MLR Rebate Fiduciary Liability: The December 30 Deadline

The Rebate Is in the Operating Account and the Clock Is Running

Insurers that missed the Affordable Care Act’s medical loss ratio standard for 2025 had until September 30, 2026 to issue rebates to the policyholders of fully insured group health plans (Rosanes 2026). For every employer whose employees paid any part of the premium, that check is not a windfall. A proportional share of it became an ERISA plan asset the moment it arrived, and the Department of Labor gives the sponsor roughly three months to put that share to work for participants before the trust requirement of ERISA §403(a) attaches (U.S. Department of Labor 2011). A rebate received on September 30 must be applied by December 30. One received in August is already late.

The benefits trade press treats this as a line on the fourth quarter compliance calendar. It is considerably more than that. Every decision the sponsor makes about the participant share is a fiduciary act, every wrong decision is a fiduciary breach, and the population of sponsors making those decisions badly, or not making them at all, is enormous and largely uninsured. The money sits in an operating account, the carrier has already told the employees that it exists, and the employer’s benefits broker is usually the only person in the room who has heard of Technical Release 2011-04.

I examine here the MLR rebate fiduciary liability through the two risk transfer instruments that respond to it. The first is the fiduciary liability policy, which is where the real exposure lives and where the market has not priced it. The second is the ERISA fidelity bond under §412, which the rebate drags into play for a class of fully insured plans that have long assumed they were exempt from bonding altogether.

How a Medical Loss Ratio Rebate Arises

Section 2718 of the Public Health Service Act, added by the Affordable Care Act, requires a health insurance issuer to spend a minimum share of premium on clinical services and quality improvement: 85 percent in the large group market and 80 percent in the small group and individual markets. An issuer that falls short must rebate the difference to its policyholders. Two features of the mechanism matter for the fiduciary analysis. First, the rebate is computed on the issuer’s aggregated experience in each state over a three year averaging period, not on any particular group’s claims (U.S. Department of Labor 2011). A sponsor with terrible claims experience can receive a rebate; a sponsor with excellent experience can receive nothing. Second, the rebate applies only to fully insured arrangements. Self funded and level funded plans are outside the medical loss ratio regime entirely (Rosanes 2026).

The dollars are not trivial. Preliminary issuer data compiled by Mark Farrah Associates and analyzed by KFF put 2026 rebates across commercial markets at roughly $759mn, down from $1.6bn in 2025 and $958mn in 2024 (Rosanes 2026). The decline reflects the averaging method rather than any improvement in the compliance picture, and it says nothing about the number of employers affected. Because rebates are calculated on the carrier’s book rather than the employer’s experience, they are spread thinly across tens of thousands of small and mid sized groups, each receiving an amount too small to justify careful legal analysis and too large to ignore.

The HHS regulations at 45 C.F.R. Part 158 direct the issuer to pay the rebate to the policyholder, which for the overwhelming majority of group plans is the employer. Those regulations say nothing about what the employer must do next under ERISA (U.S. Department of Labor 2011). That silence is filled by the Department of Labor’s Technical Release 2011-04, which remains the operative guidance fifteen years after its issuance.

Why the Participant Share Is a Plan Asset

ERISA does not define plan assets. Outside the regulations governing plan investments and participant contributions, the Department identifies plan assets by ordinary notions of property rights, and under those notions a rebate is a plan asset to the extent the plan has a beneficial interest in it (U.S. Department of Labor 2011). The fact that the employer is the policyholder does not, by itself, give the employer any claim to the money. The Department looks first to the plan documents and the policy; where those are silent or ambiguous, it looks to who paid the premium.

The resulting allocation rules are mechanical and leave little room for creativity. If the employer paid the entire premium, no part of the rebate is a plan asset and the employer keeps it. If participants paid the entire premium, the entire rebate is a plan asset. If employer and participants each paid a fixed percentage, the participants’ percentage of the rebate is a plan asset. If the employer paid a fixed dollar amount and participants paid the balance, the plan asset portion is the rebate up to the participants’ total contributions for the relevant period, and the converse rule applies where participants paid the fixed amount (U.S. Department of Labor 2011). The measurement period is the period the rebate relates to, which is the prior year’s premium, not the current plan year’s contribution structure. A sponsor that changed its cost sharing at the last renewal will miscalculate if it uses current figures.

