As Seen in InvestmentNews: 401(k) Credential Sharing Debate Intensifies — But Auditability, Plan Rules, and State Guidance Still Matter
November 5, 2025
As Seen in InvestmentNews: 401(k) Credential Sharing Debate Intensifies — But Auditability, Plan Rules, and State Guidance Still Matter
In a recent InvestmentNews article, Absolute Capital Management CEO Brenden Gebben offered key insights on the evolving debate between Fidelity and Pontera over credential-based access to workplace retirement accounts.
While Pontera framed Fidelity’s recent access restrictions as anticompetitive, Gebben suggested the larger — and more overlooked — risk is not about platform rivalry, but about how credentials are being used, whether audit trails exist, and whether plan-level rules actually permit advisors to take action on behalf of participants.
The Dispute Is Bigger Than “Freedom vs. Protection”
Pontera’s argument centers on “freedom” — the ability for clients to choose who manages their 401(k) assets and to grant credential-based access to third parties.
But that framing ignores key structural elements of employer plans:
- Workplace accounts are governed by plan documents
- Access rules vary based on sponsor and custodian design
- Credential-based trading can create audit-trail ambiguity
Gebben noted that while many participants simply want professional help, the method of access matters — because the method can determine whether the activity is compliant.
Front Door vs. Back Door Access
Gebben does not view Fidelity’s stance as an attempt to block advisors, pointing to his own experience partnering with Fidelity and other custodians.
“If it’s the right plan and you have the right registrations and things built out, they will welcome you through the front door,” he told InvestmentNews.
This stands in contrast to credential-sharing models where:
- Advisors or platforms impersonate the client online
- Multistep authentication may be bypassed
- The audit trail can become unclear
Gebben also points out the difference between fintech that may use credentials to initiate a “one-way data pull” and that which gives advisors “two-way transactional control” — the latter being where the risk math changes.
The Missing Party in the Debate: Plan Sponsors
Gebben also highlighted an element that rarely appears in headline-level discussions: plan sponsors must actually allow third-party access in the first place.
Even if a custodian is supportive — and even if a fintech is technically capable — the plan design document must authorize it.
At present, Gebben estimates approximately half of U.S. plan participants are in plans where compliant third-party advisor access is possible.
State Regulators Are Weighing In
Recent state guidance underscores that credential-sharing isn’t simply a “tech preference” — it can implicate fiduciary duties:
- Ohio: credential-based access = a breach of adviser fiduciary duty
- Washington: likely dishonest or unethical business practice
- New Jersey: may constitute fiduciary breach
Gebben noted the importance of focusing on these risks.
Read the full InvestmentNews article here:
Read Article
As Seen in InvestmentNews: 401(k) Credential Sharing Debate Intensifies — But Auditability, Plan Rules, and State Guidance Still Matter
In a recent InvestmentNews article, Absolute Capital Management CEO Brenden Gebben offered key insights on the evolving debate between Fidelity and Pontera over credential-based access to workplace retirement accounts.
While Pontera framed Fidelity’s recent access restrictions as anticompetitive, Gebben suggested the larger — and more overlooked — risk is not about platform rivalry, but about how credentials are being used, whether audit trails exist, and whether plan-level rules actually permit advisors to take action on behalf of participants.
The Dispute Is Bigger Than “Freedom vs. Protection”
Pontera’s argument centers on “freedom” — the ability for clients to choose who manages their 401(k) assets and to grant credential-based access to third parties.
But that framing ignores key structural elements of employer plans:
- Workplace accounts are governed by plan documents
- Access rules vary based on sponsor and custodian design
- Credential-based trading can create audit-trail ambiguity
Gebben noted that while many participants simply want professional help, the method of access matters — because the method can determine whether the activity is compliant.
Front Door vs. Back Door Access
Gebben does not view Fidelity’s stance as an attempt to block advisors, pointing to his own experience partnering with Fidelity and other custodians.
“If it’s the right plan and you have the right registrations and things built out, they will welcome you through the front door,” he told InvestmentNews.
This stands in contrast to credential-sharing models where:
- Advisors or platforms impersonate the client online
- Multistep authentication may be bypassed
- The audit trail can become unclear
Gebben also points out the difference between fintech that may use credentials to initiate a “one-way data pull” and that which gives advisors “two-way transactional control” — the latter being where the risk math changes.
The Missing Party in the Debate: Plan Sponsors
Gebben also highlighted an element that rarely appears in headline-level discussions: plan sponsors must actually allow third-party access in the first place.
Even if a custodian is supportive — and even if a fintech is technically capable — the plan design document must authorize it.
At present, Gebben estimates approximately half of U.S. plan participants are in plans where compliant third-party advisor access is possible.
State Regulators Are Weighing In
Recent state guidance underscores that credential-sharing isn’t simply a “tech preference” — it can implicate fiduciary duties:
- Ohio: credential-based access = a breach of adviser fiduciary duty
- Washington: likely dishonest or unethical business practice
- New Jersey: may constitute fiduciary breach
Gebben noted the importance of focusing on these risks.
Read the full InvestmentNews article here:
Read Article
