Retirement Plan Trustee Faces Cybersecurity-Related Lawsuit

The lawsuit says the trustee failed to prevent a fraudulent distribution from a participant's account and is failing to take responsibility.

A plan sponsor is suing the trustee for its 401(k) plan for breaches of fiduciary duties related to a fraudulent distribution from a participant’s account made in 2020.

American Trust is the trustee for the Mandli Communications Inc. 401(k) Plan and Trust. One of the services it provides to the plan is reviewing and approving all distributions from the plan.

Want the latest retirement plan adviser news and insights? Sign up for PLANADVISER newsletters.

On February 14, American Trust made an unauthorized distribution in the total amount of $124,105 from the account of Raymond J. Mandli, the president and founder of Mandli Communications, in response to a request for a distribution from an unknown third party.

According to the complaint, American Trust has refused to take responsibility for the unauthorized distribution from Mandli’s account, failed to timely inform Mandli and Mandli Communications about the unauthorized distribution, has concealed facts and has declined to provide Mandli or his company with copies of any of the requested documentation related to the details of the distribution.

The lawsuit alleges that on February 11, the unknown third party called American Trust and requested distribution paperwork for Mandli’s plan account. The lawsuit says that since American Trust has not released all requested documentation to Mandli, he cannot allege all facts, but he believes American Trust forwarded the distribution paperwork to an email address that was not in American Trust’s records as being Mandli’s email address or by mail or overnight delivery to a physical address that was not in American Trust’s records as being Mandli’s address.

Mandli further alleges that the in-service withdrawal election form submitted by the unknown third party included a daytime phone number that was not any phone number in American Trust’s records as being Mandli’s or Mandli Communications’ phone number. In addition, the signature on the form was not similar to any of the examples of Mandli’s signature in American Trust’s records.

The complaint says an American Trust employee who reviewed the purported signature of Mandli recognized that it was not an actual handwritten signature of Mandli’s but rather was an “electronic” signature. The complaint includes a copy of the signature portion of the form with notes made by that employee.

“Upon information and belief, American Trust had no protocols in place for verifying that an electronic signature added to an in-service withdrawal election form submitted was actually placed on the form by the purported signatory,” the complaint states.

The distribution of $124,000 from Mandli’s plan account was made by a direct deposit or wire transfer to a Citibank checking account for which the unknown third party provided a routing number and an account number. The complaint notes that the unknown third party also submitted an electronic image of a copy of a voided check for the checking account and the check number was “100,” suggesting that the checking account was new or recently opened.

The lawsuit suggests that since American Trust knew that Mandli was 60 years old, it should have made inquiries to ascertain why a 60-year-old plan participant would desire funds distributed from his account to be deposited into a new checking account.

According to the lawsuit, American Trust did not mail or email any acknowledgement of receipt of the withdrawal election form submitted by the unknown third party and did not call or otherwise contact Mandli or his firm to verify that the distribution request was legitimate.

However, on March 3, American Trust received another in-service withdrawal election form for Mandli’s account and knew it was fraudulent, according to the complaint. “Nevertheless, upon information and belief, American Trust did not immediately contact the Federal Bureau of Investigation (FBI) or any other law enforcement agency with cybersecurity and money-tracking resources,” the complaint states.

On March 11, the American Trust employee responsible for American Trust’s relationship with Mandli Communications informed Mandli about the unauthorized distribution from his plan account on February 14. On May 12, he informed Mandli that to process a claim for reimbursement, an insurance company for American Trust requested that a police report be filed. He offered to help Mandli file the report and Mandli accepted the help.

Mandli Communications’ general counsel repeatedly asked for an update on the reimbursement of the distribution from Mandli’s account, but the relationship manager never responded.

On September 9, American Trust’s chief revenue officer sent a letter to Mandli stating, “We are pleased to let you know that we have been able to recoup from the Internal Revenue Service the $24,800 paid in taxes in connection with the distribution. Additionally, we will reimburse our $105 distribution fee. All other efforts to recover any of the stolen funds will need to be performed by you.”

Mandli Communication’s general counsel requested that American Trust reimburse the rest of the funds to Mandli’s account. However, American Trust’s general counsel sent a letter stating, “We dispute your assertion that American Trust must return to Mr. Mandli the $99,200 distribution plus earnings. This demand is unacceptable to American Trust.”

