Colorado Retirement Mandate: What Employers Must Do
Colorado SecureSavings makes employers with no retirement plan register or certify exemption. The deadlines, the fines, and the 401(k) alternative.
Colorado Retirement Mandate
Colorado SecureSavings asks every employer without a plan the same question and accepts two answers: register, or certify that you already offer something qualified. Who is covered, when the clock runs, what the fine is, how the auto-IRA behaves inside your payroll, and how to weigh the state program against sponsoring a 401(k) of your own
The first Colorado SecureSavings notice I ever saw was a plain envelope with an access code printed inside, sitting in a stack of unopened mail at a client office in Denver. Nobody had opened it because nobody recognized the sender. It had been there for weeks.
The mandate itself is not complicated. It asks one question and accepts two answers: register for the state program, or certify that you already offer a qualified retirement plan. Doing nothing is the only wrong answer, and it is the answer with a price attached.
What follows covers who has to act, what the deadlines actually are now that the original waves have closed, what the fine is and how long the state waits before assessing it, how the auto-IRA behaves inside your payroll, and how to weigh the state program against sponsoring a 401(k) instead. I build the onboarding and people records tooling for businesses without an HR department at FirstHR. FirstHR is an onboarding and HR platform, not a payroll provider or a retirement plan provider, and this is general information rather than tax or legal advice.
Who Has to Act
The mandate reaches any private-sector Colorado employer that has been in business at least two years, has five or more employees, and does not already offer a tax-qualified retirement plan. Meet all three and you register. Miss any one and you certify exemption.
The two-year test is more precise than most employers expect. The program rule (8 CCR 1508-3) dates a business from whichever of four markers is closest to the present: the IRS Form SS-4, the Colorado Secretary of State formation record, the state sales tax license, or the month the business became liable for wage withholding with the labor department.
The program sits inside a wider group of state auto-IRA mandates, and if you employ people across state lines it is worth reading the national picture in the guide to state-sponsored retirement programs alongside this page. Colorado-specific obligations beyond retirement live on the Colorado compliance hub.
The Deadlines
The original registration deadlines have closed. The state phased employers in during 2023 across three groups, largest first and smallest last, and every one of those dates is now in the past. What runs today is an annual cycle rather than a one-off event.
Businesses that become newly eligible are notified by the program and given a registration date, and the program publishes a May 15 deadline for newly eligible businesses in its employer program details. Missing it does not close the door.
The portal stays open, and registering late is materially better than waiting, because the penalty schedule attaches to ongoing noncompliance rather than to the missed date by itself. The Colorado Department of the Treasury points employers to the program site to register, which is also where the exemption certification happens.
| Clock | What triggers it | What you owe |
|---|---|---|
| Your registration date | Notification from the program with an access code | Register or certify exemption by that date |
| The annual cycle | Becoming newly eligible during the year | Act by the deadline in your notice, currently May 15 |
| New employee onboarding | An individual reaching 180 days of employment | Submit their details within 30 days of that anniversary |
| The opt-out window | An employee being added to the program | Wait 30 days, then record their election |
| Every payroll run after that | Withholding a deduction | Remit to the administrator within 14 days |
That third row is the one small employers forget. The rule ties employee onboarding to a service milestone rather than to a calendar quarter, so a hire made in March creates a program obligation in the autumn. Folding it into your standard new hire paperwork routine is the only reliable way to catch it.
What the Fine Is
The Colorado Secure Savings Program Act caps fines at one hundred dollars for each eligible employee per year and five thousand dollars in aggregate per calendar year. The program rule sets the fine at that hundred dollar figure and hands collection to the Colorado Department of Labor and Employment, working in partnership with the treasury program.
The statutory authority for the penalty is in the Colorado Secure Savings Program Act, enacted by Senate Bill 20-200, which directs the program board to adopt rules establishing minimal fines for employer noncompliance within those limits.
Worth noting what the cap actually means at small scale. A business with a modest payroll will not hit five thousand dollars, so the fine is genuinely small relative to the cost of a benefits program. The reason to comply is not the number. It is that a live compliance file with a state labor department is an expensive thing to carry into an audit or a sale.
