Employers evaluating crypto in 401(k) plans face a changing regulatory environment, heightened scrutiny, and the need for effective risk controls. In May 2025, the Department of Labor (DOL) rescinded its previous guidance and now maintains a neutral stance: “By rescinding the 2022 guidance, the department reaffirms its neutral stance, neither endorsing, nor disapproving of, plan fiduciaries who conclude that the inclusion of cryptocurrency in a plan’s investment menu is appropriate.” For plan sponsors at mid-sized employers, this places a greater burden on prudent decision-making, documentation, and participant communication.

Employers who overlook this responsibility risk reputational, operational, and potential legal consequences.

For more in-depth employer guidance, see our 401(k) resources.

The Short Answer: What Controls Exist for Crypto in 401(k)s?

It’s a question nearly every employer evaluating digital assets asks: what risk controls are actually available for cryptocurrency in 401(k) plans? As of mid-2025, the DOL’s neutral position places the responsibility for risk management squarely on plan fiduciaries. The most common controls are:

• Contribution or balance caps (setting a maximum percent of an account that can be allocated to crypto)

• Strict eligibility criteria (often requiring completion of educational modules)

• Opt-in processes (no automatic enrollment)

• Access restrictions (such as trading windows)

• Ongoing monitoring and pre-set removal criteria

Understanding these controls is essential for sponsors. Cryptocurrency investment caps in 401(k) and participant eligibility requirements are determined by individual plan sponsors, with the industry trending toward more conservative approaches.

Despite growing interest, a 2024 GAO report found that crypto assets still make up only a very small part of the 401(k) market.

Why Controls Matter: Risk, Volatility, and Comprehension

Fiduciaries are required to act in participants’ best interests, especially when considering volatile assets. As the Government Accountability Office (GAO) reported in 2024, “Volatility for these crypto assets ranged from four times to 12 times greater than the volatility of the Standard and Poor’s 500 (S&P 500)...”

This level of volatility increases the risk for plan participants and adds complexity to the fiduciary’s duty of prudence.

Valuation challenges can further complicate these responsibilities for plan sponsors.

The takeaway: Crypto risk management in retirement plans is not just a compliance step, it is essential to protect participants from outsized risk and support informed, prudent decision-making.

For a deeper dive into policy and process, see our policy, process & provider checklist for employers. The heightened focus on education and communication reflects how critical it is for sponsors to clarify risks for their employee base.

Structuring Caps: Contribution, Balance, and Staged Approaches

The structure of investment caps is a primary risk control for cryptocurrency investment caps in 401(k) plans. Real-world examples show a range of approaches:

• Fidelity set a default cap, allowing participants to allocate up to 20% of their 401(k) savings to Bitcoin, and allowed employers to set lower limits.

• ForUsAll limited participants to no more than 5% of their portfolio in cryptocurrencies, with mandatory educational sessions required before investing.

These caps are not mandated by regulation but are implemented by plan sponsors to limit exposure to extreme volatility and to align with prudent fiduciary practices.

See our guide to adding crypto to your Investment Policy Statement (IPS) for more on cap documentation.

The trend is clear: staged or lower caps are a preferred method to balance interest in crypto with the need for protection.

Many advisors recommend allocations of just 2–5% for crypto in retirement portfolios.

Eligibility and Opt-In: Who Can Access Crypto, and How

Eligibility criteria for crypto investments in retirement plans are typically determined at the plan level. Most employers require employees to complete educational modules, demonstrate understanding of crypto risks, and pass a risk tolerance assessment before accessing these options.

For example, at ForUsAll, participants must complete mandatory education sessions before investing in crypto.

Opt-in remains the industry standard, and automatic enrollment into crypto investments is virtually unheard of due to the high-risk profile of these assets.

Eligibility criteria for crypto in retirement plans and auto-features for cryptocurrency in 401(k) are best approached with a focus on informed choice and clear participant acknowledgment.

