The U.S. Department of Labor’s (DOL) Employee Benefits Security Administration (EBSA) has issued a final rule imposing new disclosure requirements on providers of pharmacy benefit management (PBM) services to large, self-insured group health plans subject to the Employee Retirement Income Security Act (ERISA). The rule is designed to give plan fiduciaries greater visibility into PBM compensation and financial arrangements so they can evaluate whether their PBM contracts and compensation are reasonable under ERISA § 408(b)(2). The rule applies to plan years beginning on or after July 1, 2027.

The rule follows amendments to ERISA enacted in the Consolidated Appropriations Act, 2026 (CAA 2026), which clarified that PBMs are covered service providers under ERISA § 408(b)(2)(B) and authorized the DOL to regulate the time, manner, and content of required disclosures.

Who Is Covered?

The final rule generally applies to self-insured ERISA group health plans offered by employers with at least 100 employees and certain other self-insured plans with at least 100 participants. Fully insured plans are excluded from the rule’s detailed requirements, although statutory disclosure obligations under ERISA § 408(b)(2)(B) may still apply.

The requirements apply to entities providing PBM services to a covered plan that reasonably expect to receive at least $1,000 in direct or indirect compensation. Significantly, coverage does not depend on whether an entity labels itself a PBM. Covered PBM services include negotiating rebates and other price concessions, establishing formularies and pharmacy networks, and performing utilization management, as well as certain related administrative functions. The covered service provider definition also can capture a third-party administrator (TPA) that contracts with a self-insured plan to provide PBM services, even if the TPA relies on a PBM or affiliate to perform those services.

What Must PBMs Disclose?

Before entering into, extending, or renewing an arrangement, covered service providers must give the responsible plan fiduciary detailed written information about the compensation they expect to receive. For extensions and renewals, disclosure 90 days in advance is deemed reasonable. The final rule is effective 60 days after publication in the Federal Register and applies to plan years beginning on or after July 1, 2027, but the DOL emphasized that the CAA 2026 amendments to ERISA § 408(b)(2)(B) became effective upon enactment on February 3, 2026. In response to comments seeking more time and temporary enforcement relief, the DOL adopted a temporary enforcement policy for the period from February 3, 2026, through the rule’s applicability date. During that period, the DOL will not treat covered service providers as having failed to make required disclosures if they act in accordance with a good-faith interpretation of amended ERISA § 408(b)(2)(B), and it will not treat responsible plan fiduciaries as having engaged in a prohibited transaction if they likewise act in good faith in determining the reasonableness of the contract or arrangement.

The required disclosures reach well beyond a PBM’s direct fees. They include direct compensation, manufacturer rebates and other remuneration, spread compensation, pharmacy recoupments, price-protection arrangements, formulary-placement incentives, and other compensation received in connection with the arrangement. PBMs also must provide information about drug-pricing methodologies and disclose whether the provider or certain related entities expect to provide services as an ERISA fiduciary.

The transparency requirements continue after the arrangement begins. Covered service providers generally must provide semiannual disclosures regarding compensation actually received or reasonably expected to be received, with quarterly disclosures available at a plan’s request. Providers also must explain when particular compensation materially exceeds an earlier estimate.

New Audit Rights for Plans

The final rule also gives covered plans significant audit rights. At a plan’s written request, a covered service provider must permit an audit at least once each year to verify the accuracy of its disclosures. The responsible plan fiduciary selects the auditor, and the PBM may not impose limitations on that selection.

Information available for audit can include records, claims and transaction-level data, and contracts with retail pharmacies, drug manufacturers, and rebate aggregators that are reasonably necessary to verify required disclosures. The rule permits reasonable confidentiality protections but restricts contractual provisions that would impede a plan’s audit rights.

These requirements are tied directly to ERISA’s prohibited-transaction framework. An arrangement between a covered plan and a PBM will not be considered reasonable for purposes of ERISA § 408(b)(2) unless the applicable disclosure requirements are satisfied. The rule does, however, provide relief for responsible plan fiduciaries in certain circumstances when a service provider fails to make required disclosures without the fiduciary’s knowledge.

Our Take

The final rule represents another significant development in the evolving regulation of PBMs, particularly their relationships with self-funded ERISA plans. As we previously discussed here, the Sixth Circuit in McKee Foods Corp. held that ERISA preempted Tennessee laws requiring any-willing-pharmacy access and restricting certain financial incentives used to steer members to preferred pharmacies, as applied to a self-funded ERISA plan. The DOL’s final rule approaches PBM oversight from a different direction, using ERISA’s prohibited-transaction framework to increase fiduciaries’ visibility into PBM compensation rather than regulating plan network or cost-sharing design. The final rule itself cites McKee Foods in its discussion of plan sponsors’ settlor and fiduciary functions.

For plan sponsors and other responsible fiduciaries, the rule will place greater emphasis on understanding how PBMs and related entities are compensated, not simply obtaining the required disclosures. Covered plans should consider whether existing PBM contracts, renewal procedures, data-access provisions, and audit rights will accommodate the new requirements. PBMs and other covered service providers, meanwhile, will need to prepare for substantially greater transparency into the compensation and financial arrangements underlying their services before the rule begins applying to plan years beginning on or after July 1, 2027.