Scope of Appointment & TPMO Compliance: The Agent's Operational Guide

Two mechanics account for a disproportionate share of Medicare secret-shopper complaints: the Scope of Appointment collected at the wrong time, and the TPMO disclaimer read at the wrong time (or not at all). Neither is about whether you sold a good plan. Both are about process. This guide zooms in on those two rules and the third-party obligations wrapped around them.

It is a marketing-operations summary, not legal advice. You are the licensed party; we run marketing. And the rules below move almost every plan year, so treat this as a map to verify against current CMS guidance, not a permanent answer. For the wider rulebook, start with our plain-English walkthrough of the CMS Medicare marketing rules for agents — this article is the deep dive on the two pieces that trip people up most.

Scope of Appointment: the timing is the whole game

The Scope of Appointment (SOA) documents which product categories a beneficiary agreed to discuss before you meet. The categories matter: agreeing to talk about Medicare Advantage is not agreement to talk about a standalone drug plan or a supplement.

The rule itself is short. 42 CFR §422.2264(c)(3)(i): “Prior to the personal marketing appointment, the MA plan (or agent or broker, as applicable) must agree upon and record the Scope of Appointment with the beneficiary(ies). The Scope of Appointment must be in writing for in-person personal marketing appointments.” The obligation lands on you personally as well — §422.2274(b)(3) requires agents and brokers to “secure and document a Scope of Appointment prior to a personal marketing appointment.”

About the “48-hour rule.” It is the most-repeated claim in this corner of the business, and it is not in the regulation text today. The current §422.2264(c)(3) requires the SOA prior to the appointment and says nothing about a 48-hour cooling-off window. Treat 48 hours as a defensible internal standard — many carriers and FMOs still enforce it — not as the federal floor. What the regulation does put a number on is validity: an SOA, business reply card, or request for additional information is “valid for 12 months following the date of beneficiary’s signature date” (§422.2264(c)(3)(iii)(A)).

The four SOA elements to get right every time

1. Product categories — capture exactly what the beneficiary agreed to discuss (MA-PD, PDP, Med Supp), and nothing you were not authorized to raise. Adding a category later needs a separate SOA (§422.2264(c)(3)(iii)(B)).
2. Timing — recorded before the appointment, with the date/time provable. Same-meeting signatures are the classic violation.
3. Beneficiary agreement — in writing for in-person appointments; agreed and recorded either way.
4. Retention — archived and retrievable. Marketing and sales calls carry a hard 6-year minimum (below); an SOA’s own 12-month validity window is a separate clock.

TPMO: are you the “third party”? Almost certainly

CMS regulates most Medicare marketing through the Third-Party Marketing Organization (TPMO) category. It is deliberately broad: if you market, sell, or enroll into Medicare Advantage or Part D and you are not the carrier, you are a TPMO. Solo agents, agencies, FMOs, and lead vendors all qualify. You cannot opt out by calling yourself “just an agent.”

TPMO status is what triggers the disclaimer and the recording obligation:

• Disclaimer — standardized content set out at 42 CFR §422.2267(e)(41): “We do not offer every plan available in your area. Currently we represent [insert number of organizations] organizations which offer [insert number of plans] products in your area. Please contact Medicare.gov or 1-800-MEDICARE to get information on all of your options.” The regulation says it must be “verbally conveyed during sales calls prior to the discussion of any benefits” — a stricter trigger than the “first minute of the call” shorthand agents still repeat — plus conveyed electronically in email or chat, “prominently displayed on TPMO websites,” and included in any marketing materials.
• Recording — §422.2274(g)(2)(ii): “All marketing and sales calls, including the audio portion of calls conducted via web-based technology, must be recorded and retained in their entirety for a minimum period of 6 years,” audio-only for the first 3 years and audio or complete transcripts for years 4 through 6. The frequent error is recording only the application, not the marketing conversation where you describe plans and steer the decision.

SOA vs TPMO disclaimer: two rules, two failure modes

The third-party layer: carrier oversight of your vendors

TPMO rules do not stop at your own conduct. Carriers are required to oversee the TPMOs in their distribution chain, which means the lead vendors and downlines you work with pull you into their compliance posture too. If you buy leads, the consent trail behind those leads is part of your exposure. This overlaps with federal telemarketing law — the TCPA still governs how you dial and text regardless of CMS — which we cover in TCPA compliance when buying insurance leads.

Practical implications:

• Document where every Medicare lead came from and what the beneficiary consented to.
• Keep the disclaimer and SOA logic baked into scripts, not bolted on.
• Re-approve vendor consent language annually; carriers increasingly ask for it.

Building SOA and TPMO into the funnel, not around it

Agents who treat these as friction cut corners and end up in complaint reports. Agents who build them into the process get something valuable back: a clean paper trail that protects commissions, plus a full-call library that makes coaching real. When we build compliant Medicare marketing systems, disclaimer placement above the fold and explicit consent capture are checklist items, not afterthoughts. The same lens decides which channels are worth running at all, which is how we sort how Medicare agents get clients compliantly before any budget is committed.

A few ways the rules shape good marketing:

• Landing pages carry the TPMO disclaimer prominently and capture permission explicitly.
• Scripts open with the disclaimer and route the SOA before any product discussion.
• CRM stores the signed SOA next to the call recording, so an audit is a five-minute retrieval, not a scramble.

If you are unsure whether your current Medicare funnel would survive a carrier audit, that is exactly what a free marketing audit is for. For seasonal context, pair this with our Medicare AEP marketing playbook and the Medicare OEP marketing rules for agents.

The one-line summary

Agree and record the SOA before you meet — in writing if it is in person — state the TPMO disclaimer before you discuss any benefits, record the whole call, and keep marketing and sales call audio for at least six years. Then re-verify all of it against the current regulation text every plan year, because these rules move and your license is the one on the line.

This article is marketing guidance, not legal or compliance advice. CMS rules, SOA timing, and TPMO obligations are updated frequently; confirm specifics with official CMS sources, your carrier, and your upline before acting.