From year to year (and sometimes week to week), there never seems to be a shortage of issues and questions for employee benefit plan sponsors and fiduciaries, as well as compensation committees, to address in order to maintain legal compliance of plans and programs. With the passage of the Setting Every Community Up for Retirement Enhancement (“SECURE”) Act at the end of 2019, it is easy to succumb to a reactive mode, which will continue as the myriad of complex rules and regulations are issued and appropriate actions will need to be taken.

As we begin a new year (and a new decade), it is important to not lose sight of other big-picture items—perhaps the practices and procedures that may have been on the back burner for some time or the forward-looking programs desired by your organization—while also digesting the SECURE Act. In this Take 5, members of our Employee Benefits and Executive Compensation practice team highlight just a few of these kinds of topics for consideration and urge you to be proactive in addressing your own tailored project list.

Addressing Cybersecurity for Benefit Plans: What to Do When It’s All at Risk

It is not a secret that the administration of employee benefit plans requires the collection, processing, transmission, and storage of highly sensitive personal information. Plan participants’ personally identifiable information, protected health information, and accumulated plan assets are handled by many parties. As the delivery of employee benefits becomes increasingly more personalized, and information is collated and transmitted through apps and various technological means, this data is even more at risk. While employers are subject to a myriad of evolving data privacy and security laws on all levels regarding the protection of employee data, with increasing complexities considering the global mobility of employees, there is a gap in the required application of these laws in the employee benefit plan context. Questions even arise regarding Employee Retirement Income Security Act (“ERISA”) preemption of such laws as they may relate to the administration of an employee benefit plan governed by ERISA. Yet, in the digital age, a failure by a plan sponsor and ERISA plan fiduciaries to consider the application of these requirements to their employee benefit plan practices does not seem prudent. Court cases have also begun to emerge related to the unauthorized distributions of plan assets, and the alarm bells are ringing.

With personal information and tangible assets at risk, plan sponsors and fiduciaries who have not addressed the cybersecurity risk of their benefit plan programs must take action to do so. Now is the time to make a concerted and coordinated effort to identify all of the data points, service provider arrangements, policies and agreements, in-house and third-party privacy and security practices, data breach notification procedures, indemnification, and liability and insurance protections, just to name a few. It would also be prudent to provide plan fiduciaries with fiduciary training that addresses cybersecurity risks for employee benefit plans and assists them in establishing a road map for tackling these issues.

The Devil Is in the Details: COBRA Notice Class Action Lawsuits Offer a Cautionary Tale for Sponsors

The new year may bring new beginnings for some employees.

A termination of employment that causes a loss of group health plan coverage is the most common qualifying event requiring plan sponsors to send an election notice to participants informing them of their rights to elect continuation coverage under the Consolidated Omnibus Budget Reconciliation Act (“COBRA”).

Dozens of lawsuits were filed in 2019 in Florida’s federal courts against employers alleging technical failures related to their COBRA election notices, including omissions and other deviances from the Department of Labor’s model notice. Several have settled for undisclosed amounts, and at least one has settled for over $1 million.

The allegations in those lawsuits include failures of the notices to (i) provide the plan administrator’s (and/or the COBRA administrator’s) name, address, and telephone number, and (ii) contain one or more required explanatory details about the coverage, how to elect it, the start and termination dates, and payment requirement. The plaintiffs in these cases sought class certification and statutory penalties of $110 per day per person (plus legal fees).

The new year is an important time for plan sponsors, including those outsourcing COBRA administration, to review all of their COBRA obligations, but especially the content of their notices to avoid costly claims and lawsuits.

Plan Distribution Check Is Taxable Even if Uncashed

Retirement plan sponsors and fiduciaries should appreciate the guidance in Rev. Rul. 2019-19 (“Rev. Rul.”), which addresses income inclusion and reporting when participants do not cash plan distribution checks. The guidance is based on the following scenario: A participant with a calendar year taxable year does not cash or roll over a check issued in 2019 for a required plan distribution. Based on these facts, the Internal Revenue Service (“IRS”) held:

• the participant must include the distribution in 2019 income, even though he or she failed to cash the check in 2019;

• the employer must withhold federal income tax from the distribution; and

• the employer must report the distribution in 2019 on Form 1099-R.

