Sending client files offshore? What IRS §7216 actually requires

The first question most CPA firm owners ask me is not about price. It is: “Am I allowed to send my clients' information to a team outside the US?” The answer is yes, as long as you do it the way the rules require. Here is what that means in practice.

This is general information for accounting firms, not legal advice. Your own counsel should approve your consent forms and engagement letters.

Who §7216 covers

Internal Revenue Code §7216 applies to tax return preparers and to “tax return information”: information furnished to a preparer for, or in connection with, preparing a return. If the ledgers an outsourcing partner keeps for you will feed a client's return, treat that data as tax return information from day one. That is the safer reading, and it is the one we follow.

Inside the US, and outside it

The regulations allow certain disclosures between people preparing a return inside the United States without separate client consent. That changes once the person receiving the information is located outside the United States, even if they work for your own firm: you need the taxpayer's written consent before anything is disclosed.

What a valid consent needs

• It is signed and dated by the taxpayer before any disclosure happens.
• It identifies your firm, the recipient and the purpose, and describes the information to be shared.
• Consent to use the information and consent to disclose it are separate documents.
• If it doesn't state a duration, it lasts one year from the date it was signed.
• For individual (Form 1040) clients, Rev. Proc. 2013-14 sets out mandatory wording, including a statement that the consent may result in the client's information being disclosed to a preparer located outside the United States.
• Electronic signatures are allowed, for example, a PIN of at least five characters or the taxpayer's typed name.

The Social Security number rule

For Form 1040 clients, a US preparer generally cannot obtain consent to send a client's SSN to a preparer outside the United States. The SSN has to be redacted or masked first. The exception applies only where both firms maintain adequate data protection safeguards, as defined in Rev. Proc. 2013-14, and the US preparer verifies that those safeguards are in place.

In our workflow, SSNs are masked by default. We do not need them to keep the books.

What is at stake

A knowing or reckless unauthorized disclosure is a misdemeanor under §7216, punishable by a fine of up to $1,000, up to a year in prison, or both. Separately, §6713 imposes a civil penalty of $250 per disclosure, up to $10,000 a year, and no intent is required.

Your professional standards still apply

Three AICPA Code interpretations matter when you use a third-party provider:

• ET 1.150.040. Tell your client, preferably in writing, that you use a third-party service provider before you share confidential information. A clause in the engagement letter covers this.
• ET 1.700.040. Either obtain the client's specific consent, or have a contract that requires the provider to keep the information confidential, with reasonable assurance that the provider has procedures to prevent unauthorized release.
• ET 1.300.040. Make sure the provider is competent, and direct, supervise and review their work as you would your own staff's. Responsibility for the client stays with your firm.

As a financial institution under the Gramm-Leach-Bliley Act, your firm also needs a written information security plan (WISP). IRS Publication 5708 provides a template, and the FTC Safeguards Rule requires certain security events affecting 500 or more people to be reported to the FTC, generally within 30 days of discovery.

How we set this up with a new firm

1. Mutual NDA first. We sign it before we see a single record.
2. Your paperwork, our checklist. We share the points your engagement letter and §7216 consent need to cover. Your counsel approves the final wording.
3. Access stays in your systems. We work inside your QuickBooks, Xero or NetSuite with two-factor login and role-based permissions. No client files are stored on our machines.
4. SSNs masked by default. We ask you to redact them before sharing any documents.
5. A clear trail. Our work appears in your platform's activity history, and our security summary and DPA are available on request.

We are honest about the gaps too: SOC 2 and ISO 27001 are on our roadmap, not on our wall. If an independent attestation is a requirement for your firm, tell us on the first call.