SECURE 2.0’s auto-enrollment mandate revs up with IRS proposal 

February 11, 2025

IRS proposed regulations provide comprehensive guidance on mandatory automatic enrollment for new 401(k) and 403(b) plans. Starting with 2025 plan years, the SECURE 2.0 Act of 2022 (Div. T of Pub. L. No. 117-328) requires 401(k) and 403(b) plans established on or after Dec. 29, 2022, to include an eligible automatic contribution arrangement (EACA) that meets certain minimum contribution and investment requirements, unless an exemption applies. The proposal addresses those exemptions, incorporating and expanding interim guidance released last year. IRS also proposes to clarify the administration of key EACA features for nonexempt plans. The proposal would take effect for plan years beginning more than six months after the publication of final regulations. Until then, sponsors can rely on a reasonable good-faith interpretation of SECURE 2.0’s statutory auto-enrollment provision. Comments are due March 17.

A broad exception from the auto-enrollment mandate applies to pre-enactment plans “established” before Dec. 29, 2022 (SECURE 2.0’s enactment date). The proposal would incorporate IRS’s earlier interim guidance from Notice 2024-2 — which explains how the exemption for pre-enactment plans applies to plan mergers and spinoffs — along with additional clarifications in response to stakeholder comments. While the guidance in Notice 2024-2 is already (and presumably remains) in effect, IRS didn’t expressly say whether sponsors can rely on the proposal’s additional clarifications pending issuance of a final rule.

Definition of pre-enactment plan. To qualify for this exemption, a 401(k) plan must have adopted terms regarding elective deferrals before Dec. 29, 2022, even if those terms took effect on a later date. For 403(b) plans, the exemption would apply to plans established before Dec. 29, 2022, without regard to the adoption date of plan terms providing for salary-reduction agreements.

Pre-enactment plan mergers and spinoffs. Plans involved in transactions like mergers and spinoffs would remain exempt in certain circumstances. When two pre-enactment plans merge, the surviving plan would remain a pre-enactment plan. A plan spun off from a pre-enactment plan would also be treated like a pre-enactment plan. If a pre-enactment plan is merged with a plan that doesn’t include a deferral feature, the merged plan would remain a pre-enactment plan.

Merger with a nonexempt plan. If a nonexempt plan merges with a pre-enactment plan, the ongoing plan wouldn’t be exempt unless the merger is due to a corporate transaction eligible for relief from minimum-coverage testing that meets the following conditions:

• The plan merger is completed during the minimum-coverage testing relief period (i.e., generally the end of the plan year after the year of the corporate transaction).
• The pre-enactment plan is designated as the surviving plan.

For plans that don’t meet these conditions, the ongoing plan’s EACA presumably would need to cover the former pre-enactment plan’s employees at the beginning of the plan year after the merger, but clarification would be helpful.

Plan amendments. Amendments to a pre-enactment plan — including amendments extending eligibility to employees of the sponsor or other controlled-group members previously not covered — ordinarily wouldn’t jeopardize the plan’s pre-enactment status. However, amendments effecting plan mergers could cause a plan to lose its exemption, depending on the facts.

The auto-enrollment mandate generally applies to employers that newly adopt a multiple employer plan (MEP) — including a pooled employer plan (PEP) — on or after Dec. 29, 2022, even if the MEP was already established. This prevents an employer that doesn’t sponsor a pre-enactment plan from evading the auto-enrollment mandate by adopting a pre-enactment MEP. Notice 2024-2 provided initial guidance on explaining how the exemption for pre-enactment plans applies to MEP participants. The proposal would incorporate this guidance and provide several additional clarifications.

