SECURE 2.0's auto-enrollment mandate went live for new 401(k) and 403(b) plans with the 2025 plan year. This post covers who is covered, the EACA mechanics, the five exceptions, and the fact that decides coverage: the adoption date.
A 401(k) plan signed on December 30, 2022 carries an obligation that an otherwise identical plan signed on December 28, 2022 will never have. A two-day difference has a permanent consequence. SECURE 2.0 built that edge into the automatic-enrollment mandate, and many plan sponsors never noticed it arrive.
The rule went live for plan years beginning after December 31, 2024. For a calendar-year plan, that means January 1, 2025, and it has been running for more than a year. The question for advisors now is whether the newer plans on your book did what the law required in their 2025 payroll.
People call it SECURE 2.0 Section 101. The authority that matters is Internal Revenue Code Section 414A, Requirements Related to Automatic Enrollment. When you document a plan's compliance, cite 414A. A recordkeeper, an auditor, or the advisor who inherits this client will look to that section, and it carries the penalty.
The penalty is serious. A covered plan that fails to include the required arrangement can lose qualified status for its cash-or-deferred arrangement. That goes beyond a late-filing penalty or a corrective contribution to whether the deferral feature is qualified at all. For a sponsor serving as the named fiduciary, that lands harder than most compliance items.
414A applies only to 401(k) and 403(b) cash-or-deferred arrangements established after December 29, 2022, the day SECURE 2.0 was enacted. A plan established on or before that date is grandfathered, permanently, no matter how large the employer later grows.
The trap is that established means the adoption date, the date the plan was signed. The effective date does not control. A plan adopted in November 2022 with a January 2023 effective date is grandfathered. A plan adopted in March 2023 and made retroactively effective to an earlier period is covered. If you check the effective date and stop there, you will get this wrong on real client files. Pull the signature page.
A covered plan must run an Eligible Automatic Contribution Arrangement, an EACA. The eligible part matters, because it carries participant protections a bare automatic-enrollment feature lacks. The mechanics:
One design note: set the initial default at 10 percent and you have already reached the minimum escalation cap, which removes the annual step-up work. A higher start also helps the people in the plan, who tend to leave the default where it sits.
There are five exceptions, and two of them expire in a way that bites later.
The small-employer and new-business exceptions are timers. A client exempt today because they employ eight people, or incorporated two years ago, becomes subject to the mandate on a date you can calculate now. Put it on a calendar, with lead time to amend the document and program the recordkeeper before the deadline.
Mergers and pooled plans are where grandfathered status survives or dies. Under the IRS proposed regulation, merging two pre-enactment plans does not create a newly established plan, and a spin-off from one is generally still pre-enactment. For MEPs and PEPs, coverage is tested employer by employer, so a grandfathered employer joining a pooled plan keeps its exemption by default. Merge a grandfathered plan into a newer covered plan, however, and you can trip the mandate. In M&A and pooled-plan work, the deal structure is the compliance question.
The IRS issued proposed regulations under 414A in January 2025. Until final rules take effect, which happens only for plan years beginning more than six months after issuance, plans comply with the statute under a good-faith, reasonable interpretation. The proposed rule is the best map available, and it confirms a point to check on each affected plan: long-term part-time employees generally have to be auto-enrolled too. That population is the most likely to slip through a payroll setup.
Strip away the Code sections and this mandate changes the default for people who would otherwise have saved nothing, and it gives the newly enrolled 90 days to change their minds and get their money back. Whether that feels like a benefit or a confusing first paycheck depends on what the worker is told. Confirm that the document and recordkeeper support the 90-day unwind and that the 2025 defaults went in correctly. Then make sure someone explained, in plain language, what happened to that first deduction and how to reverse it. Auto-enrollment sets the starting point, and the advisor handles the rest.
We're onboarding advisory firms now. Apply and we'll reach out, usually within one business day.