Compliance by design
Four hard stops, one unmapped risk —
and why each fix becomes a sales line.
The finding. As described in the internal materials, the platform has four items that must be cleared before launch — and one structural question nobody has asked that could void the model. None of them is a reason to stop. Every one of them is a control we build into the product, and the control is exactly what makes NROLLNOW the trustworthy option in a category regulators distrust.
Hard stops — do not launch until cleared by named counsel
Hard stopR1 · “Emma” is acting as an unlicensed insurance agent
An AI that uses per-product sales scripts, rebuts objections to induce purchase, walks enroll-or-decline, and captures the e-signature performs acts reserved to a licensed, appointed human. The design states the quiet part: “use technology before going to the Call Center Agent” — i.e., the default path has no licensed human in it.
Authority: Tex. Ins. Code §4001.101 & §4001.051 (license required to solicit or aid in the transaction of insurance) · TDI Commissioner’s Bulletin B-0003-26 (12 Jun 2026): where AI makes a consequential decision, “a person [must] review and agree with all decisions before action is taken” · NAIC Model Bulletin on Use of AI Systems (4 Dec 2023).
Design it in: a named, carrier-appointed agent of record owns every enrollment; a human-in-the-loop gate before bind; a persistent “Emma is an automated assistant, not a licensed agent” disclosure with proactive one-tap escalation; carrier-approved, version-locked scripts — Emma may never improvise coverage advice from PDFs; a full replayable audit log (this log is also the examination defense); a written AI governance program with a named accountable owner.
Hard stopR2 · Override / “downline” pay to unlicensed payroll aggregators
Paying payroll firms — and their “downline” — compensation that moves with enrollment volume is sale-contingent pay to entities that are almost certainly not licensed producers.
Authority: Tex. Ins. Code §4005.053 — bars paying an unlicensed person “a commission… or any other valuable consideration,” and specifically a referral fee based on that customer’s purchase of insurance · Tex. Ins. Code ch. 1806 (anti-rebating / prohibited inducements).
Design it in: a flat, sale-independent technology & administration fee to the payroll vendor for the platform rail — never a % of premium, never scaled to enrollments. The payroll firm never solicits, recommends, or discusses policy terms; it hands off. Anyone earning sale-contingent compensation must be individually licensed and carrier-appointed. Retire the word “downline” — it is the single most examinable phrase in the deck.
Hard stopR3 · Marketing excepted benefits as “Major Medical Alternatives”
Presenting fixed-indemnity / limited-benefit products as a substitute for comprehensive coverage invites deception claims. Critically: the 2024 federal notice requirement for group fixed indemnity was vacated — so the ready-made disclosure safe harbor is gone, and the deception exposure rose.
Authority: 2024 Final Rule, 89 Fed. Reg. (3 Apr 2024), doc. 2024-06551 · vacated as to the group fixed-indemnity notice in ManhattanLife Ins. & Annuity Co. v. HHS, No. 6:24-cv-00178 (E.D. Tex., final judgment 4 Dec 2024) · individual-market notice still in force, 45 CFR 148.220 · deception overlay that survives regardless: FTC Act §5 (15 U.S.C. §45) and the Texas DTPA (treble damages).
Design it in: ban the phrase platform-wide. Say instead: coverage that pays in addition to — never instead of — comprehensive health insurance. Voluntarily surface the (now-vacated) 14-point “this is NOT major medical” notice on every marketing, application, and enroll/decline screen — it is free insurance against a deception claim. Emma must ask whether the employee has or needs major medical and must never steer away from it. Log the acknowledgement per product.
Hard stopR4 · Section 125 pre-tax + fixed-indemnity / wellness “double dip”
Running these premiums pre-tax through a cafeteria plan while the plan pays fixed cash “wellness” benefits the employee keeps tax-free is the arrangement the IRS has repeatedly rejected. The “no cost, boosts take-home pay” pitch is exactly the pattern.
Authority: IRS Office of Chief Counsel CCA 201703013 (benefits includible in income and wage-taxable where premiums were paid by §125 salary reduction) · reaffirmed in CCA 202323006.
