By Kevin Brenner | August 4, 2026

 

Kevin R. Brenner is Special Counsel at Global Link Law, where he leads the firm’s Global Investigations & Risk Advisory, Regulatory & Compliance, and Employment Risk & Workplace Investigations practices. A former federal prosecutor with more than two decades of courtroom, investigative, and advisory experience, Kevin helps healthcare and multinational organizations manage enforcement risk, respond to government scrutiny, and build compliance programs that operate effectively across borders.

 

For years, the conversation around PBM fiduciary risk centered on transparency.

Plan sponsors wanted more visibility into compensation, rebates, spread pricing, and the other economic arrangements built into PBM relationships. Regulators wanted more visibility. Legislators wanted more visibility. Plaintiffs’ lawyers wanted more visibility.

They’re all getting closer to it.

Congress has enacted significant PBM reforms. DOL has proposed additional disclosure requirements. States continue to impose new obligations on PBMs. The FTC remains focused on PBM business practices. And ERISA litigation challenging PBM arrangements continues to work its way through the courts.

It’s easy to look at all of that and conclude that the challenge is getting information. I’m not sure that’s right anymore. The more interesting question is what happens after the information shows up, and that is where PBM fiduciary risk now lives.

Most large plans already have smart people helping them evaluate pharmacy benefits. Brokers, consultants, actuaries, and pharmacy specialists can benchmark pricing, analyze compensation structures, compare contract terms, and assess market alternatives. That work is essential. But it is not the same thing as fiduciary governance. My focus is not on generating the analysis. It is on what’s done after the analysis arrives.

The Fiduciary Standard Is Process, Not Hindsight

Who reviews all the data the PBMs are, or soon will be providing? What concerns are escalated? What decisions are made? What recommendations are accepted or rejected? What follow-up occurs? And what record exists showing that fiduciaries exercised oversight rather than simply receiving information? Those are governance questions. They’re also the questions that often become most important during investigations, regulatory inquiries, and litigation.

If the board asks next quarter what the company is doing to address emerging PBM fiduciary risks, what is the answer? What process exists for reviewing the information, escalating concerns, making decisions, and documenting fiduciary oversight? That’s where I think the next challenge is emerging.

The reason these questions matter is that ERISA’s fiduciary standards are focused more on process than hindsight. Courts generally do not ask whether fiduciaries achieved the best possible outcome. They ask whether fiduciaries engaged in a prudent process, gathered the information necessary to make informed decisions, and monitored plan arrangements over time. A unanimous Supreme Court underscored that principle in Tibble v. Edison Int’l, 575 U.S. 523 (2015), explaining, in the context of alleged 401(k) mismanagement, that “[a] plaintiff may allege that a fiduciary breached the duty of prudence by failing to properly monitor investments and remove imprudent ones.”

Underlying all of these questions is cadence. Tibble framed prudence as a continuing duty, not a one-time event, so PBM oversight belongs on a recurring committee calendar with documented minutes, rather than surfacing only at renewal or in response to an RFP. Tibble has a limit worth identifying. As Stern v. JPMorgan Chase shows, a sponsor cannot convert a quarrel with plan design into a fiduciary-monitoring claim by relabeling it, and a monitoring theory that depends on the sponsor having redesigned the PBM arrangement will be treated as a settlor challenge and dismissed. This is also why the committee record does its heaviest work not as proof of Tibble-style monitoring, but as the evidence that a service arrangement was necessary and its compensation reasonable, which is the one place JPMorgan confirms the sponsor is acting as a fiduciary and the defense on which a surviving prohibited-transaction claim ultimately turns. A committee that reviews PBM compensation, conflicts, and rebate flows on a set schedule, and records what it reviewed and decided, is building the very record that both prudence and, more durably, the reasonableness of the arrangement are measured against.

That is why the growing emphasis on PBM transparency is significant. Disclosure does not satisfy a fiduciary obligation by itself. Rather, it provides the information fiduciaries need to evaluate compensation arrangements, identify conflicts, ask questions, and make informed decisions. Disclosure is the starting point of the analysis, not the end.

Where the PBM Litigation Is Being Decided

The recent PBM litigation illustrates where PBM fiduciary risk is concentrated. The headlines focus on outcomes. JPMorgan’s case survives. Wells Fargo’s and Johnson & Johnson’s largely do not. But from a governance perspective, what stands out is that courts are increasingly being asked to scrutinize PBM compensation arrangements, PBM contracting practices, plan-payment structures, and fiduciary oversight. Even where claims have been dismissed, the allegations themselves show where plaintiffs’ lawyers are looking and what they believe fiduciaries should have been evaluating.

The most useful thing to watch in the PBM cases is not who won. It is where the fights are being decided. So far, the fiduciary-breach theories are being screened out on two fronts. In cases like Navarro and Lewandowski, they failed at Article III standing. In JPMorgan, where standing was satisfied, they failed at the next threshold: whether the challenged conduct was a fiduciary act at all. The prohibited-transaction theories, by contrast, are surviving.

