FirstHR

Colorado Retirement Mandate: What Employers Must Do

Colorado SecureSavings makes employers with no retirement plan register or certify exemption. The deadlines, the fines, and the 401(k) alternative.

Nick Anisimov

Nick Anisimov

FirstHR Founder

Benefits
17 min

Colorado Retirement Mandate

Colorado SecureSavings asks every employer without a plan the same question and accepts two answers: register, or certify that you already offer something qualified. Who is covered, when the clock runs, what the fine is, how the auto-IRA behaves inside your payroll, and how to weigh the state program against sponsoring a 401(k) of your own

The first Colorado SecureSavings notice I ever saw was a plain envelope with an access code printed inside, sitting in a stack of unopened mail at a client office in Denver. Nobody had opened it because nobody recognized the sender. It had been there for weeks.

The mandate itself is not complicated. It asks one question and accepts two answers: register for the state program, or certify that you already offer a qualified retirement plan. Doing nothing is the only wrong answer, and it is the answer with a price attached.

What follows covers who has to act, what the deadlines actually are now that the original waves have closed, what the fine is and how long the state waits before assessing it, how the auto-IRA behaves inside your payroll, and how to weigh the state program against sponsoring a 401(k) instead. I build the onboarding and people records tooling for businesses without an HR department at FirstHR. FirstHR is an onboarding and HR platform, not a payroll provider or a retirement plan provider, and this is general information rather than tax or legal advice.

TL;DR
Colorado SecureSavings is a state-facilitated Roth IRA program. Private employers in business at least two years, with five or more employees and no qualified plan, must register or certify exemption. The default deferral is 5 percent of gross pay, escalating 1 point a year to 8 percent. Fines run up to $100 per employee per year, capped at $5,000.

Who Has to Act

The mandate reaches any private-sector Colorado employer that has been in business at least two years, has five or more employees, and does not already offer a tax-qualified retirement plan. Meet all three and you register. Miss any one and you certify exemption.

Definition
Colorado SecureSavings
A state-facilitated retirement savings program created under the Colorado Secure Savings Program Act and administered by the office of the state treasurer. Covered employers enroll their workers into individual retirement accounts through payroll deduction, opened as Roth IRAs unless the saver requests a traditional one. The employer facilitates only: it makes no contributions, selects no investments, and holds no fiduciary role. Employees are enrolled automatically and may opt out at any time.
Two years in business
The program rule dates your business from whichever of these is most recent: the IRS Form SS-4, the Colorado Secretary of State formation record, the Colorado sales tax license, or the month you became liable for wage withholding with the state labor department.
Five or more employees
The statutory trigger is a headcount of five or more. Below that line you certify exemption instead, and you may still opt into the program voluntarily if you want your people to have access to it.
No qualified plan already
Offering a tax-qualified retirement plan removes the obligation entirely. It does not remove the paperwork: you still have to certify the exemption through the program portal using the access code the state mailed you.
All three have to be true at once. Fail any one of them and your answer to the state is an exemption certification rather than a registration, which takes a few minutes and closes the file.

The two-year test is more precise than most employers expect. The program rule (8 CCR 1508-3) dates a business from whichever of four markers is closest to the present: the IRS Form SS-4, the Colorado Secretary of State formation record, the state sales tax license, or the month the business became liable for wage withholding with the labor department.

The program sits inside a wider group of state auto-IRA mandates, and if you employ people across state lines it is worth reading the national picture in the guide to state-sponsored retirement programs alongside this page. Colorado-specific obligations beyond retirement live on the Colorado compliance hub.

5%
default deferral rate, deducted after tax
8%
cap on the automatic annual escalation
$100
maximum fine per eligible employee per year
$5,000
aggregate fine cap in a calendar year

The Deadlines

The original registration deadlines have closed. The state phased employers in during 2023 across three groups, largest first and smallest last, and every one of those dates is now in the past. What runs today is an annual cycle rather than a one-off event.

Businesses that become newly eligible are notified by the program and given a registration date, and the program publishes a May 15 deadline for newly eligible businesses in its employer program details. Missing it does not close the door.

The portal stays open, and registering late is materially better than waiting, because the penalty schedule attaches to ongoing noncompliance rather than to the missed date by itself. The Colorado Department of the Treasury points employers to the program site to register, which is also where the exemption certification happens.

