401(k) TPA vs. Plan Administrator vs. Recordkeeper: Who Does What

9/27/2026

Ask five people at a mid-sized company who the "401(k) plan administrator" is, and you may get five answers: the HR manager, the recordkeeper whose name is on the participant website, the third-party administrator that runs the testing, the payroll provider, or "the company." Only one of those answers is correct in the legal sense, and it is often not the one people expect.

The confusion is not academic. ERISA assigns specific duties, and personal liability, to specific roles. When a plan files late, deposits deferrals late or pays an excessive fee, the question of who was responsible is answered by the plan document and by what each party actually did, not by what the vendor brochure said. This guide separates the four roles that run a typical 401(k) plan and identifies the duties that stay with the employer no matter how much is outsourced. It is written for plan sponsors and payroll teams, not for anyone shopping for a provider.

The Four Roles in One Table

Role	What it is	Fiduciary?	Typical tasks
Plan sponsor	The employer that establishes and maintains the plan	Yes, when acting as a fiduciary; not when making business (settlor) decisions	Plan design, amendments, hiring and monitoring providers, funding contributions
Plan administrator (ERISA §3(16))	The person designated in the plan document, or the sponsor if no one is designated	Yes, by the nature of the position	Reporting, disclosure, claims, overall operation
Third-party administrator (TPA)	A service provider for compliance and administration work	Usually no, unless it takes on discretionary authority or a fiduciary role by contract	Testing, Form 5500 preparation, distribution and loan processing, plan document support
Recordkeeper	The service provider that tracks participant accounts	Usually no	Account balances, investment elections, participant website, transaction processing

Payroll, whether in-house or a payroll provider, sits beside these roles. It does not appear in ERISA's definitions, but it handles the money and data that every other role depends on.

The Plan Administrator: A Legal Role, Not a Vendor

ERISA section 3(16)(A) defines the administrator as the person specifically designated as such by the terms of the plan document. If the document designates no one, the administrator is the plan sponsor. In most small and mid-sized plans, the document either names the company or names no one, so the employer is the plan administrator by default.

The DOL treats anyone holding the plan administrator position as a fiduciary by the nature of the role. The plan administrator is responsible for:

Annual reporting: the Form 5500 filing and its schedules
Participant disclosures: the summary plan description, summary of material modifications, summary annual report and other required notices
Claims and appeals for benefits under the plan's procedures
Operating the plan according to its terms
Responding to participant and agency requests for documents

When a vendor's marketing says it "administers" your plan, that usually means it performs administrative tasks. It does not mean it has become the ERISA plan administrator, unless the contract and plan document say so.

What a "3(16) Administrator" Service Means

Some providers offer to serve as the plan's 3(16) administrator, taking on the legal role named in ERISA section 3(16) for some or all administrative functions. This is a real transfer of responsibility for the functions accepted, and the provider becomes a fiduciary for those functions. The scope varies widely: some accept the full plan administrator role, others accept only specific tasks such as signing the Form 5500 or distributing notices. Read the service agreement to see exactly which functions are transferred and which remain with the sponsor.

The Third-Party Administrator

A TPA is a service provider that handles the technical and compliance work. Typical TPA services include:

Nondiscrimination, coverage and top-heavy testing
Calculating employer contributions and allocations
Preparing the Form 5500 for the plan administrator to review and sign
Plan document drafting, restatement and amendments
Processing or approving distributions, loans and hardship withdrawals
Advising on corrections when something goes wrong

Most TPAs work in a non-fiduciary, ministerial capacity. They perform tasks within a framework of policies and decisions made by the plan administrator. A TPA that prepares the Form 5500 has not filed it, and if the plan administrator does not review and file the return, the late filing belongs to the administrator.

The Recordkeeper

The recordkeeper keeps the participant-level records: who has what money, in which investments, from which sources. It typically:

Receives and posts contribution files from payroll
Processes investment elections and transfers
Operates the participant website and call center
Processes distributions and issues Form 1099-R
Produces the data the TPA uses for testing and reporting

In bundled arrangements, the recordkeeper and TPA are the same firm. In unbundled arrangements, they are separate, and the sponsor has to make sure the two actually exchange information. A gap between them, such as a TPA that never receives the recordkeeper's loan data, is the sponsor's problem to find.

