Client Service March 6, 2024

Morgan Stanley Heads to Market With New Participant Education Program

The firm’s Graystone Consulting group and institutional retirement advisers are pitching plan sponsors on a revamped financial education program with local capabilities.

Reported by

Morgan Stanley advisers are working with a revamped and more robust participant financial education program that can be localized by its workplace and retirement specialists around the country and further served by its more than 15,000 financial advisers, according to the firm.

The financial services company and investment bank has built up its database and financial education resources to meet plan sponsor and participant needs “across the spectrum of workers,” says Jeremy France, head of Morgan Stanley’s institutional consulting solutions, who oversees its institutional consulting and retirement businesses.  

Never miss a story — sign up for PLANADVISER newsletters to keep up on the latest retirement plan adviser news.

Jeremy France

“The C-Suite has been covered very well in the past, in part because advisers come to them, and they can also go out and get the resources on their own,” France says. “It’s the people starting out who are considering their first home or how to manage student debt versus the contribution rate for a 401(k) who need help. … In the past, there weren’t a lot of places individuals could go for that type of information.”

The financial education resources include a range of formats, such as digital newsletters, on-site seminars, one-on-one meetings via open office hours and webinars. Plan sponsors can choose which of these options to provide their participants, as well as whether to present the information broadly or to a targeted cohort, depending on the topic. That localized staffing is a key part of the offering from the national firm, according to France.

“We can meet the needs of employees across the spectrum on educational needs and then, if they are interested, follow up with them on their individual needs,” he says.

The focus area aligns with Morgan Stanley’s focus on the workplace. In its earnings report for the fourth quarter of 2023, released in January, CEO Ted Pick noted that its employer offerings make up a key pillar of the firm’s “three-channel” strategy, adding to adviser-led and self-directed client pools. Pick noted the firm sees this strategy helping it reach $10 trillion in total client assets—up from its current $6.6 trillion as of the end of 2023.

National Footprint

France was recently named to his expanded position after being head of Institutional Consulting, which includes Graystone Consulting and RIAs Cook Street and Hyas Group. He is focused on integrating the retirement team with the firm’s institutional consulting services.

The Graystone division now has about 60 offices across the U.S. Separately, the institutional consulting division has an additional 400 retirement plan director specialists, giving the firm a national footprint that prompted it to “invest more in educational resources,” France says. Total institutional assets under management at Morgan Stanley topped $614 billion at the end of 2023, with more than $300 billion in defined contribution assets.

France says the investment community has done a good job getting people into 401(k) plans and managing their money, but it has fallen down in providing a holistic financial experience. Financial education is no longer a nice-to-have, according to the executive, but part of a plan sponsor’s fiduciary duty.

“There are questions, like, ‘Do you borrow against your 401(k) for your first home?’ and the implications for that. Not judging whether that is good or bad, but just having the information available,” he says. “There weren’t a lot of places for individuals to get that information, even though, as a fiduciary, that is part of the role of providing participants with the services they need to get the right outcomes.”

Meanwhile, the firm can offer wealth management to individuals, should they want it, across its network of financial advisers. France stresses that these are made available, but not pushed.

“The goal is to be educating people for the long term,” France says. “Think about the spectrum that you meet with on an educational basis. You are really meeting the first-year employee all the way to the 35-plus-year soon-to-be-a-retiree. Each one of those needs is going to be uniquely different. It’s making certain that instead, you build your brand up by truly focusing on the education and the support of the plan, then let them make the decision of where and how they do it.”

Self-Directed

France also notes that services from E*Trade Financial Corp., a Morgan Stanley subsidiary, can be offered via the workplace for workers who want to engage in self-directed investing, including through individual retirement accounts.

One of the key pitches to plan sponsors on education, however, is a stronger, happier and more productive workforce, backed by research its Morgan Stanley at Work division has been producing on the subject, according to executive France.

“In all of the studies that we have done, we have found consistent financial education not only benefits the plan participants,” he says. “But it also builds stronger relationships with the employee, it lowers attrition, [and] enrollment rates become much higher when participants are truly educated on what that plan can do for them, which means they are less stressed about their financial positioning.”

Practice Management March 6, 2024

401(k) World: Cyber Thieves

The fifth in our Planadviser In-Depth series delves into cybersecurity threats to retirement plan assets and the industry’s approach to combatting them.

Reported by
Art by Melinda Beck
401(k) World: Cyber Thieves

With a quick Google search, anyone can get a sense of the massive amount of money in workplace retirement plans and individual retirement accounts.

What may be less known, but not too hard to figure out for hackers, is that retirement plans’ unique business model creates multiple potential openings for breaches, according to experts. Participants’ contributions and data often move through multiple organizations before reaching the financial institution serving as plan custodian.

For more stories like this, sign up for the PLANADVISERdash daily newsletter.

