The 401(k) plan has become the dominant vehicle for employer-sponsored retirement savings in the United States. For business owners, it is both a powerful tool for attracting and retaining employees and a source of significant ongoing legal obligations. While 401(k) plans offer flexibility that many other retirement vehicles do not, that flexibility comes with a complex regulatory framework that must be respected. Noncompliance can result in plan disqualification, loss of tax benefits, IRS penalties, and DOL enforcement action. This article surveys the core legal requirements for 401(k) plans, explains the nondiscrimination testing regime that applies to them, and highlights the most common compliance failures that business owners need to understand and avoid.

What Is a 401(k) Plan?

A 401(k) plan is a type of defined contribution retirement plan established by a for-profit employer under Section 401(k) of the Internal Revenue Code. The defining feature of a 401(k) plan is the cash or deferred arrangement, commonly called a CODA, which allows employees to elect to defer a portion of their compensation into the plan on a pre-tax basis (or, if the plan allows, as Roth after-tax contributions) rather than receiving it as current taxable income. Employers may also make matching contributions — contributing a percentage of each dollar the employee defers up to a specified limit — and profit-sharing contributions.

The tax benefits of a 401(k) plan flow in several directions simultaneously. Employees reduce their current taxable income by the amount of their pre-tax deferrals. Employer contributions are deductible when made, subject to limits. Earnings on plan investments grow tax-deferred. And employees are not taxed on plan balances until they take distributions, typically at retirement. These tax advantages, combined with the plan’s flexibility and the ease with which it can be paired with matching contributions to incentivize participation, make the 401(k) the retirement plan of choice for most private-sector employers.

Eligibility and Participation Requirements

The Internal Revenue Code establishes minimum age and service requirements for 401(k) plan participation. An employee generally cannot be excluded from plan participation if they have attained age 21 and completed one year of service. A year of service is defined as a 12-month period during which the employee works at least 1,000 hours. Employers can use more lenient eligibility standards — for example, allowing participation after 90 days of employment without an age requirement — but they cannot impose requirements more restrictive than the statutory minimums.

The SECURE Act of 2019 and the SECURE 2.0 Act of 2022 introduced an important expansion of eligibility rules for long-term part-time employees. Under these changes, employees who work at least 500 hours in three consecutive 12-month periods (reduced to two consecutive 12-month periods under SECURE 2.0) must be allowed to make elective deferrals to the plan, even if they would not otherwise meet the standard 1,000-hour threshold. Employers sponsoring 401(k) plans must track hours for part-time employees and ensure that their plans comply with the long-term part-time employee rules. For many businesses with substantial part-time workforces, this represents a significant administrative change.

Contribution Limits

The IRS sets annual limits on the amount that can be contributed to a 401(k) plan. For 2025, the elective deferral limit is $23,500 per year for employees under age 50. Employees who have attained age 50 by the end of the year can make additional “catch-up contributions” of up to $7,500, for a total of $31,000. SECURE 2.0 introduced an enhanced catch-up contribution for employees aged 60 through 63, allowing those participants to contribute the greater of $10,000 or 150 percent of the standard catch-up amount, indexed for inflation.

In addition to the elective deferral limit, the Code imposes an overall limit on annual additions to a participant’s account, which includes employee deferrals, employer matching contributions, and employer non-elective contributions. For 2025, this overall annual additions limit is $70,000. Finally, for purposes of determining matching and profit-sharing contributions, the Code imposes a limit on the amount of compensation that can be taken into account, which for 2025 is $350,000 per year. These limits are adjusted for inflation each year.

Vesting Requirements

ERISA and the Internal Revenue Code require that employer contributions to a 401(k) plan vest over time according to one of two minimum schedules, or faster. The cliff vesting schedule requires that participants become 100 percent vested in employer contributions after no more than three years of service. The graded vesting schedule requires at least 20 percent vesting after two years, increasing in 20 percent increments for each subsequent year until 100 percent vesting is achieved after six years. Employee deferrals are always 100 percent immediately vested.

