Where 401(k) money is held, what ERISA requires, what SOC reports show and what happens if a provider exits, plus the questions to ask any provider.
Updated November 11, 2026
8 min read
Short answer: The money in a 401(k) belongs to the plan, not to the provider. The Employee Retirement Income Security Act (ERISA) requires plan assets to be held in trust and used only to pay benefits and reasonable plan expenses, so a provider’s age does not decide whether employees’ savings are safe. The practical risks with any provider, new or established, are operational: payroll errors, a messy conversion and weak security. Before you sign, ask every finalist who holds the assets, for its SOC reports and for its exit terms.
Who actually holds the money in a 401(k)
A 401(k) has several roles, and one company can fill more than one. Knowing who does what is the fastest way to see where a provider’s own risk ends.
Role | What it does | What happens if this company stops serving your plan |
|---|---|---|
Plan sponsor | Usually the employer. Sets up the plan and chooses and monitors providers. | Not applicable; the sponsor is the one who replaces providers. |
Trustee | Holds plan assets in trust for participants. ERISA requires one or more trustees for plan assets. | The plan appoints a new trustee and the trust’s assets move to it. |
Custodian | Holds the securities and cash in the plan’s accounts. | Assets are moved to a new custodian; they are not the custodian’s property. |
Recordkeeper | Tracks each employee’s balance, contributions, loans and investments; runs the website and statements. | The plan hires a new recordkeeper and converts its records. Assets stay where they are or move between trust accounts. |
Plan administrator (ERISA 3(16)) | Runs plan operations: notices, testing, filings. Often the employer, sometimes delegated in writing to a provider. | The role reverts to the employer or moves to the next provider. |
Investment fiduciary (ERISA 3(21) or 3(38)) | Advises on (3(21)) or selects and monitors (3(38)) the fund menu. | The plan appoints another adviser or takes the role back. |
Two rules make this structure work. ERISA section 403(a) says “all assets of an employee benefit plan shall be held in trust by one or more trustees,” and section 403(c) says plan assets are held “for the exclusive purposes of providing benefits to participants” and paying reasonable plan expenses. The Department of Labor (DOL) lists “a trust fund to hold the plan’s assets” as an essential element of every plan, separate from “a recordkeeping system to track the flow of monies.”
What to ask any provider: “Name the trustee and the custodian for our plan’s assets, and tell us whether either one is affiliated with you.” Some providers use their own affiliated trust company; others use an unaffiliated one. Either can be lawful. You just need to know which you are buying.
What happens if a 401(k) provider is acquired, exits the business or fails
Because assets sit in the plan’s trust, a provider leaving the market is usually an operational event, not a loss of money. What it does cost is time and attention.
Acquired or exiting provider. The buyer or a replacement recordkeeper takes over the records, or you choose a new provider yourself. Either way, expect a conversion with a blackout period, during which employees temporarily can’t change investments or take loans or distributions. Federal rules require a written notice to affected participants at least 30 days and no more than 60 days in advance of most blackouts (29 CFR 2520.101-3).
A brokerage firm in the chain fails. Firms regulated by the Securities and Exchange Commission (SEC) and FINRA must keep customer property separate from their own business, so “if a brokerage firm fails, all customer property should be intact,” according to the SEC’s investor education office. If property is missing, the Securities Investor Protection Corporation (SIPC) works to recover it when a member firm fails financially. SIPC does not cover investment losses from market moves.
The employer disappears, not the provider. If a plan is left with no sponsor, the DOL’s abandoned plan rules let a qualified termination administrator (a financial institution that holds the plan’s assets and can serve as an IRA trustee) wind the plan down and pay out benefits (29 CFR 2578.1).
Acquisitions happen to established providers too. A long track record lowers some risks, but it does not remove the chance that your plan gets moved to a new platform on someone else’s schedule.
The risks that are real with any provider
The DOL’s guide for employers, Meeting Your Fiduciary Responsibilities (September 2021), tells plan sponsors to look at a provider’s services, fees, staff, “any recent litigation or enforcement action,” and “whether the firm has fiduciary liability insurance.” For providers that hold participant data, it adds security standards, “annual audit results available to plan clients,” and insurance “that cover[s] losses caused by cybersecurity and identity theft breaches.”
