Compliance & trust

Scope of Appointment & TPMO Compliance: The Agent's Operational Guide

By The Ledgerline TeamPublished July 4, 2026

Scope of Appointment and TPMO compliance are the two Medicare rules agents violate most. Capture a documented SOA before any sales meeting, generally 48 hours ahead, read the TPMO disclaimer within the first minute, record calls in full, and retain both records for the CMS-required period.

Two mechanics account for a disproportionate share of Medicare secret-shopper complaints: the Scope of Appointment collected at the wrong time, and the TPMO disclaimer read at the wrong time (or not at all). Neither is about whether you sold a good plan. Both are about process. This guide zooms in on those two rules and the third-party obligations wrapped around them.

It is a marketing-operations summary, not legal advice. You are the licensed party; we run marketing. And the rules below move almost every plan year, so treat this as a map to verify against current CMS guidance, not a permanent answer. For the wider rulebook, start with our plain-English walkthrough of the CMS Medicare marketing rules for agents — this article is the deep dive on the two pieces that trip people up most.

Scope of Appointment: the timing is the whole game

The Scope of Appointment (SOA), collected on form CMS-10260 or an approved equivalent, documents which product categories a beneficiary agreed to discuss before you meet. The categories matter: agreeing to talk about Medicare Advantage is not agreement to talk about a standalone drug plan or a supplement.

Where agents get burned is timing. CMS reinstated a rule requiring the SOA to be obtained at least 48 hours before an individual marketing or sales appointment, with limited exceptions such as walk-ins or the end of a valid election period. The classic violation is signing the SOA at the start of the same appointment to satisfy the paperwork — which defeats the entire purpose of a cooling-off window.

The four SOA elements to get right every time

Product categories — capture exactly what the beneficiary agreed to discuss (MA-PD, PDP, Med Supp), and nothing you were not authorized to raise.
Timing — obtained 48 hours ahead where required, with the date/time provable.
Beneficiary agreement — written, electronic, or recorded verbal, with clear consent.
Retention — archived and retrievable for the CMS-required period (generally cited as 10 years).

TPMO: are you the “third party”? Almost certainly

CMS regulates most Medicare marketing through the Third-Party Marketing Organization (TPMO) category. It is deliberately broad: if you market, sell, or enroll into Medicare Advantage or Part D and you are not the carrier, you are a TPMO. Solo agents, agencies, FMOs, and lead vendors all qualify. You cannot opt out by calling yourself “just an agent.”

TPMO status is what triggers the disclaimer and the recording obligation:

Disclaimer — the standardized language stating you do not offer every plan in the area, and how many organizations or plans you represent. Read it verbally within the first minute of a call, and display it prominently on any Medicare marketing website and materials. The exact wording has been revised between plan years, so confirm it against current CMS guidance rather than reusing last year’s script.
Recording — calls related to the sale, marketing, or enrollment of MA and Part D plans must be recorded in their entirety and retained. The frequent error is recording only the application, not the marketing conversation where you describe plans and steer the decision.

SOA vs TPMO disclaimer: two rules, two failure modes

Requirement	What it documents	Timing	Most common violation
Scope of Appointment	Product types the beneficiary agreed to discuss	Generally 48 hours before the appointment	Signed at the start of the same meeting
TPMO disclaimer	That you represent a limited set of plans	Verbally within the first minute of a call; displayed on web/materials	Read late, or omitted on the website
Call recording	Full marketing + enrollment conversation	Recorded live, retained for the required period	Only the application is recorded
Retention	SOA + call audio archive	Generally 10 years	Records not retrievable on carrier audit

The third-party layer: carrier oversight of your vendors

TPMO rules do not stop at your own conduct. Carriers are required to oversee the TPMOs in their distribution chain, which means the lead vendors and downlines you work with pull you into their compliance posture too. If you buy leads, the consent trail behind those leads is part of your exposure. This overlaps with federal telemarketing law — the TCPA still governs how you dial and text regardless of CMS — which we cover in TCPA compliance when buying insurance leads.

Practical implications:

Document where every Medicare lead came from and what the beneficiary consented to.
Keep the disclaimer and SOA logic baked into scripts, not bolted on.
Re-approve vendor consent language annually; carriers increasingly ask for it.

Building SOA and TPMO into the funnel, not around it

Agents who treat these as friction cut corners and end up in complaint reports. Agents who build them into the process get something valuable back: a clean paper trail that protects commissions, plus a full-call library that makes coaching real. When we build compliant Medicare marketing systems, disclaimer placement above the fold and explicit consent capture are checklist items, not afterthoughts.

A few ways the rules shape good marketing:

Landing pages carry the TPMO disclaimer prominently and capture permission explicitly.
Scripts open with the disclaimer and route the SOA before any product discussion.
CRM stores the signed SOA next to the call recording, so an audit is a five-minute retrieval, not a scramble.

If you are unsure whether your current Medicare funnel would survive a carrier audit, that is exactly what a free marketing audit is for. For seasonal context, pair this with our Medicare AEP marketing playbook and the Medicare OEP marketing rules for agents.

The one-line summary

Capture the SOA before you meet (generally 48 hours ahead), read and display the TPMO disclaimer, record the whole call, retain everything for the required period — and re-verify all of it against current CMS guidance every plan year, because these two rules move and your license is the one on the line.

This article is marketing guidance, not legal or compliance advice. CMS rules, SOA timing, and TPMO obligations are updated frequently; confirm specifics with official CMS sources, your carrier, and your upline before acting.

Frequently asked questions

How far in advance does a Scope of Appointment have to be collected?

CMS reinstated a rule requiring the SOA to be documented at least 48 hours before an individual marketing or sales appointment, with narrow exceptions such as walk-ins and appointments at the end of a valid election period. The purpose is to prevent same-meeting SOAs signed just to check a box. Confirm the current standard against the latest CMS Medicare Communications and Marketing Guidelines each plan year.

What product types does the SOA cover, and can I discuss others?

The SOA records the specific product categories the beneficiary agreed to discuss — for example Medicare Advantage / MA-PD, standalone Part D (PDP), or Medicare Supplement. You may only discuss what the beneficiary checked. To add a category later, you generally need a new SOA documenting the expanded scope. Discussing unauthorized products is a common secret-shopper finding.

How long must agents keep SOA forms and call recordings?

SOAs and marketing/enrollment call recordings must be retained for the CMS-required period, generally cited as 10 years. The exact retention window and format expectations can change, and your carrier or FMO may require longer or stricter storage. Keep both the signed SOA and the full call audio archived and retrievable, not just the enrollment portion.

Who counts as a TPMO, and does the disclaimer apply to me?

A Third-Party Marketing Organization is broadly anyone who markets, sells, or enrolls beneficiaries into Medicare Advantage or Part D plans and is not the plan carrier itself. That includes solo agents, agencies, FMOs, and lead vendors. If you are a TPMO, the standardized disclaimer applies — read verbally within the first minute of a call and displayed on marketing websites and materials.

Is a verbal or electronic SOA acceptable?

CMS permits SOAs collected in writing, electronically, or by recorded verbal agreement, as long as the required elements and beneficiary agreement are captured and retained. The medium matters less than provable documentation of which product types the beneficiary agreed to discuss and when consent was obtained. Verify the accepted formats and any carrier-specific requirements before you standardize your process.

Is this legal advice I can rely on permanently?

No. This is a marketing-operations summary, not legal or compliance advice, and you are the licensed party responsible. CMS updates SOA timing, disclaimer wording, and TPMO obligations frequently, and carriers layer stricter rules on top. Always confirm current requirements against official CMS guidance and your upline before each Annual Enrollment Period.