As regulatory scrutiny intensifies across healthcare, pharmacy benefit managers (PBMs) are facing a new wave of licensure requirements. From rising fees to more frequent reporting, staying compliant is no longer a back-office task—it’s a strategic imperative.

In this episode of Regulatory Joe, we’re breaking down what PBMs need to know to stay licensed, operational and competitive across the country.

What is PBM Licensure and Registration?

Every PBM operating in a state needs to be formally registered. This starts with a Secretary of State (SOS) application, a basic administrative filing that verifies your organization’s formation, location and business intent.

Licensure is what allows your PBM to legally operate in that state, and unlike the relatively uniform SOS registration, licensure is entirely state-specific with different systems, forms, deadlines, templates and expectations across the board.

Why PBM Licensure Is Gaining Attention

Over the past two years, regulators in more than half of all U.S. states have strengthened oversight of PBMs. What used to be a simple registration has evolved into a multi-step licensure process that includes:

• State-specific applications and biographical affidavits
• Ongoing financial reporting
• Increased scrutiny of claims, rebates and adjudication practices

States like Florida and New York are charging upwards of $10,000 in licensure fees before a PBM serves even a single member. And for smaller or startup PBMs, the costs of participating in multiple markets are becoming harder to justify.

Licensure Decisions Are Business Strategy Decisions

Because licensure varies so widely by state, PBMs need a strategy for where and how they choose to operate across the country.

Some PBMs prioritize licensure based on member volume. Others focus on markets with lower barriers to entry. But no matter what, one thing is clear: you can’t expand without knowing what you’re walking into.

Even PBMs that are fully licensed in their home state may need to file in neighboring states where their clients (for example, a national employer group) are filling prescriptions.

Regulatory Joe Recommendations

Based on what we’re seeing in the market, here’s what PBMs should do now:

• Get proactive, not reactive. Licensure is no longer a formality—it’s a living, ongoing obligation.
• Assign clear ownership. Whether you staff by state or function, someone needs to be accountable from start to finish.
• Build relationships with regulators. Introduce yourself early and know who is reviewing your applications. Building trust with your regulators can save you time, money and costly fines.
• Evaluate the true cost of doing business. Application fees, audits, staffing, reporting—it all adds up. Know what it takes to maintain licensure before entering a state.
• Codify your process. Don’t rely on ad hoc templates and scattered communications. Bring structure to your filings and make the process repeatable.

The Bottom Line for PBM Licensure Success

Licensure has become one of the most significant regulatory hurdles PBMs face today. And with each state setting its own pace and priorities, the burden is only increasing.

A reactive approach is no longer sustainable. PBMs that take the time to understand state-by-state requirements, invest in regulatory ownership, and build relationships with reviewers will be the ones positioned to grow—and to stay compliant at scale.

---

---

Episode Transcript

Hey everybody. Welcome to Regulatory Joe. I’m Joe Boyle, president of ClearFile and on today’s episode we’ll be talking about PBM Licensure 101.

 I know what you’re thinking. This may be a little bit different. We’ll still be reporting on health plans but we’ll be branching out to net new lines of business, including PBM licensure, TPA licensure, even non-healthcare lines of business, and don’t worry. Health plan content’s not going far. It’ll still be our primary focus on what we report on, on the podcast.

So what are we talking about today? Every pharmacy benefit manager knows well and clear that divisions of insurance are strengthening regulatory oversight for the past 24 months. Here’s what you need to know.

So starting at the beginning, every PBM needs to be registered within a state that they operate in. Registration is the first driver to become fully licensed within any division of insurance. Registration, simply put, is making sure that the company is domiciled and formed and approved by the Secretary of State, also abbreviated as an SOS application. And it may seem like a pretty simple step or an administrative filing to actually just get your SOS application approved. But really, once that application goes into your division of insurance, the clock starts ticking.

Generally speaking, an SOS application has a series of company documents, including formatted business plans, some light financial statements, history about the company, when and where it was domiciled, where your headquartered location is, and usually a small fee anywhere between $50, $100. I think the most expensive one we’ve seen is up to $500 for the application itself.

From a turnaround time perspective, once you gather and collect all of your documents and organize them and version them, making sure they’re up to date for regulator review, generally takes about five to seven business days for your SOS application to actually be approved and certified by the state.

Now recognizing each state and division of insurance operates slightly differently, we can quantify this to an average turnaround time. We generally see PBMs are planning their strategic roadmap to become compliant in different ways. Some PBMs are prioritizing their SOS registration based on the number of lives that they cover within that state, or maybe based on the cost of how much it costs to participate within that state or even become registered. And once A PBM has finalized their strategy for growth and compliance within the space, we can move on to full-blown licensure.

 It’s very important to know that licensure is not governed on a federal level where it’s consistent across all states and domestic territories within our country. It’s actually governed on a state and local government level.

So while those requirements may feel kind of similar across each state, you need to be very careful because each state has their own set of templates, state specific requirements, additional forms, exhibits, appendices, and more.

