To become a third party administrator, you form a business entity, secure the required bonds and insurance, open dedicated fiduciary accounts, and file a licensing application with the insurance department in every state where you plan to do business. Around 47 states require some form of TPA licensing or registration, and each sets its own paperwork, fees, and financial thresholds. The mechanics aren’t complicated once you see the pieces laid out, but a missed detail on the application or a gap in ongoing compliance is where most new firms get caught.
Who Actually Needs a License
A TPA handles claims processing, premium collection, or benefits administration on behalf of insurance carriers or self-insured employers. If your firm will do any of that for another company’s health plan, workers’ compensation program, or retirement fund, you need a state TPA license in each state where you operate. Regulators require licensing because TPAs handle other people’s money and sensitive personal data, and they want to verify your financial stability and the integrity of your leadership before you touch either.
A few categories fall outside the requirement. Licensed insurance companies administering their own policies don’t need a separate TPA license. Employers running benefits in-house for their own workforce are exempt. Banks and trust companies with trust powers and combined capital and surplus above $1,000,000 typically don’t need one. Neither does an administrator affiliated with an insurer that handles only that insurer’s direct business. Exemption language varies by state, so confirm with the state insurance department before you assume you qualify.
Form the Business Entity
Start by forming a corporation or limited liability company. Most state insurance departments won’t process a TPA application from a sole proprietorship or general partnership because those structures don’t give regulators the liability separation they expect from a firm managing plan funds.
Get your articles of incorporation or organization, an employer identification number, and organizational bylaws or an operating agreement in place before you touch the license application. Every state will ask for copies, and the entity type also determines your tax treatment and how much personal exposure the owners carry.
Get Bonded and Insured
State Surety Bond
Nearly every state requires a TPA to obtain a surety bond before it will issue a license. The bond protects the plans and employers you administer for: if your firm mishandles funds or fails to meet its obligations, the bond pays out. Amounts are commonly calculated as a percentage of funds under management, often 10% of the average daily client account balance, subject to a floor and ceiling set by each state.
The range is wide. Minimums start as low as $5,000, and maximums can reach $1,000,000 depending on jurisdiction and how much money flows through your accounts. You apply through a surety company, which evaluates your firm’s creditworthiness and financial history. You pay an annual premium, usually a small percentage of the bond’s face value, not the full amount. Firms with strong financials pay less. The bond has to stay active throughout your license term, and you’ll submit proof of renewal every cycle.
ERISA Fidelity Bond
If you’ll administer employee benefit plans covered by the Employee Retirement Income Security Act, there’s a separate federal bonding requirement that catches many new TPAs off guard. Every person who handles funds or property of an ERISA-covered plan must be covered by a fidelity bond that protects the plan against losses from fraud or dishonesty. This is not the state surety bond; the two coexist.1Office of the Law Revision Counsel. 29 U.S. Code 1112 – Bonding
The bond amount has to be at least 10% of the funds handled during the preceding year, with a minimum of $1,000 and a maximum of $500,000. The Secretary of Labor can authorize a higher amount in certain cases, but the 10% ceiling still applies. The amount resets at the start of each plan fiscal year based on the prior year’s activity. Plans where benefits are paid solely from the employer’s or union’s general assets are exempt.1Office of the Law Revision Counsel. 29 U.S. Code 1112 – Bonding
Errors and Omissions Insurance
Not every state mandates E&O coverage by statute, but operating a TPA without it is reckless. A single claims-processing error affecting hundreds of plan participants can generate legal costs that sink most firms. E&O policies cover defense costs and settlements for professional mistakes such as a claim processed incorrectly or benefits miscalculated. Most carriers and self-insured employers will require proof of coverage as a condition of doing business, often with minimum limits written into the administrative services agreement. Buy a policy built for TPAs or insurance administrators, not a generic professional liability policy, so the coverage lines up with the actual risks of claims administration and fund management.
Open Fiduciary Accounts
Before a state will license you, you need dedicated fiduciary accounts at a federally insured financial institution to hold client premiums and benefit funds. The rule is simple: client money never touches your operating account. Commingling plan funds with your firm’s revenue is one of the fastest paths to license revocation and personal liability.
Keep detailed records showing every deposit, disbursement, and current balance for each plan you administer. If a fiduciary account earns interest, get written authorization from the plan sponsor specifying who keeps it; don’t assume it belongs to your firm. Under ERISA, a TPA that exercises discretionary authority or control over plan assets can itself be classified as a fiduciary, which triggers strict duties of loyalty and prudence toward plan participants.2Office of the Law Revision Counsel. 29 U.S. Code 1002 – Definitions
Assemble the License Application
The application package is document-heavy, and regulators have no patience for incomplete submissions. Expect to provide:
- Biographical affidavits from every officer, director, and person owning 10% or more of the firm. Use the current NAIC Biographical Affidavit, signed no more than six months before you file.3National Association of Insurance Commissioners. Biographical Affidavit – Uniform Certificate of Authority Application
- Audited financial statements showing a positive net worth. Most states want the most recent year; some ask for more. Smaller firms may be allowed to submit reviewed statements instead.
