Two things happened on September 22 inside the federal health insurance exchange, and they will age very differently. The first was an announcement: the Centers for Medicare and Medicaid Services said it had cancelled roughly 315,000 marketplace enrollments covering more than 760,000 people, most of them in August, on the grounds that the applications lacked verifiable citizenship or immigration documentation. The second was a document. An interim final rule published the next morning at 91 FR 60317 creates a new section of the exchange regulations, 45 CFR 155.220(o), and simultaneously exercises it. The cancellations are a number that will be revised, litigated and eventually forgotten. The regulation is a capability that stays.
The authority outlives the moratorium
Read the rule as a grant of power rather than a press release, because that is how it is built. The new section gives the Department of Health and Human Services authority to impose temporary moratoria on agent and broker registration with the federally facilitated exchanges whenever it determines that conduct poses an unacceptable risk to eligibility determinations, to enrollees, or to exchange systems. The moratorium attached to it runs until February 1, 2027. The authority does not expire on that date. It is codified, and the next administration inherits it.
The procedural choice matters as much as the substance. HHS invoked good cause under the Administrative Procedure Act to skip advance notice and comment and make the rule effective immediately, arguing that prior notice would be impracticable given the conduct it was targeting. It still invited comments on whether the codified authority should be kept, modified or rescinded. That is a familiar pattern in this area of law: an agency asserts an emergency, writes the regulation so that the emergency is a single use of a durable tool, and leaves the comment period as a formality that runs after the tool is already in the drawer.
The scope is worth marking precisely, because the boundaries say something about what the government thinks the problem is. Web broker registration is untouched. State-based exchanges, which run their own eligibility and enrollment systems in roughly a dozen states and the District of Columbia, are untouched. What is frozen is the direct enrollment channel at the federal exchange, the one where an agent or broker sits between a consumer and an application.
The freeze lands on the brokers who arrived last year
The moratorium applies to agents and brokers who do not have an active exchange agreement for plan year 2026 and who want one for 2027. Affected brokers cannot complete training, register, or execute an agreement while it holds. In effect, the door closes behind everyone already inside it.
The enforcement record CMS cites explains the logic and also shows its cost. Over the summer the agency issued 569 notices of intent to terminate to agents and brokers who submitted applications missing key identifying information. New registrants accounted for about 30 percent of those notices but only about 11 percent of registered agents and brokers with at least one active enrollment in the plan year. The cohort being frozen is, by CMS's own data, the cohort with the worst observed ratio. It is also the entire cohort of new entrants, including the ones who did nothing wrong.
The National Association of Insurance and Financial Advisors welcomed the fraud crackdown but objected to the moratorium as a blanket instrument, noting that it shuts out producers with no connection to the conduct at issue and disrupts the pipeline of new professionals. That objection is not just industry self-interest. A registration freeze that spares incumbents is a market-structure decision wearing an enforcement costume. Entry barriers of this kind very often outlast the crisis that justified them, because the firms already inside them have little reason to want the door reopened.
A subsidy estimate that spans five billion dollars
Start with what is hard. CMS cancelled 315,000 policies and expects the action to return roughly $2.2 billion in premium tax credits, which is a computable figure tied to subsidies that were being paid on those specific enrollments.
Then look at what is soft. The rule states that unauthorized enrollment could amount to an estimated $1.5 billion or $6.6 billion in annual improper federal spending, with the difference attributed to methodology. Two figures produced by the same government, in the same document, spanning $5.1 billion. That range is the honest measure of how well anyone can currently size this problem. It is also the figure that will get quoted, in whichever direction the quoter prefers, and the range will quietly disappear.
The denominator has been moving too. About 19.2 million people were actively enrolled in marketplace plans in early 2026, down from roughly 21.8 million a year earlier, as the enhanced subsidies that had held premiums down expired. A cancellation of this size lands on a smaller and more stressed pool than the one the exchange had at its peak, which changes who absorbs it. People who lose coverage mid-year generally do not become uninsured in a quiet way. They show up as uncompensated care, as bad debt on hospital schedules, and as premium increases spread across everyone who remains.
What the cancellations assume about the people enrolled
The removal process ran through the insurers rather than the enrollees. According to reporting on the CMS announcement and to KFF's account of the mechanics, the administration sent insurers a list of about one million people who had been enrolled by a broker, whose premiums were fully covered by tax credits, and whose Social Security numbers or immigration documents could not be verified against federal records in real time. Insurers were asked to attempt contact and were permitted to remove anyone with a claim or prior communication from the list. Enrollees who did not respond within 30 days of that outreach had their coverage cancelled.
