Protect Your ACA Book From Unauthorized Plan Switching
CMS and GAO are cracking down on unauthorized ACA plan switching. Here is a practical checklist for agents to catch it early and protect their book this Open Enrollment.
Why ACA unauthorized plan switching matters this Open Enrollment If you sell ACA coverage, the single biggest compliance risk this Open Enrollment isn't a form you forgot to file — it's a client who gets switched to a different plan, or a different agent, without ever asking for it. Federal watchdogs say this has become a real and growing problem, and regulators have spent 2026 tightening the rules around it. Here's what changed, and a practical checklist for protecting your book before and during the November 1 – January 15 Open Enrollment window . What CMS and GAO found In July 2026, the Government Accountability Office published GAO-26-108041, "Health Insurance Marketplaces: CMS Needs Stronger Controls to Prevent Unauthorized Actions by Agents and Brokers." The report found that confirmed consumer complaints about unauthorized Marketplace enrollments and plan switches grew more than fourfold from 2023 through 2025. GAO's explanation for why this keeps happening is uncomfortable for anyone who sells ACA plans: the federal Marketplace largely relies on an agent or broker simply attesting that they obtained a consumer's consent before acting on an application. GAO found that any registered agent or broker — not just the one already on file as the client's agent of record — can view a consumer's full Marketplace record once they make that attestation, and CMS does not routinely verify that the attestation is true. The report pointed to three state-based Marketplaces (California, Georgia and New Mexico) that already require stronger protections, such as a one-time passcode sent to the consumer before an agent can act, and recommended CMS adopt comparable controls. HHS concurred with GAO's recommendations and said it is evaluating options. CMS has not waited for that process to finish. A 2026 CMS update on actions to prevent unauthorized agent and broker Marketplace activity describes a temporary moratorium on new agent and broker registrations for the 2027 plan year for anyone without an active 2026 Exchange Agreement, re-identity-proofing for existing agents and brokers through Login.gov or ID.me, and roughly 315,000 unauthorized enrollments CMS says it has already canceled, affecting more than 760,000 people. The same release says CMS has issued termination notices to more than 200 non-compliant agents and brokers since January 2026. Separately, the final 2026 Notice of Benefit and Payment Parameters gives CMS the authority to immediately suspend an agent's or broker's ability to transact with the Marketplace the moment it discovers an unacceptable risk to eligibility accuracy, operations, applicants, enrollees or Marketplace IT systems — and the June 2025 Marketplace Integrity and Affordability final rule set a preponderance-of-the-evidence standard for terminating an agent's or broker's Exchange Agreement for noncompliance. CMS has also clarified that it can pursue the owners and executives at an agency ("lead agents"), not only the individual broker who committed the violation. None of this requires you to have done anything wrong. A client can be switched away from your book by someone else entirely, and under the weak consent-verification process GAO described, you may not find out from CMS when it happens. A protection checklist for this Open Enrollment Confirm your own registration and identity-proofing status now. If you registered for the 2026 plan year without an active Exchange Agreement, you may be subject to the new registration moratorium for 2027. If CMS asks you to re-verify your identity through Login.gov or ID.me, do it before Open Enrollment opens, not during it. Don't rely on attestation alone — document consent yourself. Since CMS's own process is largely an attestation, build your own record: date, time, what plan and metal tier the client asked for, and how you confirmed it was really them (a callback to a known number, a three-way verification call, a signed form). Keep that documentation with the client's record, not in a separate file you might not be able to find later. Reconcile your book against your HealthSherpa export every week during peak Open Enrollment, not just at the end. Because many unauthorized switches hit consumers on $0-premium plans, the client often has no billing change to alert them — the first sign is usually a missing commission or a changed agent-of-record. AgencyView's ACA Marketplace Book of Business report compares your HealthSherpa export against your own CRM book and commission statements and surfaces exactly this: which clients' agent-of-record changed and when, and which paying clients from your statements no longer show up in the export at all. Investigate every AOR change you didn't make, the week it happens. The longer an unauthorized switch sits unreported, the harder it is to reverse and the more commission exposure you carry. Report suspected unauthorized switching immediately — to CMS and to your state insurance department. Keep a dated record of what you reported and when; if your own Exchange Agreement is ever questioned, that record of proactive reporting is part of your defense. If you run a downline, audit your sub-agents' practices, not just your own. CMS has clarified it can take enforcement action against an agency's owners and executives for a sub-agent's unauthorized activity, so the compliance exposure doesn't stop at the individual broker. Treat November 1 through December 15 as the highest-risk window. That's when the volume of both legitimate enrollment and rogue-agent activity peaks, since plans effective January 1 require enrollment by December 15. Reconcile weekly through that stretch, then again heading into the January 15 close. Build a paper trail you can actually produce A consent record that only exists in your memory, or scattered across text messages and call logs you'd have to dig for, doesn't hold up when a regulator or a client asks what happened six weeks ago. Every policy, enrollment and consent conversation should be logged against the client's contact record in your CRM — not a separate spreadsheet, a sticky note, or a folder on someone's desktop that leaves with them if they change agencies. When everything from the original authorization to the plan selected to the AOR history lives on one contact record, you can answer a complaint or an audit request in minutes instead of days, and you have a consistent account of what happened even if the agent who handled the enrollment is no longer with your agency. If you find an unauthorized switch Contact the client directly and confirm what happened in their own words before you act. Help them file a complaint with CMS and, if your state runs its own Marketplace, with the state insurance department. Document the date you discovered it, the date you reported it, and who you spoke with. If the switch moved the client to a different agent of record, you may be able to request it be reversed — but the sooner you catch it, the better your odds, since GAO's report found CMS doesn't reliably notify the original agent when a change occurs. How AgencyView helps AgencyView's ACA Marketplace Book of Business report was built around exactly this problem: giving agencies a way to catch agent-of-record changes and clients who've quietly dropped off their book, instead of discovering it months later when a commission statement comes up short. It reads directly from a HealthSherpa export and the agency's own CRM and commission data — no manual spreadsheet reconciliation required. Pair it with your own documented consent records in each client's contact history, and you have a defensible paper trail if CMS or a state regulator ever asks. Learn more about how AgencyView supports ACA agencies at agencyview.net . FAQ What counts as an unauthorized ACA plan switch? It's when a consumer's Marketplace plan, or the agent of record on their enrollment, is changed without their knowledge or consent — often by an agent other than the one…
Where AgencyView fits
Keep reading
Share: Facebook · LinkedIn · X · Email
All articles · AgencyView