---
title: "ERISA Fiduciary Duty and CAA Disclosure: A Practical Compliance Guide for Employers and Brokers"
description: "Compliance obligations for employers and brokers are expanding fast in 2026 - here's what the regulatory pressure actually looks like inside your organization, and how to build a compliance program that holds up."
author: "Ori Klier"
category: "Employee Benefits Strategy"
date: 2026-08-02T09:00:09.099Z
canonical: "https://octi.contentagents.dev/blog/erisa-fiduciary-duty-and-caa-disclosure-a-practical-compliance-guide-for-employers-and-brokers"
---

# ERISA Fiduciary Duty and CAA Disclosure: A Practical Compliance Guide for Employers and Brokers

![bureaucracy, file folder, paperwork](https://cdn.pixabay.com/photo/2017/02/28/21/43/bureaucracy-2106924_1280.jpg)

> Compliance obligations for employers and brokers are expanding fast in 2026 - here's what the regulatory pressure actually looks like inside your organization, and how to build a compliance program that holds up.

Benefits compliance used to feel manageable. You renewed your broker contract, filed your Form 5500, and called it a year. That's no longer enough - and employers and brokers who haven't adjusted to that reality are carrying more legal exposure than they realize.

The pressure is coming from multiple directions at once. The Department of Labor's 2026 regulatory agenda is anchored by fiduciary rules, with new investment menu rulemaking and outstanding SECURE Act guidance pushing plan sponsors toward tighter disclosure and governance standards. ERISA requirements - historically centered on retirement plans - are now being read to cover medical and pharmacy arrangements too. Fiduciary breach class-action litigation against employer plan sponsors is rising. And the Consolidated Appropriations Act's compensation disclosure requirements for brokers and consultants are still not universally understood or implemented. Compliance obligations for employers and brokers are expanding, and the window for catching up is narrowing.

## Why Compliance Obligations Are Tightening for Employers and Brokers

  ![](https://cdn.pixabay.com/photo/2026/04/10/10/21/erwinbosman-woman-10219062_1280.jpg)

The regulatory environment in 2026 is not the same one that shaped most employers' current compliance frameworks. Fiduciary rules now dominate the DOL's agenda. Proposed regulations would expand disclosure requirements for pharmacy benefit managers and related compensation structures - building on what the Consolidated Appropriations Act already requires from brokers and consultants receiving indirect compensation from carriers and vendors.

Behavioral health litigation is intensifying as plan participants continue to contest mental health parity decisions made by insurers and third-party administrators. Three large employers are currently facing fiduciary breach challenges in federal district court. These are not abstract risks - they represent the practical consequence of treating compliance as a once-a-year checkbox.

The financial exposure is real. Settlements in fiduciary breach cases can reach into the millions. Legal defense alone - even for cases that settle - consumes HR and legal bandwidth that should be going toward strategy. And employees notice. When an employer can't explain how their broker gets paid, or why certain plan designs were selected, trust erodes. That's a retention and culture problem, not just a legal one.

The distinction between employer and broker obligations matters here. Employers are liable for plan administration and disclosure - they are the plan sponsor, and the fiduciary duty sits with them first. Brokers carry their own obligations: under the CAA's broker compensation disclosure rules, they must provide transparent, itemized disclosure of all direct and indirect compensation received in connection with a plan. Neither party can fully outsource their compliance responsibility to the other.

## How Compliance Gaps Play Out Inside Your Organization

Consider a scenario that is playing out more often than most benefits leaders want to admit. A mid-market employer with around 600 employees has worked with the same broker for seven years. The relationship is comfortable. At renewal, the broker presents a plan design recommendation. The employer approves it. No one asks about the broker's compensation structure, and no one has reviewed the broker's CAA disclosure document in detail.

Eighteen months later, a plaintiff's attorney reviewing plan documents notices that the broker's indirect compensation from a PBM was not disclosed in the format required under the Consolidated Appropriations Act. The employer - not the broker - is named in a fiduciary breach complaint. The HR team spends the next eight months working with outside counsel instead of running open enrollment and implementing the new wellness program they'd planned. Two senior HR staff members leave. The plan's costs increase as the employer switches vendors mid-year to resolve the conflict.

That's the compounding effect of compliance gaps. One missed disclosure doesn't stay isolated. It becomes evidence of a pattern. An unreviewed contract becomes the document that plaintiff counsel uses to show that oversight was absent from the beginning. This is why proactive auditing and documentation matter - not because they feel good, but because they are the only thing that interrupts the compounding.

