SECURE Act 2.0: What Changed for Small Employers
SECURE Act 2.0 rewrote the 401(k) rules for small employers. What is already in effect, what is still phasing in, and the deadline you cannot miss.
I started reading SECURE 2.0 the way most founders do, which is by opening a provider summary listing ninety-something provisions and closing it again within a minute. The problem with that list is not its length. It is that the list gives every provision equal weight, and for a small employer they are wildly unequal.
Maybe eight of them will change something you do. Two of those have already changed it whether you noticed or not. One has a paperwork deadline that lands at the end of this calendar year and gets almost no attention because it is not exciting.
So this is organized the only way that helps: what is binding on you now, what you can choose to switch on, what is still phasing in, and what you should do this month.
I build the people and records side of this for companies without an HR department at FirstHR, which is an onboarding and HR platform rather than a retirement plan provider. This is general information, not tax or legal advice.
What SECURE 2.0 Actually Did
SECURE 2.0 is a package of retirement plan changes enacted as part of the Consolidated Appropriations Act, 2023 on December 29, 2022. It does three things at once: it forces some new behavior on new plans, it pays employers to start plans, and it hands existing plans a long menu of optional features.
The mental model that saves the most time is this. Ask when your plan was established, then ask what your provider has already switched on, then ask what you have signed. Those three questions resolve almost every SECURE 2.0 obligation a small business has, and most owners cannot answer the third.
The mandate comes first, because it gets the most attention and is the one most small employers with an existing plan can rule out quickly.
The Automatic Enrollment Mandate
Plans established on or after December 29, 2022 generally have to enroll employees automatically, and the requirement took effect for plan years beginning after December 31, 2024. It is in force now, which means a plan started during 2023 or 2024 should already be operating this way.
The statutory shape is specific. The arrangement has to be an eligible automatic contribution arrangement with a uniform default deferral of at least three percent and not more than ten percent of compensation in an employee's first year of participation, escalating by one percentage point each year to at least ten percent and no more than fifteen (26 U.S.C. 414A).
Employees keep the right to opt out or to choose a different rate, and the arrangement has to allow a permissible withdrawal of automatic contributions within the first ninety days. Default money goes into a qualified default investment alternative rather than sitting in cash.
Who Is Exempt
Most small employers with an existing plan are exempt, and the reason is the grandfather date rather than their size. Four separate gates take you out of the mandate, and you only need one.
The gate that catches people is the third one. Founders read the small employer exception, count their team, and conclude they are safe. Then they grow, and the exception expires a year after the close of the first taxable year in which the headcount crossed the line. It is a runway, not a permanent status.
One wrinkle qualifies the first gate. An employer that adopts a plan maintained by more than one employer after the enactment date is treated as if that plan were a single plan for this test, so joining an existing shared arrangement does not let you inherit its grandfather status. The pooled plan section below covers what that means in practice.
Worth separating from all of this: state retirement mandates are an entirely different regime with their own registration deadlines and penalties. Being outside the federal automatic enrollment requirement tells you nothing about whether your state requires you to offer a plan at all.
The Tax Credits
Two credits do the heavy lifting: SECURE 2.0 enlarged the startup cost credit and created the employer contribution credit, both for taxable years beginning after December 31, 2022. You claim both on your return rather than through the plan, and a small employer starting a plan can recover a large share of the first years of cost.
| Credit | What it covers | Value | Duration |
|---|---|---|---|
| Plan startup cost credit | Qualified startup and administration costs for a new plan | 100 percent of eligible costs at 50 or fewer employees, 50 percent above that threshold and gone past one hundred | Three years |
| Employer contribution credit | Employer contributions made on behalf of participants | Up to $1,000 per employee, excluding employees paid above an indexed wage limit ($110,000 for 2026) | Five years, tapering after the second |
| Automatic enrollment credit | Adding an eligible automatic contribution arrangement | $500 a year | Three years |
| Military spouse credit | Enrolling military spouses within two months of hire with immediate vesting | $200 per military spouse plus employer contributions for that spouse up to $300 | Three years per military spouse |
The startup cost credit is the applicable percentage of what you actually spent, capped each year at $250 per eligible non-highly compensated employee, with a $500 floor and a $5,000 ceiling on that cap. The contribution credit runs at full value for the first two years and then steps down through seventy-five, fifty and twenty-five percent (Internal Revenue Service).