Understanding the full licensure process really starts with understanding your footprint in your state today, how many lives you cover, how much revenue you’re generating, and how many claims that you’re producing on an annual basis within that state.

Now it becomes very complicated because we have worked with PBMs and organizations that may be domiciled in a state, and you could be registered in that same domiciled state, fully licensed within that state. But if you cover a group, let’s just say a trucking company that’s filling prescription drugs across state lines in bordering states, you also need to make sure that your PBM is not just registered in those neighboring states, but also fully licensed in those neighboring states as well.

And with the complexities of full-blown state licensure, you may ask the question, well, how did we get from just registering a PBM as a headquartered organization to full-blown, strengthened licensure requirements? Well, if we walk it back on a timeline for the last 24 months, we’ve seen that there’s been much more eyes from state regulators on PBM organizations as a whole.

In fact, over half the states in our country are now governing PBMs by licensure requirements through applications, biographical affidavits, templates, even reporting that are not just on an annual basis, quarterly basis, but even on a monthly basis to ensure compliant PBM operations, compliant claim adjudication and filling of prescription drugs for members that need it the most.

While some states have had licensure requirements for the past number of years, other states, such as Massachusetts, are just rolling out requirements, effective 1/1/2026.

In looking to how regulators are establishing these requirements, they’re speaking with other states. This was a huge topic at the Spring National NAIC conference, where multiple dedicated sessions across all states where regulators were collaborating had discussed: what’s working for PBM licensure requirements? Where is there opportunity for improvement? Where are regulators, in some cases, overregulating with requirements that could be looked at as disproportionate for PBMs.

Again, let’s walk it back. You have a handful of large PBMs that have governed our country’s operations for many, many years, and you have a number of small PBMs, even startup PBMs that have a percentage of lives that may not be able to afford to conduct business, even with ethical strategies within that state.

So not just application fees. We’re seeing that just to submit a licensure application, including biographical affidavits, fingerprints, even financial statements, audited or not audited, application fees, could run a PBM anywhere from $500, $1,000, or we’re seeing states like Florida up to $10,000 or New York for $10,000 to operate for three years within that state before they even sold a life.

So taking on that expense as an organization, small or large, can carry a very different burden in actual operating and conducting business.

 We are seeing that smaller PBMs are struggling to actually participate within states up against large PBMs, simply because the disproportionate regulations that are being put in force. And I think it’s important to understand that licensure applications and submitting for certification is one thing, but that’s just getting your PBM started. So if you’re operating and conducting business within the state, what happens quickly after certification is reporting. And it’s important to know that there’s different levels of reporting, not just what we talked about, of annual, quarterly, monthly, or even weekly, but harnessing the difference between reporting tied to licensure specifically, and reporting for different functions of a pharmacy benefit manager.

And what we recommend is right out of the gate, is to understand the resourcing your analysts within your company to harness the data within your warehouse. We know each PBM houses their data in many different ways. Some have their own custom database, some rented database, but really understanding reporting.

Getting your SQL servers with the, the right level of code to understand what’s required for licensure reporting and then what’s required for other functions of your business. Far, too often, they are crossing lines and it actually causes confusion, impacting the quality of submission.

And it’s important to know that all regulators are different. And so what I mean by that is even if there’s a review process in place, a big part of licensure application is interpretation. So when you’re running your reports, we encourage you to also build a relationship with your regulator.

That’s half the battle. Understanding who’s reviewing your application, making sure they know who you are, making sure they know they can trust their submitter and that they’re transparent within their application.

 Building that trust up front within your state, year one, especially if you’ve been operating and doing business within the state and covering lives, will be critically important.

This will help you avoid fines, avoid fees, and streamline the operations of actually getting your registration on time, getting your licensure application approved, and actually executing your reporting.

But you need to be prepared. You cannot actually get licensed in a state if you don’t have a plan strategy to build your business or just to simply get licensed. You need to have a plan, a business plan of action, and you need to be prepared to actually present that to the state. We’ve seen it far too often that during the application process, you can follow each questionnaire down to subsection sub letter A, B, subsection C, but they’ll still have questions about your business to actually get to know you. Why are you operating as a PBM in our state? Are you looking to cover fully insured lives or self-funded ERISA lives? Why? Be prepared to answer these questions and assemble your team. We understand PBMs can run lean with senior officers or the executive team, with very lean operations.

So we recommend having a dedicated resource on your legal team to be prepared to answer legal questions. Have a senior officer able to attest to your fiduciary responsibilities, like your CFO or your CEO, to make sure that you’ve been sound financially for the past x amount of years. Generally speaking, PBMs will ask you to have prepared anywhere from three to five years of financial statements upfront.

Have those prepared, and if you don’t, there’s a likely chance that you will be audited, and that is incredibly expensive, to the tune of what we’ve seen working with even one PBM paying $12,000 to actually conduct an audit, just to get audited financials, not even to complete the application. It’s the cost of doing business.