Two further rules close the obvious escape routes. ERISA §403(c)(1) prohibits the employer from receiving any rebate amount greater than the premiums and plan expenses it actually paid; any excess must be held in trust for participants (U.S. Department of Labor 2011). And there is no de minimis exception. A $400 participant share carries exactly the same fiduciary obligations as a $40,000 share. The administrative cost of handling it may inform how the fiduciary applies it, as discussed below, but it never relieves the fiduciary of the duty to apply it.

The three month window is the hinge of the entire analysis. Plan assets must generally be held in trust under §403(a), but most fully insured plans have no trust because premiums are paid from the employer’s general assets, including payroll deductions, and benefits are paid by the carrier. The Department has long declined to enforce the trust requirement against cafeteria plans and certain contributory welfare plans under Technical Release 92-01. In TR 2011-04 the Department extended that relief, together with the Form 5500 exemptions at 29 C.F.R. §§2520.104-20 and 104-44, to rebates that are plan assets, but only if they are used within three months of receipt by the policyholder to pay premiums or refunds (U.S. Department of Labor 2011). A sponsor that holds the participant share past that window without a trust has a §403(a) violation, has lost its reporting exemption, and has a funded welfare plan it did not know it was operating.

Deciding What to Do With It Is a Fiduciary Act

The Department could not have been plainer: decisions on how to apply or expend the plan’s portion of a rebate are subject to ERISA’s general standards of fiduciary conduct (U.S. Department of Labor 2011). Anyone with authority or control over the participant share is a fiduciary under §3(21), bound by the prudence, loyalty and plan document duties of §404(a)(1) and the prohibited transaction rules of §406. This forecloses the settlor defense that sponsors reach for whenever a benefits decision goes badly. Choosing a carrier, setting the contribution split, or amending the plan are settlor functions. Disposing of money the plan already owns is administration of plan assets, and nothing about it is settlor in nature.

TR 2011-04 adds a duty the trade press rarely mentions: the duty of impartiality, drawn from Restatement (Second) of Trusts §183. An allocation method that benefits the fiduciary as a participant at the expense of other participants is a breach (U.S. Department of Labor 2011). The owner of a twenty person firm who sits on the richest tier of coverage and allocates the rebate by tier has a problem that no amount of good faith cures.

Within those constraints the fiduciary has real latitude. The participant share may be distributed in cash, applied toward future participant premiums, or used for benefit enhancements. The fiduciary may weigh the cost to the plan, the ultimate plan benefit, and the competing interests of participant classes, provided the method chosen is reasonable, fair and objective (U.S. Department of Labor 2011). If the cost of distributing shares to former participants approximates the amount involved, the fiduciary may allocate to current participants instead. If cash payments would be de minimis or would create tax consequences, the fiduciary may apply the rebate to a premium holiday or a benefit enhancement. The one hard limit is that a rebate generated under one policy may not be used to benefit the participants of another plan; the Department labels that a breach of the duty of loyalty (U.S. Department of Labor 2011).

What the Department did not say is as important as what it said. Nothing in TR 2011-04 permits the sponsor to do nothing. Nothing in it permits the sponsor to treat the participant share as an offset against its own future premium obligation. And nothing in it relieves the fiduciary of the obligation to be able to show, after the fact, that a decision was actually made and on what basis. MLR rebate fiduciary liability is, at bottom, procedural prudence liability. The sponsor who followed a reasoned process and documented it will prevail even if a court would have chosen differently; the sponsor who cannot produce a record will lose even if the outcome was defensible.

The Catalogue of Breaches

The failure modes are few, predictable, and in the author’s experience ubiquitous among smaller sponsors. Each is an independent basis for MLR rebate fiduciary liability.