Auto-Features and Defaults: Avoiding Unintended Crypto Exposure

It’s tempting to consider auto-enrollment features for all investment options, but crypto is a critical exception. As one industry expert noted, “The more volatile an asset class is, the less you need of it in the portfolio because you presumably get more bang for your buck.”

Auto-enrolling participants in such a volatile asset would introduce unnecessary risk and could be perceived as an endorsement.

Many employers are concerned that auto-features could be mistaken for an endorsement of these high-risk options by participants.

Industry best practice is clear: require active, informed opt-in for cryptocurrency investment options.

See our resource on Is Bitcoin in Your 401(k) a Good Idea or an Avoidable Risk for more perspective.

Access Restrictions and Change Management

Sponsors often implement access restrictions such as trading windows or rebalancing limitations to further manage risk. These types of restrictions are especially common whenever retirement plans offer volatile or alternative asset classes.

The process typically involves:

1. Defining trading windows: Participants may only make crypto trades during specific periods, reducing the temptation to respond reactively to market swings.

2. Limiting rebalancing frequency: Excessive rebalancing can increase risk; restrictions promote long-term thinking.

3. Monitoring participant behavior: If a participant’s allocation exceeds guidelines or if market events dictate, sponsors can intervene.

For a full checklist on policy and process, visit our policy, process & provider checklist for employers.

Crypto risk management in retirement plans is strengthened by these practical steps.

Monitoring and Removal: When to Re-Evaluate Crypto Options

Ongoing monitoring is essential. As the GAO report highlights, “This lack of clarity could add to the complexity of decisions fiduciaries need to make to meet ERISA requirements when offering crypto asset investment options.”

Sponsors should also watch for regulatory shifts or new DOL guidance as triggers for review and possible removal.

If monitoring reveals that a crypto option no longer aligns with plan objectives, or if participant behavior or market volatility exceeds set thresholds, plan sponsors should be prepared to remove or revise the offering.

Industry legal experts suggest that “it’s really kind of getting back to the traditional fundamentals of ERISA, which is leaning on that duty of prudence and care.”

For more on documenting controls, see our IPS guide.

Documenting Controls: Tying Crypto to Your IPS

Documenting all risk controls in your Investment Policy Statement (IPS) is critical for demonstrating a prudent process. The IPS should specify:

• Inclusion/exclusion criteria for crypto investments

• Risk assessment and monitoring protocols

• Review and removal procedures

Many mid-sized employers turn to external advisors or consultants to help document and regularly review IPS controls related to digital assets.

For a practical guide, see our IPS resource.

Crypto risk management in retirement plans requires thorough documentation to withstand regulatory and participant scrutiny.

Next Steps for Employers: Get Guidance on Crypto Risk Controls

Employers considering or currently offering crypto in 401(k) plans should focus on clear documentation, participant education, and ongoing monitoring.

For tailored support, get started (for employers).

References

U.S. Department of Labor. (2025, May 28). Compliance Assistance Release No. 2025-01. https://www.dol.gov/agencies/ebsa/key-topics/retirement-benefits/cryptocurrencies/compliance-assistance-release-2025-01

Government Accountability Office. (2024, November). 401(k) PLANS: Industry Data Show Low Participant Use of Crypto Assets Although DOL’s Data Limitations Persist. https://files.gao.gov/reports/GAO-25-106161/index.html

Pillsbury Law. (2025). DOL Rescinds Biden-Era Guidance on Crypto in 401(k) Plans. https://www.pillsburylaw.com/en/news-and-insights/dol-rescinds-biden-era-guidance-crypto-401k-plans.html

Fidelity Investments. (2022). Fidelity to Offer Bitcoin in 401(k) Plans. https://www.cnbc.com/2022/04/26/why-employers-may-not-be-quick-to-jump-on-the-401k-bitcoin-bandwagon.html

ForUsAll. (2022). ForUsAll Launches Alt401(k) with Coinbase. https://www.cnbc.com/2022/11/08/here-are-the-pros-and-cons-of-owning-cryptocurrency-in-your-401k-plan.html