After a flurry of action by regulators and Congress earlier this year to shed light on pharmacy benefit managers (PBMs), the U.S. Department of Labor (DOL) has at last published the final rule on PBM compensation disclosures. As health costs and pharmacy spend continue to increase, the final rule puts plan sponsors in the driver’s seat with new tools to evaluate the reasonableness of their PBM arrangements and determine if the PBMs are truly helping the plan meet its financial needs.
Executive Summary
The DOL final rule significantly expands transparency into PBM arrangements for large self-funded ERISA health plans (generally, those maintained by employers with at least 100 employees or plans with at least 100 participants) by creating three primary requirements for covered PBMs:
initial compensation and services disclosure;
semi-annual (or quarterly, if requested) compensation disclosures during the relationship; and
audit rights.
Together, these requirements are designed to help responsible plan fiduciaries understand PBM compensation and services, monitor compensation during the relationship, and verify information received through audits.
The final rule is meant to give plan sponsors more insight into the true cost of their contracted PBM services. For too long, PBMs have withheld sources of income that could impact costs to the plan and its participants. With the comprehensive financial picture facilitated by this rule, plan sponsors will be able to fully understand the PBM relationship and better fulfill their fiduciary responsibility of ensuring contracts are reasonable.
As these rules apply for plan years beginning on or after July 1, 2027(Jan. 1, 2028, for calendar year plans), plan sponsors of covered plans should begin preparing not only to receive the new disclosures, but also to establish a prudent process for reviewing them, asking questions, and documenting their oversight of the PBM arrangement.
The big picture: how we got here
ERISA broadly prohibits the furnishing of goods, services, or facilities between an ERISA plan and a party in interest unless an exemption under ERISA §408 applies. A “party in interest” under ERISA’s definition includes a person providing services to an employee benefit plan. ERISA §408(b)(2) provides an exemption which allows plans to contract with service providers if the arrangement is reasonable, the services are necessary, and the compensation is reasonable. The Consolidated Appropriations Act of 2021 (CAA 2021) added ERISA §408(b)(2)(B) making certain group health plan service agreements entered into or renewed on/after Dec. 27, 2021, “reasonable” only if the brokers/consultants provide compensation disclosures to the group health plan.
However, PBMs argued that they were not subject to the CAA 2021 compensation disclosure requirement. But that has now changed. Earlier this year through the Consolidated Appropriations Act of 2026 (CAA 2026) and the DOL’s proposed rules, both Congress and the DOL respectively took additional steps to improve transparency into PBM fees and compensation by clarifying that the definition of a “covered service provider” under ERISA §408(b)(2)(B) is broad and includes PBMs, creating detailed transparency and disclosure requirements, and requiring prescription drug pricing transparency.
The DOL rules, now finalized, implement the framework established in CAA 2026 for PBMs serving large self-funded plans by requiring detailed prospective and ongoing disclosures designed to help fiduciaries assess the reasonableness of PBM contracts and compensation under the ERISA §408(b)(2) exemption.
The final rule addresses stakeholder concerns regarding the differences between the proposed rules and CAA 2026 and now more closely aligns the DOL’s PBM disclosure requirements with CAA 2026 reforms, including the timing of ongoing PBM compensation disclosures and audit-related protections. The DOL has also clarified that the final rule and the remaining PBM provisions of CAA 2026 are designed to work in tandem to increase transparency into PBM compensation, pricing and financial arrangements, giving plan fiduciaries greater insight into the economics of their PBM relationships.
LOCKTON COMMENT: The remaining PBM-related ERISA requirements in the CAA 2026 (100% pass-through of specified remuneration and detailed PBM reporting on drug spending) do not become effective until Jan. 1, 2029, for calendar-year plans.
Differing definitions under the final rule
For purposes of this final rule, “covered plans” are those sponsored by specified large employers (e.g., at least 100 employees) or specified large plans (e.g., at least 100 participants). Fully insured plans and plans established by plan sponsors who are (or are affiliated with) drug manufacturers, distributors, wholesalers PBMs, or rebate aggregators are excluded from the definition of “covered plan.” Therefore, this final rule is inapplicable to those plans, and PBMs (and affiliates of those PBMs) will not need to comply with the final rule’s requirements.
