Executive Brief
Most plan sponsors believe they've satisfied CAA compensation disclosure requirements. They received a document from their benefits advisor. They filed it.
They're missing fourteen other vendor categories.
CAA 2026 rewrote one phrase in ERISA section 408(b)(2). Where the law said "brokerage services," it now says "services, including brokerage services."
The list of enumerated services now names the vendor categories: your PBM, your TPA, your stop-loss carrier, your EAP, your wellness vendor, your transparency tool. Each one owes you a written disclosure before you sign or renew. Coverage extends to affiliates and subcontractors.
The requirement attached to every contract entered into, extended, or renewed after February 3, 2026. That includes automatic renewals.
January 1 is the most common renewal date in benefits. If your vendors haven't disclosed by now, the window to have received those disclosures is closing fast.
Fifteen Categories, Named by Congress
These service types come directly from the statute. Congress enumerated them, which means the question of whether a service is covered has an answer you can point to.
Your Real Count Runs Higher Than Fifteen
The categories describe services. Vendors describe themselves as companies. One company often performs three enumerated services. Three companies sometimes hide behind one invoice.
A bundled carrier arrangement is the clearest case. The same parent may provide third party administration, pharmacy benefit management, and stop-loss insurance through separate legal entities. Three covered services. Three disclosure obligations. One contract.
Subcontractors multiply it further. CAA 2026 reaches services rendered by affiliates and subcontractors. A rebate aggregator sitting between your PBM and the manufacturers is inside the perimeter even though you've never signed anything with it.
Ask a benefits team to name their covered providers and the answer usually starts with the PBM, the TPA, and the advisor. Work the enumerated list, and the count climbs into double digits.
The Thousand-Dollar Threshold That Doesn't Filter
A vendor is covered if it reasonably expects to receive $1,000 or more in direct or indirect compensation connected to those services. On paper, that sounds like a filter. In practice, it barely filters at all.
Here's why. The threshold counts both direct and indirect compensation. Direct is what your plan pays. Indirect is everything the vendor collects from everyone else: rebates, spread, placement fees, override revenue, manufacturer payments. A thousand dollars across both of those is a very low bar.
And here's the inversion worth noticing. The vendors with the largest indirect compensation are the ones pulling real money from sources you can't see. They blow past a thousand dollars without thinking. So the threshold doesn't exclude the vendors you're worried about. It guarantees they're covered.
The ones with the most invisible money are the ones most certainly on the hook to disclose.
Two Clocks, Two Standards
There are two separate timing requirements here, and they're easy to blur together.
Clock One: The Proactive Duty. The vendor is required to provide the disclosure on its own, reasonably in advance of signing or renewing. That's the up-front obligation. It's on the vendor, and the timing standard is deliberately fuzzy. The statute says "reasonable." It doesn't say thirty days or sixty days. The test is whether you had enough lead time to actually evaluate the arrangement before you were bound. A disclosure that lands on December 31st for a January 1st renewal almost certainly fails.
Clock Two: The Cure Period. This one only starts if the first one fails. Once a disclosure is missing and you send a written request, the vendor gets ninety days to deliver. That's a hard number. If they comply within ninety days, you're fine. If they don't, the next steps kick in: notify the Department of Labor about the failure, and assess whether to terminate the arrangement for future services.
The proactive duty sits with the vendor. But the consequence of them failing lands on you, the fiduciary holding the arrangement. The written request is what shifts the record back in your favor.
A Fee Schedule Is Not a Disclosure
Most sponsors holding what they believe is a disclosure are holding a fee exhibit. The two do different jobs. A fee exhibit tells you what you pay. A disclosure tells you what the vendor earns, including the part you don't pay.
A compliant disclosure describes:
- The services the vendor provides
- Whether the vendor acts as a fiduciary
- Direct compensation
- Indirect compensation, with the payer identified by name
- The arrangement under which indirect compensation flows
- Compensation set on a transaction basis among affiliates
- Compensation payable on termination
Run your PBM's document against the indirect compensation items. "Manufacturer rebates" named as a category doesn't satisfy the requirement. The statute asks who pays and under what arrangement. Those two answers are where pharmacy economics actually live.
What Happens When the Disclosure Never Comes
When a covered service provider fails to disclose, the arrangement is no longer reasonable under ERISA. The 408(b)(2) exemption stops applying, and what remains is a prohibited transaction sitting on the plan.
That's real, but it's also abstract. "Prohibited transaction" and "loss of exemption" don't make a busy CFO pick up the phone. The penalty that actually moves people is the deposition. It's a plaintiff's attorney holding up a list of fifteen vendors and asking which disclosures you collected. It's explaining a gap under oath.
The paper trail is the exposure here. Not the prohibited transaction on a compliance checklist. The file that shows what you asked for, what you received, and what you did when something was missing.
Your Contract May Not Let You Leave
ERISA creates the duty to act when a vendor fails to disclose. It does not hand you a penalty-free exit.
Termination rights live in the contract you signed. Termination for cause, termination for convenience, notice periods, exit fees: those are governed by the language you negotiated, not by the statute. So the two aren't the same lever.
If a disclosure failure creates an ERISA obligation for you to terminate, you want your contract's termination-for-cause clause to explicitly name a disclosure failure as cause. That way the statutory duty and your contractual right line up. The law tells you to leave, and the contract lets you leave fast, without a penalty.
Without that language, you can be caught between an ERISA duty to exit and a contract that charges you to do it.
This is exactly the kind of provision that belongs in your contract language. Disclosure failure equals cause. Terminable without penalty. Data returned within thirty days.
What to Do First Thing Monday
- Build your vendor list using the fifteen categories. Not every vendor. Every vendor matching one of the statutory categories. Use the table above as your checklist. If you count four, keep counting.
- For each vendor, locate the written disclosure and note when it arrived. Did it come before you signed or renewed? If you can't find it, note that too.
- For any missing disclosure, send a written request this week. The request starts the ninety-day cure clock. A documented request a vendor ignores is stronger evidence of a prudent process than a disclosure you filed without reading.
- Check your termination clauses. Does your contract name disclosure failure as cause? If not, flag it for the next renewal.
In Closing
Counting vendors is the first fiduciary act here. A sponsor who has collected every disclosure from a list of four has documented diligence against the wrong denominator.
The penalty in the statute is real. But the exposure that moves people is simpler: a file that shows what you asked for, what you got, and what was missing. Build the documentation you want found.
Your employees and their families never see any of this. They see risong premiums and copays The compensation flowing to fifteen categories of vendors is paid from the same money funding their benefits. That's why the disclosure right exists. And why using it matters.
Here's to clearer thinking, stronger plans, and better outcomes for the people who rely on us.
All the best,
P.S. Next week: what the disclosures you collect should actually reveal, and the red flags that signal the document you received isn't a disclosure at all.
────────────────────────────────────────
Keep Reading. Keep Asking Better Questions.
Get the newsletter
Timely insights every Monday on contracts, employer health benefits, PBMs, and the decisions that shape outcomes.
Read the book
The Middleman’s Cut is the leadership playbook for understanding where the money goes, why the contract is the point of control, and what employers can do about it.
Explore Contract X-Ray
See how your PBM contract measures up, where it is strong, where it is weak, and what needs to change.
Talk with us
Have a PBM contract, fiduciary question, or employer-health-plan issue you want to work through?
See the money. Know the terms. Use your leverage.