Where Payroll Fits

Payroll is not an ERISA role, but it executes the plan's most time-sensitive obligations:

Withholding deferrals in the right amounts from the right pay periods
Applying the plan's compensation definition to deferral and match calculations
Remitting deferrals and loan repayments to the plan
Sending contribution files to the recordkeeper
Producing census data for testing and the Form 5500

Once withheld, employee deferrals are plan assets. The DOL's guidance on fiduciary responsibilities states that deferrals must be deposited as soon as it is reasonably possible to segregate them from the company's assets, but no later than the 15th business day of the month following the payday. For plans with fewer than 100 participants, deferrals deposited no later than the 7th business day after withholding are treated as timely. The 15th business day is an outer limit, not a safe harbor for larger plans. If your payroll process routinely deposits in two days, the DOL generally expects two days.

Because payroll holds the money, the employer cannot outsource the obligation to deposit it. A payroll provider that remits late does so on the employer's behalf. Our 401(k) Plan Administration handbook covers deposit timing in more detail.

Settlor vs. Fiduciary Decisions

ERISA draws a line between two kinds of employer decisions.

Settlor decisions are business decisions about the plan itself. The DOL describes decisions to establish a plan, determine the benefit package, include certain features, amend a plan and terminate a plan as business decisions not governed by ERISA's fiduciary rules. Choosing a safe harbor formula or adding a Roth feature is a settlor decision.

Fiduciary decisions are decisions about operating the plan and managing its assets. Under the DOL's functional test, anyone who uses discretion in administering and managing a plan or controlling its assets is a fiduciary to the extent of that discretion or control. Titles do not matter. Selecting investments, choosing service providers, approving fees and deciding claims are fiduciary acts.

The distinction tells you which decisions need a prudent process and documentation, and which are ordinary business calls.

What a Plan Sponsor Can Never Outsource

Hiring experts is itself prudent, and ERISA allows fiduciary responsibilities to be allocated and delegated. But some responsibilities stay with the sponsor regardless.

1. Selecting Service Providers

The DOL treats hiring a service provider as a fiduciary function. The sponsor must follow a prudent process, give competing providers the same information so proposals can be compared, and document why it chose the one it did. Outsourcing the plan does not outsource the decision to outsource.

2. Monitoring Them

The DOL expects fiduciaries to establish and follow a formal review process at reasonable intervals: reviewing performance reports, checking the fees actually charged, and following up on participant complaints. A 3(16) or 3(38) provider that is never reviewed is a fiduciary breach waiting to happen, and the sponsor's breach, not only the provider's.

3. Evaluating Fees

Under ERISA section 408(b)(2), covered service providers must disclose the services they provide and all the compensation they will receive. The sponsor has to read these disclosures and decide whether the fees are reasonable. Receiving them is not the same as reviewing them.

4. Remitting Contributions

The employer holds the payroll deductions until they reach the trust. No provider can take that responsibility on unless it actually controls the payroll money.

5. Supplying Accurate Data

Testing, eligibility and reporting all depend on census and payroll data only the employer has: hire dates, hours, compensation, ownership and family relationships. A TPA cannot test correctly on wrong data.

6. Bonding

ERISA section 412 requires everyone who handles plan funds or other property to be covered by a fidelity bond protecting the plan against fraud or dishonesty. Under the DOL's Field Assistance Bulletin 2008-04, a plan official must generally be bonded for at least 10% of the funds handled, with a minimum of $1,000 and, in most cases, a maximum required bond of $500,000 per plan, or $1,000,000 for plans holding employer securities. The bond is distinct from fiduciary liability insurance, which protects fiduciaries rather than the plan.

Delegating Investment Responsibility

The one area where a sponsor can meaningfully reduce its own liability is investment management. According to the DOL, if an employer appoints an investment manager that is a bank, insurance company or registered investment adviser, the employer is responsible for selecting the manager but is not liable for the manager's individual investment decisions. This is commonly called a 3(38) arrangement, after the ERISA section that defines an investment manager. An adviser who only recommends investments for the sponsor to approve, often called a 3(21) adviser, shares fiduciary responsibility but does not take the decision off the sponsor's hands.

The sponsor still has to monitor the investment manager periodically. Delegation narrows liability, but it does not end it.

Mapping Duties in Your Own Plan

A simple exercise prevents most gaps. List every recurring plan task, then answer three questions for each: who performs it, who is legally responsible for it, and how the responsible party verifies it was done.

