SECURE Act 2.0: What Changed for Small Employers
SECURE Act 2.0 rewrote the 401(k) rules for small employers. What is already in effect, what is still phasing in, and the deadline you cannot miss.
SECURE Act 2.0
More than ninety provisions, of which maybe eight matter to a company without an HR department. Sorted by what is already binding on you, what you can switch on if you want it, what is still phasing in, and the plan document deadline that arrives before any of it
I started reading SECURE 2.0 the way most founders do, which is by opening a provider summary listing ninety-something provisions and closing it again within a minute. The problem with that list is not its length. It is that the list gives every provision equal weight, and for a small employer they are wildly unequal.
Roughly six or seven of them will change something you do. Two of those have already changed it whether you noticed or not. One of them has a paperwork deadline that lands at the end of this calendar year and gets almost no attention because it is not exciting.
So this is organized the only way that helps: what is binding on you now, what you can choose to switch on, what is still phasing in, and what you should do this month. I build the people and records side of this for companies without an HR department at FirstHR, which is an onboarding and HR platform rather than a retirement plan provider. This is general information, not tax or legal advice.
What SECURE 2.0 Actually Did
SECURE 2.0 is a package of retirement plan changes enacted as part of the Consolidated Appropriations Act, 2023 on December 29, 2022. It does three things at once: it forces some new behavior on new plans, it pays employers to start plans, and it hands existing plans a long menu of optional features.
The mental model that saves the most time is this. Ask when your plan was established, then ask what your provider has already switched on, then ask what you have signed. Those three questions resolve almost every SECURE 2.0 obligation a small business has, and most owners cannot answer the third.
Everything below is sorted by status. If you want the mechanics of standing a plan up from nothing, including provider selection and the fee structures nobody explains, that sits in the guide to a startup 401(k) rather than here.
The Automatic Enrollment Mandate
Plans established on or after December 29, 2022 generally have to enroll employees automatically, and the requirement took effect for plan years beginning after December 31, 2024. It is in force now, which means a plan started during 2023 or 2024 should already be operating this way.
The statutory shape is specific. The arrangement has to be an eligible automatic contribution arrangement with a uniform default deferral of at least three percent and not more than ten percent of compensation in an employee's first year of participation, escalating by one percentage point each year to at least ten percent and no more than fifteen (26 U.S.C. 414A).
Employees keep the right to opt out or to choose a different rate, and the arrangement has to allow a permissible withdrawal of automatic contributions within the first ninety days. Default money goes into a qualified default investment alternative rather than sitting in cash.
Who Is Exempt
Most small employers with an existing plan are exempt, and the reason is the grandfather date rather than their size. Four separate gates take you out of the mandate, and you only need one.
The gate that catches people is the second one. Founders read the small employer exception, count their team, and conclude they are safe. Then they grow, and the exception expires a year after the close of the first taxable year in which the headcount crossed the line. It is a runway, not a permanent status.
Worth separating from all of this: state retirement mandates are an entirely different regime with their own registration deadlines and penalties. Being outside the federal automatic enrollment requirement tells you nothing about whether your state requires you to offer a plan at all.
The Tax Credits
Two credits do the heavy lifting, both effective for taxable years beginning after December 31, 2022, and both claimed on your return rather than through the plan. A small employer starting a plan can recover a large share of the first years of cost.
| Credit | What it covers | Value | Duration |
|---|---|---|---|
| Plan startup cost credit | Qualified startup and administration costs for a new plan | 100 percent of eligible costs at 50 or fewer employees, 50 percent above that threshold and gone past one hundred | Three years |
| Employer contribution credit | Employer contributions made on behalf of participants | Up to $1,000 per employee, excluding employees paid above an indexed wage limit ($110,000 for 2026) | Five years, tapering after the second |
| Automatic enrollment credit | Adding an eligible automatic contribution arrangement | $500 a year | Three years |
| Military spouse credit | Enrolling military spouses within two months of hire with immediate vesting | $200 per military spouse plus employer contributions for that spouse up to $300 | Three years per military spouse |
The startup cost credit is capped at five thousand dollars a year and floored at five hundred, with the amount in between driven by how many non-highly compensated employees are eligible. The contribution credit runs at full value for the first two years and then steps down through seventy-five, fifty and twenty-five percent (Internal Revenue Service).
Two limits on the contribution credit get missed. Contributions for employees paid above an indexed wage limit do not count, and the IRS set that limit at $110,000 for 2026 in Notice 2025-67. Past fifty employees the credit also shrinks by two percentage points for every additional employee.
