APRIL 22, 2016 BENEFITS & COMPENSATION UPDATE By: Norman J. Misher, Allen J. Erreich, Judy M. Hensley, Charles C.

Shulman and Chase B. Steinlauf In This Issue:     ERISA Fiduciaries, Privacy and Cybersecurity IRS Adopts Flexible Position to Mid-Year Changes to Safe Harbor Plans Form 5500 Updates ESOP Disqualified for Violation of Anti-Assignment Rules ERISA Fiduciaries, Privacy and Cybersecurity The new frontier facing ERISA plan fiduciaries concerns the privacy and security of sensitive participant information (not just protected health information but also personally identifiable information). While the extent of a fiduciary’s responsibility to protect private participant data remains uncertain, ERISA can be interpreted to impose a general duty to protect this data when collected and stored as part of a plan’s administration.

Moreover, plans may be subject to federal and state privacy and security laws that are not preempted by ERISA. ERISA does not expressly address the extent to which fiduciaries are required to protect private participant data. However, plan fiduciaries should be cautioned against assuming that the responsibility falls to the plan’s third-party vendors. Possible theories ww w.

ro b e rts an d ho ll an d. co m 1 2 3 4 of liability against plan fiduciaries might include that: the data is a plan asset subject to fiduciary protection; the data is protected under ERISA’s general fiduciary duty of loyalty and duty to act for the exclusive benefit of plan participants; a data breach might reflect a fiduciary’s failure to carry out his duties prudently; and a breach may violate state consumer protection and privacy laws that are not preempted by ERISA. Recognizing the size of the privacy and cybersecurity issue affecting ERISA plans, the ERISA Advisory Council, which advises and provides recommendations to the DOL on employee benefit matters, announced in March that it is undertaking to prepare a report to the DOL this year on the issue with checklists and other educational tools. Until the DOL issues formal guidance on the topic, plan fiduciaries are well-advised to develop and implement strategies to address 1 . privacy and security concerns. Some best practices for fiduciaries to follow include: IRS Adopts Flexible Position to Mid-Year Changes to Safe-Harbor Plans • Safe harbor 401(k) plans are exempt from certain nondiscrimination testing if they meet certain requirements, including that the plan sponsor makes a minimum level of matching or other employer contributions, provides participants with a so-called “safe harbor notice” and maintains the safe harbor plan provisions unchanged for the entire 12month plan year, subject to certain limited exceptions. • • • • • • Establish a person, or a working group that includes a privacy and security expert, an ERISA expert and a plan administrator, to be responsible for the plan’s privacy and data security issues; Have written policies and procedures, including an employee manual and training program for personnel who handle private participant data; Have a technology expert routinely review software, hardware devices and data storage systems used by the plan; Conduct initial and ongoing due diligence on vendors that will have access to plan data, perhaps through a questionnaire or other assessment tool, and require vendors to provide periodic audit reports of their privacy and security systems and practices; Obtain appropriate representations and warranties from vendors in their service agreements and review indemnity provisions to determine whether they reflect an appropriate allocation of liability and risk; Develop response procedures to apply in the event of a security breach; and Review commercial general liability, property and fiduciary liability insurance policies to evaluate coverage for cybersecurity risks and consider obtaining cybersecurity insurance to ensure adequate protection. Recognizing that eliminating entirely the risk of a cyberattack may be nearly impossible in today’s world, fiduciaries should, as is the case with any fiduciary duty, approach privacy and cybersecurity issues in terms of developing and implementing a prudent process to manage that risk. ww w. ro b e rts an d ho ll an d. co m Practitioners have long been concerned over what should be considered a safe harbor plan provision that is not permitted to be amended mid-year.

Guidance issued earlier this year in IRS Notice 2016-16 provides some much-needed clarification that helps address this concern. Permissible Mid-Year Changes Notice 2016-16 clarifies that certain changes to safe harbor plans made on or after January 29, 2016 do not violate the safe harbor qualification requirements simply because they occur mid-year. A “mid-year change” for this purpose includes a change that is effective in the middle of the plan year or effective retroactive to the beginning of the plan year but adopted after the start of the plan year. If a mid-year change alters the plan’s required safe harbor notice content, generally speaking, an updated notice describing the change must be provided 3090 days before its effective date, and employees must be given the opportunity to change their deferral election before the effective date. An updated notice or new election opportunity is not required if the mid-year change does not alter the required content of the safe harbor notice. 2 .

