The ERISA Fidelity Bond Your 401(k) May Be Missing: The 10% Rule, the $1,000 Floor, and the $500,000 Cap

If you sponsor a 401(k), there is a federal insurance requirement you have probably never thought about — and the IRS lists a missing or inadequate bond among the top compliance failures it finds when it examines retirement plans. Every person who handles your plan's money must be covered by an ERISA fidelity bond worth at least 10% of the funds they handle. Skip it, and you are not just out of compliance: you have handed the Department of Labor a reason to audit your plan, and you may be personally on the hook for losses the bond should have covered.

The good news is that this is one of the cheapest compliance items a small business will ever buy. Most bonds cost a few hundred dollars a year. Here is who needs one, how much coverage the law requires, and how a fidelity bond differs from the fiduciary liability insurance your advisor may already have sold you.

What an ERISA Fidelity Bond Actually Covers​

An ERISA fidelity bond — sometimes called an ERISA bond or 401(k) bond — is a form of surety protection against fraud or dishonesty by the people who touch plan money. If someone with access to the plan embezzles contributions, forges a distribution check, or siphons funds through a fake vendor, a claim against the bond restores the missing money to the plan.

Three parties are involved in every bond:

• The principal — the person handling plan funds, whose honesty is being guaranteed.
• The obligee — the plan itself, which receives the payout if a loss occurs.
• The surety — the company that issues the bond, pays the plan, and then pursues the wrongdoer for reimbursement.

That structure matters because it answers the most common misunderstanding: the bond protects the plan, not you. It does not shield fiduciaries from lawsuits, cover honest mistakes, or pay for defense costs. It exists so that participant accounts get made whole when someone steals from them.

ERISA Section 412 has required this protection since the law was enacted. It applies to 401(k) plans, other pension plans, and funded welfare plans alike — basically any employee benefit plan where someone could divert assets.

Who Has to Be Bonded​

The short answer is broader than most sponsors expect: every plan fiduciary and every other person who "handles" plan funds or other property must be bonded. Handling is defined by what someone can do, not by their job title. If a person's duties give them the power to cause a loss to the plan, they handle funds. That includes anyone who can:

• Sign checks or authorize transfers out of plan accounts
• Approve or process distributions, loans, or hardship withdrawals
• Transmit employee deferrals or employer contributions to the plan
• Change bank instructions or investment allocations for plan assets

In a small business, this usually means the owner, the office manager or bookkeeper who runs payroll, and anyone else with signing authority. It is not limited to employees: independent contractors and third-party administrators who handle plan money are subject to the same requirement, and the Department of Labor has confirmed there is no blanket exception for outside administrators. Banks, insurance companies, and registered broker-dealers have their own exemptions under the statute, but your payroll clerk does not.

One practical consequence: a solo 401(k) covering only you (and your spouse, if employed by the business) generally sits outside the part of ERISA that imposes the bonding rule, and the one-participant Form 5500-EZ has no bond question. But the moment you hire an employee who becomes eligible for the plan, the plan becomes covered — and the bond clock starts ticking.

How Much Bond You Need: The 10% Rule​

The required amount is recalculated every plan year and follows a simple formula with a floor and a ceiling:

• Base amount: at least 10% of the funds handled during the preceding reporting year.
• Floor: no less than $1,000 per plan, no matter how small the plan is.
• Ceiling: no more than $500,000 per plan official for any one plan.

So a plan with $800,000 in assets needs at least an $80,000 bond. A startup plan with $6,000 in it still needs the $1,000 minimum. And a large plan with $12 million in assets caps out at $500,000 — 10% would be $1.2 million, but the law does not require more than the ceiling.

There is one important exception to the ceiling: if the plan holds employer securities — typically company stock in the 401(k) lineup — the maximum jumps to $1 million per plan official. Congress raised that cap for plan years beginning after 2007 after a wave of scandals in which employees' retirement savings were concentrated in collapsing employer stock. If your plan offers a company-stock fund, size the bond against the higher limit.

Three structural rules come with the amount:

1. No deductible is allowed. The bond must cover the first dollar of loss.
2. It must name the plan. The bond has to be in the name of the plan or trust, or must specifically state that it covers the plan. A bond written only in your company's name does not satisfy the requirement.
3. It must come from an approved surety. Only companies on the Treasury Department's list of approved sureties (Circular 570) can issue a qualifying bond. Any mainstream commercial surety qualifies, but verify before you buy.

Revisit the Amount Every Year​

The 10% figure is tied to the funds handled in the preceding year, which means a bond set correctly at launch drifts out of compliance as the plan grows. A plan that started at $200,000 with a $20,000 bond and grew to $600,000 now needs $60,000 of coverage. Auditors and examiners check the bond amount against current assets, not against what was correct three years ago. Put the bond on the same annual checklist as the Form 5500 and the plan's year-end valuation.

Small plans get an extra reason to right-size the bond: to qualify for the Department of Labor's audit waiver for plans with fewer than 100 participants, the bond generally must cover 100% of the plan's non-qualifying assets (things like real estate, limited partnerships, or anything without a regulated-entity valuation). An under-sized bond can cost you the waiver — and a full plan audit costs far more than the extra premium.

