On November 18, 2024, the U.S. Department of Labor (DOL) issued a notice announcing it has started accepting information from retirement plan administrators and authorized service providers of ERISA-covered plans on a voluntary basis to populate the new Retirement Savings Lost and Found (RSLF) database and expects it to go live for public use by December 29, 2024. This notice of information collection request (ICR) describes the data elements the DOL seeks and how to submit the information. The notice was accompanied by a DOL News Release and Fact Sheet on the subject.
Section 303 of the SECURE 2.0 Act of 2022 (SECURE 2.0) directs the DOL, in consultation with the U.S. Department of the Treasury (Treasury), to establish the RSLF by December 29, 2024, two years after the law’s enactment. This online searchable database will allow people to find the administrator of a plan in which they are or were a participant or a beneficiary, to allow them to make a claim for any vested benefits owed to them. The driving force behind the RSLF is to help address the ongoing problem of missing participants in employer-sponsored retirement plans. Although submitting information to the RSLF is voluntary, the DOL encourages plan administrators to participate to help reduce the number of missing participants and beneficiaries who may not realize they are owed retirement plan benefits.
This final version of the ICR reflects comment letters the DOL received on two earlier proposed ICR versions. On April 15, 2024, the DOL published its initial proposed ICR and potential ways for plans to submit the data, followed by a revised proposal on September 12, 2024, which significantly pared down the ICR list and announced the method to submit the data. This final version is substantially similar to the September 12, 2024, revised proposed version, with a few new updates the DOL describes as “improvements” made in response to comment letters received.
The November 18, 2024, announcement provides guidance as outlined below, with the new updates first announced in the final version of the ICR denoted as such.
Who may submit information to the RSLF
Retirement plan administrators and authorized third parties, such as the plan’s recordkeeper, third-party administrator (TPA), or other service provider, may submit information to the RSLF. Third-party filers must obtain authorization from a responsible plan fiduciary of each plan with information on the submission file before submitting the information. Third-party filers and plan administrators should retain documentation of the authorization for at least the required ERISA record retention period (generally at least six years after the filing date).
What to submit
Only information for separated vested participants age 65 or older who are owed a benefit from the plan is requested along with identifying information about the plan, plan sponsor, and plan administrator.
- Plan identification. The plan name and three-digit plan number as shown on the most recent Form 5500.
- Plan sponsor identification. The plan sponsor’s name, employer identification number (EIN), and telephone number as shown on the most recent Form 5500.
- Plan administrator identification. The plan administrator’s name, EIN, in care of name (if any), telephone number, and mailing address as shown on the most recent Form 5500.
- Participant information. The name, Social Security number (SSN), or individual taxpayer identification number (ITIN) of participants who:
- Have separated from service and are vested
- Are owed a benefit from the plan
- Are age 65 or older
New: The DOL clarifies data collection regarding participants in pay status and beneficiaries: - Participants in pay status. Although separated vested participants aged 65 or older who are in pay status are not “missing” or “lost,” the final ICR requests data on these individuals because they are still owed a plan benefit until final payment is made. While SECURE 2.0 primarily focuses on missing and lost individuals, it is not limited to them.
- Beneficiaries. The final ICR does not request data on beneficiaries. Rather, it requests data on deceased participants who would be age 65 or older and who were still owed plan benefits so that their beneficiary or survivor can search the RSLF for those benefits.
- New: Fully paid out participant information. A notation of “Paid” and the date full payment was made if a previously reported individual is no longer owed plan benefits because their benefits have since been fully paid. This applies when filers submit updated information.
When to submit
The DOL seeks first submissions as soon as possible before the December 29, 2024, opening of the RSLF searchable online database, with at least annual updates being submitted thereafter (with no specific due date). The agency strongly encourages more frequent submissions (e.g., quarterly) to keep the database current.
How to submit
Filers should use the DOL’s Excel/CSV information collection template and instructions located on the RSLF website at https://lostandfound-intake.dol.gov/template.xlsx and upload the completed information file at https://lostandfound-intake.dol.gov/. The template and upload process allows filers to submit information on multiple plans simultaneously. The completed RSLF template should not be filed through the EFAST2 Form 5500 filing system.
New: Before using the RSLF, filers must register for a no-cost Login.gov account and create a user profile that involves verifying their identity. If the filer already has an existing Login.gov account, additional information may be required to use the RSLF. The Login.gov registration process requires the user to provide their email address, legal first and last name, date of birth, Social Security number, and photos of the front and back of their active driver's license (requiring use of a mobile device to take and upload the photos and as part of the verification process).
New: Data security and privacy
DOL measures. According to the DOL, it “has taken great care to ensure that participant and beneficiary data submitted to the Lost and Found is secure and confidential.”