Hackers attempting large-scale theft of plans’ funds or participants’ data is not the only risk. Social engineers targeting plan service reps and participants, particularly individual older participants with larger balances, are another exposure.

Several lawsuits alleging theft from participants’ accounts have attracted widespread publicity. In 2016, thieves stole $99,000 from a former participant’s account in Estée Lauder’s 401(k) plan. In 2022, an impostor transferred a Colgate-Palmolive plan participant’s entire $751,000 balance out of the plan without permission to a bank account the participant did not own.

These thefts were not direct hacks into the plans’ custodial accounts. Both involved using the participants’ data, combined with a lack of adequate safeguards—or failure to follow established safeguards—at the organizations responsible for handling plan distribution requests.

Private pension plans must file an annual Form 5500 or Form 5500-SF, which includes a question disclosing losses due to fraud or dishonesty. According to 2021 data, the most recent available, of the roughly 645,000 401(k) plans that filed, only 28 indicated fraud and dishonesty. Those plans reported losses from fraud of $4.9 million, though the nature of the fraud is unclear, since Form 5500 does not ask the source of the fraud.

Does this self-reporting method work in protecting retirement plan assets? David Donaldson, president and CEO of ERISA Smart, an ERISA-risk management firm in Ventura, California, and a former senior investigator for the DOL’s Employee Benefit Security Administration, is skeptical.

“It is my opinion that theft is often not disclosed when it should have been,” he wrote in an email response. “Most plan sponsors simply sign the 5500 without really understanding what they are signing.”

Donaldson maintains there is no way to grasp the number of participants who have become theft victims. “Most often these are quietly resolved and not made public,” he says. “It is very rare that the fidelity bond is used to cover theft of assets.” 

Assessing the Risks

Sources for the article agreed that the custodian level is generally considered the most secure location for participants’ funds.

Marc Bleicher, chief technology officer at Surefire Cyber, a digital incident response and forensics company outside Washington, D.C., says financial institutions tend to have the best security and are “usually on top of emerging technology and security controls.” Bleicher is unaware of any electronic thefts directly from plans’ financial institutions and believes that stealing funds from those institutions “would be extremely difficult.”

But there have been breaches further down the line. 401(k) plans typically use a software “supply chain” connecting multiple vendors. A mid-2023 security breach of Pension Benefit Information LLC’s MOVEit software affected an estimated total of at least 2,000 organizations, including numerous companies in the U.S. retirement plan business.

The ransomware breach did not result in the immediate loss of plan participants’ funds, but the stolen data have monetary value. If the thieves sell the data, buyers could use it for identity fraud, subsequent hacking attempts and social engineering schemes. Social engineering cases pose a substantial risk for participants and plan service providers.

Roger Grimes, whose title is data-driven defense evangelist at KnowBe4, a security awareness training and phishing testing service in Clearwater, Florida, says that social engineering accounts for 70% to 90% of all successful hacking. Social engineers use stolen data to convince a plan participant or a call center rep that the engineer is who they claim to be (either by phone or email with participants).

The goal is to obtain additional information, such as a PIN or password, the thief can use to access the targeted account. Plan service centers can take steps to block thieves, but those barriers are not always foolproof. For example, voice recognition is one of the poorest authenticators, and it is often paired with a participant’s phone number, but Grimes notes that phone numbers can be faked.

“You wouldn’t want any service to rely upon voice verification alone,” Grimes says. “Even voice verification plus phone number is still in the realm of digital authentication among the weakest types.”

Locking Down

Grimes says there is no perfect technical defense against phishing; preventive education is the key. Plan administrators and participants need ongoing training about social engineering attempts coming at them from suspected phishers. Administrators also need policies that make it less likely that a social engineer will bypass safeguards and successfully impersonate a plan participant.

“You have to be really good about not bypassing [policies], because social engineers will try to appeal to your human empathy to get you to violate policies,” he explains.

ERISA Smart has developed its Participant I.D. software to help prevent fraudulent distributions like those in the Estée Lauder and Colgate-Palmolive thefts.

According to the company’s website, Participant I.D. takes a three-factor authentication approach: biometric facial recognition, government identification verification technology and an identity graph score. A proprietary algorithm uses artificial intelligence to create the risk score that helps determine the probability of fraudulent activity. Users can verify participants via their cell phones, with results delivered to the user within minutes.

The future may hold more friction for savers to enter their accounts, but it’s in the name of protecting, as Participant I.D. puts it, “the funds of hardworking Americans.”

The final installment of our Q1 PLANADVISER In-Depth series will consider the litigation that has influenced what it means to be a 401(k) fiduciary.

More on this topic:

401(k) World: The Piggy Bank
401(k) World: Retirement Plan and Wealth Advisement
401(k) World: Recordkeepers, Advisers and ‘Coopetition’
401(k) World: DCIO Managers Adjust to Fee Pressures
401(k) World: The Litigators

«