In Navarro v. Wells Fargo, the court dismissed the complaint for lack of standing, holding that even if the overpayments were a cognizable injury, the alleged harm was too speculative on causation and redressability. The plan retained sole discretion to set participant contributions, so the link between what the PBM was paid and what participants paid out of pocket was, in the court’s words, “tenuous at best.” That first dismissal was without prejudice, and the plaintiffs amended, adding a current plan participant, an expert report, and a supporting amicus brief from an ERISA scholar. Nonetheless, the court dismissed again and entered judgment, holding that the fuller record “still fall[s] short for essentially the same reasons”: the sponsor’s sole discretion over contributions, and the participants’ lack of any claim to plan assets, left the harm too speculative and beyond any remedy a court could order. Lewandowski v. Johnson & Johnson reached the same result on a second motion to dismiss, adopting Navarro’s reasoning and observing that the named plaintiff alleged roughly $210 in overpayments in a year she received more than $200,000 in plan benefits. That dismissal is now on appeal to the Third Circuit. None of these rulings reached the merits of the governance conduct; each turned on standing.

Stern v. JPMorgan Chase is the counterpoint. The court found standing there because the plaintiffs did the work: they analyzed every one of the 404 generic drugs on the plan’s formularies and pointed to specific overpayments, on specific dates, at specific markups. But the court then dismissed with prejudice the prudence and loyalty claims, holding that how the benefit was designed, how the PBM was compensated, how drugs were categorized, and which pricing benchmarks were used, reflected non-fiduciary “settlor” decisions rather than fiduciary acts. The court also refused to let the plaintiffs rescue those claims by recharacterizing them as a failure to monitor, holding that recasting structural criticisms of plan design as a monitoring lapse “does not alter their allegations’ essential character.” The same opinion held, though, that hiring and retaining a service provider is itself a fiduciary act, not a settlor decision. That is why the prohibited-transaction claims cleared the motion to dismiss: under Cunningham v. Cornell University, 604 U.S. 693 (2025), a plaintiff need only plead the elements of the prohibited transaction, leaving the reasonableness of the compensation as the fiduciary’s affirmative defense.

Cunningham and the Prohibited-Transaction Shift

Cunningham is instructive. In another unanimous decision, the Court held that plaintiffs asserting certain ERISA prohibited-transaction claims need only plead the elements of the prohibited transaction itself; they do not need to negate the statutory exemptions. The burden of establishing those exemptions falls on the defendant. That reallocation matters more than it sounds. Justice Alito, who joined the Court’s opinion in full, wrote separately to flag the consequence: “The administrator of an ERISA plan like the one at issue will almost always find it necessary to employ outside firms to provide services that the plan needs.” Because those firms become parties in interest the moment they are engaged, a plaintiff can now clear a motion to dismiss simply by alleging that the plan did what it was, in his words, “bound to do.” And getting past dismissal, Alito noted, “is often the whole ball game because of the cost of discovery.”

Although Cunningham involved retirement-plan recordkeeping fees rather than PBMs, the practical significance extends beyond that context. Service-provider arrangements typically involve payments between a plan and parties providing services to the plan, making it relatively straightforward in many cases for plaintiffs to allege the basic elements of a prohibited transaction and survive a motion to dismiss. Once discovery begins, and Cunningham makes that outcome more likely, the focus shifts to whether fiduciaries can demonstrate that an exemption applies, often by showing that services were necessary and compensation was reasonable.

For a plan sponsor, that pattern carries a clear governance lesson. The prohibited-transaction door is the one most likely to stay open, and once it does, the defense turns on whether the fiduciary can show the service was necessary and the compensation reasonable. That is a record question. It is answered by the process a committee ran and documented, not by the disclosures a PBM eventually produced. How a decision gets framed matters too: the line between plan design and plan administration can determine whether a decision is even reviewable as a fiduciary act, and that line is drawn in the minutes.

The Common Thread in PBM Fiduciary Risk Is Accountability

The same thing is happening on the regulatory side. The common thread running through federal proposals, recent legislation, state initiatives, enforcement activity, and private litigation is not simply transparency. It’s accountability.

Congress has already moved significantly in this direction. Section 202 of the Consolidated Appropriations Act, 2021 amended ERISA to require brokers, consultants, and certain other covered service providers expecting to receive at least $1,000 in direct or indirect compensation from a group health plan to disclose detailed information regarding that compensation and potential conflicts of interest.

The Department of Labor has proposed a similar framework for PBM compensation disclosures under ERISA § 408(b)(2), issued January 30, 2026 under Executive Order 14273. The premise is straightforward: fiduciaries need information about compensation so they can evaluate whether compensation is reasonable, identify potential conflicts, and make informed decisions on behalf of the plan.

