Address Changes

Curious as to what your method is for when a participant changes an address. What method are you using for confirmation? Sending via email or regular mail and to both old and new addresses? And, are you implementing a waiting period for taking a distribution after an address change? 

Every plan I’ve seen turns off distributions for a period after an address change.

An ERISA rule allows a plan’s administrator to treat this as not a blackout if the plan’s regular restriction had been disclosed to possibly affected participants, beneficiaries, and alternate payees. 29 C.F.R. § 2520.101-3(d)(1)(ii)(B) https://www.ecfr.gov/current/title-29/part-2520/section-2520.101-3#p-2520.101-3(d)(1)(ii)(B).

This is not advice to anyone.

2 hours ago, Peter Gulia said:

Every plan I’ve seen turns off distributions for a period after an address change.

It's scary how many plans don't do this.  We also require photo ID, verify bank account ownership for ACH, and more.  People are sometimes unhappy with all the hoops we make them jump through, but most accept that we are trying to protect them as much as we are protecting ourselves.

RatherBeGolfing, thank you for the information about identifying a distributee.

For a participant’s, beneficiary’s, or alternate payee’s address change that would be instructed by a person other than the plan’s administrator, what identity controls does a service provider use to find that the change is requested by the individual whose address would be changed?

Is it only about entry to the recordkeeper’s or third-party administrator’s computer system? Or are there other steps?

If an individual seeks an address change by paper rather than in a computer system, what steps?

The answer to the question about how are people handling address changes will vary from plan to plan, recordkeeper to recordkeeper, TPA to TPA...

Addresses should be treated a Personally Identifiable Information (PII) and subject to the same data security methods applicable to of PII.  At a high level, there should be a clear policy for managing PII shared across all partied involved in plan administration, and a clear delineation of steps each party will take for handling PII, and a clear assignment of accountability for any breaches that expose PII.  If the plan is audited, how PII is managed should be part of an independent auditor's review of privacy and cybersecurity practices.

With respect to addresses it, handling address changes for participants who have long since been terminated from employment with the plan sponsor are the most challenging.  In this instance, the recordkeeper is more likely to have more recent interaction with the participant than the former employer.  This suggests that an approach like @RatherBeGolfing described is appropriate to protect the plan.