401(k) Safe Harbor Requirements for Employers

To run a Safe Harbor 401(k), an employer has to meet the 401(k) Safe Harbor requirements for employers set out in IRC Section 401(k)(12): pick one of the qualifying contribution formulas and fund it for every eligible employee, vest those contributions immediately, deliver a compliant written notice each year in the 30-to-90-day window before the plan year, and adopt or amend the plan within the applicable deadlines. Do those things and the plan skips ADP and ACP testing; miss one and the exemption can vanish for the whole year.

Pick a Qualifying Contribution Formula

The plan document has to lock in one of two contribution methods before the plan year starts, and the employer is on the hook for that formula for the full year.

3% Nonelective Contribution

The nonelective contribution (NEC) requires the employer to contribute at least 3% of compensation to every eligible employee, whether or not the employee defers anything.¹ Cost is predictable because it doesn’t depend on employee behavior. For 2026, compensation is capped at $360,000 per employee, so the maximum NEC per person is $10,800.²

Basic Match

The basic match is 100% of elective deferrals on the first 3% of compensation deferred, plus 50% on the next 2%. An employee who defers at least 5% of pay receives the full 4% employer match.¹ A match can cost less than an NEC if some employees defer little, but only because those employees receive less.

Enhanced Match

An enhanced match has to be at least as generous as the basic match at every deferral level, and the match rate cannot rise as the deferral rate rises. A common design is a flat 100% match on the first 4% of pay deferred, which produces the same 4% employer ceiling as the basic match but is easier for employees to follow.¹

The QACA Alternative

A Qualified Automatic Contribution Arrangement is a Safe Harbor variant built around automatic enrollment. Employees are enrolled at a default deferral rate (starting at a minimum of 3%) that escalates each year, and they can opt out or change the rate.³

The QACA matching formula is lighter: 100% on the first 1% of pay deferred plus 50% on the next 5%, for a maximum match of 3.5% when the employee defers at least 6%. A 3% NEC also satisfies the QACA.³

The QACA also relaxes vesting: contributions have to be fully vested only after two years of service. Employees who leave before completing two years forfeit the employer’s QACA contributions, which can lower cost for businesses with heavy turnover.³

One boundary worth noting: SECURE 2.0 requires 401(k) plans established after December 29, 2022, to include automatic enrollment with an initial default rate between 3% and 10% and annual escalation of at least 1% until the rate reaches at least 10% (capped at 15%). That mandate makes the QACA design increasingly relevant for new plans.

Vest Safe Harbor Contributions Immediately

Outside the QACA exception, every Safe Harbor contribution is 100% vested the moment it lands in the employee’s account. The employee owns those dollars if they leave the next day.⁴

Discretionary employer contributions above the Safe Harbor minimum can still follow a normal graded vesting schedule. Only the Safe Harbor portion needs immediate vesting.

Deliver the Annual Safe Harbor Notice

Each eligible employee has to receive a written notice before the plan year begins. Miss the notice or miss the window and the plan loses Safe Harbor status for the year, putting the employer back into ADP/ACP testing.⁵

Timing

Deliver at least 30 days and no more than 90 days before the plan year starts. For a calendar-year plan, that’s October 2 through December 1.⁵

Required Content

Under Treasury Regulation 1.401(k)-3(d)(2), the notice has to describe, in plain language:⁶

The exact Safe Harbor matching or nonelective formula, including rates and any tiers
Any other employer contributions, including matches to another plan triggered by deferrals
The type and amount of compensation that can be deferred
How to start, stop, or change deferral elections, and the available election periods
When and how funds can be withdrawn, plus the vesting rules that apply
Where to get more plan information or a copy of the summary plan description

Adoption and Amendment Deadlines

Safe Harbor status generally requires a full 12-month plan year. A new plan launched mid-year can qualify only if the first plan year runs at least three months, so for a calendar-year plan the plan has to be effective no later than October 1. An existing plan converting to Safe Harbor has to be amended before the plan year begins, with the notice delivered in the 30-to-90-day window. For calendar-year plans, that means the amendment and notice should both be in place by December 1.

Retroactive Adoption Under the SECURE Act

Since 2020, an employer that didn’t get Safe Harbor status in place before the plan year began can retroactively adopt it for the current year, but only through the nonelective contribution. Matching formulas don’t qualify for late adoption.⁷ Two deadlines apply:

3% NEC: the amendment has to be adopted at least 30 days before the last day of the plan year (December 1 for a calendar-year plan).
4% NEC: the amendment can be adopted any time before the last day of the following plan year, giving up to an extra 12 months.