Two limits on the contribution credit get missed. Contributions for employees paid above an indexed wage limit do not count, and the IRS set that limit at $110,000 for 2026 in Notice 2025-67. Past fifty employees the credit also shrinks by two percentage points for every additional employee.
One qualification that costs pre-profit companies real money: these are general business credits rather than refundable ones (Instructions for Form 8881). A company with no tax liability does not get a check.
The Catch-Up Rules
Catch-up contributions are the extra amount employees aged fifty and older may defer beyond the standard limit, and SECURE 2.0 changed them twice. The two changes pull in opposite directions. One lets older employees save more. The other restricts how higher earners are allowed to do it.
The first is the enlarged catch-up limit for participants who attain ages sixty, sixty-one, sixty-two or sixty-three during the year, effective for taxable years beginning after December 31, 2024.
For 2026 the IRS set the elective deferral limit, the base amount an employee can contribute from pay, at $24,500, the standard age fifty catch-up at $8,000, and the higher catch-up for that four year band at $11,250 (Internal Revenue Service).
The second is the mandatory Roth treatment of catch-up contributions for higher earners. Where an employee received wages from the employer sponsoring the plan above an indexed threshold in the prior calendar year, catch-up contributions must be designated Roth contributions, which means they are made with after-tax money (Treasury final regulations).
| Question | Answer |
|---|---|
| When did the Roth catch-up rule become operative? | January 1, 2026, after an administrative transition period that ran through the end of 2025 |
| What is the wage threshold? | Indexed. The IRS set it at $150,000 of 2025 wages for determining 2026 catch-up contributions |
| Whose wages count? | FICA wages from the employer sponsoring the plan, not household or total income |
| What if the plan has no Roth source? | Affected employees cannot make catch-up contributions at all until Roth deferrals are added |
| Does it apply to self-employed owners with no FICA wages? | The test runs on prior year wages, so a partner or sole proprietor without them is not caught by it |
| When do the final regulations apply? | The Treasury regulations issued in September 2025 generally apply to contributions in taxable years beginning after December 31, 2026 |
The fourth row is the one that turns a tax rule into an employer problem. Adding a Roth deferral source is a plan amendment and a payroll configuration, and it has to be finished before an affected employee tries to defer. Otherwise the only compliant option is to block their catch-up entirely, a hard conversation with the people who most want to save.
Nick Anisimov, FirstHR founderLong-Term Part-Time Staff
Long-term part-time employees now reach eligibility a year sooner. The original SECURE Act required plans to admit employees who completed at least five hundred hours in each of three consecutive twelve month periods, and SECURE 2.0 cut that to two consecutive periods for plan years beginning after December 31, 2024 (26 U.S.C. 401(k)(2)(D)).
The five hundred hour floor did not move and the age twenty-one condition did not move. Only the number of consecutive years dropped. The rule was also extended to cover ERISA-governed 403(b) plans, which previously sat outside it (IRS Notice 2024-73).
If you have a mixed workforce, the operational question is whether your hours records could survive an audit rather than whether the rule is fair.
Provisions You Can Turn On
Most of SECURE 2.0 is optional, and nothing on this list happens unless you and your provider deliberately switch it on. These are the ones a small employer is most likely to want.
| Provision | Status | What it does |
|---|---|---|
| Student loan matching | Available for plan years beginning after Dec 31, 2023 | Lets you match an employee's qualified student loan payments as if they were deferrals |
| Pension-linked emergency savings | Available for plan years beginning after Dec 31, 2023 | A Roth sub-account for non-highly compensated employees, capped at $2,600 for 2026, withdrawable monthly |
| Roth employer contributions | Available for contributions after Dec 29, 2022 | Lets employees elect to have match or nonelective contributions treated as Roth, with tax consequences to them |
| Small enrollment incentives | Available for plan years beginning after Dec 29, 2022 | Permits a de minimis incentive up to $250, offered only to employees with no deferral election already in effect |
| Starter 401(k) | Available for plan years beginning after Dec 31, 2023 | A deferral-only arrangement with no employer contribution, limited to $6,000 for 2026 plus $1,100 for age fifty and over |
| Higher force-out threshold | Available since 2024 | Raises the involuntary cash-out limit for small balances of departed employees from $5,000 to $7,000 |
Student loan matching is the one small employers ask about most, because it reaches people who cannot afford to defer. The IRS issued interim guidance on how a plan runs these matches, including certification procedures and timing flexibility, in Notice 2024-63 (Internal Revenue Service).
