For readers who want accountability in how paperwork-reduction efforts are managed, the audit’s core message is straightforward: regulators can describe the review process, but GAO says they don’t consistently document what outcomes followed, or connect issues raised in the reviews to concrete actions.

What EGRPRA requires

EGRPRA requires the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) to review their regulations at least once every 10 years. The statute also calls for a joint report to Congress.

GAO says the agencies were in their third such review cycle as of July 2026.

GAO’s finding: outcomes are hard to connect to subsequent actions

GAO says the connection between EGRPRA reviews and later regulatory actions is often unclear. In GAO’s account, some actions described around the EGRPRA effort were initiated in response to other statutory requirements, while others were started before or while the review was underway.

GAO also found documentation gaps about attribution. In a review of Federal Register final rulemakings that cited EGRPRA from January 2014 through December 2023, GAO identified 41 final rulemakings meeting its criteria—but GAO says only seven of those (17%) specifically cited comments received during the EGRPRA review. For the remaining 34 rulemakings, GAO says agencies either did not explain how the action connected to EGRPRA or used broader language without describing how the EGRPRA work contributed.

What’s missing inside the review process

Beyond the attribution problem, GAO says the agencies don’t have fully documented procedures for key decision steps—particularly: (1) identifying which rules are outdated or unduly burdensome, and (2) determining whether issues raised in the reviews warrant action.

GAO also says the review processes don’t fully incorporate leading-practice analytical elements for retrospective reviews, including a framework for (a) prioritizing which rules to analyze, (b) conducting cost-benefit analysis (where practicable), and (c) assessing the combined or cumulative burden of multiple regulations.

Six recommendations—what agencies are being asked to do next

GAO makes six recommendations, with two each directed to the Federal Reserve, FDIC, and OCC. GAO’s recommendations ask each agency to implement documented procedures for identifying outdated, unnecessary, or unduly burdensome regulations and deciding on actions during EGRPRA reviews, and to incorporate a framework for prioritization, cost-benefit analysis, and cumulative-burden assessment.

GAO reports that the agencies neither agreed nor disagreed with the recommendations, and it lists them as open.

Why this matters to everyday finance

Even when the end result is “no change,” paperwork requirements affect compliance workflows, staffing, and operating costs for banks—and those costs can ultimately affect customers and businesses that rely on financial services.

GAO’s focus here is accountability and transparency: the next EGRPRA cycle is a key test of whether regulators build a decision record that makes review outcomes easier to evaluate and harder to dismiss as process without measurable follow-through.

Sources

• GAO-26-108027 landing page (published July 23, 2026)
• GAO-26-108027 full report (HTML)

GAO’s bottom line is about how Marketplace controls work. It does not allege wrongdoing by any specific agent or broker, but it warns that weaknesses can leave consumers unaware of changes to their plans or even at risk of losing coverage.

GAO’s three Marketplace control gaps

GAO highlights three areas where CMS controls fall short:

• Consent checks: GAO says processes to ensure consumer consent for agent or broker actions are weak.
• Enrollment-record access: GAO says CMS does not restrict access to consumer Marketplace records to the agent or broker already associated with a consumer’s enrollment.
• Consumer notifications: GAO says CMS does not inform consumers of all agent or broker actions.

What CMS changed in 2024—and why GAO still found gaps

In 2024, CMS implemented new procedures to better ensure agents and brokers obtain consumers’ consent before certain actions. CMS also said that starting July 19, 2024, it would block an agent or broker from making changes to a consumer’s federally-facilitated Marketplace (FFM) enrollment unless the agent was already associated with that consumer’s enrollment.

GAO acknowledges these steps, but concludes additional improvements are still needed—GAO says the procedures do not prevent all unauthorized actions because they are not always used, and CMS takes limited steps to confirm the consumer’s identity.

Why this can hit households

If a consumer’s plan enrollment or plan selection is changed without their authorization, the impact can be more than administrative. GAO warns consumers may not realize changes happened, and in the worst case could face loss of coverage.

GAO’s recommendations: tighter safeguards and ongoing review

GAO recommends CMS strengthen controls to ensure consumers consent to, and are informed of, agent and broker actions. GAO specifically points to safeguards that could include a one-time passcode and limits on what consumer details an agent can access, along with clearer consumer notifications about agent activity. GAO also recommends CMS periodically review the relevance and effectiveness of the controls it implements.

What consumers should do now

• Monitor your Marketplace account activity for plan and enrollment changes you did not request.
• Double-check any renewal or plan switch, especially if you worked with an agent or broker to make changes.
• Act quickly if something looks wrong: review the change details promptly and contact the Marketplace and/or your insurer to get clarity and correction.

What to watch next

The immediate question for consumers is whether CMS will implement GAO’s recommended stronger consent verification, tighten access to enrollment records, and improve consumer notifications—then verify over time that those safeguards work as intended.

Sources

• U.S. Government Accountability Office (GAO) — ACA Marketplace: Agents’ scams and efforts to prevent them (GAO-26-108297)
• CMS statement on system changes to stop unauthorized agent/broker Marketplace activity (effective July 19, 2024)