Section 7216 Consent for Offshore Tax Preparation

Section 7216 of the Internal Revenue Code makes it a crime for a tax preparer to disclose or use a client’s return information without permission. For CPA firms using offshore staff, the rule that matters is this: the IRS says that when another preparer helping with the return is located outside the United States, the taxpayer must agree and sign a consent form before anything is shared. If the client’s Social Security number will be visible to that preparer, both firms must keep adequate data safeguards and the consent must say so. Revenue Procedure 2013-14 gives the exact sentences an individual taxpayer’s consent must contain.

What is Section 7216?

It is the federal law that limits how tax preparers can disclose or use the information clients give them. It carries both criminal and civil penalties.

Under IRC Section 7216, a convicted preparer can be fined up to $1,000 for each violation and imprisoned for up to a year. A separate civil penalty under Section 6713 is $250 per improper disclosure or use, and the IRS points out that the civil penalty does not require the disclosure to be knowing or reckless (IRS Section 7216 FAQs). The IRS keeps its guidance in the Section 7216 Information Center.

When do you need consent to use offshore staff?

Whenever return information will reach a preparer located outside the United States, including your own provider’s staff in India or the Philippines. The consent must be signed before the first disclosure.

Normally, disclosing information to another preparer who helps you prepare the return does not need the client’s consent. The exception is location: if that preparer is outside the US, “the taxpayer must agree and sign a form consenting to the disclosure,” in the IRS’s words (IRS FAQ). The CPA Journal makes the same point: consent is always required before disclosure to a preparer abroad (The CPA Journal).

Can you send Social Security numbers offshore?

Yes, but only with the taxpayer’s consent and only if both the US firm and the offshore firm maintain adequate data protection safeguards. Without both, you must mask or redact the SSN first.

The consent itself changes when the SSN is included. Revenue Procedure 2013-14 requires a longer statement telling the taxpayer that their SSN may be disclosed, that both preparers keep safeguards as the 7216 regulations require, and that federal agencies may not be able to enforce US privacy laws against a preparer abroad (Rev. Proc. 2013-14, section 5.04(1)(e)).

How do you decide what each client needs?

Work through four questions for each client before any of their files go to your offshore team.

What must the consent form say?

For an individual taxpayer, the form must include the mandatory statements from section 5.04(1)(b), the TIGTA statement from 5.04(1)(d) and the outside-the-US statement from 5.04(1)(e), and the taxpayer must sign and date it.

• Section 5.04(1)(b) covers disclosure to another preparer for help preparing the return. Its sentences must appear in the order the IRS gives.
• Section 5.04(1)(d) tells the taxpayer they can complain to the Treasury Inspector General for Tax Administration.
• Section 5.04(1)(e) applies because the recipient is abroad: version (i) when the SSN is masked, version (ii) when it is included.
• Affirmative and signed. The taxpayer must actively agree (no opt-out boxes) and sign. You cannot change the form after they sign.
• Separate document. Each consent sits on its own written document, and on paper every line must relate to that consent. Paper forms need 8.5 by 11 inch sheets and at least 12-point type.
• Duration. If you do not state one, the consent lasts one year from the signature date.
• Electronic is fine. Text must be as large as the site’s body text, with enough contrast, and each screen must be printable and signable (Rev. Proc. 2013-14, sections 5 and 6).

Is there a template you can adapt?

Yes. The template below uses the mandatory IRS sentences word for word, with placeholders for your firm, your provider and the client. It is the SSN-included version; the note under it shows how to adapt it if you mask SSNs.

Copy template text

Wording sources: Rev. Proc. 2013-14, sections 5.04(1)(b), (d) and (e)(ii), and the section 7 sample consent. Check the current IRS text before each filing season.

How do you roll consents out across your client base?

Send the consent as its own document in the same e-signature packet as your engagement letter, track who signs, and route non-signers to your US team before busy season starts.

1. Decide which clients go offshore. Start with returns that fit a checklist: W-2 households, simple Schedule C, rental properties.
2. Pick SSN or masked. If your provider works in your systems through a secure virtual desktop with a SOC 2 Type II report, the SSN version is common. Otherwise mask.
3. Send with the engagement letter. A separate document in the same packet, not a clause inside the letter.
4. Track status per client. Add a “7216 offshore consent” field to your practice management system and block offshore assignment until it is signed.
5. Renew each year. State a duration, or rely on the one-year default and re-collect each season.

What other rules apply when you use offshore staff?

Two more: a written information security plan, which the IRS says federal law requires of tax and accounting professionals, and AICPA rules on third-party service providers.

• Written information security plan. The IRS says tax and accounting professionals count as financial institutions under the Gramm-Leach-Bliley Act and must keep a written plan; Publication 5708 provides a template (IRS IR-2026-92). Security events affecting 500 or more people must generally be reported to the FTC within 30 days of discovery.
• FTC Safeguards Rule. Name a qualified individual, run risk assessments, encrypt customer information, require multifactor authentication, and oversee service providers by contract. Firms with fewer than 5,000 customers are exempt from some written-document requirements (The Tax Adviser).
• AICPA confidentiality. Before sharing confidential client information with a third-party provider, either have a contract that requires confidentiality and appropriate safeguards or get the client’s specific consent (Journal of Accountancy). Members should also tell clients they use a provider, preferably in writing and before sharing data (Accounting Today).

When you compare offshore firms, ask how they support all three. Our rankings list each firm’s published security credentials, and the offshore staffing guide covers the rest of the setup.

What else do CPA firms ask?

Where do these facts come from?