Rollover Rails: How IRS Notice 2026-49 Could Finally Fix the 401(k) Rollover — and What It Will Take
Every year 10 million Americans move $1.1 trillion between retirement accounts, and most find it slow and paper-bound. Notice 2026-49 is a good design — but optional, unenforced and silent on timing. Our white paper on the six changes that would turn standardized forms into working infrastructure.
TrustRails Team
• Regulatory & Platform EngineeringIRS Notice 2026-49 is the first federal attempt to standardize the 401(k) rollover: four sample forms, a five-step plan-to-plan procedure, a rollover identification number that replaces the SSN, and a preference for electronic transfer. It is a good design, but it is optional, has no safe harbor, and sets no timelines. Turning it into working infrastructure takes a shared machine-readable schema, response-time expectations, and safe harbors tied to the protocol rather than the paper.
- rollovers per year
- 10M+
- assets moved annually
- $1.1T
- completed without assistance
- 22%
- foregone returns per day of avoidable delay
- $211M
Sources: Capitalize (2024); GAO-13-30; GAO-24-103577; TrustRails cost-of-delay model (see methodology below).
This article is adapted from the TrustRails white paper Rollover Rails. It builds on our plain-language explainer of Notice 2026-49 and focuses on the question that explainer leaves open: what would make the Notice work?
Why are 401(k) rollovers so slow?
Because there has never been a common form, identifier, channel, or expectation of how long anyone should take. Mechanically a rollover is simple — one institution sends money and a small amount of data to another. Brokerage accounts do the same thing through ACATS in about four business days — one to validate, three to complete — under a FINRA rule that sets deadlines for each side. Retirement plan rollovers take several times longer. In 2013 the GAO called mailing rollover checks to participants "archaic"; in 2024 it found nearly a third of participants still get one.
| Measure | Figure | Source |
|---|---|---|
| Annual 401(k) rollovers | 10 million+ | Capitalize, 2024 |
| Assets rolled over annually | ~$1.1 trillion | Capitalize, 2024 |
| Savers who completed a rollover without help | 22% | Capitalize, 2024 |
| Savers reporting the process took 2+ months | 42% | Capitalize, 2024 |
| Unassisted rollovers with an unintended tax consequence | Nearly 1 in 5 | Capitalize, 2024 |
| Participants still receiving a paper check to forward | Nearly one-third | GAO, 2024 |
| ACATS brokerage transfer (validation + completion) | 1 + 3 business days | FINRA Rule 11870 |
The delay is concentrated. In TrustRails' analysis of rollover workflows, the plan-to-plan exchange — the receiving plan asking for the money, the distributing plan verifying and certifying the account — accounts for roughly 35 to 45 percent of elapsed time. That is where requests sit in queues, where forms come back "not in good order," and where the participant, who cannot see either plan's system, starts calling.
Why delay is expensive. Money in transit — in a check, a mailroom, a suspense account — is not invested. At an assumed 7% return on $1.1 trillion of annual volume, each calendar day out of the market costs participants about $211 million, or roughly $21 on an average $110,000 rollover. Cutting the typical rollover from a 24.5-day median to 8 days would return on the order of $3.5 billion a year to participants — before counting fee drag, participant time, administrative cost, or abandoned rollovers.
What does IRS Notice 2026-49 do?
Section 324 of the SECURE 2.0 Act directed Treasury to issue sample forms and procedures that "simplify, standardize, facilitate, and expedite" direct rollovers. Issued August 12, 2026, the Notice proposes four forms in a fixed sequence:
| Step | Form | What happens |
|---|---|---|
| 1 | Form 1 — Participant’s Rollover Request | The participant tells the receiving plan what to fetch and authorizes it to act. This is the last thing the participant has to do. |
| 2 | Form 2 — Receiving Plan’s Request | The receiving plan assigns a rollover identification number (RIN) and asks the distributing plan for the account, listing accepted transfer and communication methods. |
| 3 | Form 3 — Distributing Plan’s Certification | The distributing plan verifies the request, certifies the plan is qualified and the money eligible, and splits the balance into pre-tax, Roth and after-tax. |
| 4 | Form 4 — Receiving Plan’s Acceptance | The receiving plan accepts and picks the transfer method. |
| 5 | Transfer | Money moves — electronically if both sides can, by check payable to the receiving plan only if they cannot. |
Behind the forms sit five design principles:
- The participant stops being the courier. After Step 1, every message is plan-to-plan — what ACATS did for brokerage transfers.
- No Social Security numbers in transit. Only name, date of birth and last four SSN digits; the RIN replaces personal data on later correspondence.
- A standard data set. Every plan asks for, and provides, the same fields in the same order.
