Sponsoring a 401(k) Makes You Personally Liable: What Fiduciary Liability Insurance Covers That Your ERISA Bond Doesn't

If your company sponsors a 401(k), you are probably a fiduciary under federal law — and fiduciaries can be held personally liable for plan losses. Under ERISA Section 409(a), a fiduciary who breaches their duties must make the plan whole out of their own pocket, and the Department of Labor tacks on a mandatory civil penalty equal to 20% of any recovery amount. Your house, your savings, your personal bank account: all potentially in reach.

Many small business owners hear this and think, "But I already have the ERISA bond — doesn't that cover me?" It does not. The ERISA fidelity bond protects the plan from theft. It protects you from nothing. Fiduciary liability insurance is the product that protects you, and unlike the bond, nobody requires you to buy it. That gap is exactly why so many sponsors learn about it for the first time from a plaintiff's attorney or a DOL investigator.

This guide explains the difference between the two, what each costs, what fiduciary liability insurance actually covers, and the practical steps to close the gap before it matters.

The ERISA Bond: Required, Narrow, and Not for Your Benefit​

Every person who "handles" plan funds or property — which includes owners, officers, and anyone with authority to move plan money — must be covered by a fidelity bond under ERISA Section 412. This is a legal requirement, not a recommendation.

What the bond covers​

The bond insures the plan against losses from fraud or dishonesty by the people handling its assets. If your payroll clerk diverts employee deferrals or a trustee siphons plan funds, the bond reimburses the plan for the stolen amount.

How much bond you need​

The required amount is straightforward:

• At least 10% of the plan assets handled in the preceding plan year
• Minimum of $1,000 per plan, even for tiny plans
• Maximum of $500,000 per plan — or $1,000,000 if the plan holds employer securities (such as company stock)

Because the 10% figure is tied to assets handled in the prior year, your bond amount must be rechecked every year as the plan grows. A plan that crossed $2 million in assets needs at least a $200,000 bond; sponsors who bought a $50,000 bond at inception and never revisited it are a staple of DOL audit findings.

What the bond does not do​

A bond is a financial guarantee, not insurance. If the surety pays a claim, it can — and will — pursue recovery from the responsible parties. And critically, the bond provides zero defense coverage and zero protection to fiduciaries accused of mismanagement. Late deposits, excessive fees, imprudent fund lineups: the bond is silent on all of them.

Bond premiums are modest — often a few hundred dollars a year — and they may be paid from plan assets. But paying the premium does not buy you any personal protection.

Fiduciary Liability Insurance: Optional, Broad, and for Your Benefit​

Fiduciary liability insurance is written to protect and defend fiduciaries — the company, the plan committee, the trustees, and often individual officers — against claims that they breached their ERISA duties. The DOL does not require it. That is precisely the trap: the thing the law mandates doesn't protect you, and the thing that protects you isn't mandated.

What it typically covers​

Policies vary (there is no standard form), but a good fiduciary liability policy generally covers:

• Defense costs for DOL investigations, participant lawsuits, and regulatory proceedings
• Settlements and judgments arising from alleged breaches of fiduciary duty
• Common small-plan allegations: failure to enroll eligible employees, late or missed employer contributions, imprudent investment selection, failure to monitor recordkeeping fees, and errors in administering loans, distributions, and beneficiary designations
• Related benefit-plan claims under HIPAA, COBRA, and the Affordable Care Act, depending on endorsements

Defense costs deserve emphasis. ERISA suits are uncommon for any single small plan, but each one is brutally expensive: every trustee typically needs their own attorney, and legal bills can burn through a $1 million limit with frightening speed. The insurance is valuable even when you win, because winning still costs six figures.

What it typically excludes​

Read the exclusions before you buy, because they define the real boundary of protection:

• Dishonest, criminal, or deliberately fraudulent acts — theft is the bond's territory, and intentional wrongdoing is nobody's
• The DOL's 20% civil penalty under ERISA Section 502(l) is frequently excluded, though some policies offer limited penalty coverage
• Settlor functions — decisions made as the employer rather than as a fiduciary, such as designing, amending, or terminating the plan, are generally outside fiduciary-duty coverage (some carriers sell settlor-function endorsements)
• Bodily injury, property damage, and employment practices claims — those belong to other policies
• Prior and pending litigation as of the policy's inception, unless prior-acts coverage is included

What it costs​

For small and mid-sized plans, fiduciary liability insurance is one of the cheapest management-liability products you can buy:

• A standalone $1 million policy for a small plan typically runs $500 to $2,500 per year, priced mainly on plan assets, participant count, and governance quality
• Broader industry estimates put small-to-mid-plan premiums in the $1,000 to $10,000 per year range as assets and complexity grow
• Bundled with directors-and-officers (D&O) coverage in a management liability package, the fiduciary add-on often costs roughly 15% of the D&O premium — frequently the most cost-effective way to buy it

One payment rule to get right: unlike bond premiums, fiduciary liability premiums should be paid by the employer, not from plan assets, unless the policy specifically permits the insurer recourse against the breaching fiduciary. When in doubt, the company checkbook is the safe source.

