The ACA Broker Moratorium: What Agents Need to Know

CMS paused new agent and broker registration for the Federally-facilitated Exchanges on September 22, 2026, and at the same time made it easier to terminate the Exchange agreement of an agent who already has one — the ACA broker moratorium runs through February 1, 2027, applies only to the 30 states on HealthCare.gov, and takes effect about five weeks before OEP 2027 opens on November 1. If you’re a compliant ACA agent with a clean book, none of that is a hypothetical. It’s a live question of whether you can prove, in under five minutes, that every enrollment you wrote this year had real consumer consent behind it.

The pain: you did everything right and you still can’t prove it fast

Here’s the version of this that actually keeps an agent up at night. You ran a clean Scope of Appointment call, you read the attestations, the client said yes, you wrote a good enrollment. Eight months later a data-matching flag, a random audit sample, or a complaint against someone else at your agency puts your name in a CMS review queue. Someone asks you to produce the consent record for that specific enrollment, today. Can you find it in under five minutes? For most independent agents, the honest answer is no — the SOA is in one system, the recorded call is in another, the actual application is in HealthCare.gov’s own portal, and the client’s file in your CRM has a note that says “enrolled” and nothing else.

That gap didn’t matter much when CMS’s enforcement posture was slow and case-by-case. It matters now, because September 2026 brought two changes at once: a channel-wide registration freeze, and a lower legal bar for pulling an individual agent’s Exchange agreement. Neither one was written to catch a compliant agent. Both of them will, if that agent can’t produce the paper trail fast enough.

What CMS actually announced in September 2026

On September 22, 2026, CMS imposed a temporary moratorium pausing new agent and broker registration for the Federally-facilitated Exchanges, codified through an interim final rule published in the Federal Register the next day. The rule’s own text is specific about who it hits: CMS is “immediately imposing a temporary moratorium to pause the registration of agents and brokers that do not have Plan Year 2026 Exchange agreements with the Federally-facilitated Exchanges and are seeking to enter into agreements with CMS to assist consumers with enrollment through the Federally-facilitated Exchanges for Plan Year 2027” (Federal Register, Doc. 2026-19493, 91 FR 60317). If you already hold a PY2026 Exchange agreement and simply need to keep working under it, the moratorium doesn’t touch you directly — it blocks new registrations and re-registrations, not existing, active agreements.

The rule sits alongside a broader enforcement push CMS described the same week in a press release titled “CMS Cracks Down on Fraud, Waste, and Abuse in the Federal Health Insurance Marketplace.” The numbers in it are the reason this story is bigger than one procedural rule:

Add to that: CMS has issued termination notices for over 200 non-compliant agents and brokers since January 2026, per the same release. CMS Administrator Dr. Mehmet Oz put the agency’s framing plainly: “Every dollar lost to fraud is a dollar taken from hardworking taxpayers.” That’s the backdrop the moratorium landed in — not an isolated procedural tweak, but one piece of a channel-wide response to a fraud pattern CMS says it has already found and started pulling apart.

Why it happened: what GAO actually found

CMS didn’t build this enforcement posture in a vacuum. On July 13, 2026, GAO published GAO-26-108297, “Health Insurance Marketplaces: CMS Needs Stronger Controls to Prevent Unauthorized Actions by Agents and Brokers,” and the findings explain the timing. GAO reported that “the number of consumer complaints of unauthorized enrollments and plan switches grew more than fourfold from 2023 through 2025,” and separately, that “at least 160,000 federal Marketplace applications in plan year 2024 had likely unauthorized changes” (GAO, GAO-26-108297, July 13, 2026).

GAO’s recommended fix is worth naming because it previews where CMS may go next: stronger controls including “use of a one-time passcode and limits to the amount of consumer details agents and brokers who are not the agent of record can see,” noting that California, Georgia, and New Mexico already require one-time passcodes to verify consumer consent to agent or broker actions on their own state-based Exchanges (GAO, GAO-26-108297). If a passcode-based consent verification requirement eventually reaches the Federally-facilitated Exchange, the agents best positioned for it will be the ones who already have a habit of timestamped, retrievable consent records — which is exactly the manual system later in this article.

The moratorium’s exact scope: who it actually hits

This is the part most agents get wrong in a hurry, in both directions — some assume it applies to them when it doesn’t, and some assume they’re in the clear when they’re one lapsed registration away from being affected.