Task	Performed by	Legally responsible	Verified by
Deferral withholding and deposit	Payroll	Employer as sponsor and plan administrator	Monthly deposit timing report
Census for testing	Payroll and HR	Employer	Reconciliation to W-2 data
ADP/ACP testing	TPA	Plan administrator	Review of test results and corrections
Form 5500 preparation	TPA	Plan administrator	Review, signature and filing confirmation
Participant notices	Recordkeeper or TPA	Plan administrator	Delivery records
Investment menu	Adviser or 3(38) manager	Committee or sponsor	Periodic investment review
Fee review	Sponsor	Sponsor	408(b)(2) disclosure review and benchmarking

If the "verified by" column is blank, that is where the next audit finding will come from. Segregating who performs a task from who verifies it is the same control principle that protects payroll itself, explained in our guide to payroll segregation of duties.

Questions to Ask Your Providers

You do not need to change providers to tighten oversight. Ask your existing ones:

Is your firm a fiduciary to the plan in any capacity? Which section of ERISA, and for which functions?
Which tasks do you perform only on our instruction, and which do you decide on your own?
What data do you need from us, by when, and in what format?
How do you confirm that deferral deposits are timely, and do you report late deposits to us?
Who signs and files the Form 5500, and how will we receive the filing confirmation?
What is your process when you find an operational error?
How are your fees calculated and where are they disclosed?

The answers belong in the plan's fiduciary file. A plan that can show it asked these questions and acted on the answers is in a far stronger position in a DOL or IRS examination. Our guide to the IRS payroll audit explains how plan data can surface during an employment tax examination.

Frequently Asked Questions

What does a third-party administrator do for a 401(k)?

A 401(k) TPA handles the technical compliance work: nondiscrimination and top-heavy testing, contribution calculations, Form 5500 preparation, plan document maintenance, and often distribution and loan processing. Most TPAs act in a non-fiduciary, ministerial role, performing tasks under policies set by the plan administrator. A TPA can take on fiduciary responsibility by contract, for example as a 3(16) administrator, but only for the functions the agreement specifically assigns to it.

Is the TPA the plan administrator?

Usually not. Under ERISA section 3(16)(A), the plan administrator is whoever the plan document designates, or the plan sponsor if no one is designated. In most plans that is the employer. A TPA becomes the legal plan administrator only if the plan document and service agreement appoint it to that role. Performing administrative tasks does not by itself make the TPA the ERISA plan administrator.

What is a 3(16) plan administrator?

A 3(16) plan administrator is a provider that accepts the legal plan administrator role defined in ERISA section 3(16), for all or some administrative functions. For the functions it accepts, it becomes a fiduciary and is responsible for them. The employer still has a fiduciary duty to select the 3(16) provider prudently and monitor it, and remains responsible for anything not transferred, such as depositing payroll deductions and supplying accurate data.

What is the difference between a recordkeeper and a TPA?

The recordkeeper tracks individual participant accounts: balances, investment elections, contributions and transactions, and usually runs the participant website. The TPA handles plan-level compliance: testing, contribution calculations, government reporting and plan documents. In a bundled arrangement, one firm does both. In an unbundled arrangement, the sponsor must make sure the two exchange complete and timely data, because neither can do its job without the other's information.

What are a plan sponsor's responsibilities in a 401(k)?

The sponsor decides plan design (a settlor function) and, as a fiduciary, must prudently select and monitor service providers, review fee disclosures, ensure deferrals are deposited on time, provide accurate data for testing and reporting, maintain a fidelity bond, and make sure the plan operates according to its document. If the plan document names no other administrator, the sponsor is also the ERISA plan administrator responsible for reporting and disclosure.

Can a plan sponsor outsource all fiduciary responsibility?

No. A sponsor can delegate specific functions, and appointing a qualified 3(38) investment manager removes liability for that manager's individual investment decisions. But the decision to hire a provider is itself a fiduciary act, and the duty to monitor providers at reasonable intervals always remains. The employer also keeps responsibility for the payroll deductions it holds until they are deposited, and for the accuracy of the data it supplies.

Know Which Role You Are Playing

Most plan failures happen in the handoffs between these roles, especially between payroll, the recordkeeper and the TPA. The 401(k) Procedures Manual and e-Alerts gives the in-house team a written procedures reference alongside 401(k) training, and the 401(k) Training and Certification Program covers the plan rules behind each task. For how payroll connects to the wider plan landscape, see payroll and retirement plans.