One qualification that costs pre-profit companies real money: these are general business credits rather than refundable ones. A company with no tax liability does not get a check. That constraint is covered in more depth alongside the rest of the benefits a small business can afford, and it is the single most common reason a founder budgets for a credit that never arrives.
The Catch-Up Rules
Catch-up contributions changed twice under SECURE 2.0, and the two changes pull in opposite directions. One lets older employees save more. The other restricts how higher earners are allowed to do it.
The first is the enlarged catch-up limit for participants who attain ages sixty, sixty-one, sixty-two or sixty-three during the year, effective for taxable years beginning after December 31, 2024. For 2026 the IRS set the elective deferral limit at $24,500, the standard age fifty catch-up at $8,000, and the higher catch-up for that four year band at $11,250 (Internal Revenue Service).
The second is the mandatory Roth treatment of catch-up contributions for higher earners. Where an employee received wages from the employer sponsoring the plan above an indexed threshold in the prior calendar year, catch-up contributions must be designated Roth contributions.
| Question | Answer |
|---|---|
| When did the Roth catch-up rule become operative? | January 1, 2026, after an administrative transition period that ran through the end of 2025 |
| What is the wage threshold? | Indexed. The IRS set it at $150,000 of 2025 wages for determining 2026 catch-up contributions |
| Whose wages count? | FICA wages from the employer sponsoring the plan, not household or total income |
| What if the plan has no Roth source? | Affected employees cannot make catch-up contributions at all until Roth deferrals are added |
| Does it apply to self-employed owners with no FICA wages? | The test runs on prior year wages, so a partner or sole proprietor without them is not caught by it |
| When do the final regulations apply? | The Treasury regulations issued in September 2025 generally apply to contributions in taxable years beginning after December 31, 2026 |
The fourth row is the one that turns a tax rule into an employer problem. Adding a Roth deferral source is a plan amendment and a payroll configuration, and it has to be finished before an affected employee tries to defer. Otherwise the only compliant option is to block their catch-up entirely, which is a difficult conversation with the exact people who most want to save.
Long-Term Part-Time Staff
Long-term part-time employees now reach eligibility a year sooner. The original SECURE Act required plans to admit employees who completed at least five hundred hours in each of three consecutive twelve month periods, and SECURE 2.0 cut that to two consecutive periods for plan years beginning after December 31, 2024.
The five hundred hour floor did not move and the age twenty-one condition did not move. Only the number of consecutive years dropped. The rule was also extended to cover ERISA-governed 403(b) plans, which previously sat outside it.
If you have a mixed workforce, the operational question is whether your hours records could survive an audit rather than whether the rule is fair. The eligibility mechanics, including how the counting periods work and what happens when somebody moves between statuses, are covered in the guide to 401(k) eligibility for part-time employees.
Provisions You Can Turn On
Most of SECURE 2.0 is optional, and nothing on this list happens unless you and your provider deliberately switch it on. These are the ones a small employer is most likely to want.
| Provision | Status | What it does |
|---|---|---|
| Student loan matching | Available for plan years beginning after Dec 31, 2023 | Lets you match an employee's qualified student loan payments as if they were deferrals |
| Pension-linked emergency savings | Available for plan years beginning after Dec 31, 2023 | A Roth sub-account for non-highly compensated employees, capped at $2,600 for 2026, withdrawable monthly |
| Roth employer contributions | Available for contributions after Dec 29, 2022 | Lets employees elect to have match or nonelective contributions treated as Roth, with tax consequences to them |
| Small enrollment incentives | Available for plan years beginning after Dec 29, 2022 | Permits a de minimis incentive up to $250, offered only to employees with no deferral election already in effect |
| Starter 401(k) | Available for plan years beginning after Dec 31, 2023 | A deferral-only arrangement with no employer contribution, limited to $6,000 for 2026 plus $1,100 for age fifty and over |
| Higher force-out threshold | Available since 2024 | Raises the involuntary cash-out limit for small balances of departed employees from $5,000 to $7,000 |
Student loan matching is the one small employers ask about most, because it reaches people who cannot afford to defer. The IRS issued interim guidance on how a plan runs these matches, including certification procedures and timing flexibility, in Notice 2024-63 (Internal Revenue Service). A match on loan payments has to use the same rate and vesting as your ordinary match, so it is a coverage extension rather than a new benefit tier.