Impermissible Mid-Year Changes Form 5500 Updates Unless certain conditions are met, current IRS regulations expressly prohibit: New IRS Compliance Program Targeted at 5500s and 5330s • a mid-year adoption of a short plan year or other change to the plan year; mid-year conversion to safe harbor plan status; and mid-year reduction or suspension of safe harbor contributions. The IRS is currently engaged in a new compliance project that is intended to advise plan sponsors of missing, incomplete or inconsistent data relating to filed Form 5500s and Form 5330s (Return of Excise Taxes Related to Employee Benefit Plans). Notice 2016-16 adds to this list by expressly prohibiting the following mid-year changes, unless required by a mid-year change in law: Under the program, if an issue is discovered as part of an initial review by the IRS, the plan sponsor is sent a letter and asked to explain or correct the issue(s) within a specified time frame and file an amended form, if applicable. • • • • • • increasing the number of years of service needed for a participant to vest in his safe harbor contribution account balance under a qualified automatic contribution arrangement (QACA); reducing the number of employees eligible to receive safe harbor contributions; converting the type of safe harbor (e.g., from traditional to QACA (or vice versa)); and (i) modifying or adding a matching contribution formula (or the compensation used in the formula) to increase the amount of matching contributions, or (ii) permitting discretionary matching contributions, unless, in either case, the change is adopted at least 3 months before the end of the plan year, applied retroactively for the entire plan year and the updated notice and new election requirements described above are met. Safe harbor plan sponsors should still consult with their legal advisors before making a mid-year change to determine whether the proposed amendment is permitted or if additional regulatory requirements apply. ww w. ro b e rts an d ho ll an d. co m If a plan sponsor is contacted under this compliance program, the plan is not considered to be under audit, as plan records are not examined, and the plan does not lose access to certain IRS correction programs. However, the likelihood of a subsequent audit may be increased if a plan sponsor contacted under the program does not timely or fully respond. IRS New Form 5500 Compliance Questions The IRS has recently provided further guidance regarding new legal compliance questions that were added to Form 5500 in 2015. The questions relate to a variety of topics, including the plan’s method of complying with minimum coverage and nondiscrimination requirements, the plan’s trust and trustee and the status of recent plan amendments, restatements and IRS determination or opinion letters. While the IRS initially informed plan sponsors and practitioners that the new legal compliance questions were optional, the IRS 3 .

has now announced that the questions should not be answered at this time. Still, some or all of these legal compliance questions are likely to become mandatory at some point in the future. As a result, it is recommended that plan sponsors take the time now to carefully review the compliance questions with their advisors in order to ensure that their plans are currently in compliance with the applicable legal requirements and that they have the information necessary to answer the questions. DOL Project to Update Form 5500 The DOL has recently informally advised practitioners of an ongoing project to update Form 5500 and its various schedules, including possibly the addition of certain audit disclosure questions, the simplification of Schedule C (relating to service provider compensation disclosures) and clarifications to Schedule H (relating to financial disclosures). The potential revisions have not yet been publicly released. ESOP Disqualified for Violation of AntiAssignment Rules The Tax Court has upheld the IRS’s disqualification of an employee stock ownership plan (ESOP) that allowed the transfer of a wife’s vested benefits to her husband following their divorce without obtaining a “qualified domestic relations order” (QDRO). An ESOP is a stock bonus plan designed to invest in qualifying employer securities and may be coupled with either a profit-sharing plan or a money purchase plan.

In order to receive favorable tax treatment, ESOPs must comply in form and operation with the taxqualified plan rules, including the requirement that a plan provide that benefits may not be assigned or alienated unless a ww w. ro b e rts an d ho ll an d. co m statutory exception applies.

A key exception to the anti-assignment rule is for assignments of a participant’s benefit to an “alternate payee” (a spouse, child or dependent) of the participant pursuant to a QDRO. In Family Chiropractic Sports Injury & Rehab Clinic, Inc. v. Commissioner, TC Memo 2016-10, Richard Leavitt, a chiropractor, and his wife, Heidi, were employees of a chiropractic business and the sole participants in an ESOP established in 1999 to invest primarily in securities of the business.

As required by the tax-qualified plan rules, the ESOP document prohibited the assignment or alienation of ESOP benefits except as permitted by law. When Richard and Heidi divorced in 2007, without referencing the ESOP, the final divorce decree awarded each 50% ownership of the chiropractic business. In 2009, in corporate documents – and without obtaining a QDRO – Heidi agreed to relinquish her ownership in the business to Richard, including her vested right to the shares held in her ESOP account. In 2010, Heidi’s shares in her ESOP account were reallocated to Richard’s ESOP account. The Tax Court concluded that the IRS did not abuse its discretion in disqualifying the ESOP for 2010 and all later years, because, in permitting the transfer of Heidi’s vested shares to Richard, the ESOP violated the anti-assignment rules applicable to taxqualified plans and failed to follow the terms of the plan document. This case illustrates the importance for taxqualified plans to have procedures in place to prevent the payment of a participant’s benefit to another person unless the QDRO or another permitted exception applies. 4 .

This update is not intended to provide legal advice with respect to any particular situation, and no legal or business decision should be based solely on its content. If you have any questions about this update, please contact: Norman J. Misher 212-903-8733 nmisher@rhtax.com Allen J. Erreich 212-903-8769 aerreich@rhtax.com Judy M. Hensley 212-903-8737 jhensley@rhtax.com Charles C.

Shulman 212-903-8687 cshulman@rhtax.com Chase B. Steinlauf 212-903-8736 csteinlauf@rhtax.com The Employee Benefits and Executive Compensation Group of Roberts & Holland LLP concentrates on a wide variety of employee benefits and executive compensation matters in both the transactional and compliance contexts. We focus on tax, ERISA and other legal considerations relating to all aspects of employee benefit plans, programs and arrangements, including design, administration and compliance of tax-qualified plans and ERISA fiduciary matters for investment funds and plan fiduciaries. We also regularly represent clients in designing, negotiating and drafting equity compensation arrangements and nonqualified deferred compensation plans, as well as executive employment, severance and change-in-control agreements and provide advice on the associated ERISA and tax implications. ww w.

ro b e rts an d ho ll an d. co m 5 .