The Federally-facilitated Exchanges the rule covers are the 30 states that use HealthCare.gov for plan year 2026, per CMS’s own Marketplace 2026 Open Enrollment Period Report: National Snapshot. The remaining 21 jurisdictions run their own State-Based Exchange platforms, named in that same CMS report (California, Colorado, Connecticut, and others). If you’re licensed only in an SBE state, this specific rule does not reach your registration — full stop. It’s still worth reading the rest of this article, because the lowered evidentiary standard for Exchange agreement termination comes from a different rule and isn’t scoped the same narrow way.

”Preponderance of the evidence”: what the lower bar actually means

This is the change that matters most for an agent who’s already registered and doesn’t think the moratorium touches them. A separate rule, CMS-9884-F — a final rule titled “Marketplace Integrity and Affordability,” published in the Federal Register on June 25, 2025 — is described by CMS’s own summary as a rule that “establishes the evidentiary standard HHS uses to assess an agent’s, broker’s, or web-broker’s potential noncompliance” (Federal Register, Doc. 2025-11606, 90 FR 27074).

That rule revised 45 CFR 155.220(g)(2), the regulation governing termination for cause. The current text, verified live against eCFR this session, reads: “An agent, broker, or web-broker may be determined noncompliant under paragraph (g)(1) of this section if HHS finds by a preponderance of the evidence that the agent, broker, or web-broker violated” a standard under that section or a term of their Exchange agreement (eCFR, 45 CFR 155.220(g)(2), current as of September 23, 2026). A separate provision, 45 CFR 155.20, defines the standard itself: “Preponderance of the evidence means proof by evidence that, compared with evidence opposing it, leads to the conclusion that the fact at issue is more likely true than not” (eCFR, 45 CFR 155.20, current as of September 23, 2026).

Translate that out of regulatory language: HHS doesn’t need proof beyond a reasonable doubt, and it doesn’t need clear and convincing evidence. It needs evidence that tips the scale past 50 percent that you did the thing alleged. That’s a materially easier bar to clear than a stricter evidentiary standard would be, and it applies to every agent and broker holding an FFM Exchange agreement, not just the ones in a registration queue.

We don’t have a confirmed, citable source describing the exact word-for-word evidentiary language that applied before CMS-9884-F, so we’re not going to guess at it or imply a specific prior standard we can’t point to. What we can say, sourced directly: this rule is the one CMS itself describes as establishing the standard now in place, and the standard it established is preponderance of the evidence, defined exactly as quoted above.

What it costs: the mechanism, not a guess

We’re not going to hand you a made-up dollar figure for what losing an Exchange agreement costs an individual agent — nobody has published a sourced number for that, and inventing one would be exactly the kind of unverifiable claim this site doesn’t run. What’s sourced and worth sitting with instead is the mechanism.

An Exchange agreement isn’t one client’s file. It’s the credential that lets you touch Marketplace enrollment and service work for every ACA client you have, through the standard Classic Direct Enrollment or Enhanced Direct Enrollment pathways. If HHS terminates it — on a preponderance-of-the-evidence finding, mid-OEP, with the moratorium blocking a straightforward re-registration until February 1, 2027 — an agent whose book is majority ACA isn’t looking at one lost sale. They’re looking at every renewal, every plan change, every new enrollment on that book going through someone else, for as long as the termination and any related registration bar stays in place. That’s the real stakes of this story for a compliant agent: not a fine, not a warning letter, but the mechanism by which an entire line of business stops.

Set against that: CMS’s own figures on what it’s already done. Termination notices issued for over 200 non-compliant agents and brokers since January 2026. 569 notices of intent to terminate issued over the summer for applications missing required information like Social Security numbers. Those aren’t hypothetical enforcement actions — they already happened, this year, to real agents, on the same regulatory machinery now sitting at a lower evidentiary bar.

The manual fix: build a retrievable proof system this week

None of what follows requires software, a vendor, or a membership. It requires an afternoon and a willingness to change how you close out every enrollment from today forward, plus a pass through your recent book to backfill what you can.

The pre-OEP self-audit: do this before November 1

Pull your last 20 Marketplace enrollments. For each one, check: do you have a dated consent record on file? Do you have a note showing the attestations were explained and confirmed? Can you find the plan-selection rationale? Is there a copy the client could also produce if asked? If you hit a gap on any of the 20, that’s the exact gap to fix agency-wide before OEP 2027 opens on November 1 — not a reason to panic about the specific file, but a clear signal about where your process is thin.

What counts as “proof of consent,” specifically

CMS doesn’t prescribe a single required format. Per its own FAQ: “CMS regulations do not prescribe the manner in which agents, brokers, and web-brokers must document consumer consent,” and acceptable formats include “a recorded phone call, text message, email, electronic document with digital signature” (CMS, Frequently Asked Questions: Consumer Consent & Application Review Requirements, June 12, 2024). What matters is that the documentation actually demonstrates consent was given, for the specific action taken, by the specific consumer or their authorized representative.