The choice of vesting schedule has practical implications. A cliff vesting schedule creates a retention incentive by keeping employer contributions at risk of forfeiture until the three-year anniversary of employment, but it may seem harsh to employees who leave just before vesting. A graded schedule provides a progressive stake that may feel more equitable but provides less of a retention incentive. Both approaches are legally permissible, and employers can also choose to vest employer contributions immediately, which eliminates the forfeiture risk and may be attractive in highly competitive labor markets.

Nondiscrimination Testing: The Foundation of 401(k) Compliance

The most complex and often the most challenging aspect of 401(k) plan compliance for business owners is nondiscrimination testing. Congress designed the 401(k) plan as a broad-based savings vehicle for American workers, not as a tax shelter for highly compensated employees. To enforce this policy, the Code requires that plans conduct annual testing to ensure that highly compensated employees do not disproportionately benefit from the plan relative to non-highly compensated employees.

For 2025, a highly compensated employee, or HCE, is generally defined as an employee who either owned more than 5 percent of the employer at any time during the current or preceding plan year, or who received compensation of more than $155,000 from the employer in the preceding plan year (indexed for inflation). Non-highly compensated employees, or NHCEs, are all other employees. The distinction is significant because the nondiscrimination tests compare the benefit levels or contribution rates of HCEs against those of NHCEs and require the two groups to be within specified limits of each other.

The ADP Test

The actual deferral percentage test, or ADP test, compares the average deferral rate of the HCE group to the average deferral rate of the NHCE group. The average deferral percentage for HCEs cannot exceed the greater of 125 percent of the NHCE average, or the lesser of 200 percent of the NHCE average or the NHCE average plus two percentage points. In plain terms, if NHCEs are deferring on average 4 percent of their compensation, HCEs generally cannot defer more than about 6 percent on average without failing the test.

When a plan fails the ADP test, the employer has several options to correct it. The most common is to make qualified nonelective contributions, or QNECs, to NHCE accounts, thereby increasing the NHCE average deferral percentage enough to allow the HCE average to pass. Another option is to distribute the excess contributions to the HCEs — effectively forcing high-paid employees to take back some of their deferrals and pay tax on them currently. These corrective distributions must be made within 2.5 months after the end of the plan year to avoid a 10 percent excise tax, or within 12 months to avoid plan disqualification, but making them is expensive in administrative cost and employee relations terms.

The ACP Test

The actual contribution percentage test, or ACP test, is similar in structure to the ADP test but applies to employer matching contributions and after-tax employee contributions rather than to pre-tax deferrals. Plans that offer employer matching contributions must demonstrate that the ratio of matching contributions to compensation for HCEs is not disproportionately higher than the corresponding ratio for NHCEs, applying the same percentage limits as the ADP test. Plans that fail the ACP test face the same corrective options as plans that fail the ADP test.

Safe Harbor 401(k) Plans

Because the ADP and ACP tests create administrative complexity and unpredictable outcomes — particularly for employers in which highly compensated employees participate heavily but rank-and-file participation is lower — Congress created the safe harbor 401(k) plan framework as an alternative. A plan that satisfies the safe harbor requirements is deemed to pass the ADP and ACP tests automatically, without actual testing.

To qualify as a safe harbor plan, the employer must make either a safe harbor matching contribution — at least 100 percent of the first 3 percent of compensation deferred plus 50 percent of the next 2 percent of compensation deferred — or a safe harbor nonelective contribution equal to at least 3 percent of compensation for all eligible NHCEs, regardless of whether they make deferrals. Safe harbor contributions must be immediately 100 percent vested. The employer must also provide employees with a notice each year describing the safe harbor contribution and the plan’s other key features before the beginning of the plan year.

