Join the waitlist

ERISA Fidelity Bond Requirement (Section 412): What Plans Must Carry and What Auditors Check

ERISA Section 412 fidelity bond rules: who must be bonded, the 10% amount with the $1,000 floor and $500,000 or $1,000,000 cap, bond vs fiduciary liability insurance, Form 5500 reporting and audit checks for employee benefit plans.

CORAA TeamUpdated November 5, 20268 min read

Section 412 of ERISA requires that every person who handles funds or other property of an employee benefit plan be bonded against fraud or dishonesty. The Department of Labor enforces it, and the amount, the insured party and the surety all have rules. The Form 5500 asks about the bond and the amount of coverage, so a missing or undersized bond surfaces on the plan's annual filing as well as in the audit.

This page covers what the law says, how to size the bond, what the Form 5500 asks, and what an auditor or finance team can check. For the broader plan audit picture, see 401(k) audit requirements.

Who must be bonded?

Per the statute (29 U.S.C. 1112) every fiduciary of an employee benefit plan, and every person who handles plan funds or other property, must be bonded. The Department of Labor's guidance narrows that in practice: a fiduciary who does not handle funds or other property need not be bonded.

A person "handles" funds whenever their duties could cause a loss of plan funds through fraud or dishonesty, acting alone or in collusion. The DOL's criteria include:

  • physical contact with cash, checks or similar property
  • power to transfer funds to oneself or to a third party
  • power to negotiate plan property such as mortgages, titles or securities
  • disbursement authority, or authority to direct disbursement
  • authority to sign checks or other negotiable instruments
  • supervisory or decision-making responsibility over activities that require bonding

Handling is broader than touching money, according to Field Assistance Bulletin 2008-04. Plan administrators and the sponsor's officers and employees who receive, safeguard or disburse contributions usually need coverage. Service providers such as a third-party administrator or investment adviser need to be bonded if they or their employees handle plan funds; an adviser with no discretionary authority is not bonded solely for giving advice. Where the person is an entity, the requirement applies to the natural persons who do the handling.

Which plans and parties are exempt?

  • Plans that are completely unfunded, with benefits paid from the employer's or union's general assets, are exempt under the statute, along with their administrators, officers and employees. Fully insured plans are generally not treated as unfunded.
  • Plans that are not subject to Title I of ERISA, such as church plans and governmental plans, are outside the requirement.
  • Certain regulated financial institutions, including qualifying banks, insurance companies and registered broker-dealers, are exempt if they meet the conditions in the statute and regulations. Under the statute, the corporate-fiduciary exemption requires combined capital and surplus above a minimum set by the Secretary, not less than $1,000,000.
  • Salary deferrals withheld by an employer are not plan funds for bonding purposes only while they stay in the employer's general assets and are not segregated in any way (29 CFR 2580.412-5).

How much coverage is required?

The amount is set by statute and by 29 CFR 2580.412-11:

  • At least 10% of the funds the person handled in the preceding plan year.
  • Never less than $1,000.
  • The DOL cannot require more than $500,000 per person per plan, or $1,000,000 for a plan that holds employer securities. The statute applies the $1,000,000 cap to pooled employer plans as well.
  • The amount is fixed at the start of each plan year. FAB 2008-04 states it is not raised mid-year if the funds handled increase.
  • Coverage must be first-dollar up to the required amount. Deductibles and similar features that leave part of the required amount uninsured are not permitted.

If there is no complete prior year, the amount is estimated under 29 CFR 2580.412-15. The amounts apply to each plan named on a bond, so a bond covering several plans may need to exceed $500,000 to meet the requirement for every plan.

Illustration (illustrative)

A plan holds $1,000,000. The trustee, the named fiduciary and the administrator are three employees, and each can transfer funds, approve distributions and sign checks. Each person handles the full $1,000,000, so each must be bonded for at least 10% x $1,000,000 = $100,000. The DOL's example reaches the same figure. A blanket bond with a single aggregate limit may not meet the per-person requirement in a collusion loss, a point FAB 2008-04 makes with a schedule-versus-blanket comparison.

For a plan with $9,000,000 handled by one person, 10% is $900,000, which exceeds the $500,000 cap, so the required amount is $500,000. If the plan holds employer securities, the cap is $1,000,000 and the 10% figure of $900,000 controls. For a plan with $4,000 handled, 10% is $400, so the $1,000 minimum controls.