- Verification before funds move. Identity and eligibility are confirmed at Step 3, with phishing-resistant MFA suggested.
- Electronic first. Plans are expressly encouraged to program the forms into an API, clearinghouse or other electronic platform.
What does Notice 2026-49 leave open?
- It is optional. Nothing requires a plan to use the forms. Treasury asked whether to require electronic transfer and how long plans would need to comply.
- There is no safe harbor yet. Treasury is considering reliance safe harbors for receiving and distributing plans. Without them, a plan that adopts the forms takes on cost without a corresponding benefit.
- There are no timelines. The distributing plan should transfer "promptly"; the receiving plan should follow up after "a reasonable time." Neither is defined. Standardized forms with undefined timing produce standardized forms and unstandardized delay.
- There is no shared electronic format. Every plan is encouraged to build its own API. Without a common schema, the result is dozens of incompatible implementations of the same four forms, each needing bilateral integration — the problem brokerage solved with a single clearing utility and health care spent twenty years escaping.
What would make Notice 2026-49 work? Six recommendations
These are the recommendations in TrustRails' formal comments to the IRS — in our view, the difference between a set of forms and a working system.
- 1
Publish a machine-readable schema
A companion JSON or XML schema mapped field-for-field to the four forms would let any two plans exchange rollover data without manual keying or bilateral integration. The IRS already does this for tax returns (Modernized e-File), Form 5500 (EFAST2) and ACA information returns (AIR). When each step is a structured message with an identifier and a timestamp, the audit trail exists as a byproduct. TrustRails has drafted such a schema, built only from data elements already on the forms, as a starting point.
- 2
Protect the privacy design from dilution
The Notice never asks for a full SSN. The first thing many plans will do when they "modify the forms as necessary" is add one, because legacy systems key on it. Final guidance should say plans adopting the procedures should not require a full SSN, specify a uniform RIN format that works across systems and on check memo lines, and route ambiguous matches through the named plan contacts rather than back to the participant.
- 3
Define response times
A business-day window for each step, generous relative to the work: two days to review Form 1, three to send Form 2, five to certify, three to accept, three to initiate the transfer. A clean rollover would close in about sixteen business days. The specific numbers matter less than the default: once one exists, delay becomes visible and measurable.
- 4
Make automatic portability fit
Section 120 automatic portability transfers are IRA-to-plan rollovers that happen in batches without a participant-signed request. The procedure needs a streamlined variant: deemed consent satisfies Step 1, the provider acts as the receiving plan’s agent, and multiple transfers travel in one message with a distinct RIN for each.
- 5
Attach the safe harbor to the protocol, not the paper
Safe harbors are the incentive that will drive adoption. They should be available to any plan that exchanges the standard data set using the RIN protocol — on paper, through a portal, an API or a clearinghouse — and conditioned on timely completion. Because choosing rollover procedures is a fiduciary act, parallel guidance from the Department of Labor’s EBSA would remove the remaining legal uncertainty.
- 6
Build a public registry
There is no authoritative directory of where to send a rollover request, which transfer methods a plan accepts, or whom to call when something goes wrong. A registry of participating plans — submission channels, transfer methods, contacts and self-reported processing times — would remove days of lookup from every rollover. It should share a plan identifier with the Retirement Savings Lost and Found so plans report once.
Notice 2026-49, implemented as structured messages
TrustRails runs the five-step procedure plan-to-plan: one identifier on every message, verification before funds move, and a timestamped record of every step.
How should Treasury answer its four open questions?
| Treasury asked whether to… | Our view |
|---|---|
| Remove the rule letting a plan hand the participant a check payable to the receiving plan | Yes. This is the regulatory basis for the practice GAO called archaic in 2013. |
| Require electronic transfer or a check sent directly to the receiving plan | Yes, technology-neutral: specify the outcome, not the channel. Large providers can comply in 18 months; smaller plans may need 36. Treat the direct-to-plan check as transitional. |
| Provide safe harbors for plans that use the forms | Yes. Attach them to the protocol in any medium, extend them to reliance on the distributing plan’s tax characterization, and condition them on timely completion. |
| Name more procedures that impermissibly obstruct rollovers | Yes. Beyond Medallion guarantees: sending the participant back to the other plan once direct contact exists, demanding letterhead versions of Form 2 or 3, requiring wet-ink signatures on e-signed forms, refusing an electronic transfer both plans support, and undisclosed review holds. |
How does Notice 2026-49 connect to Saver's Match and automatic portability?