More recently, Congress went further. The Consolidated Appropriations Act, 2026 includes sweeping PBM reforms focused on transparency, compensation, rebate pass-through requirements, reporting obligations, and audit rights. Among other things, the legislation requires PBMs serving group health plans to disclose rebates and other remuneration associated with a plan’s drug utilization, pass those amounts through to plans, make rebate records available for audit, and provide plans with greater visibility into PBM compensation and financial arrangements. By extending covered-service-provider disclosure obligations to PBMs, the legislation channels noncompliant, undisclosed arrangements into ERISA’s existing prohibited-transaction framework under Section 408(b)(2), the same mechanism Congress used in 2021. The covered-service-provider/compensation-disclosure expansion is effectively immediate for contracts entered or renewed after enactment, while the rebate pass-through, reporting, and audit provisions apply to plan years beginning roughly 30 months out (January 1, 2029 for calendar-year plans), which gives fiduciaries a runway to build the governance process now, before the disclosures arrive in volume.

And states are increasingly heading in the same direction. California’s SB 41, which took effect this year, goes beyond disclosure and imposes fiduciary obligations directly on PBMs. Whether portions of the law ultimately survive ERISA-preemption challenges remains to be seen; in January 2026, the PBM trade association PCMA sued to enjoin the fiduciary-duty provision as preempted. That challenge is not a long shot, and PCMA has litigated preemption issues for years with mixed results. It won in PCMA v. District of Columbia, 613 F.3d 179 (D.C. Cir. 2010), where the D.C. Circuit struck a comparable PBM fiduciary-duty mandate as preempted. But it lost in the First Circuit, which upheld a similar Maine law in PCMA v. Rowe, 429 F.3d 294 (1st Cir. 2005), and at the Supreme Court, which took a more permissive view of state PBM regulation in Rutledge v. Pharmaceutical Care Management Ass’n, 592 U.S. 80 (2020). Yet the broader significance is harder to miss. The statute reflects the same policy trend appearing elsewhere: regulators and legislators increasingly expect PBM compensation, conflicts of interest, and financial incentives to be disclosed so they can then be examined.

Taken together, these developments are designed to provide fiduciaries with access to information that historically has been difficult to obtain, including how PBMs are compensated, what financial incentives may influence decision-making, whether rebate dollars are being fully remitted to the plan, and whether the plan is receiving the economic benefits it expects under the arrangement.

What PBM Fiduciary Risk Means for Your Committee

Whether a service was necessary and its compensation reasonable frequently turns on evidence of process. What information was reviewed? What questions were asked? What alternatives were considered? Why did fiduciaries conclude the arrangement remained appropriate?

That is a governance issue, and it sits at the center of PBM fiduciary risk. Most plans appropriately rely on consultants, actuaries, brokers, and pharmacy specialists to analyze PBM arrangements. They should. But the key question is not whether the analysis existed. It is what fiduciaries did with it. What recommendations were accepted or rejected? What actions were taken? And how were those decisions documented?

When advising a General Counsel preparing for a board or committee discussion on PBM fiduciary risk and oversight, I recommend getting clear answers to questions such as:

• Who is responsible for reviewing PBM disclosures when they are received?

• What information is escalated to the fiduciary committee?

• What information is elevated to management or the board?

• What role do consultants and pharmacy specialists play in the review process?

• What findings require follow-up or corrective action?

• What audit rights exist under the PBM agreement?

• How are challenges to PBM compensation, pricing, or performance tracked and resolved?

• How are committee deliberations documented?

• What record could the company produce if DOL, the FTC, a state regulator, or a plaintiff’s lawyer asked how the plan evaluated PBM compensation and conflicts?

• Can the plan verify what it is being told?

As compensation disclosures become more detailed, audit rights may become just as important as disclosure rights. Fiduciary committees should understand not only what information they receive, but also how they can test its accuracy. Both the 2026 legislation and the DOL’s proposed rule build audit rights directly into the framework, which means verification is becoming a statutory and regulatory entitlement rather than merely a contract term to negotiate.

Transparency is valuable. Verification is better. Managing PBM fiduciary risk means answering the questions that matter years later, when someone is trying to reconstruct whether fiduciaries acted prudently.

Click Here to Schedule a 30 minute Consultation with Kevin Brenner

This newsletter is for informational purposes only and does not constitute legal advice. The discussion of this matter, including the conduct of any individuals involved, is based solely on publicly available information and court filings. Nothing in this post should be interpreted as a statement of fact about any person’s character, intentions, or actions beyond what has been reported in official sources.

The analysis provided reflects general legal principles and commentary and may not apply to any specific situation. Reading this post does not create an attorney-client relationship with the author or their firm. If you have questions about how these issues may affect your organization, you should consult qualified legal counsel.

The information provided on this website is for general informational purposes only and should not be considered legal advice. No attorney-client relationship is created by accessing or using this website. Please consult with a qualified attorney before making any legal decisions. Global Link Law is not liable for any reliance on the information provided. Prior results do not guarantee a similar outcome.