Plan fiduciary duty. The DOL stated that plan fiduciaries who voluntarily submit data to the RSLF (either directly themselves or through their authorized third party) and follow the program’s data transmittal instructions will satisfy their ERISA fiduciary duties and obligations to ensure proper mitigation of cybersecurity risks and to promote participants’ and beneficiaries’ interests in securing promised plan benefits. Further, they will not be subject to liability under ERISA if the DOL’s conduct results in a security failure involving the RSLF.
Regarding the interaction of state privacy laws with this voluntary ICR under federal law, the DOL noted:
- It is unclear whether any state privacy laws—which vary in their scope and application—apply to these specific circumstances.
- The DOL has explicit authorization under SECURE 2.0 to collect participants’ “name and taxpayer identifying number,” for which state privacy laws frequently contain an exemption when information is “provided to government authorities to comply with a regulatory inquiry.”
- If a plan fiduciary or plan service provider “acts reasonably and in good faith” in submitting information to the RSLF, the DOL will not bring suit or other enforcement action against them under ERISA for doing so without first obtaining participant consent if required by state law.
RSLF user authentication. As the RSLF will be a publicly accessible online database that houses sensitive personal information, the DOL indicated that it has incorporated design features to deal with the risk of that information being unintentionally exposed beyond the intended audience or the potential of it being used for fraudulent purposes. Such features include requiring each individual user wishing to search the RSLF to create an identity-authenticated account and limiting their search results to information relating to them only.
Participants’ right to opt out. SECURE 2.0 allows individuals to contact the DOL to opt out of inclusion in the RSLF. In the final ICR, the DOL provides guidance on how participants can exercise their opt-out rights “in a convenient and easy-to-use mechanism” by submitting an online request at https://www.dol.gov/agencies/ebsa/about-ebsa/ask-a-question/ask-ebsa for database administrators to carry out. Opting out of the RSLF will suppress the participant’s information from appearing in RSLF searches. The DOL is considering adding an online self-service opt-out feature within the RSLF itself as a future enhancement.
New: Use of plan assets to pay for voluntary RSLF reporting expenses
As clarification on the use of plan assets to pay for costs associated with voluntary RSLF reporting (e.g., costs of collecting, formatting, and transmitting the data), in the final ICR the DOL expressed its view that “the reasonable cost of voluntarily reporting the data… is a permissible use of plan assets because the purpose of the reporting is to connect separated vested participants with benefits owed them under the plan.”
New: Nonuse of RSLF information for DOL audits clarified
SECURE 2.0 restricts the ways in which the collected data may be used. In response to a commenter’s concern that the DOL would use RSLF information to audit plans, the DOL dispelled that concern and expressed its commitment to respect the law and only use the data to help individuals locate plans that may owe them benefits and limit disclosure of the information to only DOL employees whose official duties relate to that specific purpose.
New: Future DOL efforts to expand the scope of the RSLF
After considering the comment letters it received on its earlier proposals, the DOL is starting its RSLF information collection with a narrow focus on separated vested individuals age 65 or older who are owed a plan benefit because these participants, being at or near retirement age, are expected to benefit soonest from having access to the online searchable database. However, SECURE 2.0 authorizes the DOL to collect a more comprehensive list of information. Consequently, the DOL indicated that future efforts will expand the RSLF over time to fully complete the scope of the database as intended by SECURE 2.0.
Coordination with Form 8955-SSA data
The DOL explained that much of the participant information enumerated in SECURE 2.0 is currently reported to the IRS on Form 8955-SSA (Annual Registration Statement Identifying Separated Participants With Deferred Vested Benefits), which the IRS provides to the Social Security Administration (SSA) and the SSA then uses to inform separated vested participants of any employer-sponsored retirement plan benefits they may be owed when they file for Social Security benefits.
The DOL consulted with the Treasury and IRS to seek use of the Form 8955-SSA data to populate the RSLF database, but the IRS initially declined the request due to the tax code’s confidentiality laws protecting information reported on IRS returns from disclosure to other parties, unless a specific exception applies. The DOL nonetheless continued its discussions with the IRS and SSA and now believes the initial concerns are resolved and that it will be able to use the Form 8955-SSA data to populate the RSLF database.
Despite this potential, the DOL acknowledged “that the Form 8955-SSA data may often be inaccurate, outdated, or incomplete.” For example, Form 8955-SSA data often lacks updated reporting if previously reported deferred vested benefits have since been fully paid. To reduce “false positive search results,” the DOL said that “even if Form 8955-SSA data is received, such data would stand to benefit if supplemented by current recordkeeper data,” as “current recordkeeper data can show if benefits have been paid out, whereas Form 8955-SSA data likely cannot.” The DOL believes the final ICR’s nominal voluntary data collection list will allow plans and plan sponsors to submit accurate data to the RSLF and also affords the DOL its best possibility to comply with the Congressional directive to establish the RSLF as an operating searchable database by the December 29, 2024, deadline.
Plan sponsors are advised to consult with their retirement plan consultants and legal counsel to determine whether to participate in this voluntary information collection request and how the DOL’s plans to expand the scope of the information collection in the future may affect them.
Please contact your Milliman consultant with any questions.