Is Your Compliance Stack Ready for AEP — Not Just Your Sales Team?

Search “AEP readiness checklist” and you’ll get the same list every year: agent certifications current, book of business reviewed, call center staffing confirmed, outreach calendar built, marketing materials approved. All of that matters. None of it asks whether your compliance stack — the part that keeps CMS off your back and your commissions intact — is ready for the highest-volume, highest-risk weeks of the year.

That gap is the point of this page. AEP runs roughly seven weeks, Oct 15 through Dec 7. Call volume during that window can run several multiples of your normal month. Every script gap, every retention shortfall, and every consent-capture weak spot gets stress-tested at the worst possible time — right when a CMS secret shopper or a plan sponsor audit is most likely to be listening.

CMS’s CY2027 Medicare Advantage and Part D Final Rule changes two things your call center touches on every single call. Both take effect for the 2026 AEP selling season, so this is not a future problem — it’s an Oct 15 problem.

• •The 48-hour Scope of Appointment wait is gone.An agent can now collect a signed SOA and move directly into the same-day appointment — same call, same meeting. But a documented SOA is still required before any covered appointment happens. “The wait is gone” is not the same as “the form is optional.” See the full breakdown if your scripts or CRM still build in the old 48-hour delay.
• •The TPMO disclaimer trigger moved.Agents no longer have to read the disclaimer within the first 60 seconds of a call. The new standard is before any discussion of benefits begins. That sounds like more flexibility, and it is — but it also means your QA team needs a new definition of “too late” that isn’t tied to a stopwatch. Full detail in the disclaimer timing guide.

If your scripts, IVR prompts, or agent training decks still reference “within 60 seconds” or a mandatory 48-hour SOA cooling-off period, that’s a rewrite to make before training season starts, not during AEP week one.

Retention rules changed too. Marketing and sales call recordings now fall under a 6-year framework — 3 years of full audio, plus 3 more years where audio or a transcript satisfies the requirement. That’s down from the old 10-year rule. But enrollment call recordings are a separate clock and still require 10 years. Most competitor checklists collapse these into one number. They’re not the same requirement, and if your system tags every call the same way, you’re either over-retaining sales calls or under-retaining enrollment calls. See the full 6-year vs. 10-year comparison if your vendor contract or storage config still assumes a single retention period.

The compliance risk isn’t the rule change itself — it’s what happens to your recording pipeline when call volume jumps during the seven-week window. A system that holds up fine at 200 calls a day can silently drop or truncate recordings at 1,200 calls a day. Ask these questions now, while you can still fix the answer:

• •Does your dialer or CRM tag each recording as marketing/sales vs. enrollment at the point of capture, or does someone sort it after the fact?
• •Has anyone load-tested the recording pipeline at projected peak-week volume, not average daily volume?
• •If a call gets transferred mid-conversation — lead gen to licensed agent, agent to enrollment — does the recording follow the call or does it break at the handoff?
• •Where does the audio actually live, and who can produce a specific call within an hour if CMS asks for it during AEP?

AEP is also when most agencies spend the most on lead generation — TV, direct mail, digital, inbound call transfers, referral partners, all running simultaneously. If your attribution setup can’t tell you which source is producing which enrollment before the money is spent, you’re flying blind during the exact weeks where the spend is heaviest.

This is different from the compliance items above, but it fails the same way: nobody checks it until it’s already broken. Before Oct 15, confirm that every lead source is tagged consistently at intake, that the tag survives a transfer between call center and closing agent, and that you can trace a specific policy back to the campaign that generated it — not just the last thing the client clicked. Last-touch tracking alone will misattribute a meaningful share of your AEP volume if the sale involved more than one touchpoint, which most Medicare sales do.

Four things to confirm before volume hits, in order of urgency:

• Scripts and disclaimers updated — TPMO disclaimer moved to before-benefits-discussion, SOA workflow reflects the eliminated wait but keeps the signed form requirement, agent training decks match the current rule.
• Retention system load-tested — recordings tagged marketing/sales vs. enrollment at capture, pipeline verified at projected peak volume, transfer handoffs confirmed not to drop audio.
• Consent capture reviewed— SOA timestamps recorded and retrievable, TCPA prior-express-written-consent documentation current (the FCC’s one-to-one consent rule was vacated by the 11th Circuit, but CMS’s own TPMO consent expectations were untouched by that ruling — see what actually changed for lead buyers).
• Attribution tagging verified — every active lead source tagged at intake, tags survive agent handoffs, reporting can trace policy back to source before the heaviest spend weeks begin.

The left column is about not breaking during the surge. The right column is real work, but it’s work you can do in January with better information — including the lead-source and persistency data AEP itself is about to generate.

The moment AEP ends, most agencies move straight into next year’s planning and stop looking at the volume they just generated. That’s a mistake. The lead-source data from this AEP is exactly what tells you which sources produced policies that stick versus policies that lapse in the first 90 days — the persistency numbers that drive your December and January chargeback exposure.

Make sure whatever system captured your lead-source tags during AEP keeps that data connected to each policy through enrollment, not just through the sale. That link is what lets you run a real persistency-by-source review in December instead of guessing which campaigns to cut next year.