Colorado Retirement Mandate: What Employers Must Do
Colorado SecureSavings makes employers with no retirement plan register or certify exemption. The deadlines, the fines, and the 401(k) alternative.
The first Colorado SecureSavings notice I ever saw was a plain envelope with an access code printed inside, sitting in a stack of unopened mail at a client office in Denver. Nobody had opened it because nobody recognized the sender. It had been there for weeks.
The mandate itself is not complicated. It asks one question and accepts two answers: register for the state program, or certify that you already offer a qualified retirement plan. Doing nothing is the only wrong answer, and it is the answer with a price attached.
What follows covers who has to act, what the deadlines are now that the original waves have closed, what the fine is and how long the state waits before assessing it, how the auto-IRA (an individual retirement account employees are enrolled in automatically) behaves inside your payroll, and how to weigh the state program against sponsoring a 401(k) instead.
I build the onboarding and people records tooling for businesses without an HR department at FirstHR. FirstHR is an onboarding and HR platform, not a payroll provider or a retirement plan provider, and this is general information rather than tax or legal advice.
Who Has to Act
The mandate reaches any private-sector Colorado employer that has been in business at least two years, has five or more employees, and does not already offer a tax-qualified retirement plan, such as a 401(k). Meet all three and you register. Miss any one and you certify exemption.
The two-year test is more precise than most employers expect. The program rule (8 CCR 1508-3) dates a business from whichever of four markers is closest to the present: the IRS Form SS-4, the Colorado Secretary of State formation record, the state sales tax license, or the month the business became liable for wage withholding with the labor department.
Colorado is one of a wider group of state auto-IRA mandates. If you employ people across state lines, the guide to state-sponsored retirement programs gives the national picture to read alongside this page.
The Deadlines
The original registration deadlines have closed. The state phased employers in during 2023 across three groups, largest first and smallest last, and every one of those dates is now in the past. What runs today is an annual cycle rather than a one-off event.
Businesses that become newly eligible are notified by the program and given a registration date, and the program publishes a May 15 deadline for newly eligible businesses in its employer program details. Missing it does not close the door.
The portal stays open, and registering late is materially better than waiting, because the penalty schedule attaches to ongoing noncompliance rather than to the missed date by itself. The Colorado Department of the Treasury points employers to the program site to register, which is also where the exemption certification happens.
| Clock | What triggers it | What you owe |
|---|---|---|
| Your registration date | Notification from the program with an access code | Register or certify exemption by that date |
| The annual cycle | Becoming newly eligible during the year | Act by the deadline in your notice, currently May 15 |
| New employee onboarding | An individual reaching 180 days of employment | Submit their details within 30 days of that milestone |
| The opt-out window | An employee being added to the program | Wait 30 days, then record their election |
| Every payroll run after that | Withholding a deduction | Remit to the administrator within 14 days |
That third row is the one small employers forget. The rule ties employee onboarding to a service milestone rather than to a calendar quarter, so a hire made in March creates a program obligation in the fall. Folding it into your standard new hire paperwork routine is the only reliable way to catch it.
What the Fine Is
The Colorado Secure Savings Program Act caps fines at one hundred dollars for each eligible employee per year and five thousand dollars in aggregate per calendar year. The program rule sets the fine at that hundred dollar figure and hands collection to the Colorado Department of Labor and Employment, working in partnership with the treasury program.
The Act was enacted by Senate Bill 20-200, which directs the program board to adopt rules establishing minimal fines for employer noncompliance within those limits.
At small scale, the cap hardly comes into play. A business with a modest payroll will not hit five thousand dollars, so the fine is genuinely small relative to the cost of a benefits program.
The reason to comply is not the number. It is that a live compliance file with a state labor department is an expensive thing to carry into an audit or a sale.
How the Auto-IRA Works
Employees are enrolled automatically at 5 percent of gross pay into their own Roth IRA, deducted after taxes, with a thirty day window to opt out or change anything. The default also escalates by one percentage point each January for anyone enrolled at least six months, stopping at 8 percent.
Because the account is a Roth IRA rather than a plan account, federal IRA limits apply rather than plan limits. The IRS set the 2026 IRA contribution limit at $7,500, with a $1,100 catch-up for savers age 50 and over.
Savers pay the program cost, not the employer. The program description (May 2025) puts the total annualized asset-based fee between 0.225 percent and 0.31 percent depending on the investment option, with the target date default at 0.29 percent, plus a $22 annual account fee charged at $5.50 a quarter.