A match on loan payments has to use the same rate and vesting as your ordinary match, so it is a coverage extension rather than a new benefit tier. Because the value lands in an account the employee already has rather than against the loan balance, it also changes the calculus on standalone student loan repayment benefits.
The emergency savings account is more interesting on paper than in practice for very small teams. Contributions are Roth only and participation is limited to non-highly compensated employees.
The balance cap is indexed and sits at $2,600 for 2026 excluding earnings, and withdrawals must be permitted at least monthly with the first four in a plan year free of fees. It solves a real problem and it adds a moving part.
Pooled Employer Plans
A pooled employer plan lets unrelated small businesses save inside one 401(k) run by a professional pooled plan provider, which carries the plan document, the annual filing and most of the fiduciary weight. It arrived with the original SECURE Act rather than with 2.0, which is why it often gets discussed under both laws at once.
The 2019 law let these plans begin operating on January 1, 2021 and removed the two obstacles that had kept small employers out of shared plans. Participating employers no longer need a common interest beyond adopting the plan, and one employer's qualification failure no longer threatens everyone else in it.
SECURE 2.0 then made two narrower repairs, both for plan years beginning after December 31, 2022. Section 105 allows the plan to designate a named fiduciary other than a participating employer to collect contributions, under written collection procedures that are reasonable, diligent and systematic (29 U.S.C. 1002). Section 106 opened multiple employer and pooled arrangements to 403(b) plans, which had been shut out of them.
Some duties move to the pooled plan provider and some stay with you. The provider is designated as the named fiduciary and the plan administrator, acknowledges that role in writing, and has to register with the Department of Labor on Form PR before it can operate a pooled plan (Department of Labor).
What does not move is your own duty to select the pooled plan provider prudently and to keep watching it afterward (Employee Benefits Security Administration).
| The job | Who holds it in a pooled employer plan |
|---|---|
| Named fiduciary and plan administrator | The pooled plan provider, acknowledged in writing |
| Registration before the plan can operate | The pooled plan provider, on Form PR with the Department of Labor |
| Plan document and the annual Form 5500 | The pooled plan provider, filed once for the whole plan |
| Selecting and monitoring that provider | You. This duty does not transfer with the rest |
| Sending deferrals and match from payroll on time | You, out of your own payroll cycle |
| Whether to match, and at what rate | You, within the options the plan makes available |
Now the trap, because it quietly cancels the most valuable exemption in this article. Under the statute, an employer that adopts a plan maintained by more than one employer after December 29, 2022 loses the pre-enactment exception from the first gate and is tested as if that plan were a single plan.
A pooled plan that has been running since 2021 has its own long history, and none of it transfers to you. You join without a grandfather date, and the new business and small employer gates, which 26 U.S.C. 414A applies to each participating employer separately, are what can still keep you out of the mandate.
Dwight SchruteSales3 people
Darryl PhilbinWarehouse1 person
Kelly KapoorCustomer Service1 personWhether the trade is worth making depends on what you are trying to hand off. A pooled plan is a strong answer to fiduciary exposure and annual filing overhead, and a weaker answer to cost alone, now that a standalone startup 401(k) comes with the credits described above. Ask any provider for its Form PR filing and a written fee schedule before you compare anything else.
What Is Still Phasing In
Three items are not fully landed, and only one of them will cost you anything.
| Provision | Timing | Employer impact |
|---|---|---|
| Saver's Match | Taxable years beginning after Dec 31, 2026 | Federal money paid into employee accounts, not employer money. Expect questions and provider reporting changes |
| Paper benefit statements | Plan years beginning after Dec 31, 2025 | Defined contribution plans must furnish at least one paper statement a year unless the plan uses the 2002 electronic disclosure safe harbor or the participant elects electronic delivery |
| Required minimum distribution age | Rising again in 2033 | Administrative only, handled by the provider, but it changes what you tell departing older employees |
The Saver's Match replaces the existing Saver's Credit with a direct federal contribution into an eligible saver's account, at fifty percent of up to two thousand dollars of contributions and subject to income phase-outs, so one thousand dollars a year is the ceiling.