ClockWhat triggers itWhat you owe
Your registration dateNotification from the program with an access codeRegister or certify exemption by that date
The annual cycleBecoming newly eligible during the yearAct by the deadline in your notice, currently May 15
New employee onboardingAn individual reaching 180 days of employmentSubmit their details within 30 days of that anniversary
The opt-out windowAn employee being added to the programWait 30 days, then record their election
Every payroll run after thatWithholding a deductionRemit to the administrator within 14 days

That third row is the one small employers forget. The rule ties employee onboarding to a service milestone rather than to a calendar quarter, so a hire made in March creates a program obligation in the autumn. Folding it into your standard new hire paperwork routine is the only reliable way to catch it.

What the Fine Is

The Colorado Secure Savings Program Act caps fines at one hundred dollars for each eligible employee per year and five thousand dollars in aggregate per calendar year. The program rule sets the fine at that hundred dollar figure and hands collection to the Colorado Department of Labor and Employment, working in partnership with the treasury program.

The statutory authority for the penalty is in the Colorado Secure Savings Program Act, enacted by Senate Bill 20-200, which directs the program board to adopt rules establishing minimal fines for employer noncompliance within those limits.

The Runway Is Long, and Then It Is Not
The rule builds in real delay before money changes hands. Three notices of noncompliance go out after a registration date passes. No fine may be assessed earlier than twelve months after that registration date, and none earlier than three months after the first noncompliance notice is postmarked. Once a final notice of penalty application arrives, the employer has thirty days to remit. The practical effect is that employers receive several warnings and often conclude nothing is happening, right up until something does.

Worth noting what the cap actually means at small scale. A business with a modest payroll will not hit five thousand dollars, so the fine is genuinely small relative to the cost of a benefits program. The reason to comply is not the number. It is that a live compliance file with a state labor department is an expensive thing to carry into an audit or a sale.

Still Using Spreadsheets for Onboarding?
Automate documents, training assignments, task management, and track onboarding progress in real time.
See How It Works

How the Auto-IRA Works

Employees are enrolled automatically at 5 percent of gross pay into their own Roth IRA, deducted after taxes, with a thirty day window to opt out or change anything. The default also escalates by one percentage point each January for anyone enrolled at least six months, stopping at 8 percent.

1
The employer adds the employee
Name, Social Security number, date of birth, mailing address and contact details go to the program administrator, no later than thirty days after that person hits their one hundred and eightieth day of employment.
2
The administrator contacts the employee directly
Program information goes out, and the thirty day opt-out period starts. This conversation is not yours to run, which is the design working as intended.
3
The employee opts out, customizes, or does nothing
Doing nothing produces enrollment at the default rate with the default investment. Opting out inside the window means no account is opened at all.
4
The employer records the elections and starts deductions
The rule bars remitting anything to the program until the opt-out period ends, and the program has you begin deductions once it closes. After that you withhold at whatever rate each person landed on.
5
Contributions land in a holding investment first
Payroll deductions sit in a capital preservation option for a short period before moving automatically into a target date fund matched to the saver birth year.
6
The rate escalates each January
One percentage point a year for savers enrolled at least six months, up to the 8 percent ceiling, unless the employee declines the increase.

Because the account is a Roth IRA rather than a plan account, federal IRA limits apply rather than plan limits. The IRS set the 2026 IRA contribution limit at $7,500, with a $1,100 catch-up for savers age 50 and over.

The Roth Default Has an Income Edge
Roth IRA eligibility phases out with income. For tax year 2026 the IRS phase-out range runs from $153,000 to $168,000 of modified adjusted gross income for single filers and $242,000 to $252,000 for married couples filing jointly. Accounts open as Roth IRAs unless the saver asks otherwise, so a well-paid employee can be enrolled automatically into a vehicle they are not fully eligible to use. The program description gives them three routes out: direct the program to open a traditional IRA instead, recharacterize contributions already made, or opt out. None of it is your call, and all of it is a fair reason to make sure people actually read the program information they receive.

Savers pay the program cost, not the employer. The program description puts the total annualized asset-based fee between 0.225 percent and 0.31 percent depending on the investment option, with the target date default at 0.29 percent, plus a $22 annual account fee charged at $5.50 a quarter. That is competitive for a retail IRA and expensive relative to a well-run plan at scale.

Your Job in Payroll

Register, add employees, wait out the opt-out window, record elections, withhold, remit within fourteen days, and keep the roster current. That is the complete list, and the program rule is explicit that it is the complete list.