For many small and mid-sized employers, particularly those in which the owner and highly compensated managers want to maximize their own deferrals without worrying about testing, the safe harbor plan is the most practical approach. The required employer contributions represent a real cost, but they provide certainty and administrative simplicity that more than offset the cost for many businesses.

The Top-Heavy Rules

A separate nondiscrimination requirement applies to plans that are “top-heavy” — plans in which more than 60 percent of the plan’s aggregate account balances (or accrued benefits, for defined benefit plans) are attributable to key employees. A key employee is generally an officer earning more than $230,000 (in 2025), a 5-percent owner, or a 1-percent owner earning more than $150,000. Many small business 401(k) plans are top-heavy, because the owner’s account is a large fraction of the total plan assets.

If a plan is top-heavy, the employer must make a minimum employer contribution of 3 percent of compensation (or the highest percentage contributed for any key employee, if lower) to all non-key employees who are employed on the last day of the plan year. Safe harbor 401(k) plans are generally exempt from the top-heavy minimum contribution requirement for years in which they satisfy the safe harbor, which is another advantage of the safe harbor design for small employers.

Common Compliance Failures and Their Consequences

Despite the regulatory framework’s complexity, the most common 401(k) compliance failures are often the result of simple administrative oversights rather than sophisticated violations. The IRS regularly publishes information on the most frequently identified compliance failures in its examination program, and the same issues appear year after year.

Failure to timely amend the plan document is one of the most frequently cited failures. The law requires that plan documents be amended to reflect changes in the Code within specified remedial amendment periods. Employers who use pre-approved prototype or volume submitter plans are generally protected if they timely adopt a new document whenever their plan document provider issues an updated version, but employers who fall behind on adoptions lose that protection.

Operating the plan in a manner inconsistent with the plan document is another pervasive problem. This can occur in many ways: processing loans or hardship distributions under criteria not specified in the plan document, failing to enroll eligible employees in accordance with the plan’s eligibility provisions, allowing deferrals or employer contributions that exceed the plan’s stated limits, and applying vesting schedules that differ from what the plan document requires. The IRS takes the position that a plan that is operated in a way that is not consistent with its terms has an operational defect that must be corrected through EPCRS.

Hardship distribution failures are a particularly common area of noncompliance. A plan that permits hardship distributions must define the criteria for hardship and ensure that distributions are made only when those criteria are genuinely satisfied. Prior to 2019, plans generally required employees to take available plan loans before receiving a hardship distribution. The IRS relaxed this rule through final regulations, but the specific requirements vary by plan document, and employers who administer hardship distributions without carefully reviewing their plan’s terms frequently make errors that require correction.

Nondiscrimination testing failures that are not corrected within the applicable correction window are among the most serious violations a 401(k) plan can experience, because uncorrected ADP or ACP test failures can result in loss of qualified status for the plan — meaning that all employer contributions and all tax deferrals are immediately taxable to employees, and the employer loses its deductions. Employers should treat nondiscrimination testing as a priority item that must be completed, reviewed, and corrected (if necessary) within the correction windows the Code provides.

Using EPCRS to Correct Failures

Virtually every type of 401(k) compliance failure can be corrected through the IRS’s Employee Plans Compliance Resolution System. EPCRS offers three correction programs: the Self-Correction Program (SCP), which allows correction of certain failures without filing with the IRS; the Voluntary Correction Program (VCP), which involves filing a submission with the IRS and paying a fee in exchange for a compliance statement; and the Audit Closing Agreement Program (Audit CAP), which provides for correction and a negotiated sanction when a failure is identified during an IRS examination.

The availability of EPCRS is one of the genuinely important aspects of 401(k) compliance. It means that most compliance failures — if identified promptly and corrected properly — do not need to result in plan disqualification. The key is identifying failures early, before they become the subject of an IRS audit, when the less punitive correction programs are available. Regular compliance audits by qualified benefits counsel, typically conducted annually or every two to three years, are the most effective way to identify potential issues before they ripen into costly enforcement problems.