20.3 Electronic Delivery Safe Harbors (2002 & 2020) & SECURE 2.0 Paper Statement Requirements

20.3 Electronic Delivery Safe Harbors (2002 & 2020) & SECURE 2.0 Paper Statement Requirements

[!NOTE] The Evolution from Paper Mailings to Digital Disclosures When ERISA was enacted in 1974, "furnishing" a disclosure meant printing physical booklets and mailing them via the United States Postal Service or handing them directly to workers on the factory floor. In the modern digital economy, electronic communication offers unprecedented speed, operational efficiency, and substantial administrative cost savings for retirement plans.

However, digital delivery creates significant regulatory risks regarding the "digital divide"—the reality that not all workers have home internet access, computer literacy, or regular workplace computers. To balance administrative efficiency with participant protection, the Department of Labor (DOL) established two distinct electronic delivery safe harbors: the 2002 Safe Harbor and the 2020 Safe Harbor. Most recently, Congress intervened through Section 338 of the SECURE 2.0 Act of 2022, creating a mandatory statutory balance by reinstating guaranteed paper benefit statements.

---

The General Delivery Rule: 29 CFR §2520.104b-1

Under ERISA §104(b) and DOL Regulation 29 CFR §2520.104b-1(b), the plan administrator must use delivery methods reasonably calculated to ensure actual receipt of material by plan participants and beneficiaries:

• Acceptable Physical Methods: First-class mail to the participant's last known address, personal hand-delivery at the work site, or inclusion in a company publication mailed directly to the employee's home.
• Unacceptable Methods: Merely placing a stack of SPDs or SARs in a company breakroom, leaving booklets on a cafeteria table, or posting notices on a bulletin board does not constitute legal delivery under ERISA.
• The Function of Safe Harbors: A "safe harbor" regulation provides plan fiduciaries with a legal shield. If a plan administrator strictly satisfies all technical requirements of a DOL safe harbor, the administrator is legally deemed to have satisfied the delivery obligation, even if a particular participant later claims they never received or read the document.

---

The 2002 Electronic Delivery Safe Harbor (29 CFR §2520.104b-1(c))

Promulgated in 2002, this safe harbor established the foundational framework for digital disclosures. It divides all potential recipients into two distinct legal classes:

                                  THE 2002 SAFE HARBOR DUAL CLASSIFICATION
                                                    │
                 ┌──────────────────────────────────┴──────────────────────────────────┐
                 ▼                                                                     ▼
    "WIRED AT WORK" EMPLOYEES                                             AFFIRMATIVE CONSENT RECIPIENTS
  • Access to employer's electronic system                              • Non-wired employees (warehouse, retail)
    is an INTEGRAL PART of employment duties                            • Former employees, retirees, beneficiaries
  • Access occurs at ANY location where employee                        • Strict affirmative electronic consent required
    is reasonably expected to perform duties                            • Must demonstrate technical ability to access
  • NO affirmative consent required!                                    • Prior notice of hardware/software requirements

1. "Wired at Work" Employees (No Consent Required)

Under 29 CFR §2520.104b-1(c)(2)(i), electronic delivery is permitted without obtaining participant consent if the employee satisfies the wired-at-work standard:

• Integral Duty Requirement: The employee must have the ability to effectively access documents provided in electronic form at any location where the employee is reasonably expected to perform employment duties; AND
• Regular Access: The employee's access to the employer's electronic information system must be an integral part of their employment duties.

[!WARNING] The Shared Kiosk Fallacy: A common ASPPA QKA exam trap involves manufacturing, warehouse, retail, or agricultural employers who place a shared computer kiosk in a lunchroom or breakroom and claim their workforce is "wired at work." The DOL has repeatedly affirmed that shared kiosks do NOT satisfy the wired-at-work standard because computer access is not an integral part of the employees' daily job duties! Delivery to these employees requires affirmative consent or use of the 2020 safe harbor.

2. Non-Work-Access Individuals (Affirmative Consent Required)

For individuals who do not satisfy the wired-at-work test (including former employees, alternate payees, beneficiaries, and non-wired active workers), electronic delivery under the 2002 safe harbor requires affirmative electronic consent.