• Retention. The sponsor deposits the full check and moves on. This is the most common breach and the most serious: it violates the exclusive benefit rule of §404(a)(1)(A), the anti inurement rule of §403(c)(1), and arguably the self dealing prohibition of §406(b)(1), since the sponsor as fiduciary has dealt with plan assets in its own interest.
• Miscalculation. The sponsor uses the current year’s contribution split rather than the rebate period’s, ignores a mid year change in cost sharing, or applies a single percentage across benefit options that carried different contribution structures.
• Partial allocation. The sponsor computes the participant share correctly and then nets it against its own next premium invoice, which is retention under a different name.
• Self favoring allocation. Decision makers allocate by coverage tier, by salary band, or by any method that happens to return the largest share to the people choosing the method, in violation of the duty of impartiality.
• Cross subsidization. A rebate generated under one policy or plan is used to reduce costs under another, which the Department expressly characterizes as a breach of loyalty (U.S. Department of Labor 2011).
• The blown window. The sponsor intends to apply the rebate at renewal, renewal is more than three months out, no trust is established, and the TR 92-01 relief and Form 5500 exemption silently expire.
• Former participants ignored. The sponsor allocates to current participants without ever considering whether distribution to former participants was cost effective, which is the only basis on which TR 2011-04 permits that choice.
• No record. The sponsor did everything right and wrote nothing down. In a Department investigation two years later, the absence of a contemporaneous plan asset calculation, allocation decision and proof of use is indistinguishable from a breach.

None of these requires bad faith. Most are the natural result of a check arriving at an accounts receivable clerk who has no idea what it is.

Enforcement, Remedies and the Manufactured Complainant

The remedial architecture is the ordinary one and it is unforgiving. Under ERISA §409(a) a breaching fiduciary is personally liable to make good any loss to the plan and to restore any profit made through use of plan assets. Section 502(a)(2) gives the Secretary, a participant, a beneficiary, or another fiduciary standing to sue for that relief, and §502(a)(3) supplies equitable remedies against the sponsor and any knowing participant in the breach. Where the Department recovers on behalf of the plan, by settlement or judgment, §502(l) imposes a civil penalty equal to 20 percent of the applicable recovery amount. On a $30,000 participant share, that is restitution of $30,000, a $6,000 penalty, and the cost of counsel to negotiate both.

The practical trigger is not litigation. It is an Employee Benefits Security Administration investigation of the health plan, opened for some other reason, in which the document request asks how the sponsor handled its MLR rebates. The investigator knows the sponsor received one because the carrier reported it. The sponsor who cannot produce the calculation and the allocation decision is, at that moment, in breach.

The other practical trigger is the employee. HHS regulations require the issuer to notify subscribers directly that a rebate has been generated (45 C.F.R. §158.251). The employee therefore learns that money exists before the employer has finished the plan asset analysis, and often before the employer has noticed the check. An employee who sees no premium holiday and receives no explanation calls the EBSA benefits advisor line, and the inquiry becomes an investigation. The carrier, in other words, manufactures the complainant. No other category of MLR rebate fiduciary liability comes with its own built in notice to the people most likely to assert it.

Where the Fiduciary Liability Policy Responds, and Where It May Not

Fiduciary liability insurance is the instrument built for exactly this loss. The Department itself distinguishes it from the §412 bond: the bond insures the plan against fraud or dishonesty by those who handle plan funds, while fiduciary liability insurance generally insures against losses caused by breaches of fiduciary responsibility (U.S. Department of Labor 2008). The retained rebate, the miscalculated share, the self favoring allocation and the undocumented decision are all wrongful acts within the insuring agreement of any standard form. The question is not whether the policy responds in principle but whether the particular policy, as written and as scheduled, responds to this plan and this loss.

Five provisions deserve attention from any broker placing or reviewing fiduciary liability coverage for a fully insured sponsor.

• The definition of covered plan. Many sponsors bought fiduciary liability coverage with the 401(k) in mind, and some forms schedule plans individually. The health plan must be within the definition, by name or by a blanket reference to all employee welfare benefit plans sponsored by the insured, or the rebate claim falls outside the policy entirely.
• The benefits due exclusion. Nearly every form excludes loss that constitutes benefits due, or that would have been due, under the terms of the plan. A carrier will argue that restitution of the participant share is a benefit. The better reading is that the participant share is a plan asset, not a benefit defined by the plan, and that a claim to recover it is a claim for breach rather than for benefits. The broker should confirm the carve back for amounts payable because of a breach, and at minimum the carve back for defense costs, before relying on that argument.
• Penalties. The §502(l) assessment is the most likely out of pocket cost after restitution. Most forms cover it, often within a sublimit shared with §502(c) penalties and voluntary compliance program expenses. A sublimit of $25,000 or $50,000 is adequate for the typical rebate; a form that excludes civil penalties altogether is not.
• The personal profit and deliberate acts exclusions. A sponsor that knowingly kept the participant share may face the argument that it obtained a profit to which it was not legally entitled. The form should apply those exclusions only on final adjudication, so that defense is funded until then.
• Recourse. Where the plan rather than the sponsor pays the premium, ERISA §410(b) requires that the policy permit recourse by the insurer against the fiduciary for breach, unless the fiduciary separately purchases a waiver (U.S. Department of Labor 2008). Sponsors routinely pay from corporate funds and the issue does not arise, but it must be checked.