Design it in: do not market or display tax-free “extra take-home pay.” If §125 pre-tax is offered, treat wellness/indemnity cash benefits as taxable and wire payroll to withhold. Put a CPA-drafted disclosure in enrollment. The safest posture is often not to pre-tax these particular products — model it before a single deduction runs. The liability lands on the employer — the very constituency promised “no cost.”
The risk nobody put on the list — now verified against primaries (11 Jul 2026)
The one fact that decides everything: is every product 100%-insured by a Texas-authorized carrier, issued as a genuinely individual policy (not an association / trust / master group plan), with zero platform-retained risk? — Yes → a lawful distribution channel, likely not a MEWA. No (retained risk, master/association, or PEO) → an unlicensed MEWA operating in Texas. Verify this before anything else.
Hard stopR6-A · Retained-risk, association/trust, or PEO channel = unlicensed MEWA in Texas
A benefit arrangement covering employees of two or more unrelated employers is a MEWA even without an ERISA plan — the statute reaches “any other arrangement.” If it is not 100% insured by a TX-authorized carrier (any self-/level-funded layer, captive, MGU, or an association/trust/master group policy employers “join”), or it runs through a PEO (one program across many client-employers — the textbook MEWA), operating it in Texas without a certificate is a direct violation.
Authority (verified 11 Jul 2026): ERISA §3(40), 29 U.S.C. §1002(40)(A) — “an employee welfare benefit plan, or any other arrangement… to the employees of two or more employers” (govinfo) · Tex. Ins. Code §846.051 — “may not establish or maintain… a [MEWA] in this state unless the arrangement obtains… a certificate of authority” · §846.002(c) — the chapter switches off only while the MEWA is fully insured by a TX-authorized carrier · ERISA §514(b)(6), 29 U.S.C. §1144(b)(6) — a non-fully-insured MEWA gets full state insurance regulation, no preemption.
Design it in: ship only products 100%-insured by TX-authorized carriers, as individual policies — never an association/trust/master plan, never a platform-retained-risk layer; gate any product or carrier lacking written proof of both. Segregate the PEO channel onto a separate MEWA-track until counsel clears it. If any medical-care product is a MEWA, Form M-1 (29 CFR §2520.101-2) is a federal filing the TX fully-insured exemption does not remove.
Verified · conditionalR6-B · The individual-voluntary channel escapes MEWA/plan status only if the §2510.3-1(j) safe harbor holds — per employer
Genuinely individual policies sold via payroll deduction can be neither a plan nor a MEWA — but only while the employer merely permits, deducts, and remits. §125 pre-tax framing, co-branding, and Emma steering enrollment each push the employer into endorsement / contribution / consideration, which creates an ERISA plan — and a plan across unrelated employers is then a MEWA. §125 pre-tax is the sharpest breaker (ties to R4).
Authority (verified 11 Jul 2026): 29 CFR §2510.3-1(j) — excludes voluntary group insurance where (1) no employer contributions, (2) participation is fully voluntary, (3) the employer’s sole role is to publicize / collect / remit “without endorsing the program,” and (4) no consideration beyond reasonable admin cost (Cornell LII / eCFR).
Design it in: §125 pre-tax OFF by default (post-tax deduction) unless ERISA counsel + CPA jointly bless it; de-brand the employer from the offer; attribute Emma and all enrollment advice to the licensed carrier / agent; bake a per-employer safe-harbor attestation into onboarding as a gating control. The copy that keeps it clean: “Your employer doesn’t sponsor, endorse, contribute to, or profit from this coverage — they only forward your payroll deduction. You own the policy; it goes with you if you leave.”
Favorable fact (client-confirmed): carriers such as Ethos enroll online and issue individual policies, and there are carrier contracts under which the carrier itself accepts the electronic signature. That means each policy is a carrier-issued individual contract (not a platform master plan) with signature acceptance handled at the carrier level — this supports the “not a MEWA” reading and strengthens R8. It does not by itself resolve the three pivot conditions (TX authorization, 100% risk transfer, no association/trust wrapper); carrier compliance must still certify those in writing.
Secondary controls — build in, not bolt on
R5 · PHI/PII over SFTP (HIPAA)
The platform is near-certainly a business associate. Signed BAAs with every carrier and subcontractor before a file moves; encrypt in transit & at rest (key-based SFTP + PGP payloads) so a lost file is not “unsecured PHI”; minimum-necessary field scoping; access logging; a written 60-day breach runbook. Emma’s chat transcripts sit inside the same perimeter.