The 4% option is the fallback for employers who discover in January or February that the prior year failed ADP/ACP testing. Adopting Safe Harbor status retroactively at 4% avoids refunding contributions to highly compensated employees.⁷

Mid-Year Changes

If the content of the Safe Harbor notice changes during the plan year, an updated notice has to go out at least 30 days before the change takes effect, and employees need at least 30 days to adjust their deferral elections.⁸

What Safe Harbor Status Gets You

The whole point is escape from testing. A compliant Safe Harbor plan is exempt from the ADP and ACP nondiscrimination tests that compare highly compensated employee contributions against everyone else’s.⁹ An employee counts as highly compensated if they owned more than 5% of the business in the current or prior year, or if their prior-year compensation from the employer exceeded the statutory threshold, which is $160,000 for plan years beginning in 2026.²

Safe Harbor plans that receive only elective deferrals and the required Safe Harbor minimum contributions are also exempt from top-heavy testing. Top-heavy rules normally require additional employer contributions when more than 60% of plan assets sit with key employees, which is common at small businesses where the owner’s balance dwarfs everyone else’s. The top-heavy exemption disappears if the employer makes contributions beyond the Safe Harbor minimum, such as discretionary profit-sharing. In that case the plan has to run top-heavy testing like any other 401(k).¹⁰

If You Miss a Requirement

A late or missing annual notice is the most common failure. The IRS treats it as an operational failure, so the employer can’t simply drop Safe Harbor status for that year and run ADP/ACP testing instead. Correction depends on the harm. If an employee never learned about the plan and couldn’t make deferrals, the employer may need a corrective contribution equal to 50% of the missed deferral opportunity (at least 50% of 3% of pay for matching plans). If the employee already knew about the plan and was deferring, the fix can be as simple as updating procedures for future notices.¹¹

Failing to make the required Safe Harbor contribution is worse. Without the minimum, the plan loses its testing exemption, and possibly its top-heavy exemption, retroactively for the entire year. That means corrective ADP/ACP testing, potential refunds to HCEs, and unwinding a year’s worth of contributions that exceeded what testing would have allowed.

2026 Numbers Employers Need

Employee elective deferrals: $24,500 (up from $23,500 in 2025)
Catch-up contributions (age 50 and older): $8,000
Enhanced catch-up (ages 60–63): $11,250
Total annual additions (employee plus employer): $72,000
Compensation cap for contribution calculations: $360,000
HCE compensation threshold: $160,000

The elective deferral and total addition limits apply per employee across all 401(k) plans they participate in, not per plan.²

Optional: Match Student Loan Payments

For plan years after December 31, 2023, employers can treat an employee’s qualified student loan payments as elective deferrals for matching purposes. An employee paying down student loans instead of contributing to the 401(k) can still receive the Safe Harbor match if the plan adopts the feature.¹² Loan payments eligible for matching are capped at the annual elective deferral limit ($24,500 for 2026), reduced by any actual deferrals the employee makes. The employee has to certify their payments annually, and the loans have to qualify as educational loans under the tax code. Adoption is optional.

1
Office of the Law Revision Counsel. 26 USC 401 – Qualified Pension, Profit-Sharing, and Stock Bonus Plans
2
Internal Revenue Service. 2026 Amounts Relating to Retirement Plans and IRAs, as Adjusted for Changes in Cost-of-Living
3
Internal Revenue Service. FAQs – Auto-Enrollment – Are There Different Types of Automatic Contribution Arrangements for Retirement Plans
4
Internal Revenue Service. Issue Snapshot – Vesting Schedules for Matching Contributions
5
Internal Revenue Service. Notice Requirement for a Safe Harbor 401(k) or 401(m) Plan
6
eCFR. 26 CFR 1.401(k)-3 – Safe Harbor Requirements
7
Internal Revenue Service. Mid-Year Changes to Safe Harbor Plans or Safe Harbor Notices
8
Internal Revenue Service. Mid-Year Changes to Safe Harbor 401(k) Plans and Notices
9
Internal Revenue Service. 401(k) Plan Fix-It Guide – The Plan Failed the 401(k) ADP and ACP Nondiscrimination Tests
10
Internal Revenue Service. Is My 401(k) Top-Heavy?
11
Internal Revenue Service. Fixing Common Plan Mistakes – Failure to Provide a Safe Harbor 401(k) Plan Notice
12
Internal Revenue Service. Notice 2024-63 – Guidance Under Section 110 of the SECURE 2.0 Act