How the Auto-IRA Works
Employees are enrolled automatically at 5 percent of gross pay into their own Roth IRA, deducted after taxes, with a thirty day window to opt out or change anything. The default also escalates by one percentage point each January for anyone enrolled at least six months, stopping at 8 percent.
Because the account is a Roth IRA rather than a plan account, federal IRA limits apply rather than plan limits. The IRS set the 2026 IRA contribution limit at $7,500, with a $1,100 catch-up for savers age 50 and over.
Savers pay the program cost, not the employer. The program description puts the total annualized asset-based fee between 0.225 percent and 0.31 percent depending on the investment option, with the target date default at 0.29 percent, plus a $22 annual account fee charged at $5.50 a quarter. That is competitive for a retail IRA and expensive relative to a well-run plan at scale.
Your Job in Payroll
Register, add employees, wait out the opt-out window, record elections, withhold, remit within fourteen days, and keep the roster current. That is the complete list, and the program rule is explicit that it is the complete list.
| Task | Yours | Not yours |
|---|---|---|
| Registering the business and setting up payment | Yes | |
| Adding employees and marking departures | Yes | |
| Withholding the elected percentage each run | Yes | |
| Remitting within fourteen days of withholding | Yes | |
| Updating contribution rate changes in the portal | Yes | |
| Opening employee accounts | Handled automatically | |
| Answering investment questions | Program administrator | |
| Processing withdrawals and account changes | Program administrator | |
| Selecting the investment lineup | State program board |
Two mechanical details cause most of the errors I see. Nothing may be remitted to the program until the opt-out period ends, and the amount withheld cannot exceed what remains after higher-precedence payroll deductions such as taxes and court orders have come out. Both are in the rule, and both are easy to get wrong on a first run.
The other quiet cost is roster hygiene. Every new hire, every departure, every rate change has to reach the portal, which for a business running Colorado payroll alongside other obligations is one more list to keep accurate. If you already track headcount changes centrally, the marginal work is small. If you do not, this is the thing that slips.
The Fiduciary Line
You facilitate the program. You do not sponsor it. That single distinction is what makes the state option nearly free and what makes it limited, and it is worth understanding precisely before comparing it to a plan of your own.
Because you are not the sponsor, there is no plan document to adopt, no investment committee, no annual Form 5500 filing, and no ERISA plan sitting on your balance of obligations. State auto-IRA programs were built specifically to avoid creating employer-sponsored plans, which is why the employer role is drawn so narrowly.
The flip side arrives the moment you want to do anything generous. You cannot match. You cannot make a profit-sharing contribution. You cannot use the program to give owners a meaningful deferral. Every one of those requires you to leave the program and sponsor something.
Certifying Exemption
If you already offer a tax-qualified retirement plan, you are exempt, but you are not finished. An authorized representative certifies through the program website that the business offers a qualified plan, has fewer than five employees, or has been in business under two years. The program then issues a certificate of exemption.
That certificate stays in effect as long as the underlying fact stays true. It is not an annual filing, which is a relief, and it is also the reason a business that terminates its plan can drift back into the mandate without noticing. If you ever wind down a plan, treat re-registration as part of the wind-down checklist.
The certification is also the answer to the letter sitting in the mail pile. Employers who already have a plan frequently ignore the notice on the reasonable assumption that it does not apply to them. It does apply, in the sense that the state cannot tell the difference between an exempt employer and a noncompliant one until somebody clicks the button.
Registering Versus Sponsoring Your Own Plan
The state program is a compliance answer. A 401(k) is a compensation decision. Both satisfy the mandate, and they solve genuinely different problems, which is why the comparison is rarely close once you know what you are trying to achieve.