TaskYoursNot yours
Registering the business and setting up paymentYes
Adding employees and marking departuresYes
Withholding the elected percentage each runYes
Remitting within fourteen days of withholdingYes
Updating contribution rate changes in the portalYes
Opening employee accountsHandled automatically
Answering investment questionsProgram administrator
Processing withdrawals and account changesProgram administrator
Selecting the investment lineupState program board

Two mechanical details cause most of the errors I see. Nothing may be remitted to the program until the opt-out period ends, and the amount withheld cannot exceed what remains after higher-precedence payroll deductions such as taxes and court orders have come out. Both are in the rule, and both are easy to get wrong on a first run.

The other quiet cost is roster hygiene. Every new hire, every departure, every rate change has to reach the portal, which for a business running Colorado payroll alongside other obligations is one more list to keep accurate. If you already track headcount changes centrally, the marginal work is small. If you do not, this is the thing that slips.

The Fiduciary Line

You facilitate the program. You do not sponsor it. That single distinction is what makes the state option nearly free and what makes it limited, and it is worth understanding precisely before comparing it to a plan of your own.

You cannot contributeEmployer contributions are not merely optional under the program rule, they are prohibited. There is no match to design, no vesting schedule to write, and no formula to budget for.
You are not a fiduciaryThe Colorado Secure Savings Program Board selects the investment options and a contracted program administrator runs the accounts. You are explicitly barred from exercising authority or control beyond the payroll duties the rule assigns you.
You cannot give adviceThe rule forbids advising account holders on contribution rates, escalation, or investment choices. When somebody asks what they should pick, the correct answer is the program service line, not your opinion.
You cannot discourage participationProhibiting, restricting, or discouraging employee participation is a separate violation from failing to register. Neutral facilitation is the entire role the statute gives you.
Source: Colorado Secure Savings Program rule, 8 CCR 1508-3, employer restrictions and enforcement sections.

Because you are not the sponsor, there is no plan document to adopt, no investment committee, no annual Form 5500 filing, and no ERISA plan sitting on your balance of obligations. State auto-IRA programs were built specifically to avoid creating employer-sponsored plans, which is why the employer role is drawn so narrowly.

The flip side arrives the moment you want to do anything generous. You cannot match. You cannot make a profit-sharing contribution. You cannot use the program to give owners a meaningful deferral. Every one of those requires you to leave the program and sponsor something.

Companies Using FirstHR Onboard 3x Faster
Join hundreds of small businesses who transformed their new hire experience.
See It in Action

Certifying Exemption

If you already offer a tax-qualified retirement plan, you are exempt, but you are not finished. An authorized representative certifies through the program website that the business offers a qualified plan, has fewer than five employees, or has been in business under two years. The program then issues a certificate of exemption.

That certificate stays in effect as long as the underlying fact stays true. It is not an annual filing, which is a relief, and it is also the reason a business that terminates its plan can drift back into the mandate without noticing. If you ever wind down a plan, treat re-registration as part of the wind-down checklist.

The certification is also the answer to the letter sitting in the mail pile. Employers who already have a plan frequently ignore the notice on the reasonable assumption that it does not apply to them. It does apply, in the sense that the state cannot tell the difference between an exempt employer and a noncompliant one until somebody clicks the button.

Registering Versus Sponsoring Your Own Plan

The state program is a compliance answer. A 401(k) is a compensation decision. Both satisfy the mandate, and they solve genuinely different problems, which is why the comparison is rarely close once you know what you are trying to achieve.

DimensionColorado SecureSavingsYour own 401(k)
Annual employee limit$7,500 IRA limit for 2026, plus $1,100 catch-up$24,500 deferral limit for 2026, plus $8,000 catch-up
Employer contributionsProhibitedOptional, and deductible
Tax treatmentRoth by default, traditional IRA on requestPre-tax, Roth, or both by design
Fiduciary responsibilityNone for the employerYes, and it is real
Plan document and annual returnNonePlan document plus annual filing obligations
Nondiscrimination testingNoneYes, unless a safe harbor design applies
Income eligibility limitsRoth phase-outs apply to the saverNo income cap on deferrals
Cost to the employerFree to facilitateSetup and recordkeeping fees, partly offset by tax credits
Cost to the employee0.225 to 0.31 percent a year plus a $22 account feeDepends entirely on the provider you choose
PortabilityThe IRA belongs to the individualRollover on separation

The first row decides most cases involving owners. A founder trying to shelter a meaningful share of income cannot do it at the IRA limit, and no amount of administrative convenience compensates for a ceiling that low. That single fact pushes most profitable small businesses toward a plan of their own within a few years.

The fourth and sixth rows decide most cases involving nobody senior. If the honest goal is to satisfy the state and give people access to payroll savings without adding an obligation you have no capacity to run, the state program is the correct answer and there is no shame in it.

