There has been a recent flurry of legislative and regulatory activity in the Pharmacy Benefit Manager (PBM) space and M3 is here to break it down for you!
On January 30, 2026, the Department of Labor (DOL) released proposed rules (“Improving Transparency into Pharmacy Benefit Manager Fee Disclosure”) developed pursuant to Executive Order 14273 and supported under ERISA §408(b)(2) and §505. These rules are focused on PBM compensation disclosures to self-funded ERISA plans.
On February 3, 2026, the Consolidated Appropriations Act (CAA) of 2026 was signed into law by President Trump after congressional passage. CAA 2026 focuses on disclosure requirements and mandates 100% rebate pass-through for all plans subject to ERISA.
It is important to note that the CAA 2026 applies to all group health plans, including fully insured plans, while the DOL rules only apply to self-funded ERISA plans. Due to the significant overlap of requirements, it is most likely that the DOL will revise the proposed regulations before finalization to line up with the statutory requirements in the CAA. M3 will continue to monitor the DOL’s response to public comments and any coordination efforts that would provide a unified regulatory approach to PBM oversight.
The key provisions of each are described below:
CAA 2026
Applicability:
Disclosure Requirements:
- All group health plans including fully insured plans
- Entities providing pharmacy benefit management services on behalf of group health plans
- Indirect application to “applicable entities”: drug manufacturers, distributors, wholesalers, rebate aggregators, applicable group purchasing organizations and their subsidiaries, affiliates or subcontractors
- Large employers (100+ employees) will receive detailed PBM reports
- Small employers (less than 100 employees) will receive a summary document with aggregate information.
100% pass-through rebate mandate
- Entities providing pharmacy benefit management services to ALL plans subject to ERISA, including Third Party Administrators (TPAs)
Effective Date: January 1, 2029 for calendar year plans (August 1, 2028 for non-calendar year plans)
Required Disclosures:
When? Semiannually (every 6 months) or quarterly upon employer’s request.
What? Detailed drug-level data for large employers/plans
- Contracted compensation (plan to PBM and PBM to pharmacy)
- Spread between amounts paid
- Rebates, fees and other remuneration by drug and therapeutic class
- Gross and Net drug spending
- Broker/consultant referral fees
- Benefit design parameters favoring affiliated pharmacies
100% Rebate Pass-Through Mandate: Required for ERISA plans only
- Rebates must be remitted quarterly (within 90 days after quarter-end) to plan or issuer
- Rebates must be remitted quarterly (within 45 days after quarter-end) by rebate aggregators and group purchasing organizations
- Full disclosure and enumeration to the plan required
- “Rebates” include fees, alternative discounts, and other remuneration from any “applicable entity related to drug utilization or spending”
Audit Rights:
- Annual audit rights for ERISA plans only
- Rebate contract with aggregators/manufacturers must be available for audit.
- Plan fiduciary selects auditor
- PBMs cannot pay for auditor
ERISA Fiduciary Relief: Innocent plan fiduciary exemption for failures attributable to PBMs, provided fiduciary did not know and reasonably believed compliance occurred.
Penalties: Applicable to PBMs, health insurance issuers, TPAs (entities required to provide disclosures)
- $10k per day for failure to disclose required information;
- $100k per item of false information knowingly provided.
DOL Proposed Rulesi
Applicability:
Direct applicability: Self-funded ERISA group health plans, regardless of size
Indirect Applicability: “Covered Service Providers” contracted with Self-funded ERISA group health plans to provide PBM services:
- PBMs and any entities providing PBM services
- Affiliates of PBMs that provide advice, recommendations, or referrals regarding PBM services.
- TPAs and health insurers that contract with plans to provide PBM services are also covered service providers responsible for making disclosures.
Effective Date: July 1, 2026 (January 1, 2027 for calendar year plans) **limited disclosure under DOL PR would apply before the broader CAA mandates – including 100% rebate pass-through**
Required Disclosures:
When?
- Initial disclosure before entering/renewing contracts,
- Semiannual disclosures (within 30 days after each 6-month period) and
- Disclosures of information for employer reporting upon request.
What?
- Direct compensation (aggregate and by service)
- Manufacturer payments/rebates (aggregate and per drug)
- Spread compensation (aggregate, per drug, per pharmacy channel)
- Co-pay claw backs
- Price-protection payments
- Drug-pricing methodology for formulary drugs
100% Rebate Pass-Through Mandate: NO MANDATE, BUT DISCLOSURE REQUIRED
- Required disclosure of rebate amounts retained vs. passed through but does not prohibit PBMs from retaining rebates
Audit Rights – Annual required
- PBM must confirm receipt of audit request within 10 business days and provide information within a commercially reasonable period.
- Plan and PBM share cost of the audit
- Plan fiduciary selects the auditor; PBM may not limit audit choice or restrict number of records.
ERISA Fiduciary Relief: Administrative class exemption for responsible plan fiduciaries if PBM fails to comply provided fiduciary did not know of non-compliance and reasonably believed requirements are satisfied; Fiduciary must request corrections for non-compliance in writing and must notify the DOL if not corrected within 90 days.
Penalties: enforcement under ERISA 408b2 – non-compliance renders the service arrangement “unreasonable” causing a prohibited transaction and the DOL may bring civil actions under ERISA and assess penalties.
Key Takeaway:
New federal rules increase PBM transparency and will require employers, both fully insured and self‑funded, to receive detailed, drug‑level reporting and ultimately benefit from full rebate pass‑through (for ERISA plans). While the Department of Labor’s proposed rules start earlier and apply only to self‑funded plans, the broader and stricter requirements in the Consolidated Appropriations Act of 2026 will apply to all group health plans. Employers should expect more insight into PBM pricing, compensation, and rebates, along with new audit rights and strong penalties for non‑compliance. These changes will shift how employers evaluate PBM arrangements and make plan fiduciaries responsible for ensuring PBM transparency. Your M3 Team will continue to monitor these developments to bring you the most current and accurate information you need to effectively administer your prescription drug plans.
i Note: Final rule may be significantly revised to coordinate with CAA)
The information provided is a summary of laws and regulations relating to employee benefit plan compliance. This information should not be construed as legal advice. In all cases, employers should consult with their own legal counsel.