| Dimension | Colorado SecureSavings | Your own 401(k) |
|---|---|---|
| Annual employee limit | $7,500 IRA limit for 2026, plus $1,100 catch-up | $24,500 deferral limit for 2026, plus $8,000 catch-up |
| Employer contributions | Prohibited | Optional, and deductible |
| Tax treatment | Roth by default, traditional IRA on request | Pre-tax, Roth, or both by design |
| Fiduciary responsibility | None for the employer | Yes, and it is real |
| Plan document and annual return | None | Plan document plus annual filing obligations |
| Nondiscrimination testing | None | Yes, unless a safe harbor design applies |
| Income eligibility limits | Roth phase-outs apply to the saver | No income cap on deferrals |
| Cost to the employer | Free to facilitate | Setup and recordkeeping fees, partly offset by tax credits |
| Cost to the employee | 0.225 to 0.31 percent a year plus a $22 account fee | Depends entirely on the provider you choose |
| Portability | The IRA belongs to the individual | Rollover on separation |
The first row decides most cases involving owners. A founder trying to shelter a meaningful share of income cannot do it at the IRA limit, and no amount of administrative convenience compensates for a ceiling that low. That single fact pushes most profitable small businesses toward a plan of their own within a few years.
The fourth and sixth rows decide most cases involving nobody senior. If the honest goal is to satisfy the state and give people access to payroll savings without adding an obligation you have no capacity to run, the state program is the correct answer and there is no shame in it.
What a 401(k) Costs
A small business plan carries setup and recordkeeping fees, and federal tax credits offset a meaningful share of them for eligible employers. The credit for retirement plan startup costs runs for three consecutive tax years and is capped at the greater of $500 or the lesser of $250 per eligible non-highly compensated employee and $5,000.
The share of costs the credit covers is tiered by employer size, with the smallest employers able to cover the full amount of eligible startup costs and larger ones covering half, per the IRS guidance on the startup costs credit. A separate credit of $500 a year for three years applies to adding an automatic enrollment feature.
Those credits came largely from the SECURE Act 2.0 package, which also made automatic enrollment mandatory for most 401(k) plans established after the act was signed, effective for plan years beginning after 2024. Default rates under that requirement run between 3 and 10 percent with annual escalation, and the requirement carves out very new businesses and the smallest employers, so confirm which side of the carve-out you land on before designing anything.
The other cost worth naming is testing. An ordinary plan is tested annually, and a plan where owners defer heavily while nobody else participates tends to fail. That is what nondiscrimination testing exists to catch, and a safe harbor design is the standard way to sidestep it in exchange for a mandatory employer contribution.
How to Decide
The question is not which is better. It is whether retirement savings is a compliance item or a compensation item for your business this year.
A perfectly reasonable path is to register for the state program now because a deadline is real, then sponsor a plan later and certify exemption when it is live. Registering does not commit you to anything permanent. It commits you to facilitating payroll deductions for as long as you have no plan of your own.
If you take the plan route, treat it as part of a wider benefits package decision rather than a standalone purchase, and get the design questions answered before the provider conversation rather than during it. The guide to a startup 401(k) covers the setup sequence in detail.
Common Mistakes
Five patterns account for nearly every Colorado compliance problem I have watched a small employer create.
Ignoring the notice because you already have a plan is first and by far the most common. Exemption still requires certification, and until somebody certifies, the state has no way to distinguish you from an employer doing nothing.
Treating the mandate as a one-time task is second. New hires generate obligations at their service milestone, departures have to be marked, and rate changes have to reach the portal. It is an ongoing payroll routine, not a project with an end date.
Starting deductions too early is third. The rule bars remitting anything until the thirty day opt-out period closes, and the program has you begin deductions after it, so money taken from somebody who opted out has to be unwound.
Advising employees on what to choose is fourth. It feels helpful and the program rule prohibits it. Point people at the program service line and keep your own view out of it.
And assuming the state program is a benefits program is fifth. It is a payroll savings mechanism with no employer money in it, and describing it to candidates as a retirement benefit sets an expectation your offer letter will not meet.
For employers running Colorado payroll alongside everything else, the state obligations do not stop at retirement. State withholding, unemployment premiums, paid family leave, and sick leave all carry their own requirements, and the Colorado payroll overview is a faster place to check them than the mandate materials.
Frequently Asked Questions
Who has to register for Colorado SecureSavings?