The exposure is underpriced not because any individual claim is large but because the distribution is wrong for the way the product is sold. Fiduciary liability coverage is marketed to sponsors of retirement plans with meaningful assets, on the theory that severity drives the purchase. MLR rebate fiduciary liability has the opposite profile: low severity, very high frequency, and concentrated in precisely the small fully insured employers who have never bought a fiduciary liability policy and who assume, wrongly, that their employment practices or directors and officers coverage will respond. Both of those policies exclude ERISA claims as a matter of course. A $1mn fiduciary liability policy for a fifty life group costs less than the premium for a single month of health coverage and would absorb every one of the breaches catalogued above.

The ERISA Bond Adjacency: Fully Insured Does Not Mean Unfunded

Most sponsors of fully insured health plans believe they are exempt from the ERISA fidelity bond requirement of §412. The Department’s own guidance says otherwise. Field Assistance Bulletin 2008-04 states flatly that fully insured plans are not unfunded for bonding purposes, because a plan is unfunded only if all benefits are paid directly from the employer’s general assets (U.S. Department of Labor 2008). What spares most fully insured plans from bonding is not an exemption but the absence of handling: premiums paid directly from general assets to a carrier involve no plan funds that anyone could steal. The Department then identifies the exception in language that could have been written with the MLR rebate in mind. Insured arrangements are not normally subject to bonding except to the extent that monies returned by way of dividends, credits or otherwise, which by the terms of the plan belong to the plan, are subject to handling by a plan official (U.S. Department of Labor 2008).

A medical loss ratio rebate is money returned by the carrier that, to the extent of the participant share, belongs to the plan. The person who receives the check, deposits it, decides how it will be applied and directs the disbursement is handling plan funds under 29 C.F.R. §2580.412-6(b): physical contact with a negotiable instrument, disbursement authority, and decision making responsibility over activities that require bonding are each independently sufficient (U.S. Department of Labor 2008). Section 412(b) then makes it unlawful for any plan official to permit another to handle plan funds without first being bonded.

There is a partial safe harbor, and it is narrower than it looks. In FAB 2008-04 the Department announced, as an enforcement policy, that it will treat a welfare plan associated with a §125 cafeteria plan as unfunded for bonding purposes if it meets the conditions of Technical Release 92-01 (U.S. Department of Labor 2008). TR 2011-04 extends TR 92-01 to rebates used within three months of receipt (U.S. Department of Labor 2011). A cafeteria plan sponsor that applies the participant share to premiums within the window therefore has a defensible position that the enforcement policy continues to cover it. Three classes of sponsor fall outside that position entirely.

• Contributory plans not run through a §125 cafeteria plan. Where employees contribute on an after tax basis, the FAB 2008-04 enforcement policy never applied, and the rebate is handled plan money from the day it arrives.
• Any sponsor that misses the three month window. TR 92-01 relief is conditioned on use within three months. Once the window closes the plan is funded, the trust requirement applies, and so does the bond.
• Any plan whose documents make the plan or a trust the policyholder, where the entire rebate is a plan asset from the outset (U.S. Department of Labor 2011).

The underwriting consequences are modest. The bond amount is fixed at ten percent of funds handled, with a $1,000 floor, and is set annually at the start of the plan year on the highest amount handled in the preceding year (U.S. Department of Labor 2008). A rebate received mid year does not change the current bond amount; it feeds next year’s calculation. The loss scenario, a plan official converting the participant share, is wrongful conversion or willful misapplication within the scope of coverage the bond must provide (U.S. Department of Labor 2008), and recovery is bounded by the ten percent rule. The exposure is small and the premium is smaller. What the rebate changes is not the risk but the population: a large class of fully insured sponsors who have no ERISA bond at all, now holding plan money, with the Department’s own bulletin explaining why that is a problem.

What Sponsors and Their Advisors Must Do Before December 30

The compliance exercise is short. Its absence is what creates MLR rebate fiduciary liability, so the record of having done it is the deliverable.

