Carriers, Not CMS, Are the Regulator You'll Actually Meet

42 CFR §422.2274is the federal rule that makes Medicare Advantage and Part D carriers responsible for the marketing and enrollment conduct of their downstream entities — the third-party marketing organizations (TPMOs), which is the regulatory term that covers most independent agencies and call centers. CMS doesn’t have a direct enforcement line to your agency under this framework. It regulates the plan sponsor (the carrier), and the carrier is contractually and legally obligated to make sure you follow the rules on the carrier’s behalf.

This is a structural fact, not an oversight anyone is racing to fix. It means the carrier isn’t just a business partner who happens to also care about compliance — it’s the entity holding the actual regulatory exposure if your agency does something wrong. That’s why carriers investigate every complaint and demand documentation fast; see the full complaint-to-termination chain for how that plays out call by call.

Look at where CMS money penalties actually go and the pattern holds. According to a review of CMS’s 2024 Medicare Advantage and Part D program audit enforcement report, CMS levied roughly $2.9 million in Civil Money Penalties from that year’s audit cycle — and none of it was traced to marketing-conduct violations at the agency level. The penalties CMS actually imposes hit carriers, for carrier-level compliance failures across areas like formulary administration, appeals processing, and organization determinations — not a fine mailed to an independent agency for a bad sales call.

That doesn’t mean marketing misconduct goes unpunished. It means the punishment doesn’t come from CMS directly — it comes from the carrier, through contract termination, chargebacks, and appointment revocation, because the carrier is the one holding CMS-facing liability for what happened on your call.

CMS itself has characterized carrier oversight of agent marketing as reactive rather than proactive. A summary from Blue Peak Advisors notes CMS has called out plans for waiting until a complaint or an audit finding forces action, rather than monitoring TPMO conduct on an ongoing basis. That’s a useful data point for agencies: the enforcement trigger in practice is much more often a specific complaint or specific documentation gap than a general sweep — which is exactly why the document-production speed described in the enforcement chain article matters as much as it does.

This isn’t a fringe complaint from industry critics. The Senate Finance Committee’s March 2025 report on Medicare Advantage marketing practices found that regulators have limited direct oversight authority over TPMOs, and that total TPMO spending across the industry grew from approximately $2.4 billion in 2018 to $6.9 billion in 2023 — nearly tripling during exactly the period when direct federal oversight of that spend stayed structurally limited. The report’s core recommendation, consistent with the companion Wyden investigation, is that Congress should give CMS direct authority over TPMOs. That hasn’t happened yet. Until it does, the carrier remains the enforcement layer standing between you and CMS.

It’s tempting to assume state insurance departments fill the gap. Mostly, they don’t — 42 CFR §422.402 preempts state law with respect to Medicare Advantage plan standards, which covers most of the marketing and enrollment rules that actually govern your day-to-day conduct. States retain authority over licensing and certain state-specific insurance regulation, but the marketing rulebook you operate under is federal, and federal preemption keeps most state regulators out of that specific lane.

Net result: no state insurance commissioner is likely to be the one calling about a marketing complaint. That call, if it comes, comes from the carrier.

None of this works as an enforcement chain unless the carrier has its own reasons to care. It does, and they’re financial, not civic-minded.

• •Star Ratings.Complaint volume is weighted at 1.5 in CMS’s Star Ratings methodology — a heavier weight than many other measures — and Star Ratings drive bonus payments and plan competitiveness. A carrier’s agents generating complaints directly costs the carrier money through this channel.
• •Direct DOJ exposure. In May 2025, the Department of Justice filed a False Claims Act complaint against Aetna, Humana, and Elevance, alongside brokers eHealth, GoHealth, and SelectQuote, according to the DOJ’s own press release. That case survived motions to dismiss in March 2026 — see Health Affairs’ coverage of the ruling. Carriers named in an active False Claims Act suit have every incentive to tighten broker oversight, because the government is arguing the carrier is liable for what its distribution partners did.

Put together, Star Ratings punish complaint volume and the DOJ case demonstrates that carriers can be sued directly over broker conduct. Both point the same direction: carrier self-interest, not CMS mandate, is what drives day-to-day oversight of your agency.

If you run a small or midsize Medicare agency, the practical translation of all of the above is simple: stop picturing a CMS auditor as your compliance risk, and start picturing your carrier’s broker-oversight desk. That’s the entity with both the legal duty and the financial motive to review your conduct, and it’s the entity that will actually contact you.

• Know which person at each carrier you’re appointed with handles broker compliance escalations — don’t wait to find out during an active complaint.
• Treat every document request from a carrier as effectively identical to a federal audit request in seriousness and deadline, even though it arrives on carrier letterhead.
• Keep your own complaint rate and chargeback data visible to yourself before the carrier brings it to you — see how to segment chargebacks by lead source so you catch a bad pattern before a carrier does.
• Build vendor oversight documentation as routine practice, not after-the-fact — this is the exact evidence that determined the outcome in Hossfeld v. Allstate, separate from but parallel to your carrier relationship.