That fee level is competitive for a retail IRA and expensive relative to a well-run plan at scale.
Your Job in Payroll
Register, add employees, wait out the opt-out window, record elections, withhold, remit within fourteen days, and keep the roster current. That is the full list of what the program asks of you, and the program rule bars you from taking on any role beyond your payroll duties.
| Task | Yours | Not yours |
|---|---|---|
| Registering the business and setting up payment | Yes | - |
| Adding employees and marking departures | Yes | - |
| Withholding the elected percentage each run | Yes | - |
| Remitting within fourteen days of withholding | Yes | - |
| Updating contribution rate changes in the portal | Yes | - |
| Opening employee accounts | - | Handled automatically |
| Answering investment questions | - | Program administrator |
| Processing withdrawals and account changes | - | Program administrator |
| Selecting the investment lineup | - | State program board |
Two mechanical details cause most of the errors I see. Nothing may be remitted to the program until the opt-out period ends, and the amount withheld cannot exceed what remains after higher-precedence payroll deductions such as taxes and court orders have come out. Both are in the rule, and both are easy to get wrong on a first run.
The other quiet cost is roster hygiene. Every new hire, every departure, every rate change has to reach the portal, which for a business running Colorado payroll alongside other obligations is one more list to keep accurate. If you already track headcount changes centrally, the marginal work is small. If you do not, this is the thing that slips.
The list below is that roster, in the shape the program actually asks for. One row per person, one row per pay run, and the dates that the rule attaches consequences to worked out in advance rather than in arrears.
| A | B | |
|---|---|---|
| 1 | Item | Entry |
| 2 | Legal business name | |
| 3 | Date the access code letter arrived | |
| 4 | Access code stored where | |
| 5 | Years in business, and the marker used for the date | |
| 6 | Employee count on the date of the notice | |
| 7 | Qualified retirement plan already offered | |
| 8 | Answer given: registered, or exemption certified | |
| 9 | Date completed in the portal | |
| 10 | Certificate or confirmation reference | |
| 11 | Who in the business owns this each month | |
| 12 | If a plan of our own is ever terminated, re-register by | |
| 13 | Note | An exemption certificate holds only while the fact behind it holds. Terminating a plan puts the business back inside the mandate. |
The Fiduciary Line
You facilitate the program. You do not sponsor it. That single distinction is what makes the state option nearly free and what makes it limited, and it is worth understanding precisely before comparing it to a plan of your own.
Because you are not the sponsor, there is no plan document to adopt, no investment committee, no annual Form 5500 filing, and no ERISA plan on your list of obligations. State auto-IRA programs were built specifically to avoid creating employer-sponsored plans, which is why the employer role is drawn so narrowly.
The flip side arrives the moment you want to do anything generous. You cannot match. You cannot make a profit-sharing contribution. You cannot use the program to give owners a meaningful deferral. Every one of those requires you to leave the program and sponsor something.
Certifying Exemption
If you already offer a tax-qualified retirement plan, you are exempt, but you are not finished. An authorized representative certifies through the program website that the business offers a qualified plan, has fewer than five employees, or has been in business under two years. The program then issues a certificate of exemption.
That certificate stays in effect as long as the underlying fact stays true. It is not an annual filing, which is a relief, and it is also the reason a business that terminates its plan can drift back into the mandate without noticing. If you ever wind down a plan, treat re-registration as part of the wind-down checklist.
The certification is also the answer to the letter sitting in the mail pile. Employers who already have a plan frequently ignore the notice on the reasonable assumption that it does not apply to them. It does apply, because the state cannot tell the difference between an exempt employer and a noncompliant one until somebody clicks the button.
Registering Versus Sponsoring Your Own Plan
The state program is a compliance answer. A 401(k) is a compensation decision. Both satisfy the mandate, and they solve genuinely different problems, which is why the comparison is rarely close once you know what you are trying to achieve.
| Dimension | Colorado SecureSavings | Your own 401(k) |
|---|---|---|
| Annual employee limit | $7,500 IRA limit for 2026, plus $1,100 catch-up | $24,500 deferral limit for 2026, plus $8,000 catch-up |
| Employer contributions | Prohibited | Optional, and deductible |
| Tax treatment | Roth by default, traditional IRA on request | Pre-tax, Roth, or both by design |
| Fiduciary responsibility | None for the employer | Yes, and it is real |
| Plan document and annual return | None | Plan document plus annual filing obligations |
| Nondiscrimination testing | None | Yes, unless a safe harbor design applies |
| Income eligibility limits | Roth phase-outs apply to the saver | No income cap on deferrals |
| Cost to the employer | Free to facilitate | Setup and recordkeeping fees, partly offset by tax credits |
| Cost to the employee | 0.225 to 0.31 percent a year plus a $22 account fee | Depends entirely on the provider you choose |
| Portability | The IRA belongs to the individual | Rollover on separation |
The first row decides most cases involving owners. A founder trying to shelter a meaningful share of income cannot do it at the IRA limit, and no amount of administrative convenience compensates for a ceiling that low. That single fact pushes most profitable small businesses toward a plan of their own within a few years.
