Does a CPA firm need client consent before sending tax return information offshore?
Under Treasury Regulation §§301.7216-2(c) and (d), a U.S. tax return preparer generally needs prior written taxpayer consent before disclosing tax return information to a preparer located outside the United States, subject to the regulation’s specific exceptions and facts. The firm and its own adviser determine what applies and obtain the consent.
Section 7216 is usually the first question a U.S. accounting firm asks about outsourced tax preparation, and it is the one most often answered loosely. The short version is that the location of the receiving preparer is what matters: when a U.S. tax return preparer discloses tax return information to a preparer located outside the United States, prior written taxpayer consent is generally required under Treasury Regulation §§301.7216-2(c) and (d), subject to the regulation’s specific exceptions and the facts of the engagement.
This article covers what that requirement looks like in an operational workflow: when the consent has to exist, which format applies to which return type, and the one rule that reshapes how the working file is assembled. It is written for firms planning an outsourced tax workflow and it is not legal or tax advice — the determination belongs to the firm and its own adviser, and this page is a map of what to ask them about. For the surrounding workflow, software and reviewer-control questions, see our guide to tax preparation outsourcing; for the pre-engagement sequence, the CPA firm outsourcing readiness checklist.
What the regulation actually addresses
The rules concern the use and disclosure of tax return information by a tax return preparer. Treasury Regulation §§301.7216-2(c) and (d) deal with disclosures to another tax return preparer, and they treat a recipient located outside the United States differently from one located inside it. That distinction is the whole mechanism. It is not about whether the recipient is an employee or a contractor, and it is not about the commercial shape of the arrangement — a firm’s own staff working from outside the United States raises the same question as an external provider does.
The regulations carry specific exceptions, and whether one applies is fact-dependent. That is the part a summary cannot resolve for a particular engagement, which is why the step below is a conversation with the firm’s adviser rather than a checkbox.
The consent comes before the disclosure
The consent contemplated by the regulations is prior written consent. It is obtained before the tax return information is disclosed, not documented after the fact, and a disclosure that has already happened cannot be converted into a consented one later. In practical terms the consent step sits in engagement setup — alongside the engagement letter and the access arrangements — rather than in the first busy week of the season, when the temptation to move a file first and paper it afterwards is highest.
It also means the firm needs to know, before the workflow starts, which clients it intends to include. A consent process running in parallel with production creates a window in which some files are eligible to move and some are not, and that window has to be managed in the work queue rather than assumed away.
Form 1040-series returns: the wording is prescribed
For Form 1040-series returns, the applicable consent format and language are prescribed by Revenue Procedure 2013-14 or its successor. This is unusual and worth stating plainly: in most of an outsourcing arrangement the firm chooses its own wording, but here the format is governed. A firm should have its adviser confirm the current version of the revenue procedure rather than reuse a template of unknown vintage, because a prescribed format that has been superseded is a drafting problem a signature does not cure.
Returns outside the Form 1040 series
For returns outside the Form 1040 series, the regulations permit another format, including an engagement letter, if it gives the taxpayer sufficient information for informed consent. The flexibility is in the format, not in whether consent is needed. Whether a particular engagement letter carries enough information to constitute informed consent is a judgment for the firm and its adviser, and it is a different question from whether the letter is signed.
For firms whose outsourced work is weighted toward business returns this is the route most often discussed — and it is also where an existing engagement letter is most often assumed to do more work than it does. The relevant return-type pages are Form 1065, Form 1120 and Form 1120-S.
Social Security numbers cannot be consented offshore
This is the rule that changes how the file is built, and the one most frequently misstated in provider summaries. A U.S.-based preparer may not obtain consent to disclose a taxpayer’s Social Security number to a tax return preparer located outside the United States. The Social Security number must be masked or redacted before that disclosure.
There is no consent that unlocks this. It is not a drafting question and it is not negotiable between the firm and the provider — it is a file-preparation step that has to happen before transmission.
What masking means for the working file
Masking the return is the visible part and rarely the hard part. The identifier travels in the package around the return, so the step is only complete when every item carrying it has been addressed:
- Client organizers and intake forms
- Prior-year returns used as a comparison or rollforward basis
- Scanned W-2, 1099, K-1 and other source-document images
- Payroll reports and wage summaries
- Software extracts, proformas and client files exported with identifying fields
- Trial balances or ledgers carrying an owner or employee identifier
A firm that masks the return and transmits unmasked source documents has not completed the step. This requirement — rather than the consent wording — is usually what determines the shape of an outsourced tax process: who prepares the package, where masking happens, and which system holds the unmasked original. Those are questions to settle during scoping, and they form part of the access and information-handling instructions described on our data security page.
What stays with the firm
The CPA or EA firm is responsible for determining the applicable requirements and for obtaining any required consent, with its own tax or legal adviser. Accounstone follows the firm’s documented access and information-handling instructions. We do not provide legal advice, do not determine whether a firm’s arrangement satisfies Section 7216, and do not draft or hold taxpayer consents.
The same boundary applies to the work itself: preparation can be delegated, while tax positions, client advice, final review, approval and the filing and signature decision remain the firm’s. That line is set out on our CPA firm support page, and the workpaper package it produces on tax workpaper preparation.
Official U.S. references
Work from the primary sources rather than from any provider’s summary, including this one. The regulations are fact-specific, and the consent format and the Social Security number rule are the two points on which secondary summaries most often differ.
- IRS Section 7216 Information Center — the agency’s collected guidance for tax professionals.
- Internal Revenue Bulletin 2008-5 — the IRS explanation accompanying the final regulations.
Where to go next
Take the consent question to your firm’s adviser first: it is the step that has to be settled before a file can move, and it is the one no provider can answer on your behalf. Once it is settled, the readiness checklist covers the surrounding steps — scope, access, review controls and a pilot — and the tax preparation outsourcing guide covers how the preparation and reviewer handoff work in practice.