The month the bonding rule reached the person who never touched the money, at 80K MRR

That was our plan administrator, on a call in January, telling me something reassuring and wrong. I had never moved a dollar of the 401(k). I did not have login credentials. I had signed the adoption agreement in 2024 and then stopped thinking about it, the way you stop thinking about a filing cabinet. We were at 80K MRR, eleven people, and the plan had quietly grown into the only pile of other people's money I was responsible for. The number that mattered turned out not to be the balance. It was a number I was supposed to re-set every January and had never re-set once.

Quick answer (2026). This diary is a composite. I write as Anya Petrova, and the company, the people and the figures are assembled from several real operators' experiences rather than one; the law and the documents are real and cited. ERISA requires a fidelity bond of at least 10 percent of the funds handled, re-fixed at the beginning of every plan year, with a floor of $1,000. Two things are widely mis-stated. First, handling plan funds without that bond is expressly unlawful, and the prohibition also catches the person who merely permits an unbonded person to do the handling, which is how it reached me. Second, the often-quoted $500,000 ceiling is the 1963 regulation's number; the current statute substitutes $1,000,000 not only for plans holding employer securities but also for pooled employer plans, which is the arrangement a lot of small companies are sold.

The bond I bought once and never looked at again

When we set the plan up in 2024 there were six of us and the provider's checklist had a line on it that said fidelity bond, with a note that $10,000 was typical for a plan our size. I bought a $10,000 blanket bond. It cost less than a laptop. I filed the certificate in the same folder as the lease and never opened it again.

That was, at the time, correct. Six people, a plan that had existed for four months, a trivial amount of money moving through it. The bond was comfortably more than the rule required.

What I did not register is that the rule is not a one-off. It is an annual arithmetic problem, and the inputs are my own growth. By the beginning of 2026 the plan had been running two full years, we had gone from six people to eleven, and the amount of money that had passed through it in the preceding year was $684,000. Ten percent of that is $68,400. I was holding a bond for $10,000. The shortfall was $58,400, and nothing anywhere had told me, because nothing was supposed to tell me. The duty to work the number out is mine.

The sentence that re-prices the bond every January

The bonding requirement is ERISA section 412. It opens by describing who is covered, and the scope is wider than fiduciaries: "Every fiduciary of an employee benefit plan and every person who handles funds or other property of such a plan". Then comes the part I had never read:

The statute, verbatim: "The amount of such bond shall be fixed at the beginning of each fiscal year of the plan." And immediately after it: "Such amount shall be not less than 10 per centum of the amount of funds handled."

Fixed at the beginning of each fiscal year. Not fixed once at adoption. The bond is not a certificate you obtain, it is a quantity you are required to recompute on a schedule, and the schedule is yours rather than your provider's.

The regulation that implements it says the same thing in more operational language, requiring "the amount of the bond be fixed at the beginning of each calendar, policy or other fiscal year". The same regulation also closes a gap I would otherwise have walked into when shopping for a replacement: the bond must "to insure from the first dollar of loss up to the requisite bond amount and not to permit the use of deductible or similar features". A cheaper bond with a deductible does not satisfy the requirement, however sensible a deductible sounds everywhere else in insurance.

Funds handled is not the number on the statement

I had assumed, when I eventually did the arithmetic, that 10 percent meant 10 percent of the balance. It does not, and the difference moved my answer by a lot.

Section 412 says the base is determined by "the amount of funds handled" by the people to be covered, during the preceding reporting year. Handled, not held. For us that meant the money that moved through the plan in 2025 rather than the balance on 31 December: the opening balance that was administered all year plus a full year of contributions. That is why my base was $684,000 against a year-end balance that was smaller. Growth shows up twice, once in the balance and once in the flow, and the flow is the one the statute uses.

One genuine piece of relief sits in the same sentence: the base is the preceding reporting year. A company growing fast is always being measured on a smaller version of itself. That is the only part of this that works in a founder's favour.

The half of the unlawful acts sentence nobody quotes

Subsection (b) of section 412 is headed Unlawful acts. Every summary I read quoted its first limb, which makes it unlawful for a plan official to handle funds while unbonded. I was comfortable with that, because I handle nothing.

The sentence does not stop there. It continues: "it shall be unlawful for any plan official of such plan, or any other person having authority to direct the performance of such functions, to permit such functions, or any of them, to be performed by any plan official, with respect to whom the requirements of subsection (a) have not been met".