Mergers and spinoffs. The SECURE 2.0 auto-enrollment rules generally apply separately to each employer participating in a MEP, so actions taken by an individual employer generally wouldn’t affect the status of other participating plans under the pre-enactment exemption. The proposal explains how the exemption would apply when a pre-enactment plan is involved in a merger or spinoff:

• Participating employers wouldn’t lose the exemption when a nonexempt plan merges into a MEP. In that situation, the sponsor of the nonexempt plan would need to comply with the auto-enrollment mandate as if it were a separate plan.
• When a pre-enactment plan merges into a MEP, the exemption would continue to apply to that participating employer — even if the MEP was established after SECURE 2.0’s enactment. This would expand IRS’s earlier guidance, which was limited to mergers into a pre-enactment MEP.
• A plan spun off from a MEP would be exempt if the employer was treated as sponsoring a pre-enactment plan while participating in the MEP.

Multiemployer plans are excluded. The proposal would confirm that SECURE 2.0’s reference to “a plan maintained by more than one employer” means a MEP (i.e., it doesn’t include a multiemployer plan). As a result, an employer newly adopting or merging into a pre-enactment multiemployer plan wouldn’t be subject to the auto-enrollment mandate, even if the employer didn’t sponsor a pre-enactment plan. This interpretation is consistent with draft technical corrections legislation.

Plans adopted after SECURE 2.0’s enactment may qualify for other exemptions from the auto-enrollment mandate. The proposal provides the first guidance on application of the exemptions for plans sponsored by new businesses, small employers, and church, governmental and savings-incentive match plans for employees of small employers (SIMPLE) plans.

New businesses. A 401(k) or 403(b) plan sponsored by an employer in business less than three years (taking into account any predecessor employer) is exempt from the auto-enrollment mandate. The proposal would clarify that a new employer must adopt the required EACA for the first plan year beginning after the employer’s third anniversary of existence (i.e., plans wouldn’t have to add auto-enrollment midplan year). This exemption would also apply to a new business participating in a MEP.

Small employers. The auto-enrollment mandate doesn’t apply to a 401(k) or 403(b) plan sponsored by an employer that “normally” employs 10 or fewer employees. A business would calculate how many employees it normally employs by applying the standard used to determine when a small employer is exempt from offering COBRA continuation for group health plan coverage. The proposal would clarify that the employer must adopt the required EACA as of the first plan year beginning at least 12 months after the close of the first tax year the employer normally employed more than 10 employees. This would allow sponsors whose tax and plan years don’t align to avoid adding auto-enrollment midplan year. This exemption would apply to a small employer participating in a MEP.

Church, governmental and SIMPLE plans. SECURE 2.0 exempts governmental plans, church plans and SIMPLE 401(k) plans from the auto-enrollment mandate. The proposal would incorporate these exemptions with no additional conditions or clarifications.

SECURE 2.0 requires nonexempt plans to offer an EACA with certain features, including:

• Initial contribution rate. Employees are enrolled at an initial rate between 3% and 10% of compensation, unless they opt out or elect a different contribution rate.
• Withdrawal right. Employees can withdraw their automatic contributions during the 30- to 90-day period after the initial contribution.
• Automatic escalation. The default contribution rate for automatically enrolled employees’ increases by 1% after each completed year of participation until the rate reaches at least 10% (but not more than 15%) of compensation, unless they opt or elect a different contribution rate.

The proposal would clarify aspects of each of these elements and provide special transition rules for nonexempt plans that become subject to the mandate for the 2025 plan year. The proposal also explains that compliance with these requirements would be determined on a plan-year basis.

Existing IRS regulations provide that an EACA needn’t cover all eligible employees (i.e., a sponsor can limit its plan’s EACA to certain categories of employees or employees who become newly eligible after the arrangement takes effect, excluding employees with earlier eligibility dates — even employees without affirmative elections). However, the statutory auto-enrollment provision doesn’t suggest plans can exclude any categories of employees. IRS is interpreting SECURE 2.0 to require a nonexempt plan’s EACA to cover all eligible employees, including those eligible to contribute as long-term part-time workers. The proposal would also amend IRS’s EACA regulations to conform to this interpretation. This is more restrictive than the rules for plans with EACAs not mandated by SECURE 2.0, which can continue to define which employees are subject to the arrangement (e.g., a sponsor can limit its EACA to employees who become eligible after the arrangement is effective).