Vice President JD Vance described the group as a mix of people who never existed and real people who do not meet eligibility requirements, and officials said most were unreachable despite repeated contact attempts. Independent analysts offered a qualified version of the same concern. Cynthia Cox of KFF said there was no question that fraudulently enrolled people should lose coverage, and also that there is "no way to know how many legitimately enrolled people had their plans canceled" when nonresponse is treated as evidence.
The countervailing evidence is real and worth stating plainly. The Government Accountability Office has been running covert tests on the federal marketplace for years. It created 20 fictitious identities for plan year 2025; 18 were still actively covered as of September 2025, with subsidies running over $10,000 a month. Its data analysis found more than 160,000 applications in plan year 2024 with changes likely made by agents or brokers without authorization, alongside roughly 275,000 complaints from consumers about unauthorized enrollments or plan changes. On the other side, an actuarial study prepared for the health insurance trade group AHIP found that enrollment records showing no claims have ordinary explanations, including healthy consumers, short enrollment spells and claims-processing lags, which weakens the inference that a silent record means a fake enrollee. Both things can be true: significant unauthorized enrollment exists, and a nonresponse test will cancel some legitimate coverage. Unproven allegations against named brokers remain exactly that, and the companies and individuals involved have not been found liable.
Identity proofing moves into the enrollment act itself
The rule does more than freeze registrations, and the rest of it points at where the exchange thinks its exposure lives. Existing agents and brokers must re-verify their identities through Login.gov or ID.me, which converts a one-time onboarding check into a recurring one. Consumers must authorize a broker electronically before that broker can act on their application. Brokers are barred from being added to applications consumers are supposed to complete themselves. The exchange is standing up an anti-fraud coordination group that draws on CMS and departmental leadership.
Notice the direction of travel. The exchange is trying to move proof of identity and authorization to the moment a broker touches an application, rather than reconstructing it months later from a claims record. That is a real improvement in principle and it is also a transfer of friction. A consumer who once clicked through a broker-assisted enrollment in a few minutes now has to complete an authorization step, and if that step is missed or fumbled, the consequence lands on the enrollee's coverage. The same dynamic showed up in the marketplace's income verification rules, which can suspend tax credits over a database mismatch before anyone has established that the consumer did anything wrong. Verification is cheap to mandate and expensive to survive.
What the calendar does next
Four dates govern the rest of this. The moratorium runs to February 1, 2027. Comments on the codified authority remain open, and HHS has said it may modify or rescind the rule in light of them. Open enrollment for 2027 begins November 1 and runs into mid-January, which is precisely when the frozen broker channel would normally be recruiting and enrolling. And the 419,000 enrollments flagged for additional verification are still working through a process that can end the same way for the people inside it.
Meanwhile the 2027 rate filings that insurers submitted this summer already reflect a market where the subsidies that cushioned premiums have expired and utilization has not fallen. The cancellations sit on top of that, not beside it.
The durable change is conceptual. The federal exchange now treats its distribution channel as a risk surface in its own right, with a standing power to close it. Whether or not this particular moratorium is lifted in February, that framing is now in the regulation and will shape how the next fraud finding gets handled. What the rule does not build is the other half of the problem: a faster way to adjudicate an individual enrollment on evidence rather than on silence. The exchange can now act on a channel in days. It still cannot tell one person's legitimate enrollment from another's fraudulent one without a 30-day clock and an unanswered letter. Whichever side of this debate a reader takes, both should want that gap closed by evidence rather than by nonresponse, because the cost of the current method falls on whoever moves, or checks their mail, slowest.
Primary sources
- Federal Register, Interim Final Rule, Patient Protection and Affordable Care Act; Temporary Moratoria on Certain Agent and Broker Registration (91 FR 60317, CMS-9872-IFC, RIN 0938-AW26).
- U.S. Government Accountability Office, GAO-26-108811, Preliminary Results of Ongoing Work Suggest Fraud Risks in the Advance Premium Tax Credit Persist.
- NPR, HHS cancels health insurance of 760,000 individuals enrolled in healthcare.gov plans.
- National Association of Insurance and Financial Advisors, statement on the CMS fraud crackdown and agent moratorium.
- Fierce Healthcare for CMS officials' characterization of the cancellations and the verification volumes.