The fourth and sixth rows decide most cases involving nobody senior. If the honest goal is to satisfy the state and give people access to payroll savings without adding an obligation you have no capacity to run, the state program is the correct answer and there is no shame in it.
Dwight SchruteSales3 people
Darryl PhilbinWarehouse1 person
Kelly KapoorCustomer Service1 personWhat a 401(k) Costs
A small business plan carries setup and recordkeeping fees, and federal tax credits offset a meaningful share of them for eligible employers. The credit for retirement plan startup costs runs for three consecutive tax years and is capped at the greater of $500 or the lesser of $250 per eligible non-highly compensated employee and $5,000.
The share of costs the credit covers is tiered by employer size: employers with 50 or fewer employees who earned at least $5,000 the prior year can cover the full amount of eligible startup costs, and those with 51 to 100 such employees cover half, per the IRS guidance on the startup costs credit.
A separate credit of $500 a year for three years applies to adding an automatic enrollment feature.
The SECURE Act 2.0 package created that full-cost tier. It also made automatic enrollment mandatory for most 401(k) plans established after the act was signed, effective for plan years beginning after 2024.
Default rates under the automatic enrollment statute start between 3 and 10 percent and climb one point a year until they reach at least 10 percent. The mandate carves out businesses less than three years old and employers with 10 or fewer employees, so confirm which side of the carve-out you land on before designing anything.
The other cost worth naming is testing. An ordinary plan is tested annually, and a plan where owners defer heavily while nobody else participates tends to fail. That is what nondiscrimination testing exists to catch, and a safe harbor design is the standard way to sidestep it in exchange for a mandatory employer contribution.
How to Decide
The question is not which is better. It is whether retirement savings is a compliance item or a compensation item for your business this year. Read the Pros column below as the case for the state program and the Cons column as the case for a plan of your own.
A perfectly reasonable path is to register for the state program now because a deadline is real, then sponsor a plan later and certify exemption when it is live. Registering does not commit you to anything permanent. It commits you to facilitating payroll deductions for as long as you have no plan of your own.
Leaving the program has a notice period. The program rule asks a participating employer that starts offering a qualified plan to notify the program administrator at least sixty days before payroll deductions stop, and to notify the affected employees at least thirty days before.
If you take the plan route, treat it as part of a wider benefits package decision rather than a standalone purchase, and get the design questions answered before the provider conversation rather than during it.
Common Mistakes
Five patterns account for nearly every Colorado compliance problem I have watched a small employer create.
Ignoring the notice because you already have a plan is first and by far the most common. Exemption still requires certification, and until somebody certifies, the state has no way to distinguish you from an employer doing nothing.
Treating the mandate as a one-time task is second. New hires generate obligations at their service milestone, departures have to be marked, and rate changes have to reach the portal. It is an ongoing payroll routine, not a project with an end date.
Starting deductions too early is third. The rule bars remitting anything until the thirty day opt-out period closes, and the program has you begin deductions after it, so money taken from somebody who opted out has to be unwound.
Advising employees on what to choose is fourth. It feels helpful and the program rule prohibits it. Point people at the program service line and keep your own view out of it.
And assuming the state program is a benefits program is fifth. It is a payroll savings mechanism with no employer money in it, and describing it to candidates as a retirement benefit sets an expectation your offer letter will not meet.
Nick Anisimov, FirstHR founderFor employers running Colorado payroll alongside everything else, the state obligations do not stop at retirement. State withholding, unemployment premiums, paid family leave, and sick leave all carry their own requirements, and the Colorado payroll overview is a faster place to check them than the mandate materials.
Whatever you decide about a plan of your own, the first step is the same: find the envelope with the access code, open it, and register or certify exemption.
Frequently Asked Questions
Who has to register for Colorado SecureSavings?