Ability to exclude employees with preexisting affirmative elections. Plans established after Dec. 29, 2022, but before the 2025 plan year — as well as plans sponsored by new or small employers that become nonexempt after the 2025 plan year — will already have eligible employees before implementing the mandated EACA. The proposal would allow these plans to exclude employees with an affirmative election to contribute or not contribute at the time the plan becomes subject to the auto-enrollment mandate. Plans that don’t exclude employees with affirmative elections wouldn’t have to reduce an election that is higher than an employee’s applicable percentage (see Contribution requirements later).

• Special rule for plans first subject to the mandate in 2025. Nonexempt plan sponsors likely began preparing to implement the required EACA for the 2025 plan year months before the proposal’s publication. Based on the current EACA regulation, these sponsors may have decided to apply the required EACA prospectively to only newly eligible employees. If so, the EACA would exclude employees who became eligible in earlier plan years but had no affirmative contribution election in place. The proposal would allow plans first subject to the mandate in 2025 to delay auto-enrolling these employees until the first plan year after final regulations take effect. Plans generally would have to apply the contribution rate that would be in effect in that later plan year had these employees been auto-enrolled for the 2025 plan year and subject to the required annual auto-escalation (see Contribution requirements). However, sponsors could choose to auto-enroll these employees at the initial percentage if they haven’t had default contributions for an entire plan year.
• Interaction with PLESA elections. Nonexempt plans can also exclude employees with affirmative elections to contribute to a pension-linked emergency savings account (PLESA) at the time the auto-enrollment mandate applies to the plan (because those elections are affirmative contribution elections). This presumably is true even if the participant has reached the PLESA account limit, but clarification would be helpful.

Collectively bargained employees. Both the statute and proposal are silent on how the auto-enrollment mandate applies to collectively bargained employees. This seems to suggest plans covering collectively bargained employees must include an EACA that satisfies SECURE 2.0’s requirements if none of the exemptions discussed above applies — meaning employers and unions couldn’t negotiate out of the EACA mandate. Confirmation would be helpful.

EACA must allow permissible withdrawals. Nonexempt plans would need to include the 30- to 90-day withdrawal feature, which is optional for EACAs not mandated by SECURE 2.0. Withdrawals are adjusted for earnings and taxable in the year distributed (unless the withdrawals are designated Roth contributions). However, the 10% early withdrawal penalty doesn’t apply.

The proposal would clarify how plans must implement the required initial contribution rate and automatic escalation of contributions for future years.

Contribution rate for initial period. SECURE 2.0 requires the contribution rate during an auto-enrolled employee’s “first year of participation” to be a uniform percentage of compensation that is at least 3% and at most 10%.

• Definition of first year of participation. The proposal would define an employee’s first year of participation as the period beginning on the date the employee becomes eligible to contribute (or the date the plan first becomes subject to the auto-enrollment mandate, if later) and ending on the last day of the next plan year. This would help simplify administration by allowing plans to implement automatic increases on the first day of the plan year instead of the individual anniversaries of employees’ eligibility dates.
• Exclusion of default PLESA contributions. For plans that automatically enroll employees in a PLESA feature, the proposal wouldn’t count default PLESA contributions toward SECURE 2.0’s auto-enrollment contribution rate (even though plans can exclude from auto-enrollment participants who make affirmative elections to contribute to the plan’s PLESA). IRS explains that this is because PLESAs must invest in principal preservation products that don’t meet the mandate’s investment requirement (described later).

Timing for annual auto-escalation. For every plan year after an employee’s initial period, contributions would increase 1% until reaching at least 10% and at most 15%. Participants can opt out of the automatic increase or elect a different contribution rate.

Breaks in eligibility. IRS proposes to incorporate the qualified automatic contribution arrangement (QACA) rules for determining the applicable contribution rate after an employee’s break in eligibility, including for rehires. Under these rules, plans could (but wouldn’t have to) reenroll employees at the initial rate if their break is at least an entire plan year.

Auto-reenrollment permitted but not required. Nonexempt plans could choose to automatically re-enroll participants who opt out or elect a contribution rate different than the initial percentage. These employees could be re-enrolled at the initial percentage once their affirmative elections have been in effect for an entire plan year.