Any other person having authority to direct the performance of such functions. To permit. That is the founder. The offence in the second limb is not touching the money, it is allowing someone else to touch it while the bond is short. My distance from the bank account, which the administrator had offered me as comfort, is precisely the position the second limb describes. I had spent two years being reassured by the wrong clause.

What the penalty is, and what it is not

Here I expected to find a tidy per-day penalty, and I was wrong in a way that is worth being precise about, because the internet's answer and the statute's answer are both partly right.

There is no standalone civil money penalty keyed to being under-bonded. Searching this, you will find confident statements that there are therefore no penalties at all. That is where it stops being true. Section 412 sits in part 4 of ERISA's subtitle B, and the civil penalty section reaches "any breach of fiduciary responsibility under (or other violation of) part 4 of this subtitle by a fiduciary". The words in the brackets are doing the work: a bonding failure is not itself a breach of fiduciary duty, it is an other violation of part 4. Where it applies, "the Secretary shall assess a civil penalty against such fiduciary or other person in an amount equal to 20 percent of the applicable recovery amount".

Read the definition of that base and the shape of the risk appears. The applicable recovery amount is what is recovered under a settlement with the Secretary or ordered by a court in a proceeding the Secretary brings. No loss, no recovery, no 20 percent. So the comforting answer is correct in exactly the world where nothing goes wrong, which is also the world in which the bond was never needed.

Invert it and it is much less comfortable. If someone does steal from the plan, an unbonded plan does not merely lack the money that would have made participants whole. The loss is now mine to restore, and the government's penalty is calculated as a percentage of that same restoration. The bond is the instrument that would have paid the number the penalty is measured against.

Two honest qualifications. The same section lets the Secretary waive or reduce the penalty where "the fiduciary or other person acted reasonably and in good faith", so this is not a strict-liability trap. And the criminal penalty section reaches "Any person who willfully violates any provision of part 1 of this subtitle". Part 1, not part 4. Despite the Unlawful acts heading, a bonding failure is not within ERISA's criminal provision at all.

The million dollar line that is not about company stock

The last thing I found is the one I would have got wrong for years, because every secondary source states it the same incomplete way.

The ceiling is usually given as $500,000, rising to $1,000,000 for plans that hold employer securities. The first half comes from the statute, which says "In no case shall such bond be less than $1,000 nor more than $500,000". But the statute then substitutes the higher figure in two cases, not one: "In the case of a plan that holds employer securities (within the meaning of section 1107(d)(1) of this title) or in the case of a pooled employer plan (as defined in section 1002(43) of this title)".

A pooled employer plan. ERISA's definition is a plan maintained for "the employees of 2 or more employers" with a designated pooled plan provider. That is exactly the product a small company is steered toward, because it is cheaper and someone else runs it. We hold no company stock, so I had filed the $1,000,000 figure under not-my-problem. If we were in a pooled arrangement it would be my bracket.

I want to be careful about how much this mattered to me, because the honest answer is not yet. The ceilings only bite once 10 percent of funds handled exceeds them, which is funds handled above $5,000,000 for the lower figure and above $10,000,000 for the higher. At $684,000 I am nowhere near either, and anyone telling a company our size that the ceiling is their problem is selling something. It matters as a thing to know before the year it does bite, and as a demonstration that the summaries are not reliable.

The reason they are not reliable is visible in the sources. The regulation I quoted earlier is sourced to 28 FR 14403, dated December 1963, and its page records no changes after January 2017. It still says $500,000 flat. It contains no pooled employer plan language and no $1,000,000 anywhere. The regulation is older than the statute it implements, and the pages that paraphrase the regulation inherit a ceiling the statute has already changed.

What I got wrong

What actually happened

Limits

Our plan is a single-employer calendar-year plan with no employer securities, so I have not tested the pooled employer plan path or the $1,000,000 ceiling against anything lived. I have not had a loss, so the 20 percent penalty is something I read rather than something that happened to me, and whether the Secretary would have waived it on good faith is not knowable from the outside. I deliberately did not quote the Department of Labor's own plain-language leaflet on this, because its page would not serve to my tooling and I will not quote a document I could not read end to end. Section 412 carries exemptions, including one for certain banks and registered broker-dealers, that I have not worked through because none applied to us. This is what I checked and what I concluded; it is not advice about your plan.

The one thing I would tell you

Go and find the fidelity bond certificate for your plan, look at the number on it, and then look at the date you bought it. If those two things were decided in different years, you already know the answer. The rule is not that you must have a bond. The rule is that you must have re-decided how big it is every January, and the person the rule reaches is not the person with the bank login. It is the person who let the year go by.