Treasury and the IRS set out their intended approach to the Saver's Match in Notice 2026-48 in August 2026, and savers will claim the match on a new form filed with the 2027 return.
Paper statements are the sleeper. The requirement applies to plan years beginning after December 31, 2025, so it is live for calendar year plans right now.
The Department of Labor proposed implementing rules for paper statements in February 2026 and then issued Field Assistance Bulletin 2026-02 in May 2026, setting out a temporary non-enforcement posture until final rules land. Good faith compliance with a reasonable interpretation is still expected.
The Plan Document Deadline
The first plan document deadline arrives at the end of 2026. Operational compliance and paperwork compliance were deliberately decoupled: plans had to follow each provision from its own effective date, but the formal amendments were deferred. They now run on two clocks, one for the optional features you adopted and one for the changes the law required.
Under IRS Notice 2024-2, amendments for the optional features a plan already operates are due December 31, 2026 for most non-governmental qualified plans and for 403(b) plans not maintained by a public school. That is a fixed calendar date rather than the last day of your plan year, so running an off-calendar plan year buys you nothing here.
Other plan types got more time. Applicable collectively bargained plans have until December 31, 2028 and governmental plans until December 31, 2029, and IRS Notice 2026-9 pushed IRAs, SEPs and SIMPLE IRA plans out to December 31, 2027.
Required changes follow a later schedule. According to the IRS (Employee Plans News, September 2026), mandatory provisions take their deadlines from its annual Required Amendments List: the Roth catch-up amendment is expected to fall due December 31, 2029, and the automatic enrollment and long-term part-time amendments will get dates only after final regulations apply.
This is also the natural moment to check that your summary plan description and enrollment materials describe what the plan actually does now. Several SECURE 2.0 features change what employees see at enrollment, and communications tend to lag the plan document by a year or more.
What to Do Now
Seven checks, in the order that finds problems fastest.
Each of those checks produces an answer that is worth writing down, because the person who asks next year will be you, and the useful part is the date and the source rather than the recollection. The record below is where the answers go.
Common Mistakes
Five recurring failures, ranked by how expensive they are to unwind.
Assuming a provider switched something on is first. Optional provisions are opt-in at both the plan level and the provider level, and a feature described in a marketing email is not a feature enabled in your plan.
Treating the small employer exception as permanent is second. It expires a year after the close of the first taxable year in which you normally employed more than ten people, which means the obligation arrives while you are busy with the growth that triggered it.
Missing the Roth catch-up configuration is third. It surfaces as a payroll anomaly rather than as a compliance alert, usually reported by the affected employee, usually weeks after it started.
Leaving the amendment unsigned is fourth. Operational compliance without the document amendment is a plan qualification problem, and the correction is more expensive than the signature would have been.
And confusing federal and state obligations is last. The federal enrollment mandate and the state auto-IRA programs are separate regimes with separate triggers, and satisfying one has no effect on the other.
None of these are exotic. They are the ordinary failure modes of a company where the retirement plan is one of forty things somebody handles alongside a full job, which is also why the answer is usually a calendar entry rather than a policy.
Give one person the annual review and keep the plan inside your wider view of employee benefits, and most of this stops being a risk.
Frequently Asked Questions
What is the SECURE Act 2.0?
SECURE 2.0 is a retirement law enacted on December 29, 2022 as Division T of the Consolidated Appropriations Act, 2023. It contains more than ninety provisions covering 401(k), 403(b), SIMPLE and IRA arrangements, and it phases them in across roughly a decade rather than all at once. For a small employer the practical content is narrower than the headline count suggests: a mandate to automatically enroll new hires in plans established on or after the enactment date, enlarged tax credits for starting a plan, two changes to catch-up contributions, faster eligibility for long-term part-time staff, and a menu of optional features such as student loan matching that you can adopt or ignore.
Does SECURE 2.0 require my 401(k) to have automatic enrollment?
Only if your plan was established on or after December 29, 2022 and you fail every exemption. Plans established before that date are grandfathered permanently. Beyond that, a business that has operated for under three years is excepted, a business that normally has ten or fewer employees gets a pass until a year after it grows past that size, and SIMPLE, governmental and church plans are outside the requirement altogether. Where the mandate does apply, the plan has to be an eligible automatic contribution arrangement that enrolls eligible employees at a default rate of at least three and no more than ten percent of pay in their first year, rising by one percentage point every year.