LOCKTON COMMENT: Please note, while the above excluded plans and smaller self-insured ERISA group health plans are not subject to this final rule, they remain “covered plans” under ERISA §408(b)(2)(B), meaning that their covered service providers (e.g., brokers, consultants and other service providers) must still provide the generalized statutory compensation disclosures under ERISA §408(b)(2)(B). The focus of this Alert, however, is on the specific requirements applicable to PBMs under the DOL’s final rules.
New initial PBM disclosure requirements
For large self-funded ERISA health plans, the final rule requires PBMs to disclose detailed information about PBM services, compensation, financial arrangements, formulary incentives, and drug pricing before initial contracting or renewal. The purpose is to give fiduciaries information needed to evaluate the reasonableness of the arrangement and the compensation before entering into the service agreement. For extensions and renewals, disclosure at least 90 calendar days in advance is deemed reasonable under the final rule.
This new requirement is now part of ERISA § 408(b)(2)(B)’s prohibited transaction regime, which permits a plan to contract with service providers if the arrangement is reasonable, the services are necessary, and the compensation is reasonable.
The initial disclosure is substantially more detailed than a traditional fee disclosure and must include, among other things:
PBM services and direct compensation, including how compensation is allocated when services are bundled;
Manufacturer rebates, fees, alternative discounts, and other indirect compensation, including what is expected to be passed through to the plan and what may be retained;
Spread pricing, pharmacy recoupments, copay claw-backs, and price-protection arrangements;
Arrangements or incentives that steer participants to pharmacies affiliated with the PBM;
Financial incentives that affect formulary placement, including certain information about therapeutic alternatives and biosimilars;
The net price for each formulary drug by National Drug Code (NDC)-identification and pharmacy channel, or a verifiable pricing methodology when a specific amount cannot reasonably be determined;
Arrangements or incentives that steer participants to pharmacies affiliated with the PBM;
Other compensation. The rule includes a broad catch-all covering compensation not otherwise disclosed, including identification of the payer, services for which compensation is received, and the applicable compensation arrangement.
LOCKTON COMMENT: The intent behind the initial disclosure is to provide the disclosure of expected PBM compensation as a monetary amount, rather than leaving the fiduciary with only a percentage, formula, or contractual methodology. When the monetary amount is not reasonably ascertainable, the final rule allows an estimate based on good-faith assumptions using contractually defined terms and elements.
The initial PBM disclosure must also address termination compensation, including applicable treatment of prepaid amounts, and must state whether the covered service provider, affiliate, agent, or subcontractor will provide or reasonably expects to provide services directly to the plan as an ERISA fiduciary, if applicable.
LOCKTON COMMENT: The disclosure goes well beyond a traditional administrative-fee summary provided to employer plan sponsors. It is intended to show the broader economics of the PBM relationship, including compensation that may not be obvious from the contract’s headline fees. That gives plan fiduciaries a better starting point for comparing proposals, negotiating renewals, and documenting why an arrangement is reasonable. Prudent fiduciary oversight is process-based, and this newly available information will help plan sponsors make prudent decisions.
New semi-annual (or quarterly upon request) compensation reports
Importantly, and much unlike CAA 2021's compensation disclosure, the final rule creates a semi-annual (or quarterly if requested by the plan) compensation disclosure requirement for PBMs. The DOL intentionally adopted this reporting frequency to align the final rule with the reporting periods established by new ERISA § 726 under CAA 2026.
Unlike the initial disclosure, which provides prospective information, the semi-annual disclosure is designed to support the fiduciary’s ongoing monitoring of the PBM relationship and its compensation.
The semi-annual disclosure focuses principally on the compensation generated by the PBM arrangement during the reporting period. Rather than simply repeating the estimates contained in the initial disclosure, the PBM must report the required categories of compensation received (or reasonably expected to be received) in connection with services during the reporting period regardless of when payments occur.
The disclosure includes categories of direct and indirect compensation, including compensation associated with:
Direct compensation received in connection with the PBM services;
Manufacturer remuneration, including applicable rebates, fees, alternative discounts, or other remuneration;
Spread compensation;
Copay claw-backs and other retroactive pharmacy reimbursement adjustments;
Price-protection arrangements; and
Other compensation not otherwise captured by the specific categories.
If a category of compensation received by the PBM or its affiliate, agent, or subcontractor materially exceeds the initial estimate, the PBM must disclose the aggregate amount of the overage and the reason for it.
The semi-annual disclosure also includes an updated statement regarding ERISA fiduciary status, to the extent applicable and not previously disclosed, as well as information regarding the plan’s audit rights.
