PLANSPONSOR - August/September 2020 - 7

that password has already been accessed
through a cyberattack and could easily be
reused to access all accounts where that
user used the same or similar passwords. "
This focus on the employee as the
first line of defense in protecting his own
401(k) account raises the liability stakes
for employers, says Mathew Elkins, 401(k)
administrator at USI Consulting Group in
New London/Norwich, Connecticut.
If employees, especially remote-based
workers, are not fully trained in cyberdefense
best practices, responsibility falls on
the negligent employer.
" The safeguards that should be in
place include strong passwords, multifactor
authentication (MFA) and proper
procedures to authenticate customers
online and over the phone, " stresses Bryce
Austin, a cybersecurity expert and risk
consultant in Lakeville, Minnesota. " When
these safeguards are utilized, they are
effective almost all the time. "
Organizations should, at a minimum,
have the following defensive elements in
place, says Richard Carpenter, president
of USVI Pensions in the U.S. Virgin
Islands: login time monitoring-how
long does it take to enter user name and
password; recipient account monitoring-
how long has the new account been open;
401(k) account activity monitoring; password
strength and modification monitoring;
security awareness training for all
employees; additional identity screening
for call centers; and ambient-sound monitoring
for call centers.
Finally, when looking for an
outsourced company to administer
employees' retirement accounts, Austin
says, ask what processes the company
promises to use to authenticate users
before it provides them services. Also
find out what contractual obligations the
retirement company is willing to sign off
on regarding its liability for not following
reasonable cybersecurity practices.
" They need to be on the hook for
mistakes like these, " he advises. " In
writing. No exceptions. " -David Weldon
More From Washington
And the Courts
Lifetime Income
Illustrations
The Department of Labor (DOL)'s
Employee Benefits Security Administration
(EBSA) released an interim final rule
implementing Section 203 of the Setting
Every Community Up for Retirement
Enhancement (SECURE) Act, requiring
that a participant's accrued benefit
amount be included on his plan statement
as a current account balance and as an
estimated lifetime stream of payments.
Using assumptions set forth in
the rule, plan administrators will show
participants equivalents of their retirement
savings broken down as monthly
" paychecks " under two potential scenarios:
1) as a single life income stream, and 2) as
an income stream that factors in a survivor
benefit. The statements will also explain
how the assumptions were arrived at and
how they will translate to income. For
example, " This is what you can receive
monthly if you convert your balance to a
[single-life/survivor] annuity starting at
age X and paying for Y years. "
To help ease the additional burden
on plan administrators, the interim final
rule includes model language that may
be used for these explanations. Plan fiduciaries
that use the regulatory assumptions
and model language will qualify for
liability relief and will not be held liable
if participants fail to receive equivalent
monthly payments.
Fiduciary Rule
Debate Continues
The comment deadline has passed on the
fiduciary rule proposal published by the
Department of Labor (DOL) in late June.
As proposed, the exemption would authorize
a wide range of investment advice
compensation models and client relationship
structures that could otherwise be
prohibited under the new fiduciary rule.
To qualify, advisers would need to live up
to a set of " impartial conduct standards "
such as those included in the Regulation
Best Interest (Reg BI) framework recently
implemented by the Securities and
Exchange Commission (SEC). This is to
say, they still must collect no more than
reasonable compensation and make no
materially misleading statements.
Much of the financial services industry's
commentary about the proposal has
been positive, with various commenters
voicing appreciation that multiple
national-level conflict of interest rules are
now aligned. But not everyone is pleased
with the DOL's proposal. For instance,
comments submitted by Barbara Roper,
director of investor protection with the
Consumer Federation of America, suggest
the regulation is being rushed. She argues
that the regulatory package consists of two
components that " work together to make it
easier for firms to evade fiduciary obligation "
and to weaken the fiduciary standard
when it does apply.
ESG Restrictions Panned
The recent regulation proposed by the
Department of Labor (DOL) to restrict the
use of environmental, social and governance
(ESG) investing principles within
defined contribution (DC) retirement
plans has generated much controversy.
According to DOL leadership, the proposal
is designed to make clear that plan fiduciaries
" may not invest in ESG vehicles when
they understand an underlying investment
strategy of the vehicle is to subordinate
return or increase risk for the purpose of
nonfinancial objectives. "
The consensus among expert ERISA
[Employee Retirement Income Security
Act] attorneys is that these restrictions
will make it more difficult, in immediate
PLANSPONSOR.COM August - September 2020 7
http://www.PLANSPONSOR.COM
PLANSPONSOR - August/September 2020

Table of Contents for the Digital Edition of PLANSPONSOR - August/September 2020