Even in the state of Florida, comparably speaking, we’ve worked with a PBM that ingested a $60,000 fee simply to have audited financials because they’ve been in business for so long and they were such a large company that that’s what it took. So contracting a CPA, you should get one quickly. Codify your business operations, build your team, assemble your team, ensure your fiduciary responsibility, review historic data in your company and have a plan.

It will be important in understanding how your organization is set up. And what I mean by that is far too often, we see PBMs that are what we are referring to as child organizations within parent organizations, PBMs who are oversaw by a grocery store, a joint venture partner, a hospital health system or other, even a health plan for that matter.

You have to make a decision if it’s the child organization or the parent organization that ultimately is responsible, who’s operating independently from who. How we break that down and how we look at the responsibility and ownership and accountability is by tax ID number or FEIN number.

So really where you’re getting licensed, the organization that’s conducting the operation, really making sure that that FEIN number is taking fiduciary accountability for the operations within the state or exclusively articulating in your application that your parent company will oversee and take responsibility for all of your PBM operations.

So all that said, let’s ask the question, where are states going? With regulations, we do see states strengthening requirements month over month for the foreseeable future. We recommend following operations and conversations through the National Association of Insurance Commissioners, NAIC, and work with your regulators, attend the meetings. Make the effort to show up and to shake hands. Have the conversations, build your relationships.

Being at the forefront of watching your regulators formate policies will allow you the opportunity to ask questions, share your opinion, and share your outlook as a PBM and the operations you’re conducting in your state to share your voice.

And it’s very important. Every PBM has a voice and regulators do listen. You just have to make the time and the effort to show up. Very specifically speaking, we do anticipate and we do expect many states, inconsistently across the board will increase reporting requirements.

So be prepared to report more on your rebates, be prepared to report more on your claims. This is all in support of transparency and coverage, or TIC, all governed, even as far up as the CAA or the Consolidated Appropriations Act. So that’s not going away by any stretch of the imagination.

We would also encourage PBMs to be prepared for more financial reporting. So I know we’ve already talked about financial statements, audited or not, but being prepared to produce different things in your general ledger, different formats of financial statements, different time periods of financial statements.

And lastly, PBMs really need to be prepared for increased fines, increased dollar amounts, and increased penalties across the board. PBMs should really take a step back and take a moment to understand the cost of doing business within their states. Evaluate the number of lives and the number of membership that you have in the state versus how much it will cost to complete your registration application, your licensure application, or even the cost of building, reporting, or a process in place to sustain business in that state.

We’re seeing more often than not in smaller PBMs case, this is driving PBMs to actually exit or withdraw from the market.

So one more thing PBM should be prepared of is we’ve been so used to being in the virtual world over the past 24 months when PBMs have been developing these requirements. Be prepared to show up in person. It’s not uncommon for a regulator, even for a specific reason of getting a fine to simply ask a PBM or a representative of that organization to show up in person, to have a conversation. As they go through the licensure application, getting to know you and learning more about your business and your PBM is going to be important for that regulator and that reviewer to know.

Licensure is a living obligation, and just because you get your registration complete with your SOS application, just because your licensure is approved and you started your reporting, if you don’t dedicate the time, materials, and resources to a codified process, year over year, regulators will know and they will ask questions.

And regardless if you’re a startup PBM operating in one state, growing one state at a time into 2, 3, 4, 5, or you’re a regional PBM entering four states at a time, regardless of your structure or your org design, you really need to sit down and think about how am I going to assign my work by state, or how am I going to assign my work by function?

It is very important to understand how you’re going to staff the work because we’re big believers in accountability, and we’ve seen PBMs be successful by having an accountable owner work a state application from end-to-end. They own that state, they own those templates. They own those applications and materials all the way through the review period, through approval and reporting. We’ve also seen some PBMs be very successful by having dedicated resources by function for many states, not one-to-one, but one to many, where they’ll complete biographical affidavits for all the states within the scope of their engagement.

And there’s another dedicated resource that will complete all financial statements for all the states within the scope and that engagement. Both models work perfectly fine. It’s just truly based on how you’re staffing your organization, how you’re going to invest in the organizational design of your PBM, and how you’re going to approach and look at that work.

On a go forward basis, we encourage all PBMs to be proactive and to, quite frankly, self-regulate. And what we mean by that is not just simply sitting and waiting around for a regulator or a state to find PBM activity and broach the subject themselves, but really taking the accountability within their own organization to say, “Hey, we’re going to get ahead of any regulation.

We’re going to get ahead of any application and prioritize this to be a good steward and a good fiduciary within the industry.” Leading the change will be very important, too. Even getting public presence, attending conferences with regulators, showing up, spending the time and investing the time with our legal partners to making sure that we’re on the path for compliant PBM activity within all states across the country.

Shameless self-promotion: ClearFile makes this process easy for PBMs, really bringing all matrixed PBM requirements, thousands of documents, templates, applications, and instructions into one organized place where we can assign accountable owners across any type of organization, keeping it as closely managed or as broadly managed as that organization operates. All the way from pre-licensure certification, all the way to disposition, approvals and reporting.

Thanks again for tuning in. Don’t forget to give us a like, give us a share and we’ll see you all next time.