CMS Compliance Requirements for Medicare Advantage: The Complete Reference
Sevana Health Team
July 5, 2026
CMS compliance requirements for Medicare Advantage plans come in two layers. The first is the compliance program itself: seven mandatory elements defined in regulation at 42 CFR 422.503(b)(4)(vi), with a parallel Part D requirement at 423.504(b)(4)(vi). The second is the operational obligations the program exists to keep in check: decision timeliness, formulary administration, care coordination, guidance implementation, delegated entity oversight, and the data that proves all of it. This reference covers both layers and how CMS verifies them.
Where the requirements come from
Four sources define what a Medicare Advantage compliance team is accountable for:
- ▸Regulation. 42 CFR Part 422 governs Medicare Advantage and Part 423 governs the prescription drug benefit. The compliance program mandate lives at 422.503(b)(4)(vi) and 423.504(b)(4)(vi).
- ▸Sub-regulatory guidance. The Medicare Managed Care Manual and Prescription Drug Benefit Manual chapters interpret the regulations, and HPMS memos deliver ongoing operational guidance week after week.
- ▸The annual rulemaking cycle. Each year's Final Rule and Rate Announcement adjust requirements, and plans are expected to implement the changes on schedule.
- ▸Audit protocols. The CMS Program Audit protocols define how compliance is tested in practice, including the universe record layouts published through OMB-approved form CMS-10717.
The practical challenge is that these sources move at different speeds. The regulation is stable; the guidance changes weekly. A compliance program is judged on how reliably it turns all of it into operations.
The seven elements of an effective compliance program
The heart of the requirement is 42 CFR 422.503(b)(4)(vi): every MA organization must adopt and implement an effective compliance program with measures to prevent, detect, and correct non-compliance and fraud, waste, and abuse. The regulation specifies seven elements, and CPE reviews are structured around them.
Written policies, procedures, and standards of conduct
The regulation requires: Written standards that articulate the organization’s commitment to comply with federal and state law, describe expectations, and include a policy of non-intimidation and non-retaliation for good faith reporting.
What it looks like in practice: A maintained policy library with review cycles, version history, and a documented chain from new CMS guidance to policy updates.
Compliance officer and compliance committee
The regulation requires: A designated compliance officer who is an employee of the MA organization, its parent organization, or a corporate affiliate (not of a first tier, downstream, or related entity) and a committee accountable to senior management, with periodic reporting to the governing body.
What it looks like in practice: Committee charters, meeting minutes, and board reporting that auditors can trace, not just an org chart.
Training and education
The regulation requires: Effective compliance training for employees, senior leadership, and governing body members, at least annually and as part of orientation for new hires and appointees.
What it looks like in practice: Completion tracking with dates and rosters. In an audit, the question is not whether training exists but whether you can prove who took it and when.
Effective lines of communication
The regulation requires: Confidential communication channels between the compliance officer, employees, and first tier, downstream, and related entities, including a method for anonymous good faith reporting.
What it looks like in practice: A working hotline or reporting portal, evidence it is publicized, and a log showing reports are received and acted on.
Well-publicized disciplinary standards
The regulation requires: Enforced standards that encourage good faith participation in the compliance program and provide timely, consistent, and effective enforcement when violations occur.
What it looks like in practice: Documented, consistent handling of violations. Inconsistent enforcement is itself a finding.
Routine monitoring, auditing, and risk identification
The regulation requires: An effective system for routine monitoring and identification of compliance risks, including internal audits and external audits as appropriate.
What it looks like in practice: A risk assessment cadence, an audit and monitoring work plan mapped to identified risks, and completed oversight activities. This is the element the COA universe exists to evidence.
Prompt response to compliance issues
The regulation requires: Procedures for promptly responding to compliance issues as they arise, investigating potential violations, correcting problems, and ensuring ongoing compliance with CMS requirements.
What it looks like in practice: Incident and investigation records that show intake, root cause, corrective action, and validation, with dates at every step.
Two things practitioners know that newcomers miss. First, the elements are tested on evidence, not existence: a policy without a review trail, or training without completion records, fails in exactly the way a missing policy does. Second, the program must extend to first tier, downstream, and related entities. The contracting requirements at 42 CFR 422.504(i) make the plan accountable for work it delegates, which is why delegated oversight shows up in every element above.
The operational requirements the program has to keep in check
The compliance program is the control system. These are the operations it controls. Some carry hard regulatory clocks tested through dedicated audit universes; others are evidenced through oversight records, contracts, and traceability:
Determinations, appeals, and grievances
Part C organization determinations and Part D coverage determinations carry defined decision and notification timeframes, appeal rights, and effectuation obligations. Tested through the ODAG and CDAG universes. See the ODAG and CDAG guides.