• Hardware/Software Statement: Prior to consenting, the individual must receive a clear statement detailing the hardware and software specifications needed to access and retain the electronic documents.
• Electronic Demonstration of Access: The individual must provide consent electronically, in a manner that reasonably demonstrates their ability to access the documents in the electronic format that will be used (e.g., responding to an email confirmation or submitting a web-based consent portal form).
• Right to Withdraw and Free Paper Copies: The disclosure must explain that consent may be withdrawn at any time without charge, explain procedures for withdrawal, and confirm the right to request a paper copy free of charge.

3. General Requirements for 2002 Safe Harbor

• Notice of Electronic Posting: A written or electronic notice must be sent to the recipient each time an electronic document is posted, alerting them to the posting and explaining its significance.
• Protection of Personal Data: Fiduciaries must take reasonable measures to safeguard the confidentiality of personal participant data (e.g., encryption of Social Security numbers and account balances).
• Monitoring Delivery: The administrator must monitor for electronic delivery failures (such as email bounce-backs) and take prompt corrective action to furnish the material through alternative means.

---

The 2020 Safe Harbor: "Notice and Access" (29 CFR §2520.104b-31)

In May 2020, the DOL issued a major new regulation—29 CFR §2520.104b-31—allowing plan administrators to treat electronic delivery as the default delivery method for all "covered individuals" without requiring upfront affirmative consent.

1. Who Is a "Covered Individual"?

A participant, beneficiary, or other individual entitled to ERISA disclosures who provides the employer, plan sponsor, or administrator with a valid electronic address (e.g., personal email address or mobile phone number for text alerts), or who is assigned an electronic address by the employer for employment purposes.

2. The Two Delivery Models Under the 2020 Safe Harbor

1. Notice and Access (Website Posting): The administrator posts plan documents on a website and furnishes an electronic Notice of Internet Availability (NOIA) to each covered individual.
2. Direct Email Delivery: The administrator sends the plan documents directly to the covered individual's electronic address as an email attachment (such as a PDF) or incorporated directly into the body of the email.

3. Step 1: The Initial Paper Notice Requirement (The "Paper Bridge")

Before a plan administrator can transition any covered individual to the 2020 default electronic delivery safe harbor, the administrator MUST furnish an Initial Notice on physical paper via postal mail:

+---------------------------------------------------------------------------------------------------+
|                         THE 2020 SAFE HARBOR INITIAL PAPER NOTICE MANDATE                         |
+---------------------------------------------------------------------------------------------------+
|   • Format: Physical paper document delivered by postal mail or hand-delivery.                    |
|   • Timing: Furnished PRIOR to utilizing the 2020 safe harbor for the individual.                 |
|   • Mandatory Contents:                                                                           |
|     1. Informs recipient that plan documents will henceforth be delivered electronically.        |
|     2. Identifies the specific electronic address where notifications will be sent.               |
|     3. Outlines the recipient's absolute right to OPT OUT of electronic delivery globally and     |
|        receive all disclosures on paper free of charge.                                           |
|     4. Explains the procedure for exercising opt-out rights and requesting free paper copies.     |
|                                                                                                   |
|   * Critical Rule: You CANNOT send the Initial Notice electronically! It must be on physical      |
|     paper to ensure the participant is informed before digital delivery begins.                   |
+---------------------------------------------------------------------------------------------------+

4. Step 2: The Notice of Internet Availability (NOIA)

When relying on the website posting model, the administrator must furnish an electronic NOIA whenever a document is made available on the website.

• Timing: Furnished at the time the document is posted, OR through an Annual Combined NOIA (which may combine notices for recurring disclosures: SPD, SMM, SAR, annual fee disclosure, and QDIA notice) issued once every 12 months.
• NOIA Content Requirements: Under 29 CFR §2520.104b-31(d)(3), the NOIA must contain:
  1. A prominent subject line reading: "Disclosure About Your Retirement Plan";
  2. A brief, concise description of the document posted;
  3. The website address (direct hyperlink) leading directly to the document or a secure login page;
  4. A statement of the participant's legal right to request and receive a free paper copy;
  5. A statement of the right to opt out of electronic delivery entirely at any time;
  6. A telephone number for contacting the plan administrator.
• Strict Brevity and Formatting: The NOIA must be written in clear, concise language and cannot contain marketing, advertising, or non-plan promotional content.

