Missouri Rule Restricts Advisors’ Use of Shared 401(k) Credentials

Missouri’s new restriction puts a clear limit on how investment advisers can access clients’ held-away 401(k) accounts: advisers may not use third-party technology that logs in with a client’s credentials without the recordkeeper’s approval. The change gives advisers and software providers a concrete boundary in a debate that has already drawn action from major recordkeepers and raised questions about account security, plan terms and responsibility for managing retirement assets.

The Missouri Securities Division adopted the amendment to its rule on dishonest or unethical business practices without changes from its July 2026 proposal. The Missouri Register published the order on Oct. 15, following objections from St. Louis-based brokerage Stifel, 401(k) technology firm Pontera and several banking groups. Missouri appears to be the first state to put this specific prohibition into a rule.

The practice at issue, often called credential sharing, gives a third-party service a client’s 401(k) username and password. The software then accesses the recordkeeper’s website as if it were the account holder, allowing an adviser to review the account and, depending on the service, trade or rebalance assets. That access takes place without the recordkeeper’s direct involvement. A description of the technology outlines this login-based approach.

Access and security concerns

In its order, the division said access without custodian approval could raise concerns about account security, possible conflicts with user agreements, custody of funds and recordkeeping. The department also said it wants Missouri investors to maintain good relationships with their investment advisers and investment adviser representatives. It did not accept the requested changes.

Stifel’s Geoffrey Valentino said the amendment leaves uncertainty around access methods that clients have authorized. He urged the division to weigh client choice and access to advice alongside cybersecurity protections. Pontera’s Kajal Patel described the firm’s service as enabling advisers to review client information and send rebalancing recommendations to recordkeepers. Pontera argued that the rule could remove a secure way to manage accounts, and asked for an exemption when clients approve access, credentials are encrypted, and advisers neither use nor retain identifying information.

The disagreement turns in part on who controls the login and who carries the risk when a third party enters an account through the client’s credentials. A client’s consent may address one concern, but it does not by itself resolve questions about the recordkeeper’s approval, the account’s user terms, or what other information becomes visible through the same login. Missouri’s rule focuses on the recordkeeper’s awareness and approval as part of that access arrangement.

Recordkeepers had already tightened access

The Missouri change follows steps by large recordkeepers to limit credential-based access. Fidelity began blocking credential-sharing systems in 2024. In November 2025, Schwab asked clients to reset their login credentials, amid a public dispute between Pontera and Fidelity over access.

Alex Barned, executive director at Absolute Capital, an SEC-registered RIA with a held-away account platform that competes with Pontera, said Missouri went further than other states. Ohio and Nebraska have issued alerts and guidance on advisers’ use of platforms that rely on clients’ login credentials, he said. “Missouri is the first one to come out with that concrete type of structure and just say no,” Barned said at Schwab IMPACT in Boston.

Barned said the federal regulator has not taken a position on the issue. He described Missouri’s concerns as cybersecurity exposure for clients, the possibility that an adviser might see accounts beyond the 401(k) being managed, and a recordkeeper’s lack of visibility into activity on its own platform. Those points show why client authorization alone may not settle the debate: access can affect the security and oversight of more than the specific retirement account an adviser intends to manage.

Plan terms shape the available route

Barned said Missouri’s rule leaves a route for access when the adviser, client and recordkeeper are all aware of and agree to the arrangement. His account of that provision suggests the practical question for advisers is whether they can establish an approved connection with the recordkeeper and satisfy the individual plan’s terms.

He also disputed the idea that recordkeepers are uniformly opposed to outside advisers. In his view, restrictions can stem from plan sponsors’ documents barring adviser involvement. Recordkeepers then have to administer those terms even when advisers seek to help participants manage their accounts. The distinction matters: a platform’s technical ability to reach an account does not establish that the plan permits an adviser to act on it.

Absolute Capital connects directly with recordkeepers, Barned said, and follows plan requirements, including fee caps. He characterized credential-sharing services as indirect access that can leave advisers carrying fiduciary responsibility while the technology provider avoids registration or oversight. That is Barned’s assessment of the model; the source of the dispute remains the different views among advisers, technology providers and recordkeepers about how access should be authorized and monitored.

Barned pointed to the Employee Retirement Income Security Act of 1974 (ERISA) as a larger constraint, saying plan sponsors retain authority over the rules governing retirement plan assets. For advisers, the Missouri rule makes the immediate operating conditions more explicit: access arrangements need the recordkeeper’s involvement, while the plan’s own terms continue to shape what advisers can do. Whether other states or the federal regulator take a position remains unresolved.