPS) and related documentation is essential for both compliance and risk management.

1. Review IPS Sections: Address how alternative assets—including crypto—fit within overall investment objectives and risk tolerance.

2. Document Decision Rationale: Write a detailed memo explaining why the committee chose to add or not add crypto, including all supporting research.

3. Set Review Cadence: Define how often the IPS and crypto options will be reassessed.

This documentation can help protect fiduciaries if their decisions are ever challenged, mitigating litigation risk by evidencing prudent process.

For a deeper dive, see our IPS guide.

IPS Sections to Touch

Sections on asset allocation, risk controls, eligible investments, and monitoring protocols should be updated to reflect digital asset considerations.

Liquidity and valuation: Define how the plan will address valuation and liquidity of digital assets.

Decision Memo Outline (Copy Block)

A decision memo should include: the decision made, rationale, supporting research, expected risks and benefits, and a plan for ongoing monitoring. This documentation can help protect fiduciaries if their decisions are ever challenged.

Provider Due Diligence: What to Ask Before You Commit

Thorough due diligence on vendors is non-negotiable. Key areas to probe include:

• Custody and Security: What measures protect participant assets?

• Fees: Are all transaction and management fees fully disclosed?

• Trading and Liquidity: How are trades executed and are there limits on volume or frequency?

• Education: What resources are provided to help participants understand crypto risks and opportunities?

• Reporting and Compliance: Does the provider’s system support ERISA reporting needs?

• Regulatory Cooperation: Does the provider have a clean compliance record and proactive engagement with regulators?

Plan for periodic re-evaluation of vendors to verify compliance and operational reliability.

A well-structured diligence process demonstrates fiduciary care. Use our due-diligence questions as a starting point.

Risk Controls: Guardrails for Crypto in Your 401(k)

To mitigate risk, experts recommend several prudent controls:

• Limit Exposure: Cap allocations to a small portion of the portfolio to manage volatility.

• Opt-In Only: Require participants to actively choose crypto investments.

• Eligibility Criteria: Set requirements such as investment experience or risk tolerance assessment.

• Access and Removal Criteria: Define when and how crypto options can be added or removed from the plan.

A clear communication plan is a critical risk control, helping participants understand both limits and risks of their choices.

These controls help demonstrate prudent oversight and protect participants from risk. For more, see our risk controls resource.

Participant Education Plan: Communicating Crypto to Employees

Effective education is critical when introducing digital assets. Best practices include:

• Providing clear, jargon-free materials on how cryptocurrencies work and their risks.

• Highlighting volatility and regulatory uncertainties.

• Offering tools to help participants assess suitability for their own portfolios.

• Transparent disclosures about fees, withdrawal limitations, and potential tax consequences should be included in all education materials.

A solid education plan can reduce confusion and help participants make informed choices. Explore our participant education resources for templates and tips.

Monitoring Cadence and Triggers: Staying Ahead of Change

Ongoing monitoring is required under ERISA. A prudent cadence includes:

1. Quarterly Reviews: Check crypto performance and compliance with IPS.

2. Annual Reassessment: Revisit the rationale for offering crypto and update documentation.

3. Trigger Events: Immediate review if there are significant regulatory changes or major market events.

Consider incorporating participant feedback or concerns into regular reviews to address emerging risks.

Documenting these reviews and actions is key to demonstrating ongoing prudence. See our monitoring and process checklist.

Common Pitfalls and How to Avoid Them

Plan sponsors face several potential pitfalls, including:

• Vague Pricing: Leads to participant confusion and potential compliance issues.

• Unclear Custody: Increases risk of loss or theft.

• Weak Communication: Results in participant complaints or regulatory attention.

• No Removal Criteria: Makes it hard to respond quickly to market or regulatory changes.

In its March 2022 guidance, the DOL warned that “cryptocurrencies... present significant risks and challenges to participants’ retirement accounts, including significant risks of fraud, theft, and loss” (DOL, 2022).

Inadequate risk controls, communication, or documentation have led to participant lawsuits or regulatory action in other novel asset rollouts, making careful planning essential.

Careful planning and communication can help avoid these consequences. For more, review our due-diligence questions.

Next Steps for Employers: Get Guidance or Start Your Plan

Employers should act prudently, document every decision, and seek expert guidance before adding crypto to a 401(k) plan. For a step-by-step walkthrough or to connect with our team, get started (for employers).

This content is for informational purposes only and is not legal, tax, investment, or compliance advice.

References

• Compliance Assistance Release No. 2025-01. (2025, May 28). U.S. Department of Labor. https://www.dol.gov/agencies/ebsa/employers-and-advisers/plan-administration-and-compliance/compliance-assistance-releases/2025-01

• Government Accountability Office. (2024). Retirement Plan Investments: Characteristics of Plans Offering Cryptocurrency. https://www.gao.gov/products/gao-25-106161

• Final Rule on Prudence and Loyalty in Selecting Plan Investments and Exercising Shareholder Rights. U.S. Department of Labor. https://www.dol.gov/agencies/ebsa/about-ebsa/our-activities/resource-center/fact-sheets/final-rule-on-prudence-and-loyalty-in-selecting-plan-investments-and-exercising-shareholder-rights

• Compliance Assistance Release No. 2022-01. (2022, March 10). U.S. Department of Labor. https://www.dol.gov/newsroom/releases/ebsa/ebsa20220310