# Fiduciary Liability Insurance for Small Businesses with a 401(k)

By [John Abbott](https://insura.ai/authors/john-abbott), Licensed Insurance Broker (Missouri license #3003876211) · 2026-10-16

Source: https://insura.ai/articles/fiduciary-liability-insurance-small-business-401k

> **Do small businesses with a 401(k) need fiduciary liability insurance?** Yes, if you want plan decision-makers protected. ERISA makes owners, officers, and HR staff who run a 401(k) personally liable for plan losses, and the required ERISA bond only protects the plan from theft. D&O usually excludes ERISA claims. Most small firms add fiduciary coverage inside a management liability package, such as Cowbell's Zurich-underwritten program with D&O, EPL, and crime, where a $1M limit can cost around $500 a year.

## The Short Version

If your company sponsors a 401(k) or a group health plan, the people who run that plan are fiduciaries under ERISA, the federal law that governs employee benefit plans. Fiduciaries can be **personally liable** for losses the plan suffers because of their mistakes. Fiduciary liability insurance pays to defend those people and covers settlements or judgments.

It is not the same as the ERISA bond your 401(k) provider asked you to buy, and your D&O policy almost certainly excludes it. Most small companies add it to a management liability package for a few hundred to a couple thousand dollars a year.

## Who Counts as a Fiduciary at a Small Company

Under ERISA, you are a fiduciary if you exercise discretion or control over the plan or its assets. You don't need a title. At a 10–200 person tech company, SaaS startup, law firm, RIA, or MSP, that usually includes:

- **The owners and officers** who signed the plan documents and picked the provider
- **The CEO or CFO** who approves the fund lineup or the recordkeeper contract
- **HR or the benefits committee** that handles enrollment, deferrals, and vendor reviews
- **Anyone who remits payroll deferrals** or decides which claims a health plan pays
- **The company itself**, as plan sponsor and usually the named plan administrator

The key word is *personal*. ERISA §409 makes a fiduciary who breaches their duties personally liable to make the plan whole. That means an employee's lawsuit can reach the founder's own assets, not just the company's bank account. Corporate indemnification helps, but it disappears if the company can't pay or isn't allowed to indemnify a particular loss.

## What Fiduciary Claims Actually Look Like

Fiduciary claims are not just a large-company problem. The issues that typically come up for small plans are operational, not exotic:

- **Excessive fee suits.** Class actions over high recordkeeping fees and expensive share classes started with mega-plans, but plaintiff firms have been working down-market. A small plan with retail-priced funds and no documented fee benchmarking is the classic target.
- **Late deposits of employee deferrals.** Payroll withholds 401(k) contributions, but they sit in the operating account too long before reaching the plan. The DOL treats that as a prohibited use of plan assets. It's one of the most common findings in DOL audits of small plans.
- **Imprudent fund menu.** Keeping underperforming or high-cost funds without a review process, or offering no sensible default investment.
- **Administrative errors.** Wrong compensation definition, missed eligibility, botched auto-enrollment, missed match calculations. Corrections can run into tens of thousands of dollars once you add lost earnings.
- **Health plan claim denials.** An employee sues because a self-funded or level-funded plan denied a costly claim, and the committee that reviewed the appeal is named.
- **COBRA notice errors.** A former employee never received a proper COBRA election notice, lost coverage, and then had a major medical bill. Statutory penalties and the unpaid claim can both land on the plan administrator.

Even a claim with no merit costs real money to defend. ERISA litigation is specialized, and defense is often the bulk of the cost.

## The ERISA Bond vs. Fiduciary Liability Insurance

This is the most common point of confusion. Many business owners think they're covered because their 401(k) provider made them buy a "fiduciary bond." They aren't.

**The ERISA fidelity bond is required.** ERISA §412 requires that everyone who handles plan funds be bonded. The bond must equal at least 10% of the plan assets handled, with a minimum of $1,000 and a maximum of $500,000 per plan ($1,000,000 if the plan holds employer securities). It protects **the plan** against theft or fraud by the people handling its money. If your bookkeeper embezzles 401(k) deferrals, the bond pays the plan back.

**Fiduciary liability insurance is optional.** It protects **the fiduciaries** (and usually the company) when someone alleges they breached their duties. It typically pays:

- Defense costs, often in addition to or within the limit depending on the form
- Settlements and judgments for breach of fiduciary duty
- Claims alleging negligent plan administration (enrollment, eligibility, notices)
- Some fees and penalties where insurable, such as DOL Voluntary Fiduciary Correction Program (VFCP) and IRS EPCRS correction fees, and the ERISA §502(l) 20% civil penalty, often subject to a sublimit
- HIPAA and certain health-plan penalties under some forms, again usually sublimited

The bond does nothing when an employee sues over fees or a late deposit. The fiduciary policy does nothing when someone steals from the plan. You generally need both.

One technical note: if the plan itself pays the premium, ERISA §410 requires the insurer to have recourse against the fiduciary. Most companies pay the premium from corporate funds, and many carriers offer an inexpensive "waiver of recourse" option. Ask your broker to confirm how it's set up.

