Congress enacted significant new requirements for pharmacy benefit managers (PBMs) in the Consolidated Appropriations Act, 2026 (CAA 2026), including provisions governing rebates, other forms of remuneration, PBM service fees and audit access. Most of the major requirements won’t take effect until 2028 or later, and some implementation details are still being finalized. 

What changes will depend on the market a PBM serves. CAA places new limits on the compensation PBMs and their affiliates can retain in Medicare Part D, while establishing broader rebate and remuneration pass-through requirements for ERISA-covered group health plan arrangements. 

For PBM compliance teams, that makes the next few years an important preparation window. Contracts, payment flows, affiliate relationships, reconciliation processes and supporting documentation may all need to be evaluated before the new requirements become applicable.  

CAA 2026 Rebate Pass-Through Requirements for ERISA Plans 

For ERISA-covered group health plan arrangements, CAA 2026 requires PBMs to remit 100% of certain rebates, fees, alternative discounts and other remuneration related to prescription drug utilization or spending under the plan. The requirement applies to new, renewed or extended PBM service contracts or arrangements for plan years starting on or after August 3, 2028. 

What PBM Payments Are Subject to the CAA 2026 Pass-Through Rule? 

The law’s scope extends beyond payments received directly from drug manufacturers. It also reaches remuneration from group purchasing organizations, wholesalers, distributors, rebate aggregators and certain affiliated or subcontracted entities. 

That means a contract promising to pass through 100% of manufacturer rebates may not capture everything subject to the new requirement. PBMs will need to understand which payment streams fall within the law and where those amounts are received across their contracting relationships. 

When Must PBMs Remit Rebates and Other Payments? 

CAA 2026 sets deadlines for moving covered remuneration through the payment chain. PBMs generally must remit required amounts to the plan within 90 days after the end of each quarter, while rebate aggregators and applicable group purchasing organizations (GPOs) must remit specified rebates to the PBM within 45 days after quarter-end. 

For PBM teams, that amplifies the importance of being able to trace amounts from receipt through allocation and final remittance, including which plan and reporting period each payment belongs to. 

It’s important to note that not every payment a PBM receives must be passed through. The law allows PBMs to retain reasonable compensation for bona fide services when those fees are transparent and quantifiable to the plan or issuer. 

CAA 2026 Medicare Part D PBM Compensation Requirements 

Beginning with plan years on or after January 1, 2028, CAA 2026 places new limits on remuneration PBMs and their affiliates may retain in connection with covered Part D drugs. 

Bona fide service fees must reflect fair market value for itemized services actually performed and must be structured as flat dollar amounts. They cannot be based on factors such as drug price, rebate amounts, formulary placement or business volume. Manufacturer rebates, discounts and other price concessions can still flow through the PBM when they are fully passed through to the prescription drug plan (PDP) sponsor and otherwise comply with Part D requirements. 

That makes clear visibility into affiliate relationships increasingly important, including which affiliates perform PBM-related functions, how fees are calculated, who receives compensation and where rebate and other payment flows ultimately land. 

What PBMs Should Do Now to Prepare for CAA 2026 

With the major CAA 2026 rebate and compensation requirements taking effect in 2028, PBMs have a meaningful window to prepare. Rather than waiting for the applicable contracts and plan years to arrive, compliance teams can begin identifying where the new requirements intersect with existing agreements, payment processes and internal controls. 

• Monitor implementation guidance: While the core requirements are now law, agencies still need to clarify some of the implementation details. CMS, for example, is still developing guidance around Part D issues such as fair market value for bona fide service fees and the treatment of certain affiliate, intermediary and incentive-payment arrangements. DOL also has implementation work ahead for the commercial provisions. 

• Review contracts by market and effective date: Separate Medicare Part D and ERISA arrangements and identify the contracts, renewals and extensions that may become subject to the new requirements. Pay particular attention to how rebates, service fees, incentives and other forms of compensation are defined and structured. 

• Map and document payment flows:  Identify where rebates and other remuneration are received, which affiliates, rebate aggregators, GPOs or other intermediaries are involved, and how amounts are allocated and remitted to the appropriate client or plan. PBMs should also make sure those processes are supported by records that can withstand the new audit rights created under CAA 2026. 

• Invest in a centralized compliance platform or regulatory partner: Managing CAA 2026 alongside existing multistate requirements will require more than monitoring updates. PBMs need a system for tracking what changed, assigning ownership, organizing supporting documentation and maintaining a clear record of implementation as requirements evolve. 

• Track the Department of Labor’s (DOL) separate PBM fee-disclosure rulemaking: DOL is separately pursuing requirements around the compensation information PBMs provide to ERISA plan fiduciaries. Because that rulemaking is separate from CAA 2026, PBMs should monitor it as its own compliance track rather than treating it as part of the requirements enacted through the CAA. 

Prepare for CAA 2026 Before the 2028 Requirements Take Effect 

CAA 2026 gives PBMs something compliance teams don’t always get: time to prepare before major new requirements become operational. 

The most valuable use of that runway isn’t trying to predict every detail agencies will finalize. It’s using the time to identify where contracts, compensation structures, payment flows, affiliate relationships and supporting records may need attention. That foundation will make it much easier to respond as implementation guidance develops—and to avoid turning 2028 into a last-minute compliance exercise. 

Preparing for CAA 2026? ClearFile helps PBM compliance teams track evolving requirements, organize supporting documentation and build clear workflows before new obligations take effect. Talk with our team about how ClearFile can help strengthen your regulatory readiness.