Mandli Communication’s general counsel also requested documentation related to the fraudulent distribution and was told, “We respectfully decline to provide you with copies of any of the requested documentation.”

The complaint notes that no one has provided Mandli or his firm with any information suggesting that there is any further review procedure available to seek recovery from American Trust.

The lawsuit asks that American Trust be held liable to make good to the plan the losses to the plan from its breach of fiduciary duties in an amount not less than $99,200 plus lost earnings from February 14 “and other equitable or remedial relief as the court may deem appropriate.”

Lawsuit Says Provider Used Plan to Promote Its Own Funds

Associated Banc-Corp is also accused of allowing the plan to pay excessive recordkeeping fees to its subsidiary.

Participants in the Associated Banc-Corp 401(k) and Employee Stock Ownership Plan have filed an Employee Retirement Income Security Act (ERISA) lawsuit against Associated Banc-Corp and its retirement plan administrative committee for “applying an imprudent and inappropriate preference for products associated with Associated Bank within the plan, despite their poor performance and lack of traction among fiduciaries of similarly sized plans.”

The plaintiffs also allege that the defendants failed to monitor or control the plan’s recordkeeping expenses, which were paid to Associated Bank’s subsidiary, costing the plan millions of dollars in excessive administrative fees.

A spokesperson for Associated Banc-Corp told PLANADVISER the bank cannot comment on pending legislation.

For more stories like this, sign up for the PLANADVISERdash daily newsletter.

The lawsuit says the defendants used the plan to promote Associated Bank’s proprietary financial products and earn profits for Associated Bank. It says the Associated Bank investment products within the plan “were overwhelmingly rejected by similarly situated fiduciaries.” The lawsuit also says the funds were poor performers.

Specifically, the complaint offers as an example the Associated Balanced LifeStage and Associated Growth Balanced LifeStage funds. It says a review of publicly filed Form 5500s for plans with more than $500 million in assets shows no other defined contribution (DC) plan that offered those funds.

In addition, the complaint includes charts showing that these funds performed less well than other funds “which had similar asset allocations and levels of risk and greater acceptance among fiduciaries of similar plans.”

The lawsuit notes that instead of removing these poorly performing Associated Bank investments, in 2017, the defendants removed a non-proprietary fund in the same asset class—the Vanguard Balanced Index Fund. “This led to a predictably poor outcome for plan participants,” the lawsuit states. “As of year-end 2015, the Associated Balanced LifeStage Fund had materially trailed the removed Vanguard fund by 2.46% and 2.67% over the prior three- and five-year periods, respectively. The performance of the Associated Growth Balanced LifeStage Fund at this time was similarly poor compared to this Vanguard option, trailing it by 0.99% and 1.69% over the prior three- and five-year periods, respectively.” The plaintiffs also note that the Vanguard Balanced Index Fund was widely held by similarly situated fiduciaries, offered in more than 60 plans with more than $500 million in assets, according to Form 5500 data.

The complaint also alleges the defendants selected a subsidiary of Associated Bank as the plan’s recordkeeper and allowed the plan “to pay nearly three times what a prudent and loyal fiduciary would have paid for such services.” The lawsuit notes that the Associated Bank plan was the only plan with more than $500 million in assets for which Associated Trust provided recordkeeping services; the average size of plans for which Associated Trust provided recordkeeping services was $27 million.

According to the complaint, as of year-end 2016, the plan had 5,858 participants. The plan’s Form 5500 reflects that it paid $803,198 to Associated Trust for recordkeeping expenses that year, and that Associated Trust Co. received approximately $37,000 in additional revenue sharing. This translates to at least $143 per participant per year in fees. In 2019, the plan paid $882,482 to Associated Trust for recordkeeping expenses, and Associated Trust Co. received an additional amount of approximately $55,000 in revenue sharing. With 6,944 participants in the plan that year, this translated to a per participant recordkeeping rate of $135 per person.

The lawsuit cites a recent study by NEPC that found the median rate for recordkeeping services for plans with between 5,000 and 10,000 participants is approximately $50 per participant. “And even the 75th percentile (the highest quartile in cost) is only about $60 per participant,” the complaint notes.

The lawsuit seeks an order compelling the defendants to personally make good to the plan all losses that the plan incurred as a result of the breaches alleged and an order requiring Associated Bank to disgorge all profits received from the plan, among other things.

«