One consent can cover more than one of these if it was written broadly enough and hasn’t been rescinded or expired — CMS allows an initial consent to authorize later status checks throughout the year without a fresh form each time, including agency-wide if the original documentation said so (CMS, Frequently Asked Questions: Consumer Consent & Application Review Requirements, June 12, 2024). But any time you take an action a prior consent doesn’t cover — updating a plan selection, for instance — a fresh, documented consent is required for that specific action.

A timeline: how we got from GAO’s report to the moratorium

Where Ambrose fits, and where it doesn’t

Nothing below makes you compliant. Building the actual documentation — the consent record, the plan-selection note, the client-accessible copy, all of it retained for the 10-year window CMS requires — is work you or your agency does; no platform automates that governance decision for you, Ambrose included. What Ambrose’s own documentation confirms, fetched fresh this session, is narrower and still genuinely useful for the exact retrievability problem this article is about.

The client-vault spoke is documented as a “client-facing enrollment + policy store,” with a HIPAA posture marked “safe” (Ambrose docs, Spokes). Instead of a consent recording in one system, a CRM note in another, and the actual application sitting in a third, an agency’s own tenant keeps each client’s enrollment record in one retrievable place.

The PHI Rail’s audit log gives that retrieval a paper trail of its own: every scrub event is logged — “timestamp, source, identifier counts — never the actual values” — and it’s queryable through phi_audit_query (Ambrose docs, Architecture: PHI Rail). That’s a real, timestamped record of what ran and when, without the actual identifiers sitting exposed in the log itself.

And Routines — a scheduled prompt attached to an agent or team, on cron syntax, with results sent to Slack, email, a GoHighLevel note, or a log (Ambrose docs, Routines) — is the feature an agency could use to build its own version of the self-audit above: a weekly sweep of the last week’s enrollments, checking for missing consent documentation or incomplete attestation notes, posted to the team’s Slack channel every Monday morning. That’s not a shipped “compliance audit” product; it’s a routine you configure yourself, using the Routines feature exactly as documented, aimed at exactly the gap this article describes.

Everything in the manual section above works whether you ever look at Ambrose or not — verify identity, capture the consent language, timestamp the plan rationale, document the attestation review, keep a client-accessible copy, file it so any one record is retrievable in five minutes. Ambrose’s seat is worth mentioning here specifically because the gap it closes — records scattered across three systems, no queryable log of what happened, no recurring check to catch the ones that slipped through — is exactly the kind of gap that turns “I did this correctly” into “I can’t prove it fast enough” when CMS asks.

This is the kind of thing we build on a Tuesday call with Ambrose open on the screen — setting up client-vault for a real book, watching a scrub event actually land in the PHI Rail’s audit log, and writing the Monday-morning Routine that flags incomplete files before OEP does. $97 a month, cancel anytime, and nobody’s going to pitch you a downline while you’re doing it.

What you get by joining

One Ambrose seat, including client-vault, comes with the $97/month Tech Savvy Insurance membership — billed monthly, cancel anytime, with the founding rate locked in while the membership stays continuously active. Ambrose usage runs on its own credit ledger, separate from the membership fee, so cost stays visible instead of becoming a surprise. Alongside the seat: weekly Zoom calls with open Q&A and build-with-you sessions, more than 30 hours of recorded training updated monthly, Meta Ads and AI marketing training built for health and life agents, pre-built AI templates and bot deployments, and a free annual in-person member workshop — in an explicit no-recruiting zone, so you can ask a real compliance question without getting DM’d about a downline an hour later.

Related reading: our guide on reshopping your ACA book before Open Enrollment, what to check before the ACA subsidy cliff hits a client’s household income, our breakdown of vetting insurance lead vendors if unauthorized enrollments in your funnel trace back to a lead source, and our look at insurance referral fee rules for the adjacent compliance landscape agents are navigating this year.

The close

CMS didn’t write the September 2026 moratorium or the preponderance-of-the-evidence standard to catch an agent who ran a clean SOA and wrote a clean enrollment. It wrote them in response to a real, sourced pattern: complaints up more than fourfold in two years, at least 160,000 likely-unauthorized applications in a single plan year, hundreds of thousands of people affected, billions in subsidies paid out on enrollments nobody actually authorized. The problem for a compliant agent is that the response is channel-wide and the evidentiary bar for an individual termination is now lower, which means the agents best protected aren’t necessarily the ones who did the most right — they’re the ones who can prove it fastest. Build that proof system before OEP 2027 opens on November 1, not after CMS asks for it.