What a 401(k) Costs

A small business plan carries setup and recordkeeping fees, and federal tax credits offset a meaningful share of them for eligible employers. The credit for retirement plan startup costs runs for three consecutive tax years and is capped at the greater of $500 or the lesser of $250 per eligible non-highly compensated employee and $5,000.

The share of costs the credit covers is tiered by employer size, with the smallest employers able to cover the full amount of eligible startup costs and larger ones covering half, per the IRS guidance on the startup costs credit. A separate credit of $500 a year for three years applies to adding an automatic enrollment feature.

Those credits came largely from the SECURE Act 2.0 package, which also made automatic enrollment mandatory for most 401(k) plans established after the act was signed, effective for plan years beginning after 2024. Default rates under that requirement run between 3 and 10 percent with annual escalation, and the requirement carves out very new businesses and the smallest employers, so confirm which side of the carve-out you land on before designing anything.

The other cost worth naming is testing. An ordinary plan is tested annually, and a plan where owners defer heavily while nobody else participates tends to fail. That is what nondiscrimination testing exists to catch, and a safe harbor design is the standard way to sidestep it in exchange for a mandatory employer contribution.

How to Decide

The question is not which is better. It is whether retirement savings is a compliance item or a compensation item for your business this year.

Pros
Nobody in the business needs to defer more than the IRA limit, including the owners
You have no capacity to administer a plan and no appetite for fiduciary duty
Cash is tight and any employer contribution would be a genuine strain
You want people to have payroll savings access without adding a benefits program
You are close to a registration deadline and need a compliant answer quickly
Cons
Owners or senior staff want to shelter a meaningful share of income
You want to offer a match as part of how you pay people
You are competing for hires against employers that sponsor real plans
You want to pick the investment lineup and the provider rather than take what the state selected
You are already building out a real benefits program and this fits inside it

A perfectly reasonable path is to register for the state program now because a deadline is real, then sponsor a plan later and certify exemption when it is live. Registering does not commit you to anything permanent. It commits you to facilitating payroll deductions for as long as you have no plan of your own.

If you take the plan route, treat it as part of a wider benefits package decision rather than a standalone purchase, and get the design questions answered before the provider conversation rather than during it. The guide to a startup 401(k) covers the setup sequence in detail.

Common Mistakes

Five patterns account for nearly every Colorado compliance problem I have watched a small employer create.

Ignoring the notice because you already have a plan is first and by far the most common. Exemption still requires certification, and until somebody certifies, the state has no way to distinguish you from an employer doing nothing.

Treating the mandate as a one-time task is second. New hires generate obligations at their service milestone, departures have to be marked, and rate changes have to reach the portal. It is an ongoing payroll routine, not a project with an end date.

Starting deductions too early is third. The rule bars remitting anything until the thirty day opt-out period closes, and the program has you begin deductions after it, so money taken from somebody who opted out has to be unwound.

Advising employees on what to choose is fourth. It feels helpful and the program rule prohibits it. Point people at the program service line and keep your own view out of it.

And assuming the state program is a benefits program is fifth. It is a payroll savings mechanism with no employer money in it, and describing it to candidates as a retirement benefit sets an expectation your offer letter will not meet.

What worked for me
What made this manageable at the client in Denver was moving the whole thing into onboarding rather than treating it as a treasury matter. The employee data the program wants is data you already collect on day one, the service milestone is a date you already track, and the departure flag is a step you already run. Once it lived in the same checklist as the I-9 and the direct deposit form, nobody had to remember it separately, and the pile of unopened envelopes stopped being a compliance strategy.

For employers running Colorado payroll alongside everything else, the state obligations do not stop at retirement. State withholding, unemployment premiums, paid family leave, and sick leave all carry their own requirements, and the Colorado payroll overview is a faster place to check them than the mandate materials.

Key Takeaways
Colorado employers in business at least two years, with five or more employees and no qualified plan, must register for Colorado SecureSavings or certify exemption.
The original staged deadlines have closed and an annual cycle now applies, with newly eligible employers notified and given a registration date.
Fines run up to $100 per eligible employee per year, capped at $5,000 in a calendar year, and are collected by the state labor department after three notices.
The default is 5 percent of gross pay into a Roth IRA, escalating one point each January up to 8 percent, with a thirty day employee opt-out window.
The employer never contributes and is never a fiduciary: the role is limited to registering, adding employees, withholding, remitting within fourteen days, and keeping the roster current.
A 401(k) is the answer when owners want to defer above the IRA limit or the business wants to offer a match, and federal startup tax credits offset part of the setup cost.