Compliance failures also create operational drag that's easy to underestimate until you're inside it. Every hour an HR leader spends coordinating legal responses is an hour not spent on retention programs, benefits education, or workforce planning. The cost isn't just financial - it's organizational.

## What Compliant Employers and Brokers Are Doing Differently

The employers navigating this environment well share a few specific practices. They conduct annual broker audits - not just contract renewals, but structured reviews of compensation disclosures, conflicts of interest, and whether the broker's recommendations align with the employer's interests and the plan's documented objectives. They have documented fiduciary review processes that show, in writing, what was evaluated and why decisions were made. They maintain transparent, itemized fee schedules that any employee, auditor, or regulator could follow.

They also assign clear ownership. Compliance doesn't belong to everyone, which means in practice it belongs to no one - unless there is a named benefits leader or compliance contact who is accountable for the calendar, the documentation, and the reviews. Some employers bring in outside legal counsel or compliance consultants for independent verification; others build the capacity internally. Both approaches work. The common thread is that someone owns it.

An anonymized example: a self-funded employer in the Midwest with approximately 900 employees scheduled a proactive broker audit as part of their annual benefits review. During that review, the HR director noticed that the broker was receiving quarterly payments from the plan's PBM that had not been disclosed in the required CAA format. The employer brought it to legal counsel, renegotiated the broker's compensation structure, required a corrected disclosure, and documented the entire process. No litigation. No regulatory referral. The broker relationship continued under clearer terms, and the employer's plan documents now reflect a formal conflicts-of-interest review as part of annual renewal. That's not a complicated outcome - it's just what a functioning compliance process looks like in practice.

## Where Traditional Compliance Approaches Fall Short

Legacy compliance practices were built for a simpler regulatory environment. Many employers still rely on brokers to self-police their own compensation disclosures - which is precisely what the CAA's disclosure requirements were designed to address, because self-policing is not reliable when there is financial incentive misalignment.

Annual renewals catch a lot, but they miss mid-year changes. A vendor relationship that shifts, a new payment arrangement between a broker and a PBM, a plan design modification that wasn't formally documented - none of these show up if the only review happens at renewal in October. And compliance checklists, without someone who understands what they're reviewing and why it matters, are not compliance. They're the appearance of compliance.

The deeper problem is incentive structure. Brokers have real, legitimate conflicts of interest in certain plan designs. That doesn't make them bad actors - it makes them human. But it does mean employers cannot assume that broker recommendations are always made with the plan's lowest cost or best structure in mind. Verification is not distrust; it's fiduciary responsibility.

Continuous monitoring, independent verification, and documented decision-making are no longer optional practices for sophisticated plan sponsors. They're the baseline that regulators, plaintiff attorneys, and increasingly, employees themselves expect to see.

## The Role of Documentation, Auditing, and Advocacy

  ![](https://cdn.pixabay.com/photo/2019/05/09/10/52/audit-4190944_1280.jpg)

If you ever face a fiduciary breach allegation, your defense is your paper trail. Courts and regulators want to see that decisions were made deliberately, that conflicts of interest were reviewed and addressed, and that employees were given the disclosures they were entitled to. A well-documented fiduciary file - showing what the plan committee reviewed, what the broker disclosed, what alternatives were considered, and what rationale supported the final decision - is worth more than any after-the-fact explanation.

A compliance audit of your broker relationship should cover at minimum: the broker's compensation disclosure document and whether it meets CAA requirements; all direct and indirect compensation the broker receives from carriers, PBMs, or other vendors; any potential conflicts of interest in plan design recommendations; the plan documents themselves for accuracy and currency; and any employee communications related to plan features, costs, or rights. Who conducts the audit matters. An internal review is better than nothing, but an independent review by outside counsel or a compliance consultant carries more weight and is more likely to surface issues that internal staff - through familiarity or relationship - might overlook.

Advocacy is also part of fiduciary duty. HR leaders pushing back on broker recommendations, asking for itemized fee justification, or requesting independent cost benchmarking are not being difficult. They are doing exactly what their role requires. External advocacy - working with legal counsel when something doesn't add up, or engaging a compliance consultant for a second opinion - is not a sign that something is wrong. It's a sign of a mature, functioning benefits operation.

## What to Prioritize in Your Compliance Program

  ![](https://cdn.pixabay.com/photo/2015/07/17/22/43/student-849826_1280.jpg)

If you are looking at your current compliance posture and feeling uncertain about where to start, here is what we'd focus on first.