Private-sector Colorado employers that meet three conditions at once: in business for at least two years, five or more employees, and no tax-qualified retirement plan already offered. Employers that meet all three must register and facilitate payroll deductions. Employers that fail any one of the three certify an exemption instead, which the Colorado Department of the Treasury runs through the same program portal using the access code mailed to the business. The exemption certificate stays valid for as long as the business keeps offering a qualified plan or stays under the employee threshold, so it is not a form you refile every year.
What is the deadline to register?
The original staged registration dates closed in 2023, when the state phased employers in over three groups from the largest down to the smallest. What runs now is an annual cycle: businesses that become newly eligible are notified by the program, which publishes a May 15 deadline for newly eligible businesses. If your deadline has already passed, registration does not close. The portal stays open and the practical instruction from the program is to register late rather than wait, because the fine schedule attaches to continued noncompliance rather than to the missed date itself. The notification arrives by first-class mail and carries the access code you need to register or to certify exemption, so the envelope matters more than the calendar.
What is the penalty for not registering?
Up to one hundred dollars for each eligible employee per year, capped at an aggregate five thousand dollars in a calendar year. The program rule assigns collection to the Colorado Department of Labor and Employment, which sends three notices of noncompliance before anything is assessed. The rule also builds in timing floors: no fine earlier than twelve months after the registration date or one year after the employer was scheduled to enter the program, whichever falls later, and none earlier than three months after the first noncompliance notice is postmarked. Once a final notice of penalty application arrives, the employer has thirty days to remit.
Does the employer contribute to Colorado SecureSavings?
No, and the point is stronger than that: employer contributions are prohibited by the program rule, not merely optional. There is no match to design, no vesting schedule, and no employer money in the accounts at all. Every dollar comes from the employee through payroll deduction into that employee’s own individual retirement account, which opens as a Roth IRA unless the saver asks the program for a traditional one instead. The same rule bars employers from acting as a fiduciary, advising employees on contribution rates or investments, or discouraging participation. If you want to put company money into retirement savings, you need a plan of your own rather than the state program.
What is the default contribution rate?
Five percent of gross pay, deducted after taxes because the account is a Roth IRA by default. The default also includes automatic escalation: one percentage point each January for savers who have been enrolled at least six months, continuing until the rate reaches eight percent. Employees can set any rate from one percent upward within federal IRA limits, decline the escalation, or opt out entirely at any time. Contributions for a given year stop once the saver reaches the federal IRA maximum for that year. Anyone who opts out during the thirty day window after being added never has an account opened and never has a deduction taken.
Can employees opt out of the state program?
Yes, at any time and without your involvement. After an employer adds someone to the program, the administrator contacts that person directly and gives them thirty days to opt out or customize the account. Opting out inside the window means no account is created and no payroll deduction ever starts. Opting out later means the employer is notified to stop the deduction, and contributions already made can be withdrawn. Employees who opt out can rejoin whenever they want, which is why the roster you maintain has to stay current. The rule separately bars an employer from prohibiting, restricting, or discouraging participation, so the decision has to be left alone.
Is a 401(k) better than the Colorado state program?
It depends on what you want retirement savings to do for the business. The state program is free to facilitate, carries no fiduciary role, and needs no plan document or annual filing, but it caps out at the federal IRA limit and allows no employer money. A 401(k) allows a far higher deferral limit, employer contributions, and a startup tax credit for eligible small businesses, at the price of plan documents, testing, an annual return, and real fiduciary duty. Costs also land differently: the state program charges the saver an asset-based fee plus a flat annual account fee, while a plan of your own bills the business. Owners who want to defer meaningfully themselves usually outgrow the state program quickly.
What does the employer actually have to do each payroll run?
Withhold the elected percentage from participating employees, remit it to the program administrator promptly, and keep the employee roster accurate. The program rule requires contributions to reach the administrator no later than fourteen days after they are withheld from wages, bars remitting for anyone who opted out, and requires the employer to add new hires, update rate changes, and mark departures as terminated. The amount withheld also cannot exceed what is left of the paycheck after deductions with higher precedence, including taxes and court orders. New employees are added no later than thirty days after their one hundred and eightieth day of employment, which makes onboarding the natural place to catch it.