What are the SECURE 2.0 tax credits for starting a 401(k)?
There are two that matter most, and they stack. The startup cost credit covers a percentage of qualified plan startup costs for three years, at one hundred percent for employers with no more than fifty employees and half that from fifty-one to one hundred. Each year the credit is limited to two hundred fifty dollars for every eligible non-highly compensated employee, with a minimum limit of five hundred dollars and a maximum of five thousand. A separate credit covers employer contributions of up to one thousand dollars per employee, at full value in the first two years and then tapering across the third, fourth and fifth years. Contributions for anyone paid above an indexed wage ceiling do not count toward that credit, and Notice 2025-67 fixed the ceiling at one hundred ten thousand dollars for 2026.
Do high earners have to make Roth catch-up contributions now?
Yes. Where an employee received wages from you above the indexed threshold in the prior calendar year, any catch-up contribution has to be a designated Roth contribution. The threshold is indexed and moved to one hundred fifty thousand dollars of 2025 wages for determining 2026 catch-ups. The employer consequence is blunt: a plan without a Roth deferral source cannot accept catch-up contributions from affected employees at all, so the practical choice is to add Roth or to switch catch-ups off for that group. Only wages paid by the company that sponsors the plan count toward the test, so household or total income does not enter into it.
What is the higher catch-up limit for ages 60 to 63?
SECURE 2.0 created an enlarged catch-up limit for participants who reach ages sixty, sixty-one, sixty-two and sixty-three during the year, effective for taxable years beginning after December 31, 2024. The 2026 figure is eleven thousand two hundred fifty dollars, against eight thousand dollars for the standard age fifty catch-up, and either amount sits on top of the twenty-four thousand five hundred dollar elective deferral limit. Eligibility is by age attained during the year, so a participant who turns sixty-four loses access to the higher figure and drops back to the standard catch-up. Plans are not required to offer the enlarged limit, but payroll systems need to know which of the three numbers applies to which employee, and that mapping has to be refreshed every January.
When do long-term part-time employees become eligible for a 401(k)?
Under SECURE 2.0 the requirement fell from three consecutive years to two, effective for plan years beginning after December 31, 2024. An employee who works at least five hundred hours in each of two consecutive twelve month periods and has reached age twenty-one by the close of the second period has to be allowed to make elective deferrals, even if the plan otherwise requires a thousand hours. Employer contributions are not required for people who enter only through this route, and plans may exclude these employees from certain nondiscrimination, coverage and top-heavy testing. SECURE 2.0 also extended the rule to 403(b) plans covered by ERISA. The administrative burden lands on hours tracking rather than on plan design.
Do I have to amend my plan document for SECURE 2.0?
Yes, and the first deadline is close. Each provision had to be followed in practice from its own effective date, while the written amendments were postponed. For discretionary features a plan already runs, such as Roth employer contributions or student loan matching, IRS Notice 2024-2 sets December 31, 2026 for most non-governmental qualified plans and for 403(b) plans not maintained by a public school, whatever your plan year. Applicable collectively bargained plans get until the end of 2028 and governmental plans until the end of 2029, while Notice 2026-9 moved IRAs, SEPs and SIMPLE IRA plans to the end of 2027. Mandatory changes sit on a separate track: the IRS said in September 2026 that they follow its Required Amendments List, which generally puts the Roth catch-up amendment at December 31, 2029 and leaves the automatic enrollment and long-term part-time dates open until final regulations apply. If your provider uses a pre-approved document they will usually handle the drafting, but somebody at your company still has to sign it.
What is the Saver’s Match and does it cost employers anything?
Starting with taxable years beginning after December 31, 2026, the Saver’s Match takes the place of the existing Saver’s Credit. Rather than trimming the saver’s tax bill, the federal government deposits a matching amount straight into the saver’s retirement account. The match is fifty percent of contributions up to two thousand dollars, reduced as income rises, so one thousand dollars a year is the most anyone can receive. Because the money comes from Treasury, employers carry no direct payroll cost. What they should expect is employee questions and reporting mechanics that plan providers are still building. Notice 2026-48, issued in August 2026, outlines how the match is expected to work, and savers will claim it on a new form filed with the 2027 return.
Make HR the easy part of running your business
Onboarding, e-signatures, training and core HR in one place. Up and running in 5 minutes.
- 7-day free trial
- No credit card required
- Cancel anytime