45 CFR 164.502(e), 164.504(e), 164.308, 164.314, 164.400–414 · Tex. Health & Safety Code ch. 181 (to confirm)
R7 · TCPA / CAN-SPAM on outreach
Log prior express written consent at onboarding before any automated text or call; the “a live agent will call you” flow must run off a consent the employee actually gave. Honor internal DNC. Emails: truthful headers, working unsubscribe, postal address. Note: the FCC one-to-one consent rule was vacated (11th Cir., 24 Jan 2025) — ordinary prior-express-consent still governs.
47 U.S.C. §227 · 15 U.S.C. §7704 · $500–$1,500 per message
R8 · E-SIGN / UETA signature validity — carrier-supported
Strengthened: carriers (e.g. Ethos) enroll online and there are carrier contracts that accept the electronic signature — acceptance lives at the carrier, not just on generic E-SIGN/UETA. Still bake in an explicit, logged, revocable E-SIGN consent step before signing (hardware/software, paper-copy and withdrawal disclosures); bind the signature to intent, identity, timestamp and the exact document version; deliver a retainable copy. Mirror the flow in English and Spanish so consent is equally valid. A defective flow voids the enrollment — and erases the R3 disclosure defense.
15 U.S.C. §7001(c) · Tex. Bus. & Com. Code ch. 322 · carrier e-sign acceptance agreements
R9 · Accessibility & language access
A public enroll-or-decline assistant handling a benefits transaction should meet WCAG 2.1 AA — keyboard and screen-reader paths throughout. The bilingual EN/ES build is a genuine strength; extend it to accessible design rather than treating it as a checkbox.
ADA Title III (demand-letter exposure)
The controls are the copy — every fix is a sentence that wins the room
The control
What we get to say
Licensed agent of record + human-in-the-loop gate (R1)
“A licensed human signs off on every enrollment. Emma never closes alone.”
Voluntary “not major medical” notice (R3)
“We tell you plainly: these plans pay in addition to — never instead of — real health insurance.”
Flat, sale-independent platform fee (R2)
“A flat technology fee. We are not paid more when you enroll in more.”
BAAs + encryption + audit log (R5, R1)
“Bank-grade encryption on every file, a signed privacy agreement with every carrier.”
Who must clear what — before a dollar is charged or a file moves
| Reviewer | Clears |
|---|
| ERISA / employee-benefits counsel — start here | R6 (MEWA status) · R3 · R4 |
| Texas-licensed insurance regulatory attorney | R1 · R2 · R3 · R8 · TDI posture |
| Health-care privacy counsel + named HIPAA Security Officer | R5 |
| CPA / ERISA tax counsel | R4 (one-way door for the employer) |
| TCPA / telemarketing counsel | R7 |
| Each carrier’s compliance / general counsel | Agent-of-record, appointments, script approval, AI-governance program |
This is a risk map, not legal advice. It locates authorities, ranks exposure, and proposes design-level mitigations. It creates no attorney–client relationship and renders no legal conclusion; it was not prepared by a licensed attorney. It reasons from the described system — not from the actual code, carrier appointments, vendor contracts, or Business Associate Agreements, none of which were reviewed. The MEWA authorities (ERISA §3(40) / 29 U.S.C. §1002(40); Tex. Ins. Code ch. 846; ERISA §514(b)(6); 29 CFR §2510.3-1(j) and §2520.101-2) were
verified against primary sources on 11 Jul 2026. Items that remain
unverified and dispositive —
per-carrier Texas authorization and 100% risk transfer (factual, decides R6); whether a fully-insured or excepted-benefits-only MEWA is relieved from
Form M-1; MEWA statutes in
every other state where an enrolled employer sits; Tex. Ins. Code ch. 541; Tex. Health & Safety Code ch. 181; current STLDI duration-limit litigation posture — and must be confirmed against primary sources. Whether Emma’s specific build crosses into “acting as agent” is a legal conclusion that turns on the exact scripts and human-review gating — a licensed attorney must apply the statute to the real flow.
Hard stops before launch: R1, R2, R4, and R6.
Prepared by One Trinity for NROLLNOW / AdvantEdge · Summit Alliance Companies · Confidential