• Date the receipt. The three month window runs from the day the policyholder received the rebate, not from the carrier’s deadline. Pull the deposit record.
• Read the plan document and the policy. If either allocates distributions, that language governs. Most are silent.
• Calculate the participant share using the contribution structure in force during the period the rebate relates to, policy by policy and benefit option by benefit option.
• Decide, and record why. Cash distribution, premium reduction or benefit enhancement, with a written statement of the allocation method, why it is reasonable, fair and objective, and, if former participants are excluded, why distribution to them was not cost effective.
• Apply the participant share within the window, or establish a trust. Instruct the carrier in writing if the choice is a premium credit.
• Retain the file. The plan asset calculation, the allocation decision and proof of use should be kept with the plan’s permanent records (Kirschbaum, quoted in Rosanes 2026).
• Review the fiduciary liability policy for the covered plan definition, the benefits due exclusion and penalty coverage, and bind coverage if there is none.
• Confirm the ERISA bond. If the plan is contributory and not run through a cafeteria plan, or if the window has already closed, the plan officials who handled the rebate must be bonded.

Conclusion

The medical loss ratio rebate is a small check that carries the full weight of Title I. The Department of Labor settled the plan asset question in 2011 and has not revisited it since, which means the law is stable, the obligations are clear, and ignorance is no longer a plausible defense. What has changed is the enforcement environment and the sophistication of the participants, who now receive notice of the rebate from the carrier before the employer has read the envelope. MLR rebate fiduciary liability is therefore not a theoretical exposure. It is a high frequency, low severity loss that lands squarely on sponsors who have never insured against it.

The two instruments that respond are complementary rather than alternative. Fiduciary liability coverage absorbs the breach: the restitution, the §502(l) penalty and the defense. The ERISA fidelity bond answers the narrower risk that a plan official converts the money outright, and for a meaningful class of fully insured sponsors the rebate is the event that first brings them within §412 at all. Surety One, Inc. underwrites both. ERISA fidelity bonds compliant with §412 and 29 C.F.R. Part 2580 are available at ERISA-Bonds.com, and fiduciary liability coverage for sponsors of health, welfare and retirement plans is available at FiduciaryLiabilityCoverage.com. The sponsor who received a rebate on September 30 has until December 30. The sponsor who received one in August should call today. Follow our blog on all things ERISA, fidelity bonding and ERISA-adjacent fiduciary liability insurance.

~ C. Constantin Poindexter, MA, JD, CPCU, AFSB, ASLI, ARe, AINS, AIS, CPLP

References

• Rosanes, Mark. 2026. “MLR Rebate Checks Are in Hand. The ERISA Clock Is Already Running.” Insurance Business, October 26, 2026. https://www.insurancebusinessmag.com/us/news/benefits/mlr-rebate-checks-are-in-hand–the-erisa-clock-is-already-running-594920.aspx
• U.S. Department of Labor, Employee Benefits Security Administration. 1992. Technical Release 92-01, May 28, 1992. https://www.dol.gov/agencies/ebsa/employers-and-advisers/guidance/technical-releases/92-01
• U.S. Department of Labor, Employee Benefits Security Administration. 2008. Field Assistance Bulletin No. 2008-04, Guidance Regarding ERISA Fidelity Bonding Requirements, November 25, 2008. https://www.dol.gov/agencies/ebsa/employers-and-advisers/guidance/field-assistance-bulletins/2008-04
• U.S. Department of Labor, Employee Benefits Security Administration. 2011. Technical Release 2011-04, Guidance on Rebates for Group Health Plans Paid Pursuant to the Medical Loss Ratio Requirements of the Public Health Service Act, December 2, 2011. https://www.dol.gov/agencies/ebsa/employers-and-advisers/guidance/technical-releases/11-04
• Employee Retirement Income Security Act of 1974, §§ 3(21), 403, 404, 406, 409, 410, 412 and 502, 29 U.S.C. §§ 1002, 1103, 1104, 1106, 1109, 1110, 1112 and 1132.
• Public Health Service Act § 2718, 42 U.S.C. § 300gg-18.
• 29 C.F.R. Part 2580 (fidelity bonding regulations); 29 C.F.R. §§ 2520.104-20 and 2520.104-44 (reporting exemptions).
• 45 C.F.R. Part 158 (medical loss ratio requirements), including § 158.251 (notice of rebates to subscribers).
• Restatement (Second) of Trusts § 183 (1959).