That list points to where things actually go wrong:
Payroll and contribution errors. Late or wrong deposits create corrections and make employees lose trust fast.
Conversion mistakes. Balances, loans and contribution history have to move accurately from the old provider.
Security. A recordkeeper holds Social Security numbers, pay and account access.
Compliance work that slips. Missed notices, testing or filings fall back on the plan.
None of these depends on how old the company is. They depend on controls, staffing and how the provider’s systems connect to your payroll.
What SOC reports tell you (and what they don’t)
A System and Organization Controls (SOC) report is an independent CPA firm’s report on a service organization’s controls, defined by the American Institute of CPAs (AICPA).
SOC 1 covers controls relevant to clients’ financial reporting. Your plan’s auditor may ask for it.
SOC 2 covers controls for one or more of five areas the AICPA lists: security, availability, processing integrity, confidentiality and privacy.
Type I vs Type II. A Type I report looks at whether controls are designed properly at one point in time. A Type II report also tests whether they worked over a period of time.
A SOC report is an attestation by an auditor, not a certification or a government approval. Read the period covered, the auditor’s opinion, any exceptions noted, and the “complementary user entity controls” that you, the employer, are expected to perform. In 2026 the AICPA warned that it is looking into allegations about a vendor selling quick-turn SOC services, and urged that SOC engagements be “thoroughly evaluated,” so it is also fair to ask which CPA firm did the audit.
Questions to ask any 401(k) provider, new or established
Question | Why it matters | What a good answer includes |
|---|---|---|
Who is the trustee and the custodian, and are they affiliated with you? | Shows where assets sit and who answers for them. | Named entities and the account structure for your plan. |
May we see your most recent SOC 1 and SOC 2 reports? | Independent evidence of controls. | Report type, period, auditor and any exceptions. |
Which fiduciary roles do you take, in writing? | Decides what stays on your desk. | 3(16) and 3(21)/3(38) scope stated in the service agreement. |
What insurance do you carry? | DOL asks about fiduciary liability and cyber coverage. | Policy types and how a claim would reach the plan. |
What happens to our plan if you are acquired or exit? | Sets expectations for a forced move. | Notice period, data hand-off and deconversion terms in the contract. |
How do contributions get from our payroll to the plan? | Most day-to-day errors start here. | The integration method and who fixes a mismatch. |
ERISA also requires everyone who handles plan funds to be covered by a fidelity bond of at least 10% of the funds handled, generally no less than $1,000 and no more than $500,000 per person for each plan ($1,000,000 if the plan holds employer securities) (29 U.S.C. 1112). Ask who buys and maintains it.
How Basic Capital is set up
Basic Capital is a 401(k) provider for employers: recordkeeper and plan administrator in one platform, used by 400+ companies.
Recordkeeping and administration: Basic Capital Recordkeeping Services LLC, a wholly owned subsidiary of Basic Capital Group, Inc., serves as the 3(16) plan administrator for the administrative functions listed in its service agreement.
Investment advice (optional): Basic Capital Advisors LLC, registered with the State of New York as an investment adviser, can serve as 3(38) investment fiduciary under a separate agreement. Employers can also keep their own adviser.
Custody: plan assets are held by trusted, independent custodians, American Estate & Trust and Matrix Trust, in accounts for each plan. They never sit on Basic Capital’s balance sheet, so if Basic Capital stopped operating, the assets would stay with the custodian while another recordkeeper takes over.
Independent audits: SOC 2 Type II and SOC 1 reports from independent CPA firms, available on request through the Basic Capital Trust Center, plus annual independent penetration testing and continuous control monitoring.
Data protection: data is stored and processed in the United States on AWS, encrypted in transit and at rest, and backed up daily.
Access controls: single sign-on (SAML, including Okta) and SCIM user provisioning for employer teams, two-factor authentication in the employer and employee apps, and role-based, least-privilege access for Basic Capital staff.
Resilience: cybersecurity insurance and tested business continuity and disaster recovery plans.
AI and your data: AI features run on Anthropic’s Claude under an enterprise agreement with zero data retention, and customer data is never used to train models.
Fidelity bond: Basic Capital procures and maintains an ERISA fidelity bond for each plan.
Neither Basic Capital Recordkeeping Services nor Basic Capital Advisors is a broker-dealer.