That provision also changes the calculus on standalone student loan repayment benefits, since the retirement route delivers the value through an account the employee already has rather than through a taxable stipend.
The emergency savings account is more interesting on paper than in practice for very small teams. Contributions are Roth only, participation is limited to non-highly compensated employees, the balance cap is indexed and sits at $2,600 for 2026 excluding earnings, and withdrawals must be permitted at least monthly with the first four in a plan year free of fees. It solves a real problem and it adds a moving part.
What Is Still Phasing In
Three items are not fully landed, and only one of them will cost you anything.
| Provision | Timing | Employer impact |
|---|---|---|
| Saver's Match | Taxable years beginning after Dec 31, 2026 | Federal money paid into employee accounts, not employer money. Expect questions and provider reporting changes |
| Paper benefit statements | Plan years beginning after Dec 31, 2025 | Defined contribution plans must furnish at least one paper statement a year unless an electronic delivery safe harbor applies or the participant elects electronic |
| Required minimum distribution age | Rising again in 2033 | Administrative only, handled by the provider, but it changes what you tell departing older employees |
The Saver's Match replaces the existing Saver's Credit with a direct federal contribution into an eligible saver's account, at fifty percent of up to two thousand dollars of contributions and subject to income phase-outs, so one thousand dollars a year is the ceiling. Treasury and the IRS set out their intended approach in Notice 2026-48 in August 2026, and savers will claim the match on a new form filed with the 2027 return.
Paper statements are the sleeper. The requirement applies to plan years beginning after December 31, 2025, so it is live for calendar year plans right now. The Department of Labor proposed implementing rules in February 2026 and then issued Field Assistance Bulletin 2026-02 in May 2026, setting out a temporary non-enforcement posture until final rules land. Good faith compliance with a reasonable interpretation is still expected.
The Plan Document Deadline
Operational compliance and paperwork compliance were deliberately decoupled, and the paperwork is now due. Plans had to operate in accordance with each provision from its own effective date, but the formal document amendment was deferred to a single later deadline.
Under IRS Notice 2024-2, the amendment deadline for most non-governmental qualified plans and for 403(b) plans not maintained by a public school is December 31, 2026. That is a fixed calendar date rather than the last day of your plan year, so running an off-calendar plan year buys you nothing here. Applicable collectively bargained plans have until December 31, 2028 and governmental plans until December 31, 2029, and IRS Notice 2026-9 pushed IRAs, SEPs and SIMPLE IRA plans out to December 31, 2027.
This is also the natural moment to check that your summary plan description and enrollment materials describe what the plan actually does now. Several SECURE 2.0 features change what employees see at enrollment, and communications tend to lag the plan document by a year or more.
What to Do Now
Seven checks, in the order that finds problems fastest.
Common Mistakes
Five recurring failures, ranked by how expensive they are to unwind.
Assuming a provider switched something on is first. Optional provisions are opt-in at both the plan level and the provider level, and a feature described in a marketing email is not a feature enabled in your plan.
Treating the small employer exception as permanent is second. It expires a year after the close of the first taxable year in which you normally employed more than ten people, which means the obligation arrives while you are busy with the growth that triggered it.
Missing the Roth catch-up configuration is third. It surfaces as a payroll anomaly rather than as a compliance alert, usually reported by the affected employee, usually weeks after it started.
Leaving the amendment unsigned is fourth. Operational compliance without the document amendment is a plan qualification problem, and the correction is more expensive than the signature would have been.
And confusing federal and state obligations is last. The federal enrollment mandate and the state auto-IRA programs are separate regimes with separate triggers, and satisfying one has no effect on the other.
None of these are exotic. They are the ordinary failure modes of a company where the retirement plan is one of forty things somebody handles alongside a full job, which is also why the answer is usually a calendar entry rather than a policy. If the plan sits inside a wider view of your employee benefits, and someone owns the annual review, most of this stops being a risk.
Frequently Asked Questions
What is the SECURE Act 2.0?
SECURE 2.0 is a retirement law enacted on December 29, 2022 as Division T of the Consolidated Appropriations Act, 2023. It contains more than ninety provisions covering 401(k), 403(b), SIMPLE and IRA arrangements, and it phases them in across roughly a decade rather than all at once. For a small employer the practical content is narrower than the headline count suggests: a mandate to automatically enroll new hires in plans established on or after the enactment date, enlarged tax credits for starting a plan, two changes to catch-up contributions, faster eligibility for long-term part-time staff, and a menu of optional features such as student loan matching that you can adopt or ignore.