Every related federal program needs to identify a person, identify a plan, move money between institutions, and keep a record of having done so. Notice 2026-49 is the first federal proposal for a common way to do that — so its value multiplies if it becomes the transport layer for all of them:
- •Saver’s Match. From the 2027 tax year, Treasury will deposit matches of up to $1,000 into savers' accounts. One routing path in Notice 2026-48 is a rollover from a Treasury conduit IRA — a Notice 2026-49 transaction. Our companion piece covers this in detail.
- •Automatic portability. The DOL’s final Section 120 rule is pending; its data-use and retention rules should align with the Notice’s forms so a provider does not document one transfer two ways.
- •Retirement Savings Lost and Found. A participant who finds a forgotten account there needs a path to roll it over; a plan registry on the same identifier would provide one.
- •Executive Order 14247. The federal government is moving its own payments off paper. The direct-to-plan check is a transitional method, not an endpoint.
What should plans, recordkeepers, and advisors do now?
Plan sponsors
- •Ask your recordkeeper whether and when it will support the Notice 2026-49 forms, and whether electronically or only as PDFs.
- •Check your plan document for rollover procedures that would need amending. Most plans must adopt SECURE 2.0 amendments by December 31, 2026; if you are amending anyway, consider making the rollover language procedure-neutral now.
- •Ask your provider for its average rollover processing time. If it cannot tell you, that is itself an answer.
Recordkeepers and IRA providers
- •Map your intake fields to the Notice’s standard data set and find where you require more than the forms ask for — especially full SSNs.
- •Decide whether your electronic implementation will follow an open schema or a proprietary one. Bilateral integrations do not scale.
- •Instrument the five steps now. Timestamps collected today are tomorrow’s processing-time disclosures and the evidence for any safe harbor conditioned on timeliness.
Advisors and RIAs
- •The rollover is where client assets are won or lost. Know which custodians and recordkeepers in your ecosystem are adopting the standard procedures, and how fast they process.
- •Expect clients to ask about the RIN and the new forms once they appear. A one-page explainer will save many phone calls.
How we calculated the cost of rollover delay
Annual foregone return recovered = annual rollover assets × assumed annual return ÷ 365 × share of delay spent out of the market × days saved.
Inputs: $1.1 trillion and 10 million rollovers (Capitalize, 2024); 7% return (TrustRails assumption, varied from 4% to 10%); 100% out-of-market share (assets liquidated before transfer and not yet invested after); 16.5 days saved (a modeled reduction from a 24.5-day median to an 8-day median). Result: about $211 million per day system-wide and $3.5 billion per year in the base case, between roughly $2 billion and $5 billion across the sensitivity range. The current and target medians are TrustRails estimates, not survey results; the model is available on request.
Frequently asked questions
How long does a 401(k) rollover take?
There is no standard. In a 2024 Capitalize survey, 42% of savers said their rollover took two months or longer. By comparison, brokerage transfers through ACATS take about four business days — one to validate, three to complete — because FINRA Rule 11870 sets deadlines for each side.
How much does rollover delay cost participants?
At an assumed 7% annual return on roughly $1.1 trillion of annual rollover volume, each calendar day that rolled-over money sits out of the market costs participants about $211 million system-wide, or about $21 on an average $110,000 rollover (TrustRails estimate).
Are the Notice 2026-49 rollover forms mandatory?
No. The forms and five-step procedure are optional, there is no safe harbor yet, and the Notice does not set deadlines for any step. Treasury has asked whether to require electronic transfer and how long plans would need to comply.
What is missing from IRS Notice 2026-49?
Four things: a requirement to use it, a safe harbor for plans that do, response-time expectations for each step, and a shared machine-readable format so independently built electronic systems can exchange the forms without bilateral integration.
What would a rollover safe harbor do?
Treasury is considering two: one letting a receiving plan rely on the forms to conclude a rollover is valid, and one letting a distributing plan rely on them to conclude no withholding is required. TrustRails recommends attaching them to the standard data set in any medium and conditioning them on timely completion.
Does Notice 2026-49 cover automatic portability?
Automatic portability transfers under SECURE 2.0 Section 120 are IRA-to-plan rollovers, so they fall within the Notice, but they move in batches without a participant-signed request. They need a streamlined variant in which deemed consent satisfies Step 1 and one message carries many transfers, each with its own RIN.
TrustRails builds infrastructure for direct trustee-to-trustee retirement plan rollovers and has implemented the Notice 2026-49 forms and five-step procedure as structured electronic messages. Our formal comment letters on Notices 2026-49 and 2026-48, the full white paper, and the cost-of-delay model are available on request — talk to us.
For general information only; not legal, tax, or investment advice. Notice 2026-49 is proposed guidance and does not describe the final position of Treasury, the IRS, or the Department of Labor. Figures identified as TrustRails estimates are described with their assumptions so readers can substitute their own.