## Bond vs. Fiduciary vs. D&O: Side-by-Side

| | ERISA Fidelity Bond | Fiduciary Liability | D&O Insurance |
|---|---|---|---|
| Required? | Yes, by ERISA §412 | No | No (often required by investors) |
| Who it protects | The plan | Plan fiduciaries + company | Directors, officers + company |
| What triggers it | Theft or fraud by people handling plan money | Alleged breach of fiduciary duty, admin errors | Alleged wrongful acts managing the company |
| Covers fee or late-deposit suits | No | Yes | Usually no — ERISA exclusion |
| Covers defense costs | No | Yes | Yes, for covered claims |
| Typical amount | 10% of plan assets, $1K min, $500K max | $1M limit common for small companies | $1M–$5M for small private companies |
| Typical cost | Often under a few hundred dollars | Roughly $500–$2,500/yr standalone | Varies widely by stage and revenue |

That D&O column is the point to remember. Nearly every private company D&O form carries an **ERISA exclusion** that removes claims arising from benefit plan fiduciary duties. If your board thinks D&O "covers the officers for everything," it doesn't cover this. Our [D&O insurance guide](/articles/directors-and-officers-insurance-guide) walks through the other common exclusions.

## What Fiduciary Liability Insurance Costs

For a small company with a straightforward 401(k), pricing typically falls into these ranges:

- **Added to a management liability package:** often a few hundred dollars. One example we've seen: a $1M fiduciary limit with a $0 retention came in around **$500/yr** as part of a management liability quote for a small professional-services firm.
- **Standalone small-plan fiduciary:** typically about **$500–$2,500/yr** for a $1M limit, depending on the plan.

What moves the price:

- **Plan assets.** More assets means bigger potential losses and more appeal to fee-litigation firms.
- **Participant count.** More participants means more chances for an admin error and a bigger class.
- **Plan types.** A 401(k) plus a self-funded health plan rates higher than a 401(k) alone. Defined benefit plans, ESOPs, and employer stock in the plan raise the price further.
- **Use of professional providers.** Hiring a 3(16) administrator (takes on admin duties) or a 3(38) investment manager (takes on fund selection) shifts some fiduciary responsibility away from you, and underwriters notice.
- **Governance.** A documented investment policy statement, annual fee benchmarking, and committee minutes help.
- **Prior claims and DOL activity.** Any audit findings, late-deposit corrections, or past suits will affect terms.

**Limits:** $1M is the typical starting point for companies under ~200 employees with plan assets in the low millions. Larger plans, or plans with company stock, usually look at $2M–$3M.

## How Most Small Companies Buy It: The Management Liability Package

Few small companies buy fiduciary liability alone. It's usually one part of a **management liability package** that bundles:

1. **D&O** — protects leaders from claims about how the company is run
2. **EPL (Employment Practices Liability)** — wrongful termination, discrimination, harassment
3. **Fiduciary liability** — benefit plan claims, covered in this article
4. **Crime** — employee theft, funds transfer fraud, social engineering

Buying them together typically costs less than four separate policies and avoids gaps between them. For example, Cowbell's management liability program, underwritten by Zurich (Zurich Select Plus), quotes all four parts together, and it can be placed alongside a cyber policy. That matters because a funds transfer fraud or phishing loss can touch both crime and cyber coverage, and you want the two policies to fit together.

See how the parts fit on our [management liability insurance](/insurance/management-liability-insurance) page, or go straight to [fiduciary liability coverage](/insurance/fiduciary-liability-insurance).

### The bundle by vertical

- **SaaS and tech startups:** D&O + EPL + Fiduciary + Crime, alongside Cyber and Tech E&O. Investors care most about D&O, but the 401(k) you rolled out after your Series A creates fiduciary exposure the D&O won't cover. See our [D&O + EPLI bundle guide for SaaS](/articles/do-epli-bundle-saas-companies-guide).
- **Law firms:** Legal malpractice (E&O) + Cyber, plus management liability for the firm's own employment and benefits exposure.
- **IT consultants and MSPs:** Tech E&O + Cyber, with a management liability package once headcount and a 401(k) are in place.
- **RIAs:** Professional E&O + Cyber, plus fiduciary liability for your own plan. See the next section.

## A Note for RIAs: Your E&O Isn't Your Fiduciary Policy

This trips up financial advisors constantly. If you are an RIA that acts as a 3(21) or 3(38) fiduciary for **clients'** retirement plans, claims from that work belong under your **professional liability / E&O** policy. That's your professional service. Our [E&O guide for financial advisors](/articles/eo-insurance-financial-advisors) covers it.

Fiduciary liability insurance covers something different: your firm's role as sponsor of **its own employee 401(k) or health plan**. Advisor E&O policies typically exclude claims from your own benefit plans, and fiduciary policies don't cover your advisory services to clients. An RIA with ten employees and a firm 401(k) usually needs both: E&O + Cyber for the advisory business, and fiduciary liability (often inside a management liability package) for the firm's own plan.

## Practical Steps Before You Quote

- **Find your bond.** Check Form 5500 (or 5500-SF) for the bond amount and confirm it's at least 10% of plan assets.
- **List your plans.** 401(k), health, dental, HSA/FSA, and whether any are self-funded or level-funded.
- **Check your D&O for an ERISA exclusion.** If you have D&O, you almost certainly have one.
- **Know your providers.** Note your recordkeeper, TPA, and whether anyone is acting as a 3(16) or 3(38).
- **Fix deposit timing.** Small plans have a DOL safe harbor if deferrals hit the plan within 7 business days, and faster is better.
- **Document fee reviews.** Even a simple annual benchmarking memo helps with underwriting and with defending a claim.

## Get Quotes

Insura is a licensed insurance broker, not a carrier. Fill out [one application](/get-quote) and we'll compare fiduciary liability and full management liability packages from Cowbell and other carriers, alongside cyber and E&O where it fits your business. A licensed producer reviews every quote before it reaches you, so you can see what's covered, what's excluded, and what you'll pay.

---
Compare cyber, E&O and D&O quotes from Chubb, Hiscox, The Hartford and Cowbell: https://insura.ai/get-quote