Bond vs. Policy: The Side-by-Side​

The common and dangerous confusion is believing one substitutes for the other. Your D&O policy doesn't fill the gap either: most D&O forms exclude ERISA fiduciary claims. The bond, D&O, and fiduciary liability are three separate instruments covering three separate exposures.

Why This Matters More Than It Used To​

Two trends are pushing fiduciary risk down-market toward smaller plans.

First, ERISA litigation keeps broadening. In 2025, roughly 155 ERISA fiduciary suits were filed, with defined-contribution plans involved in nearly two-thirds of cases. Over the last five years, more than 200 excessive-fee and imprudent-investment settlements have totaled over $1.3 billion. New theories keep emerging — nearly 100 suits over the past three years have challenged how sponsors handle forfeited 401(k) money, and health-plan fiduciary claims now account for more than a fifth of filings. Plaintiff firms that once targeted only mega plans have steadily moved down the asset ladder.

Second, the DOL keeps finding the same small-plan mistakes. Late remittance of employee deferrals remains the single most common 401(k) audit finding: the DOL expects deferrals deposited as soon as they can reasonably be segregated from company assets, and for small plans the safe harbor is seven business days. One late payroll cycle can trigger a multi-year investigation, corrective interest payments, and the 20% penalty on recoveries. Missed deferral elections, unmonitored recordkeeping fees buried in 408(b)(2) disclosures, and uncorrected ADP/ACP testing failures round out the greatest-hits list — every one of them a fiduciary breach the bond won't touch.

What to Do: A Five-Step Action Plan​

1. Right-size your ERISA bond every year​

At the start of each plan year, confirm the bond covers at least 10% of prior-year plan assets (minimum $1,000, maximum $500,000 or $1 million with employer securities). Make sure every person who handles plan funds is covered, the plan is named as the insured, and the bond comes from a Treasury-listed surety. A two-minute annual check prevents one of the easiest DOL findings to avoid.

2. Buy fiduciary liability insurance — standalone or bundled​

Get quotes for at least $1 million in coverage. If you already carry D&O insurance, ask your broker about adding fiduciary liability to the management liability package; if not, a standalone policy for a small plan is inexpensive. Confirm the policy names the plan's legal entity, the committee, and individual fiduciaries as insureds.

3. Mind the coverage details that matter at claim time​

Ask your broker these questions before binding:

• Are defense costs inside or outside the limit? Outside is better — defense spending won't erode the amount available for settlements.
• Is there prior-acts coverage, or does the retroactive date leave past years exposed?
• Does the policy cover DOL penalty exposure, voluntary-correction costs (VFCP/EPCRS filings), or HIPAA/COBRA claims?
• Are settlor functions covered or excluded?
• What is the deductible per claim, and does each trustee trigger a separate retention?

4. Fix the operational habits that create claims​

Insurance covers allegations, but clean operations prevent them. Deposit deferrals on the fastest schedule you can sustain — same-day or next-day beats the seven-day safe harbor. Benchmark recordkeeping fees against comparable plans at least annually and document the review. Respond to participant enrollment elections immediately, keep committee meeting minutes, and self-correct errors through the DOL's Voluntary Fiduciary Correction Program or the IRS correction system before an auditor finds them.

5. Don't assume delegation eliminated your duty​

Hiring a 3(38) investment manager or outsourcing to a bundled recordkeeper transfers tasks, not ultimate accountability. You retain the duty to prudently select and monitor every service provider — and to document that you did. Keep the fee disclosures, the benchmark reports, and the minutes. Paper trails win fiduciary cases.

Keep Your Plan Records Audit-Ready From Day One​

Every defense in this article — timely deposits, monitored fees, documented decisions — depends on clean, complete financial records. When deferral dates, employer contributions, fee payments, and corrections all live in one transparent ledger, answering a DOL investigator or an auditor takes hours instead of weeks. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — no black boxes, no vendor lock-in. Get started for free and see why developers and finance professionals are switching to plain-text accounting.