5. Website Standards and Undeliverable Address Protocols

• Website Retention: Posted documents must remain on the website for at least one full year (or until superseded by a newer version).
• Bounce-Back System: The administrator's electronic delivery system must alert the administrator of an invalid or inoperable electronic address (e.g., bounced email alert). Upon alert, the administrator must attempt redelivery, reach out to obtain a corrected electronic address, or treat the individual as having opted out and immediately furnish a paper notice.

---

Qualified Default Investment Alternative (QDIA) Notices (DOL Reg. §2550.404c-5)

Under ERISA §404(c)(5), plan fiduciaries are relieved of fiduciary liability for investment losses when participant assets are invested in a Qualified Default Investment Alternative (QDIA)—such as a Target-Date Fund (TDF), Balanced Fund, or Professionally Managed Account—in the absence of affirmative participant investment instructions. To secure this fiduciary protection, the administrator must furnish a statutory QDIA Notice.

Statutory Timing of the QDIA Notice

Under DOL Regulation 29 CFR §2550.404c-5(c)(3):

• Initial Notice: Must be furnished to the participant at least 30 calendar days in advance of the date of eligibility or the initial default investment.
  • EACA 90-Day Exception: If the plan incorporates an Eligible Automatic Contribution Arrangement (EACA) where participants have the statutory right to make a 90-day permissive withdrawal of automatic deferrals, the initial QDIA notice may be furnished on or before the date of eligibility.
• Annual Notice: Must be furnished at least 30 calendar days prior to the start of each subsequent plan year (e.g., by December 1 for a calendar year plan).

Mandatory QDIA Notice Content

1. Explanation of the specific circumstances under which assets will be defaulted into the QDIA;
2. Detailed explanation of the participant's absolute right to direct their investments into any other available plan investment alternative without penalty;
3. Description of the QDIA's investment objectives, risk/return characteristics, and operating fees and expenses;
4. Where participants can obtain additional information on the other designated investment alternatives.

---

SECURE 2.0 Act §338: Mandatory Paper Benefit Statements

To counter concerns that low-income workers, rural populations, and older participants were being disenfranchised by default electronic disclosures, Congress enacted Section 338 of the SECURE 2.0 Act of 2022 (amending ERISA §105(a)(2)). Effective for plan years beginning after December 31, 2025 (i.e., beginning with the 2026 plan year), SECURE 2.0 establishes strict statutory paper benefit statement mandates.

1. Defined Contribution (DC) Plans

• ERISA Quarterly Statement Rule: Participant-directed DC plans must provide quarterly benefit statements (4 statements per calendar year).
• SECURE 2.0 Paper Mandate: At least ONE quarterly benefit statement per calendar year MUST BE DELIVERED ON PHYSICAL PAPER!
• The Affirmative Election Exception: The paper statement requirement does NOT apply if the participant has affirmatively elected to receive statements electronically (e.g., under the 2002 safe harbor affirmative consent rules or an affirmative electronic statement portal opt-in).
• THE CRITICAL INTERPLAY WITH THE 2020 SAFE HARBOR: A plan relying on the 2020 "Notice and Access" safe harbor—where electronic delivery is the default without affirmative consent—CANNOT treat default digital participants as paperless for benefit statements! Unless the participant affirmatively opts in to electronic delivery, the plan MUST mail at least one paper statement annually!

2. Defined Benefit (DB) Plans

• ERISA Triennial Statement Rule: DB plans must provide a benefit statement at least once every 3 years (or furnish an annual notice of statement availability).
• SECURE 2.0 Paper Mandate: At least ONE benefit statement every 3 years MUST BE DELIVERED ON PHYSICAL PAPER, unless the participant affirmatively elects electronic delivery.