- Fingerprints for state and FBI background checks, focused on financial crimes and any prior regulatory action against your leadership.
- Entity documents: articles of incorporation, bylaws or operating agreement, and proof of good standing in your state of formation.
- A named designated responsible person to serve as the regulatory contact, with relevant industry experience documented through their biographical affidavit.
- A description of the plans you’ll administer (health, life, pension, workers’ compensation) and the states where you’ll operate.
Cross-check every data point across the package before submitting. A name spelled one way on the biographical affidavit and another way on the articles of incorporation, or financial figures that don’t reconcile between documents, will trigger a deficiency notice and slow the process. Signatures must be notarized according to the rules of the state where you’re filing.
File With Each State
TPA applications go directly to state insurance departments. Many states accept electronic filings through the National Insurance Producer Registry, which lets you upload documents, submit fingerprints, and pay fees in one portal.4NIPR. Apply for an Insurance License Some still require original fingerprint cards or certain notarized documents by mail. If you mail anything, use a trackable service and keep the confirmation.
Application fees vary by state, generally a few hundred dollars per jurisdiction. Costs stack up quickly for multi-state operations because you need a separate license in each one. After you submit, states typically take 7 to 10 days to review, though complex filings or those triggering additional background investigation take longer.4NIPR. Apply for an Insurance License Watch your portal during this window. If regulators request additional information, they’ll set a deadline, and missing it can close the application and force you to start over.
HIPAA If You’ll Handle Health Data
If you’ll administer health plans, HIPAA compliance is non-negotiable from day one. A TPA that handles protected health information on behalf of an insurance carrier or self-insured employer is a business associate under HIPAA, which means you sign a Business Associate Agreement with every covered entity you work with before touching any participant data.5HHS.gov. Sample Business Associate Agreement Provisions
The BAA legally obligates you to implement safeguards against unauthorized disclosure, report any breach to the covered entity, make PHI available to individuals who request their records, and return or destroy all PHI when the contract ends. Subcontractors who will access PHI must agree to the same restrictions. A covered entity can terminate your contract for a material violation.5HHS.gov. Sample Business Associate Agreement Provisions If a breach occurs, you have to notify the affected covered entity no later than 60 days after discovering it.6HHS.gov. Breach Notification Rule Penalties for HIPAA violations run into the millions for willful neglect, and since the HITECH Act, business associates are directly liable. Many carriers and self-insured employers now also require SOC 2 Type II certification before signing an administrative services agreement.
After the License Issues
Getting licensed is the start of ongoing work, not the end. Every state requires annual reports covering the plans you administered during the year, the funds you handled, and your current financial condition. These filings typically include audited or reviewed financial statements and a fee. Deadlines vary by state, so if you’re licensed in more than one, build a compliance calendar early.
Renewal runs annually or biennially depending on the state, and each renewal requires updated financial disclosures and proof of a current surety bond. Missing a renewal doesn’t just create paperwork; it can suspend your authority to operate and leave clients searching for a replacement administrator.
Notify the state insurance department of material changes to your business. Ownership changes, changes in control, new officers or directors, and address changes generally have to be reported within 30 days. Failing to disclose changes is one of the most common reasons regulators open enforcement files against otherwise compliant TPAs.
ERISA adds a parallel compliance layer. The Department of Labor imposes reporting and disclosure obligations that run alongside state requirements, including the plan sponsor’s Form 5500 filing.7U.S. Department of Labor. Reporting and Disclosure Guide for Employee Benefit Plans As the firm actually processing claims and managing records, your systems typically supply the underlying data for those filings even when the plan sponsor is technically responsible.
What Happens If You Skip Licensing
Running TPA operations without the required state license carries serious consequences. State insurance departments can issue cease and desist orders that shut down your operations in that state immediately, and civil penalties have historically run from $20,000 to $40,000 or more per enforcement action. Regulators can pursue individuals personally, not just the company.
The knock-on effects are worse than the fines. Contracts entered without proper licensing may be voidable, which can leave you with no way to collect earned fees. Clients who discover you were unlicensed will terminate immediately, and word moves fast in the benefits industry. A history of unlicensed activity can also lead to permanent denial when you eventually apply, because biographical affidavits require disclosure of prior regulatory actions. Regulators read attempts to bypass licensing as a signal for how you’ll handle every other compliance obligation.