LOCKTON COMMENT: This is an incredible step toward ensuring the reasonableness of PBM arrangements. A plan fiduciary no longer receives detailed PBM compensation information only when evaluating the contract. The semi-annual disclosure gives the fiduciary information during the relationship that can be compared with the original compensation projections and, where questions arise, tested using the final rule’s audit rights.
New audit rights for plan sponsors
Significantly, the final rule gives covered large self-funded ERISA health plans an important new tool for independently verifying the accuracy of compensation information provided by their PBMs. Rather than requiring plan fiduciaries simply to rely on the PBM’s disclosures, the rule requires that the service arrangement allow plans to audit the accuracy of the required disclosures at least once each year. While this audit availability is a right, it is not a requirement that fiduciaries conduct audits every year. To facilitate an audit, the PBM must provide access to the records, claims, and transaction-level data reasonably needed to test the disclosures. That includes relevant contracts with pharmacies, pharmaceutical manufacturers, and rebate aggregators.
The regulatory audit right is not unlimited. The audit is focused on verifying compliance with the disclosure requirements and is limited to the period covered by the disclosure being reviewed. It is not the same as a broader contractual audit right that a plan may negotiate separately (e.g., an operational readiness audit). Moreover, the plan chooses the auditor and pays the auditor’s fees, while the PBM pays its own costs of producing the required information.
LOCKTON COMMENT: The DOL declined to require the PBM to pay all audit costs when the audit identifies errors above a specified threshold. Plans therefore may want to consider whether their PBM contracts provide additional audit-cost protections beyond the regulatory minimum.
Other requirements include that:
the PBM acknowledges an audit request within 10 business days;
the requested information is generally produced within a commercially reasonable period, with an outside deadline of 60 calendar days unless extraordinary circumstances outside the PBM’s control prevent timely production; and
reasonable confidentiality protections are permitted, but they cannot eliminate disclosures to regulators or legal counsel.
LOCKTON COMMENT The DOL also incorporated CAA 2026-related privacy protections while making clear that those protections do not eliminate access to claims and transaction-level information otherwise permitted or required under ERISA, HIPAA, or other applicable law, including information necessary to conduct the audit contemplated by the rule.
What if my PBM isn’t playing ball?
The final rule includes relief intended to protect a responsible plan fiduciary that reasonably believed the disclosure requirements were being met but later learns that the PBM did not comply. To preserve that relief, the fiduciary must follow the rule’s process rather than ignoring the missing information. The prescribed process includes strict timeframes, notice requirements, and necessary documentation. Specifically:
The fiduciary must have been unaware of the failure;
Request the missing information in writing, and create a record of what information was requested and when;
Give the PBM 90 days to comply;
Notify DOL if the failure is not corrected;
Decide whether to continue or terminate the relationship; and
Document the decision.
While the regulatory process is prescriptive, it gives prudent fiduciaries more information and options in how to run their plan even if a PBM isn’t providing the required information.
Conclusion and employer next steps
Until these rules become effective, DOL has indicat
ed that it will not treat a plan as failing the PBM compensation-disclosure requirements if the plan continues to act in good faith in applying ERISA’s reasonableness standards. With an 8-month runway until the rule is effective, plan sponsors have time to begin planning how they will use this newly available data to make decisions for their plans.
These disclosures will give plan sponsors much better visibility into how their PBM arrangement works. The information itself is only the first step. The fiduciary value comes from reviewing the data, asking questions, comparing actual results with the original estimates, and documenting the decisions made on behalf of the plan.
With the new requirements applying for plan years beginning on or after July 1, 2027, employers can begin preparing now by reviewing their PBM contracts, identifying upcoming renewal timelines, and thinking through how the new disclosures will be reviewed and incorporated into their fiduciary oversight process.
Lockton’s dedicated specialty teams can help plan sponsors understand how the rule may affect their plans and PBM relationships, assist in preparing for the new disclosures, make sense of the information provided, and determine how the new data can be incorporated into your pharmacy procurement, ongoing PBM oversight and fiduciary process.
Not legal advice: Nothing in this alert should be construed as legal advice. Lockton may not be considered your legal counsel, and communications with Lockton's Compliance Consulting group are not privileged under the attorney-client privilege.
For more alerts, insights and additional information, click here (opens a new window) to visit Lockton's ERISA Compliance Consulting page.
Download alert (opens a new window)