What makes a bond valid?

  • The plan, not the sponsor or administrator alone, must be named as an insured party, or otherwise specifically identified, so the plan can recover.
  • The surety or reinsurer must be on the Treasury Department's list of approved sureties (Circular 570). Under certain conditions Lloyd's of London underwriters are also allowed.
  • Neither the plan nor any party in interest may have control or a significant financial interest, directly or indirectly, in the surety, agent or broker through which the bond is obtained.
  • The bond protects the plan against fraud or dishonesty, including theft, embezzlement, forgery and misappropriation.
  • The plan may pay the premium from plan assets, because the bond protects the plan and does not protect the person who handles the funds.

Is fiduciary liability insurance the same thing?

No. The DOL states that the bond insures the plan against losses from fraud or dishonesty by people who handle plan funds. Fiduciary liability insurance insures fiduciaries, and sometimes the plan, against losses from breaches of fiduciary duty. It is not required by ERISA and does not satisfy the bond requirement. The Form 5500 instructions go further: fiduciary liability policies cannot be reported as fidelity bonds on the form.

What does the Form 5500 ask?

Schedule H (large plans), Schedule I (small plans) and the Form 5500-SF ask whether the plan was covered by a fidelity bond. Per the instructions (Schedule H and I line 4e; Form 5500-SF line 9d), plans that check "Yes" enter the aggregate amount of fidelity bond coverage for all claims. The instructions say to check "Yes" only if the plan itself is a named insured under a bond from an approved surety covering plan officials and protecting the plan from fraud or dishonesty as described in 29 CFR Part 2580. A related question asks whether the plan suffered or discovered any loss from dishonest or fraudulent acts, even if reimbursed by the bond.

The same bonding rules reach the small plan audit waiver. Under 29 CFR 2520.104-46, a small plan with more than 5% of its assets in non-qualifying plan assets must have a bond covering the people who handle them. The Form 5500 instructions give an example: a plan with $600,000 in assets, of which $42,000 is non-qualifying, has 7% in non-qualifying assets ($42,000 / $600,000), so it needs a bond of at least $42,000 covering the people who handle those assets to qualify for the waiver. Where the Section 412 bond is already at least that large, it can serve both purposes.

What can the auditor or finance team check?

Bond compliance is the plan administrator's obligation. These are practice checks rather than procedures the auditing standards name:

  • Obtain the bond and read the named insured, insurer, period and amount. Confirm that the insurer is on the Treasury list and that there is no deductible against the required amount.
  • Compare the amount to 10% of the prior-year funds handled by each covered person, with the cap and floor applied.
  • Compare the amount on the bond to the Form 5500 reporting, and the answer on the loss question to what the audit found.
  • Ask who in the plan's service provider chain handles funds (recordkeeper, TPA, payroll provider) and whether each one is bonded or exempt.
  • Read the representation letter the administrator signs for plan audits. See the EBP management representation letter template.
  • Consider whether an uncovered loss or non-compliance should be communicated to the plan's governance body under AU-C 260.

Frequently asked questions

Does a 401(k) plan need a fidelity bond?

Yes, unless it is exempt. The DOL states the requirement applies to most ERISA retirement plans and many funded welfare plans.

What is the minimum and maximum bond amount?

At least 10% of funds handled in the preceding plan year, with a $1,000 minimum and a $500,000 maximum per person per plan, or $1,000,000 for plans holding employer securities.

Can the plan pay for the bond?

Yes. The DOL states plan assets may be used because the bond protects the plan.

Is a crime or fidelity policy purchased for the company enough?

Only if the plan itself is a named insured, or otherwise specifically identified, so it can recover, and the bond meets the amount, surety and deductible rules.

Does fiduciary liability insurance replace the bond?

No. It covers breaches of fiduciary duty and does not satisfy Section 412. The Form 5500 instructions say it cannot be reported on the bond line.

Sources

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

Part of CORAA University · Tax and compliance for CPA firms: related guides, calculators and templates.

Share

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required

Keep reading
Tax and Compliance
Accuracy-Related Penalty Under Section 6662: The 20 Percent Rate, Substantial Understatement Thresholds and Reasonable Cause Documentation
Auditing Standards
Other Auditors Under PCAOB Standards: AS 1201 Supervision Versus AS 1206 Dividing Responsibility
Auditing Standards
Using an Auditor-Engaged Specialist Under PCAOB AS 1210