Formulary administration
The formulary administered at the pharmacy counter must match what CMS approved, including transition fills and new enrollee protections. Tested through the FA universe. See the FA universe guide.
SNP care coordination
Special Needs Plans must execute their Models of Care, including health risk assessments and individualized care plans on the required clocks. Tested through the SNPCC protocol. See the SNPCC guide.
Guidance implementation
New CMS guidance has to move from receipt to policy to operations, with a record of how. We wrote about what that takes in the Friday afternoon HPMS memo.
Delegated entity oversight
PBMs, TPAs, and other delegates execute member-facing functions, but accountability stays with the plan. Oversight has to be measured, not assumed. See measuring TPA performance.
Data production
When audited, plans must produce accurate, complete universes on a 15 business day clock, and files that fail integrity testing after three attempts can be cited as Invalid Data Submission. See IDS in 2026.
How CMS verifies compliance
Verification is data-driven. The centerpiece is the CMS Program Audit, which tests operations by sampling from universes of real cases across five protocols and, since the 2026 framework reset, classifies findings as CAR, Observation, or IDS. We cover the whole process, protocol by protocol, in our CMS Program Audit guide, and the CPE portion now runs as a discussion-based review, a pilot sometimes referred to as "Collaborating on Compliance," built on the plan's COA universe.
Outside of audits, two distinct tracks matter, and CMS manages them through different functions:
- ▸Compliance actions, typically issued through CMS account management and the regional offices: notices of non-compliance, warning letters, and ad hoc corrective action plans for issues identified outside the audit process.
- ▸Enforcement actions, handled by CMS's enforcement function (currently the Medicare Oversight and Enforcement Group): civil money penalties, intermediate sanctions such as enrollment or marketing suspensions, and contract termination.
For a fuller picture of the oversight machinery, see how CMS ensures Medicare Advantage compliance.
Meeting the requirements in practice
Every requirement above shares one property: it is evidenced by records that accumulate continuously or not at all. That is why the plans that do well under the 2026 framework treat compliance as an operating system rather than an audit-season project: oversight activities captured as they happen, universes validated on a schedule instead of inside the 15 day window, guidance tracked from memo to policy to closure, and delegates measured monthly. Sevana's platform was built around that premise; the CMS Universe Scrubber handles the data-production side, and the surrounding modules keep the element F and G evidence current.
Frequently Asked Questions
What are the CMS compliance requirements for Medicare Advantage plans?
Medicare Advantage organizations must operate an effective compliance program meeting the seven core elements at 42 CFR 422.503(b)(4)(vi), with a parallel Part D requirement at 42 CFR 423.504(b)(4)(vi): written policies and standards of conduct, a compliance officer and committee, training, effective lines of communication, enforced disciplinary standards, routine monitoring and auditing, and prompt response to identified issues, including measures to prevent, detect, and correct fraud, waste, and abuse. On top of the program requirement, plans carry operational obligations across determinations and appeals timeliness, formulary administration, SNP care coordination, guidance implementation, delegated entity oversight, and data reporting.
What are the seven elements of an effective compliance program?
Under 42 CFR 422.503(b)(4)(vi), the seven elements are: (1) written policies, procedures, and standards of conduct; (2) a designated compliance officer and compliance committee; (3) effective training and education; (4) effective lines of communication, including anonymous reporting; (5) well-publicized disciplinary standards; (6) an effective system for routine monitoring, auditing, and identification of compliance risks; and (7) procedures for promptly responding to compliance issues.
How does CMS verify that a plan is compliant?
Primarily through data. CMS Program Audits test operations by pulling universes of real cases across the ODAG, CDAG, FA, SNPCC, and CPE protocols and tracing how members were handled. Outside of audits, CMS account management monitors performance data and complaints, and can issue compliance actions such as notices of non-compliance and warning letters. Enforcement actions, including civil money penalties and intermediate sanctions, are handled by CMS’s Medicare Oversight and Enforcement Group.
What happens if a Medicare Advantage plan is non-compliant?
It depends on the severity and the path. Routine issues surface as compliance actions from CMS account management: a notice of non-compliance, a warning letter, or a request for an ad hoc corrective action plan. Serious or systemic failures can escalate to enforcement actions handled by the Medicare Oversight and Enforcement Group: civil money penalties, intermediate sanctions like enrollment or marketing suspensions, and ultimately contract termination. Findings from a formal program audit are classified as CAR, Observation, or IDS under the 2026 framework.
Primary sources
- ▸42 CFR 422.503 (Part C compliance program requirements) and 42 CFR 423.504 (Part D counterpart)
- ▸CMS Program Audits hub: protocols, record layouts, and audit process documents
- ▸CMS Audit Submission Checklist (PDF): required universes and due dates per protocol