Conduct a baseline broker audit within 90 days. This doesn't need to be a lengthy engagement - it starts with pulling your broker's CAA compensation disclosure document and reviewing it line by line. What compensation is disclosed? Is indirect compensation from PBMs or carriers itemized? Does the format meet the regulatory standard? If you don't have a current disclosure document, that itself is your first finding. Ownership sits with the benefits leader; legal counsel should be looped in if there are gaps.

Establish a documented fiduciary review process. This means creating a written record of how plan design decisions are made, what was evaluated, who was in the room, and what the rationale was. It doesn't have to be elaborate - a one-page summary for each significant decision, filed with your plan documents, is enough to establish a pattern of deliberate governance.

Create an annual compliance calendar with assigned owners. Schedule broker audits, plan document reviews, employee disclosure updates, and fiduciary committee meetings with named owners and deadlines. Compliance that lives on a shared drive with no owner effectively doesn't exist.

Build employee-facing disclosure materials that are actually readable. Your employees have the right to understand what they're enrolled in and what their plan costs. Clear, plain-language summaries of plan features, cost-sharing, and their rights under ERISA are both a legal obligation and a trust-building tool.

Finally - and this is worth saying plainly - compliance is not a project with an end date. It's a discipline. The regulatory environment will keep moving. The DOL's 2026 agenda will give way to 2027 guidance. New litigation will clarify obligations that are still contested today. The employers who are positioned well are the ones who build compliance into how they operate, not the ones who scramble to catch up after a letter arrives from the DOL.

We built Octi to help employers and brokers stay ahead of exactly this kind of pressure - with transparent fee structures, documented audit trails, and advocacy that keeps your plan's interests at the center. If you're not sure where your compliance posture stands today, that's the right place to start.

  ![](https://cdn.pixabay.com/photo/2018/03/03/20/02/laptop-3196481_1280.jpg)

## FAQ

### What are the main compliance obligations employers have for their health benefit plans?

Employers who sponsor group health plans are fiduciaries under ERISA, which means they are legally responsible for plan administration, fee oversight, and employee disclosures. In 2026, that includes reviewing broker compensation disclosures required under the Consolidated Appropriations Act, ensuring plan documents are current, and maintaining documented records of how plan design decisions were made. Compliance is not something that can be fully delegated to a broker or TPA - the employer remains liable as the plan sponsor.

### What do brokers have to disclose to employer clients under the Consolidated Appropriations Act?

Under the CAA's broker compensation disclosure requirements, brokers and consultants who receive $1,000 or more in compensation in connection with a group health plan must provide a written disclosure of all direct and indirect compensation they receive - including payments from carriers, pharmacy benefit managers, and other vendors. The disclosure must be itemized and provided before the contract is executed or renewed. Employers who do not receive this disclosure should request it in writing; a missing or incomplete disclosure is a compliance finding in itself.

### What is a fiduciary breach, and how can employers protect themselves?

A fiduciary breach occurs when a plan sponsor fails to act in the sole interest of plan participants - for example, by approving a plan design that benefits the broker more than employees, or by failing to monitor service provider compensation. Protection comes from documented decision-making: written records of what was reviewed, what alternatives were considered, and what rationale supported each decision. Independent broker audits and regular plan document reviews are also core protections. The paper trail is your defense.

### How often should employers audit their broker relationships?

At minimum, once per year - ideally timed ahead of renewal so that audit findings can inform contract negotiations. However, mid-year reviews are increasingly important, because broker compensation arrangements and vendor relationships can shift between renewals. Any significant plan change, carrier switch, or PBM arrangement should trigger a targeted review of the broker's disclosure and any potential conflicts of interest that may have emerged.

### What is the difference between employer compliance obligations and broker compliance obligations?

Employers are liable as plan fiduciaries: they are responsible for how the plan is designed, administered, and disclosed to employees. Brokers have their own separate obligations - primarily the requirement to disclose all compensation they receive in connection with the plan, and to avoid undisclosed conflicts of interest. These are distinct legal responsibilities. An employer cannot assume that because their broker is in compliance, they are too. Employers must independently verify broker disclosures and document their own fiduciary oversight process.


---
Source: https://octi.contentagents.dev/blog/erisa-fiduciary-duty-and-caa-disclosure-a-practical-compliance-guide-for-employers-and-brokers