Collectively bargained employees. Under IRS’s current EACA regulations, plans covering union and nonunion employees can apply different default deferral rates to the two groups, without violating the requirement that an EACA provide default rates that are a uniform percentage of compensation (this is true for any groups mandatorily disaggregated for nondiscrimination testing). The proposed regulation is silent on whether this rule would also apply to a plan with a SECURE 2.0-mandated EACA covering union and nonunion employees. Clarification would be helpful.

Nonexempt plans offering employer contributions may consider QACA safe harbor

The proposal generally aligns these contribution requirements with existing rules for QACAs. A QACA is an optional safe-harbor design that exempts a plan from the actual deferral percentage (ADP) nondiscrimination test and possibly the actual contribution percentage (ACP) test (depending on whether the plan provides nonsafe-harbor matching contributions or after-tax contributions). The employer must make either safe-harbor matching contributions — at least 100% of the first 1% and 50% of the next 5% of compensation — or a 3% safe-harbor nonelective contribution. These safe-harbor contributions must be fully vested after two years of service.

Plans subject to SECURE 2.0’s auto-enrollment mandate don’t have to offer employer contributions. However, nonexempt employers that choose to make matching or nonelective contributions may consider structuring them (and other plan design elements) to take advantage of the QACA or traditional nondiscrimination safe harbors.

The proposal would implement the statutory requirement that an auto-enrolled employee’s default contributions must be invested “in accordance with” the Labor Department’s qualified default investment alternative (QDIA) regulation, unless the employee makes an affirmative investment election. The QDIA regulation provides a safe harbor — which is voluntary in other instances — that relieves fiduciaries of liability for investment losses related to the default investment of a participant’s contributions in a QDIA. That regulation contains detailed conditions, including a requirement to furnish a QDIA notice when participants become eligible and then 30 to 90 days before the start of each plan year. The proposal doesn’t explain how sponsors of nonexempt plans could correct errors involving compliance with the QDIA regulation. Clarification would be helpful.

The proposal would amend the EACA regulation to reflect two SECURE 2.0 provisions aimed at simplifying and streamlining required notices. However, the proposal doesn’t seek to make corresponding amendments to notice requirements in any other IRS regulations.

No annual EACA notice for unenrolled participants. For plan years beginning after Dec. 31, 2022, SECURE 2.0 simplifies disclosure requirements for “unenrolled participants” (i.e., eligible employees who are not participating). If these employees received the plan’s summary plan description and other required disclosures when first eligible, DC plans only have to provide an annual reminder notice about those participants’ eligibility to participate and any applicable election deadlines. Each employee covered by an EACA must receive a notice when first eligible and then again 30 to 90 days before the start of each plan year. The notice must describe the level of default contributions, the right to opt out or elect a different contribution rate, the way contributions will be invested, and the ability to make permissible withdrawals (if applicable). The proposal would specify that administrators don’t have to give the annual notice to unenrolled participants (i.e., those who have opted out of auto-enrollment). However, the proposal doesn’t explain whether plans with auto-reenrollment features would still need to provide the EACA notice 30 to 90 days before reenrollment of these participants. Clarification would be helpful.

Consolidation of EACA and other notices. SECURE 2.0 directs Treasury to adopt regulations allowing plans to consolidate into a single notice two or more of the notices required for QDIAs, automatic enrollment and 401(k) plan safe harbors. The consolidated disclosure would need to meet the content, timing and frequency requirements for each individual notice. The proposal would amend the EACA regulation to reflect consolidation of the required EACA notice with these other notices, as well as the PLESA notice for plans offering that feature.

• Proposed regulations (Federal Register, Jan. 14, 2025)
• News release (IRS, Jan. 10, 2025)

• User’s guide to SECURE 2.0 (updated periodically)
• IRS fine-tunes auto-enrollment exemption, explains new correction (April 15, 2024)
• Road-testing SECURE 2.0’s auto-enrollment mandate for new DC plans (Feb. 14, 2023)