See how Basic Capital is built for the full list of entities, audits and backers, or compare Basic Capital with other providers. If you are weighing a move, the 401(k) switch timeline guide covers what a conversion involves.
Frequently asked questions
Can a 401(k) provider use my employees’ money if it runs into trouble? Plan assets must be held in trust for the exclusive purpose of paying benefits and reasonable plan expenses (ERISA section 403). They are not the provider’s assets.
Is my 401(k) insured like a bank account? No. Investments in a 401(k) are not FDIC insured and can lose value. SIPC protection applies when a member brokerage firm fails and customer property is missing; it does not cover market losses.
Who decides when to replace a provider? The plan sponsor, usually the employer. The DOL expects sponsors to review providers “at reasonable intervals” and document the process. Our guide to how to evaluate a 401(k) provider has a checklist, and who carries which fiduciary role explains 3(16), 3(21) and 3(38).
Does a SOC 2 report mean a provider is certified? No. It is a CPA firm’s attestation about controls over a stated period. Read the period, the opinion and any exceptions.
References
U.S. Code, Title 29, §1103 (ERISA §403), Establishment of trust. https://www.govinfo.gov/content/pkg/USCODE-2023-title29/html/USCODE-2023-title29-chap18-subchapI-subtitleB-part4-sec1103.htm
U.S. Code, Title 29, §1112 (ERISA §412), Bonding. https://www.govinfo.gov/content/pkg/USCODE-2023-title29/html/USCODE-2023-title29-chap18-subchapI-subtitleB-part4-sec1112.htm
U.S. Department of Labor, EBSA. (2021, September). Meeting your fiduciary responsibilities. https://www.dol.gov/sites/dolgov/files/ebsa/about-ebsa/our-activities/resource-center/publications/meeting-your-fiduciary-responsibilities.pdf
U.S. Department of Labor, EBSA. (n.d.). Tips for hiring a service provider with strong cybersecurity practices. https://www.dol.gov/agencies/ebsa/key-topics/retirement-benefits/cybersecurity/tips-for-hiring-a-service-provider-with-strong-security-practices
29 CFR §2520.101-3, Notice of blackout periods under individual account plans. https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XXV/subchapter-C/part-2520/subpart-A/section-2520.101-3
29 CFR §2578.1, Termination of abandoned individual account plans. https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XXV/subchapter-G/part-2578/section-2578.1
U.S. Securities and Exchange Commission, Office of Investor Education and Advocacy. (n.d.). Investor bulletin: SIPC protection, part 2: filing a SIPC claim. https://www.investor.gov/introduction-investing/general-resources/news-alerts/alerts-bulletins/investor-bulletins/investor-bulletin-sipc-protection-part-2-filing-sipc-claim
Securities Investor Protection Corporation. (n.d.). What SIPC protects. https://www.sipc.org/for-investors/what-sipc-protects
AICPA & CIMA. (n.d.). System and Organization Controls: SOC suite of services. https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services
All retrieved 2026-11-11.
The modern 401(k) for employers
Recordkeeping, plan administration and payroll sync in one platform. Most plans go live in 30 to 60 days.
Related articles
Moving from an EOR to a PEO: what happens to your 401(k)
November 11, 2026
401(k) blackout period: notice rules, timing and what employees experience when you switch providers
November 11, 2026
Your plan was migrated: options for Guideline, Accrue and Vestwell customers
November 11, 2026
3(21) vs 3(38) fiduciary services, and where 3(16) fits: who is the fiduciary in a 401(k)?
May 19, 2026
More articles
November 13, 2026
401(k) contribution limits for 2027: what changed and what employers should do
The 2027 401(k) limit is $25,500, catch-ups rise to $8,500 and $11,750, and total additions hit $75,000. Every 2027 limit, plus what employers do next.
Read article
November 11, 2026
Best 401(k) providers for PEO clients in 2027
Using a PEO? Join its 401(k) or run your own. Five providers for PEO clients, compared on plan structure, fiduciary roles and portability.
Read article
November 11, 2026
Best 401(k) providers for companies with no HR team in 2027
Six 401(k) providers for companies with no HR team, compared on who acts as 3(16) administrator and 3(38) fiduciary, payroll sync and what you still own.
Read article