Private-sector Colorado employers that meet three conditions at once: in business for at least two years, five or more employees, and no tax-qualified retirement plan already offered. Employers that meet all three must register and facilitate payroll deductions. Employers that fail any one of the three certify an exemption instead, which the Colorado Department of the Treasury runs through the same program portal using the access code mailed to the business. The exemption certificate stays valid for as long as the business keeps offering a qualified plan or stays under the employee threshold, so it is not a form you refile every year.
What is the deadline to register?
The launch-era dates have passed. The state brought employers in during 2023 across three groups, from the largest down to the smallest. After that, the program moved to a yearly cycle: it notifies businesses that newly become eligible and lists May 15 as the date for them to act. Missing that date does not shut anything down. The portal stays open, and the program’s practical advice is to register late rather than hold off, because the fine schedule attaches to ongoing noncompliance, not to the missed date alone. Watch your mail, too. The notice arrives by first-class mail with the access code you need either to register or to certify exemption, so the envelope matters more than the calendar.
What is the penalty for not registering?
The fine is at most one hundred dollars per eligible employee for each year, and the total in any calendar year cannot pass five thousand dollars. The Colorado Department of Labor and Employment handles collection and sends three notices of noncompliance first, so nothing is assessed without warning. Timing also works in the employer’s favor. A fine cannot be assessed before the later of two points: twelve months after the registration date, or one year after the employer was scheduled to enter the program. The first noncompliance notice must also have been postmarked at least three months earlier. Once the final notice of penalty application is issued, payment is due within thirty days of the date printed on it.
Does the employer contribute to Colorado SecureSavings?
No. Employer money is not merely optional: the program rule prohibits it outright, so the state program cannot carry a match, a vesting schedule, or any other company contribution. All of the savings come from the employees themselves, taken out of their paychecks and deposited into each person’s own individual retirement account. That account is a Roth IRA by default, and the saver can ask the program for a traditional IRA instead. The rule also keeps you out of three other roles: you cannot act as a fiduciary, you cannot advise employees about rates or investments, and you cannot discourage anyone from taking part. Any plan to put company money toward retirement means setting up a plan of your own.
What is the default contribution rate?
The default is 5 percent of gross pay. Because the account is a Roth IRA unless the saver changes it, the deduction comes out of pay after taxes. Savers are also stepped up automatically: every January the rate climbs by one percentage point for anyone who has been enrolled for at least six months, and it stops climbing at 8 percent. None of this is fixed for the employee. They can choose a rate of 1 percent or more within federal IRA limits, turn the increases down, or leave the program entirely at any time. Deposits for a given year end when the saver reaches that year’s federal IRA maximum. A person who opts out within thirty days of being added never gets an account and never has money withheld.
Can employees opt out of the state program?
Yes. Employees can opt out whenever they like, and it happens between them and the program, not through you. Once you add a person to the program, the administrator reaches out to that employee and allows thirty days to opt out or adjust the account. Someone who leaves within that period never has an account opened or a deduction started. Someone who leaves later triggers a notice telling the employer to stop deducting, and the contributions already made can be withdrawn. Because people who opt out are free to rejoin at any time, your roster has to stay current. And since the program rule bars you from prohibiting, restricting, or discouraging participation, the choice is theirs alone.
Is a 401(k) better than the Colorado state program?
It depends on what you want retirement savings to do for the business. The state program is free to facilitate, carries no fiduciary role, and needs no plan document or annual filing, but it caps out at the federal IRA limit and allows no employer money. A 401(k) allows a far higher deferral limit, employer contributions, and a startup tax credit for eligible small businesses, at the price of plan documents, testing, an annual return, and real fiduciary duty. Costs also land differently: the state program charges the saver an asset-based fee plus a flat annual account fee, while a plan of your own bills the business. Owners who want to defer meaningfully themselves usually outgrow the state program quickly.
What does the employer actually have to do each payroll run?
Each payroll run comes down to three jobs: withhold the percentage each participating employee elected, send it to the program administrator, and keep the roster accurate. On timing, the program rule gives you fourteen days after the money comes out of wages to get it to the administrator, and it bars sending anything for an employee who opted out. The program’s own employer instructions describe the roster work as adding new hires, entering rate changes, and marking departures as terminated. The deduction also cannot take more than the paycheck has left once deductions with higher precedence, such as taxes and court orders, have come out. New people join the roster no later than thirty days after their 180th day of employment, so onboarding is the natural place to catch it.
Make HR the easy part of running your business
Onboarding, e-signatures, training and core HR in one place. Up and running in 5 minutes.
- 7-day free trial
- No credit card required
- Cancel anytime