The Rev. Rul. is helpful when the plan sponsor is relatively certain that a participant received the check. However, the guidance does not appear to apply to a missing participant, as the Rev. Rul. provides that the Department of the Treasury and the IRS continue to analyze situations involving missing individuals with benefits under a plan. Similarly, when the plan sponsor is not certain that the participant received the distribution, the Rev. Rul. provides no guidance. Plan sponsors should revisit their processes and procedures regarding uncashed plan distributions and missing participants, as well as deceased participants, and ensure that the assets of these participants are in the right hands and being properly reported.

Balancing Student Loan Repayments and Retirement Savings

While many employers have implemented some type of student loan repayment benefit to recruit and retain employees, in recent years, there has been growing discussion about student loan debt affecting employees’ ability to save for retirement. In a widely referenced private letter ruling (“PLR”), the IRS discussed allowing a company to make employer contributions to 401(k) accounts of employees making student loan repayments, even if the employees do not contribute to the plan.

Since the issuance of the PLR, there have been several legislative proposals addressing the student loan debt issue. In March 2019, Senator Ron Wyden reintroduced a bill similar to the PLR that allows employers to contribute to 401(k), 403(b), and SIMPLE (Savings Incentive Match PLan for Employees) individual retirement account (“IRA”) plans that match higher education student loan repayments. Addressing qualified plan nondiscrimination-testing concerns, under the proposal, employees without student loan debt would not be treated as being denied benefits, rights, and feature. In December 2019, Senator Rand Paul introduced the HELPER Act, which would permit individuals to take out up to $5,250 from their 401(k) plan or IRA each year without incurring a penalty. One concern is whether this proposal removes the primary benefit of long-term investing through compound interest because of the use of retirement funds.

While none of these proposals has yet become law, the growing concern that mounting student loan debt is contributing to a potential retirement crisis is pushing employers and legislators to come up with unique solutions outside of regular student loan repayment programs. Employers should monitor these developments as implementation of a viable approach will be desired by many employees with such debts.

Mitigating Your Company’s Equity Plan Risk

U.S. corporations that grant equity awards outside of the United States should be aware of a recent ruling made by a French employment tribunal. The case (Bernard Mourad v. SA Morgan Stanley France, Conseil de Prud’hommes, Paris, 24 juin 2019), which is expected to be heard by France’s Supreme Court, can set important precedent for how pay in the banking industry is structured and may affect award procedures across other industries.

It is common for employees in the banking industry to receive one variable compensation award amount for a calendar year. Typically, a portion of this award is mandatorily deferred over a future time period. These deferred awards are often granted in the form of equity and subject to a time-based vesting requirement, which requires the employee to remain employed through each specified vesting date to retain the award. In form and substance, these deferred awards operate in the same manner and serve the same purpose as long-term incentive awards utilized in other industries.

In Mourad, a French employment tribunal ruled that a former banker at a major global financial institution was entitled to retain his outstanding unvested deferred awards (valued at $1.5 million) for calendar years 2012-2014, despite not satisfying the award’s time-based vesting requirements upon his voluntary resignation in 2015. The former employee argued that he never accepted, and never understood, the English terms and conditions applicable to his awards. The French employment tribunal agreed and did not enforce the U.S. choice-of-law provision. Applying French law, the employment tribunal ruled that the former banker was entitled to retain his awards since he was employed on the last day of each of the calendar years to which the deferred awards related.

In addition to French companies in the banking industry that compensate through the use of mandatory deferral, the final outcome of this case will be relevant for all U.S. companies that grant equity awards outside of the United States. Companies should ensure they have a process whereby award recipients are required to adequately accept the terms and conditions of their award. Without doing so, companies may jeopardize their capability to enforce critical award provisions.

Mitigating the risk associated with your company’s equity plan is critical in today’s environment, and this case serves as a reminder.