CMS vs FCC rules: compliance differences for agents

Look, if you sell Medicare and think one set of rules covers you, I've got bad news. Two federal frameworks touch almost every call an agent makes, and they don't overlap the way most people assume. CMS handles what you can say and how you document a Medicare sale. FCC handles how you're allowed to make contact in the first place. Mix them up and you're one audit, or one lawsuit, away from a bad year.

I've spent enough time around call data and compliance teams to know this isn't theoretical. Agencies get burned every year treating CMS and FCC compliance like one checklist instead of two separate systems running in parallel.

What is CMS and what does it actually regulate?

CMS, the Centers for Medicare & Medicaid Services, governs how Medicare Advantage and Part D plans get marketed and sold. It sets rules through the Medicare Communications and Marketing Guidelines, updated most years each spring. Real teeth got added for the 2024 and 2025 plan years.

CMS cares about the sales process itself: scripts, disclosures, call recording, documentation. Selling a Medicare Advantage plan means you need a Scope of Appointment on file before discussing specific plan benefits, generally at least 48 hours ahead of the appointment unless the beneficiary qualifies for one of the narrow walk-in or short-notice exceptions. CMS also requires you to record the entire sales call, not just parts of it. That applies to in-person appointments too, which need their own documentation trail even without an audio recording.

The 2024 and 2025 updates tightened things further, cracking down on misleading use of Medicare branding in ads and demanding clearer disclaimers on TV, direct mail, and third-party lead generation sites. CMS doesn't mess around with plan sponsors either. A sponsor that lets marketing violations slide can face sanctions directly, and that pressure rolls downhill to the agents and agencies writing business under that carrier.

Takeaway: CMS owns the content and documentation of the Medicare sale, not the method of first contact.

What is FCC and what does it actually regulate?

The FCC enforces the Telephone Consumer Protection Act, or TCPA, and it covers a lot more ground than Medicare. Auto, final expense, life, ACA health plans sold outside Medicare, all of it falls under TCPA rules the second a call or text gets involved.

The TCPA is about consent. Period. It doesn't care what you say once you're on the phone. It cares whether you had the right to call that number in the first place. The FCC's one-to-one consent rule, which has bounced through legal challenges over the past couple of years, generally requires prior express written consent naming each specific seller before you send an auto-dialed text or run a predictive dialer. A lead form that says "you may be contacted by our partners" doesn't cut it anymore in most interpretations. The consent has to name you, or your agency, specifically.

This is where a lot of agents get tripped up. TCPA violations aren't handled by carrier sanctions or corrective action plans. They're statutory, meaning a plaintiff doesn't have to prove damages to collect. Courts have awarded $500 to $1,500 per call or text, and class actions stack that into real money fast. I've seen agencies get six-figure demand letters over a lead list that never should've touched a dialer.

Takeaway: FCC owns consent and contact method, across every insurance product you sell, not just Medicare.

The overlap agents keep missing

Here's what agents get wrong more than anything: having a Medicare lead doesn't mean TCPA rules disappear. CMS compliance and FCC compliance run at the same time, on the same call, and neither replaces the other.

Say you get an inbound call from a Medicare lead generated through a paid search campaign. CMS still requires an SOA before talking specific plan benefits, still requires the call gets recorded, still requires you follow the current MCMG script and disclosure rules. Most agents get that part by now.

What's less obvious: if your agency placed an outbound call to that same person first, maybe a follow-up dial after they filled out a form, you needed TCPA-compliant consent for that outbound contact, separate from anything CMS requires. The Do Not Call registry, state-level mini-TCPA laws, and the federal one-to-one consent rule still apply. CMS doesn't grant an exemption from any of it just because the product is Medicare.

I sit in the middle of agents, agencies, and marketers all day through my work at Ringba, and this exact confusion shows up constantly in call flow audits. Agencies build a Medicare-focused compliance checklist, feel good about their SOA process and call recording setup, and never ask whether the lead source itself had proper consent for the dial. Both boxes have to get checked. Honestly, the agencies that get sued usually don't have bad Medicare scripts. They have bad lead consent going into the dialer.

Why the stakes are different

CMS violations and FCC violations don't hurt the same way. That matters for how you prioritize compliance spend.

Get sloppy with CMS rules and you're looking at plan sponsor sanctions, possible termination from your carrier contracts, or a corrective action plan that eats your time and slows commissions. Painful. But usually contained to your Medicare book of business and your relationship with that carrier.

Get sloppy with FCC and TCPA rules and you're looking at statutory damages of $500 to $1,500 per call or text, no cap on how many calls get bundled into a claim, and exposure across every product line you sell, not just Medicare. A final expense campaign with bad consent records can generate the same legal exposure as a Medicare campaign with bad consent records. The TCPA doesn't care what you were selling.

Generating your own inbound calls instead of buying leads from a third party gives you a lot more control here. You know exactly what consent language sat in front of the consumer before they called or texted, and you're not inheriting someone else's compliance risk. That's a big part of why I wrote The Pay Per Call Revolution, walking agents and agencies through building inbound call generation that doesn't leave you exposed to somebody else's sloppy lead form. There's a companion workbook too, walking through the setup step by step if you'd rather build this out yourself than rely on outside vendors.

FAQ

Does an SOA satisfy TCPA consent requirements? No. A Scope of Appointment is a CMS document about discussing Medicare plan benefits. It says nothing about your right to call or text that person under the TCPA. You need separate, documented consent for the contact method itself.

If I buy Medicare leads from a vendor, am I covered on TCPA? Not automatically. Verify the vendor's consent language names your agency specifically, matches the one-to-one consent standard, and gets stored with a timestamp. Ask for proof, not a promise.

Do CMS call recording rules apply to final expense or ACA sales? No. CMS's recording requirement is specific to Medicare Advantage and Part D. Final expense, life, and off-exchange ACA sales have no equivalent federal recording mandate, though some states or carriers may still require it.

Can I get sued under TCPA even if I followed every CMS rule perfectly? Yes. CMS compliance and TCPA compliance are independent. A perfectly documented, perfectly scripted, properly recorded Medicare sale can still generate a TCPA claim if the original contact lacked proper consent.