The Bond Is Not Fiduciary Liability Insurance​

This is the confusion that sinks the most sponsors. Fiduciary liability insurance and an ERISA fidelity bond sound similar, cover the same plan, and are often bought from the same agent. They are completely different products, and one never substitutes for the other:

It is entirely possible — and common — for a sponsor to carry a generous fiduciary liability policy and still be in violation of the bonding requirement. If your advisor set you up with fiduciary coverage years ago, pull the policy and check whether a fidelity bond was purchased alongside it. Many sponsors discover the bond was never bought at all.

How a Missing Bond Gets Caught​

You do not need a disgruntled employee to report you. The enforcement mechanism is largely automatic:

• Form 5500 asks the question directly. Schedules H and I both carry a compliance line asking whether the plan was covered by a fidelity bond and in what amount. Answering "no" — or reporting an amount below 10% of assets — puts the deficiency in writing, signed under penalty of perjury, every single year.
• The IRS treats it as a top exam issue. The agency's examination guide for retirement plans lists inadequate or missing fidelity bonds among the most common compliance failures. Examiners know exactly where to look.
• The Department of Labor monitors the answers. EBSA investigators routinely pull plans that report no bond or an insufficient one, and a bond deficiency is one of the easiest triggers for a full plan audit — which then examines everything else, from late deferrals to fee reasonableness.
• Fiduciaries face personal liability. There is no fixed-dollar fine that says "missing bond: $X." Instead, the exposure is worse: fiduciaries can be held personally liable for plan losses that a proper bond would have covered. The bond you skipped to save $300 a year becomes the measure of what you owe out of pocket.

In short, the bond question on the Form 5500 turns an invisible gap into a signed confession. Fixing it before filing season is one of the highest-leverage compliance moves a small plan sponsor can make.

What It Costs and How to Buy One​

Pricing is refreshingly boring. Most ERISA bonds cost roughly $100 to $500 per year, with the premium driven by the bond amount rather than anyone's credit score:

• A small plan needing $50,000–$100,000 of coverage typically pays around $200–$300 a year.
• A plan at the $500,000 statutory cap typically pays $400–$500 a year.
• A plan needing the $1 million employer-securities limit typically pays $600–$900 a year.

You can buy one through your company's property-and-casualty insurance agent or directly from a surety company online; several specialize in ERISA bonds with short applications. For amounts up to $500,000 the process is usually a one-page form stating the plan name, the bond amount, and the plan year. Confirm three things before you pay: the surety appears on Treasury Circular 570, the bond names the plan (not just your company), and the amount is at least 10% of the funds handled last year.

Keep the Bond on Your Books, Not Just in a Drawer​

Like every recurring compliance item, the bond needs a home in your bookkeeping routine, not just a PDF in an email thread. Three habits keep it current:

• Book the premium consistently. Decide whether the company or the plan pays the premium, record it the same way every year, and keep the invoice with the plan's permanent records. If the plan pays, the expense belongs in the plan's accounting, not buried in general office insurance.
• Tie the renewal to the Form 5500 calendar. When you pull year-end asset figures for the filing, compute 10% on the spot and compare it to the current bond. If assets grew past the coverage, increase the bond before you sign the return.
• File the bond with the plan document. Auditors ask for the bond instrument itself — amount, plan name, surety, and effective dates. Store it alongside the adoption agreement and determination letter so a document request takes minutes, not weeks.

If you run your books in plain text, this kind of annual checklist item is exactly what version-controlled accounting handles well: the bond amount, premium, and renewal date live in your ledger history alongside every other recurring obligation. The Beancount documentation on recurring transactions shows patterns for tracking renewals like this automatically.

Five Mistakes That Leave Plans Unbonded​

1. Assuming the recordkeeper's bond covers you. Your 401(k) provider is bonded for its handling of funds. That coverage does not extend to your payroll clerk transmitting deferrals or your signature on the plan's checking account. The plan needs its own bond covering its own handlers.
2. Setting the amount once and forgetting it. The most common deficiency is a bond that was correct years ago. Growth in assets without growth in coverage is still a violation.
3. Bonding the company instead of the plan. If the instrument does not name the plan or specifically state it covers the plan, examiners treat it as no bond at all.
4. Accepting a deductible. Commercial crime policies often carry deductibles; ERISA bonds cannot. A policy with even a small deductible fails the requirement.
5. Waiting for the audit letter. By the time EBSA or the IRS asks, you owe the bond and you are explaining everything else they decided to examine. A $300 premium bought this week beats a corrective-action plan next year.

Keep Your Plan's Paperwork as Clean as Its Investments​

An ERISA fidelity bond is the rare compliance item that is simultaneously mandatory, cheap, and easy to get wrong through sheer inattention. Pull your Form 5500, check the bond line against 10% of plan assets, and confirm the instrument names the plan and comes from an approved surety. Ten minutes of verification now beats an audit trigger at filing time.

As your plan grows, keeping every recurring obligation — bond renewals, premium payments, filing deadlines — visible in one set of books is what turns compliance from a scramble into a routine. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — no black boxes, no vendor lock-in. Get started for free and see why developers and finance professionals are switching to plain-text accounting.