+---------------------------------------------------------------------------------------------------+
|                     SECURE 2.0 §338 PAPER STATEMENT DECISION FRAMEWORK                             |
+---------------------------------------------------------------------------------------------------+
|   Participant Delivery Status         | DC Plan Requirement               | DB Plan Requirement   |
|   ----------------------------------  | --------------------------------- | --------------------- |
|   Participant AFFIRMATIVELY ELECTED   | All 4 quarterly statements may    | Triennial statement   |
|   Electronic Delivery                 | be 100% electronic.               | may be electronic.    |
|   ----------------------------------  | --------------------------------- | --------------------- |
|   Participant Covered Under 2020      | AT LEAST 1 QUARTERLY STATEMENT    | AT LEAST 1 STATEMENT  |
|   Safe Harbor (DEFAULT, No Consent)   | PER YEAR MUST BE ON PHYSICAL PAPER| EVERY 3 YRS ON PAPER  |
|   ----------------------------------  | --------------------------------- | --------------------- |
|   Participant Opted Out of Electronic | ALL 4 quarterly statements must   | All statements must   |
|   Delivery                            | be delivered on physical paper.   | be on physical paper. |
+---------------------------------------------------------------------------------------------------+

---

Synthesis: Comparison of Electronic Delivery Frameworks

+---------------------------------------------------------------------------------------------------+
|                         ELECTRONIC DELIVERY FRAMEWORKS COMPARISON                                 |
+---------------------------------------------------------------------------------------------------+
|  Feature            | 2002 Safe Harbor             | 2020 Safe Harbor             | SECURE 2.0 §338 Mandate|
|  ------------------ | ---------------------------- | ---------------------------- | ----------------------|
|  Regulation         | 29 CFR §2520.104b-1(c)       | 29 CFR §2520.104b-31         | ERISA §105(a)(2)      |
|  Default Electronic?| NO (Only wired-at-work)      | YES (For covered individuals)| Restricts default elec|
|  Affirmative Consent| Required for non-wired staff | NOT required upfront         | Required to eliminate |
|  Required?          | and former employees         | (Default electronic delivery)| annual paper statement|
|  Paper Bridge?      | No initial paper notice      | MANDATORY Initial Paper      | Guarantees at least 1 |
|                     | required                     | Notice via postal mail       | paper DC stmt/year    |
|  Periodic Notice    | Notice each time doc posted  | NOIA per posting or Annual   | Paper statement itself|
|                     |                              | Combined NOIA                | satisfies delivery    |
|  Free Paper Copies? | Must provide upon request    | Must provide upon request    | Mandatory annually    |
|  Opt-Out Rights?    | Can withdraw consent anytime | Universal opt-out at any time| Affirmative opt-in req.|
+---------------------------------------------------------------------------------------------------+

---

Common ASPPA QKA Exam Traps

• Exam Trap 1: The Kiosk Fallacy under 2002 Safe Harbor: Questions state an employer has 100 retail cashiers who do not use computers in their work, but the store has a computer terminal in the breakroom. Candidates assume the cashiers are "wired at work." Shared breakroom kiosks do NOT satisfy the wired-at-work standard! They must provide affirmative electronic consent under the 2002 safe harbor.
• Exam Trap 2: Default Electronic Delivery Eliminating Paper Statements: A scenario states that an employer implemented the 2020 "Notice and Access" safe harbor for all employees and asks whether the employer must mail any paper benefit statements in 2026. Candidates incorrectly assume the 2020 safe harbor allows 100% digital statements. Under SECURE 2.0 §338, DC plans must provide at least one paper statement annually unless the participant affirmatively elects electronic delivery!
• Exam Trap 3: Emailing the 2020 Initial Notice: A question states that a plan administrator sent an email to all employees notifying them that future plan disclosures would be delivered electronically under the 2020 safe harbor. The Initial Notice under 29 CFR §2520.104b-31 MUST be furnished on PHYSICAL PAPER via postal mail or hand-delivery! Emailing the initial notice invalidates the safe harbor.
• Exam Trap 4: QDIA Notice Timing in Calendar Days: Questions test whether the QDIA notice must be given 30 business days or 30 calendar days in advance. The QDIA notice requirement is strictly at least 30 CALENDAR DAYS in advance of the plan year start or initial default investment.
• Exam Trap 5: EACA Initial QDIA Notice Timing: Candidates often miss that in an Eligible Automatic Contribution Arrangement (EACA) with 90-day withdrawal rights, the initial QDIA notice may be furnished on or before the eligibility date, rather than 30 days in advance.