Frequently Asked Questions

Who has to register for Colorado SecureSavings?

Private-sector Colorado employers that meet three conditions at once: in business for at least two years, five or more employees, and no tax-qualified retirement plan already offered. Employers that meet all three must register and facilitate payroll deductions. Employers that fail any one of the three certify an exemption instead, which the Colorado Department of the Treasury runs through the same program portal using the access code mailed to the business. The exemption certificate stays valid for as long as the business keeps offering a qualified plan or stays under the employee threshold, so it is not a form you refile every year.

What is the deadline to register?

The original staged registration dates closed in 2023, when the state phased employers in over three groups from the largest down to the smallest. What runs now is an annual cycle: businesses that become newly eligible are notified by the program, which publishes a May 15 deadline for newly eligible businesses. If your deadline has already passed, registration does not close. The portal stays open and the practical instruction from the program is to register late rather than wait, because the fine schedule attaches to continued noncompliance rather than to the missed date itself. The notification arrives by first-class mail and carries the access code you need to register or to certify exemption, so the envelope matters more than the calendar.

What is the penalty for not registering?

Up to one hundred dollars for each eligible employee per year, capped at an aggregate five thousand dollars in a calendar year. The program rule assigns collection to the Colorado Department of Labor and Employment, which sends three notices of noncompliance before anything is assessed. The rule also builds in timing floors: no fine earlier than twelve months after the registration date or one year after the employer was scheduled to enter the program, whichever falls later, and none earlier than three months after the first noncompliance notice is postmarked. Once a final notice of penalty application arrives, the employer has thirty days to remit.

Does the employer contribute to Colorado SecureSavings?

No, and the point is stronger than that: employer contributions are prohibited by the program rule, not merely optional. There is no match to design, no vesting schedule, and no employer money in the accounts at all. Every dollar comes from the employee through payroll deduction into that employee’s own individual retirement account, which opens as a Roth IRA unless the saver asks the program for a traditional one instead. The same rule bars employers from acting as a fiduciary, advising employees on contribution rates or investments, or discouraging participation. If you want to put company money into retirement savings, you need a plan of your own rather than the state program.

What is the default contribution rate?

Five percent of gross pay, deducted after taxes because the account is a Roth IRA by default. The default also includes automatic escalation: one percentage point each January for savers who have been enrolled at least six months, continuing until the rate reaches eight percent. Employees can set any rate from one percent upward within federal IRA limits, decline the escalation, or opt out entirely at any time. Contributions for a given year stop once the saver reaches the federal IRA maximum for that year. Anyone who opts out during the thirty day window after being added never has an account opened and never has a deduction taken.

Can employees opt out of the state program?

Yes, at any time and without your involvement. After an employer adds someone to the program, the administrator contacts that person directly and gives them thirty days to opt out or customize the account. Opting out inside the window means no account is created and no payroll deduction ever starts. Opting out later means the employer is notified to stop the deduction, and contributions already made can be withdrawn. Employees who opt out can rejoin whenever they want, which is why the roster you maintain has to stay current. The rule separately bars an employer from prohibiting, restricting, or discouraging participation, so the decision has to be left alone.

Is a 401(k) better than the Colorado state program?

It depends on what you want retirement savings to do for the business. The state program is free to facilitate, carries no fiduciary role, and needs no plan document or annual filing, but it caps out at the federal IRA limit and allows no employer money. A 401(k) allows a far higher deferral limit, employer contributions, and a startup tax credit for eligible small businesses, at the price of plan documents, testing, an annual return, and real fiduciary duty. Costs also land differently: the state program charges the saver an asset-based fee plus a flat annual account fee, while a plan of your own bills the business. Owners who want to defer meaningfully themselves usually outgrow the state program quickly.

What does the employer actually have to do each payroll run?

Withhold the elected percentage from participating employees, remit it to the program administrator promptly, and keep the employee roster accurate. The program rule requires contributions to reach the administrator no later than fourteen days after they are withheld from wages, bars remitting for anyone who opted out, and requires the employer to add new hires, update rate changes, and mark departures as terminated. The amount withheld also cannot exceed what is left of the paycheck after deductions with higher precedence, including taxes and court orders. New employees are added no later than thirty days after their one hundred and eightieth day of employment, which makes onboarding the natural place to catch it.

Ready to transform your onboarding?

7-day free trial No credit card required
Start Your Free Trial