The statutory heart of an ESOP is an exemption from the duty to diversify. ERISA requires a fiduciary to discharge duties prudently and "by diversifying the investments of the plan so as to minimize the risk of large losses, unless under the circumstances it is clearly prudent not to do so." Then 29 U.S.C. 1104(a)(2) carves a hole in it: for an eligible individual account plan, the diversification requirement, and the prudence requirement to the extent it requires diversification, "is not violated by acquisition or holding of qualifying employer real property or qualifying employer securities." Every other feature of the plan follows from that sentence. The law permits a retirement account to be concentrated in a single company's stock, and only in this setting.
Because the concentration is permitted, the counterweights are statutory rather than discretionary. IRC 401(a)(28)(B) requires the plan to let a "qualified participant," defined as an employee who has completed at least 10 years of participation and has attained age 55, elect within 90 days after the close of each plan year in a six-plan-year election window to direct the investment of at least 25% of the account, measured net of any amount covered by an earlier election. In the last year of that window the fraction is at least 50%. The plan satisfies the requirement either by distributing the elected portion or by offering at least three investment options and moving the money accordingly. This provision does not apply to a plan holding publicly traded employer securities, which is governed instead by IRC 401(a)(35): there, amounts attributable to employee contributions and elective deferrals can be divested immediately, employer contributions after three years of service, and the plan must offer at least three diversified alternatives with materially different risk and return characteristics.
Valuation and the put option are what make a private-company ESOP work at all. Shares in a company that is not publicly traded have no market price and no buyer. IRC 401(a)(28)(C) requires that all valuations of employer securities that are not readily tradable on an established securities market be performed by an independent appraiser. And IRC 409(h) gives a participant entitled to a distribution the right to demand that benefits be distributed in employer securities and, where those securities are not readily tradable, "a right to require that the employer repurchase employer securities under a fair valuation formula." That repurchase right, generally called the put option, is the mechanism that turns shares nobody can sell into money. It has exceptions: a plan maintained by an S corporation, or by an employer whose charter or bylaws restrict ownership of substantially all its stock to employees or to the plan trust, may provide for cash distribution instead, with resale rights attached where securities are distributed.
Getting money out has its own timetable. IRC 409(o) requires the plan to provide that, if the participant elects it, distribution of the account will begin no later than one year after the close of the plan year in which the participant separates from service by reason of normal retirement age under the plan, disability or death, or the fifth plan year after the plan year of any other separation, and that it be paid in substantially equal periodic payments over no more than five years unless the participant elects otherwise. Larger balances get a longer maximum period on thresholds the statute adjusts for cost of living. Shares held in an ESOP that carry appreciation over the plan's cost can also raise the net unrealized appreciation rules on a lump-sum distribution, which is a separate decision covered there.
The household consequence is the one worth acting on. A concentrated retirement account at an employer sits alongside a salary from the same employer, and often alongside health coverage and a purchase plan too, so a single company's fortunes drive several parts of one household's finances at once. That structure and what to do about it belong to concentration risk.