Does SECURE 2.0 require my 401(k) to have automatic enrollment?
Only if your plan was established on or after December 29, 2022 and you fail every exemption. Plans established before that date are grandfathered permanently. Beyond that, an employer in existence for less than three years is excepted, an employer that normally employs no more than ten employees is excepted until a year after it grows past that point, and SIMPLE, governmental and church plans are outside the requirement altogether. Where the mandate does apply, the plan needs an eligible automatic contribution arrangement with a default deferral of at least three percent and no more than ten percent in the first year, escalating by one percentage point annually.
What are the SECURE 2.0 tax credits for starting a 401(k)?
There are two that matter most, and they stack. The startup cost credit covers a percentage of qualified plan startup costs for three years, at one hundred percent for employers with no more than fifty employees and half that from fifty-one to one hundred, capped at five thousand dollars a year and floored at five hundred. A separate credit covers employer contributions of up to one thousand dollars per employee, at full value in the first two years and then tapering across the third, fourth and fifth years. Employees paid above an indexed wage limit are excluded from the contribution credit calculation, and the IRS set that limit at one hundred ten thousand dollars for 2026 in Notice 2025-67.
Do high earners have to make Roth catch-up contributions now?
Yes. Where an employee received wages from you above the indexed threshold in the prior calendar year, any catch-up contribution has to be a designated Roth contribution. The threshold is indexed and moved to one hundred fifty thousand dollars of 2025 wages for determining 2026 catch-ups. The employer consequence is blunt: a plan without a Roth deferral source cannot accept catch-up contributions from affected employees at all, so the practical choice is to add Roth or to switch catch-ups off for that group. The test uses wages from the employer sponsoring the plan, so it is not a household income test.
What is the higher catch-up limit for ages 60 to 63?
SECURE 2.0 created an enlarged catch-up limit for participants who reach ages sixty, sixty-one, sixty-two and sixty-three during the year, effective for taxable years beginning after December 31, 2024. For 2026 the IRS set that figure at eleven thousand two hundred fifty dollars against a standard age fifty catch-up of eight thousand dollars, on top of an elective deferral limit of twenty-four thousand five hundred dollars. Eligibility is by age attained during the year, so a participant who turns sixty-four loses access to the higher figure and drops back to the standard catch-up. Plans are not required to offer the enlarged limit, but payroll systems need to know which of the three numbers applies to which employee, and that mapping has to be refreshed every January.
When do long-term part-time employees become eligible for a 401(k)?
Under SECURE 2.0 the requirement fell from three consecutive years to two, effective for plan years beginning after December 31, 2024. An employee who works at least five hundred hours in each of two consecutive twelve month periods and has reached age twenty-one by the close of the second period has to be allowed to make elective deferrals, even if the plan otherwise requires a thousand hours. Employer contributions are not required for people who enter only through this route, and plans may exclude these employees from certain nondiscrimination, coverage and top-heavy testing. SECURE 2.0 also extended the rule to 403(b) plans covered by ERISA. The administrative burden lands on hours tracking rather than on plan design.
Do I have to amend my plan document for SECURE 2.0?
Yes, and the deadline is close. Operational compliance was required from each provision’s own effective date, but the formal amendment was deferred. Under IRS Notice 2024-2 the deadline for most non-governmental qualified plans and for 403(b) plans not maintained by a public school is December 31, 2026. That is a fixed calendar date, not the last day of whatever plan year you happen to run, so an off-calendar plan year buys you nothing. Applicable collectively bargained plans have until December 31, 2028 and governmental plans until December 31, 2029. IRS Notice 2026-9 pushed the deadline for IRAs, SEPs and SIMPLE IRA plans out to December 31, 2027. If your provider uses a pre-approved document they will usually handle the drafting, but somebody at your company still has to sign it.
What is the Saver’s Match and does it cost employers anything?
The Saver’s Match replaces the existing Saver’s Credit for taxable years beginning after December 31, 2026. Instead of a tax credit on a return, the federal government contributes a matching amount directly into an eligible saver’s retirement account, at fifty percent of up to two thousand dollars of contributions and subject to income phase-outs, so the maximum is one thousand dollars a year. The money comes from Treasury rather than from the employer, so there is no direct payroll cost. What employers should expect is questions from employees, plus reporting mechanics that plan providers are still building. The IRS set out its intended approach in Notice 2026-48 in August 2026, and savers will claim the match on a new form filed with the 2027 return.