It is mid-January. The firm's team in India is trained and ready to start on individual returns, and the first batch of scanned W-2s and brokerage statements is sitting in the portal. The engagement letters went out in December. Nobody added a Section 7216 consent to them.
If those documents are released to the offshore team today, each one is a disclosure the client has not authorised. The fix is a signed form, and the time to put it in place is now, before busy season, not after the first upload.
What Section 7216 consent covers
Section 7216 of the Internal Revenue Code makes it an offence for a preparer to disclose or use a client's tax return information without permission. The regulations define that term broadly. It reaches any information furnished "for, or in connection with, the preparation of a tax return", in any form, plus whatever the preparer derives from it.
Most disclosures a firm makes while preparing a return are allowed without a form. One exception matters here. Where the person receiving the information is located outside the United States, the client's written consent is required before anything is sent.
When consent is required
Location decides it. What matters is where the recipient sits, not whether they are your employee. A staff member in your own India office needs the same consent as an outside provider.
| Situation | Consent needed? | Where the rule sits |
|---|---|---|
| Your own staff in the United States | No | §301.7216-2(c) |
| Another US preparer helping with the return | No | §301.7216-2(d)(1) |
| Your own staff or affiliate outside the US | Yes, before disclosure | §301.7216-2(c)(2) |
| A contractor or delivery partner outside the US | Yes, before disclosure | §301.7216-2(d), Example 3 |
| A client's SSN to anyone outside the US | Only with consent and an adequate data protection safeguard at both ends | §301.7216-3(b)(4) |
Consent comes first. A signature collected after the documents have moved does not cure the disclosure. Build the form into onboarding so it is signed before the portal opens.
The Social Security number rule
By default the position is strict. A US preparer may not obtain consent to send a client's Social Security number to a preparer outside the United States, and must mask or redact it before the information leaves.
There is one way around it. Under Rev. Proc. 2013-14, a firm may disclose the number with consent if both the US firm and the offshore recipient maintain an adequate data protection safeguard, both when consent is obtained and when the disclosure is made. IRS guidance defines that as a security programme approved and implemented by management, with administrative, technical and physical safeguards, that conforms to a recognised framework. Accepted frameworks include the AICPA/CICA Privacy Framework, IRS Publication 1075, an industry standard accepted as good practice, or another framework offering the same level of protection.
In practice, many firms mask. If your workflow can run with the last four digits or a client code, masking removes the question entirely and changes the wording your consent needs.
What the consent form must say
For clients filing a Form 1040-series return, Rev. Proc. 2013-14 sets the format and content. Here are the main requirements.
A separate document. The consent must stand on its own, on paper or on screen. It can travel as an attachment to the engagement letter, but every sheet must deal only with the disclosure it authorises.
The mandatory statements, in order. These cover why federal law requires the form, what the client need not sign, the duration rule, and a TIGTA contact for complaints about misuse.
The offshore sentence. Where the SSN is masked, the form must state that the consent "may result in your tax return information being disclosed" to a preparer outside the United States. Where the SSN is included, a longer statement is required. It confirms that both preparers maintain an adequate data protection safeguard, and warns that US agencies might be unable to enforce American privacy law against the offshore recipient.
An affirmative signature. Opt-out forms are not allowed. On paper the client signs by hand. Electronically, the client types an assigned PIN of at least five characters, types their own name, or enters five or more characters unique to them. Software may not pre-fill the signature so that one click completes it.
Readable and complete. Paper forms need at least 12-point type. The firm cannot hand over a form with blanks to fill in after signing.
A stated term. If the form does not say how long consent lasts, it runs for one year after the client signs. A firm that collected consent last January should check whether it has lapsed.
Business clients are simpler. For taxpayers outside the 1040 series, the regulation allows the consent in any format, including within the engagement letter, provided it meets the general requirements in §301.7216-3.
Bookkeeping data is not automatically tax return information
This matters to firms whose offshore team does the monthly close rather than the return. Under the regulation, information is connected with return preparation if the client would not have provided it but for engaging you to prepare the return. It also excludes identical information obtained otherwise than in connection with return preparation.
Bank feeds and invoices a client gives you for a monthly close would usually have been provided anyway. Workpapers built for the return, the return itself and the tax organiser are a different matter. Where the same team handles both, the cleaner course is to take consent for every client and stop drawing the line case by case. Your counsel or state society can confirm how the rule applies to your engagement structure.
The penalties
| Penalty | Amount | Source |
|---|---|---|
| Civil, per unauthorised disclosure or use | $250, capped at $10,000 a year | IRC §6713(a) |
| Civil, where linked to identity theft | $1,000, capped at $50,000 a year | IRC §6713(b) |
| Criminal, knowing or reckless disclosure | Fine up to $1,000 ($100,000 where §6713(b) applies), up to one year in prison, or both | IRC §7216(a) |
Money is rarely the larger cost. A consent failure surfaces when a client complains, a breach occurs or a reviewer asks, and by then it is a conversation about trust.
The security plan sits alongside the consent
Consent permits the disclosure. It does not protect the data. In IR-2026-92, issued on 18 August 2026, the IRS and the Security Summit reminded tax and accounting professionals that federal law requires them to keep a written information security plan. Publication 5708 provides a template.
FTC's Safeguards Rule adds two points relevant to offshore work. Firms must select service providers capable of maintaining appropriate safeguards, require those safeguards by contract and assess them periodically. And a security event involving the information of at least 500 consumers must be reported to the FTC within 30 days of discovery.
Questions to put to an offshore delivery partner
Your firm stays the preparer that obtains consent, so your firm carries the risk. Ask the partner for answers in writing.
Who sees what. Which roles open tax workpapers or source documents, and whether access is limited by client and by engagement.
Where data lives. Whether files stay in your systems or are copied to the partner's, and what happens to copies when the work ends.
Which framework. If SSNs will be shared, which recognised security framework the partner's programme conforms to, and who in management approved it.
Employees or contractors. Whether the people doing the work are employed by the partner or subcontracted again, because each extra hand is another recipient your consent and your contract need to cover.
What happens after an incident. How quickly the partner will tell you, so that you can meet the FTC's 30-day reporting window.
A pre-season checklist
1. List every person outside the US who will see client tax information this season, including your own staff and any provider's team.
2. Decide on SSNs. Mask by default, or document the safeguard framework at both ends before using the longer consent wording.
3. Add the consent to onboarding so it is signed before documents are uploaded, with a clear duration.
4. Check last year's consents. Any without a stated term expire one year after signing.
5. Update the security plan and the provider contract to cover the offshore team.
6. Keep a copy of each signed consent and a record of when the first disclosure was made.
What a signed consent will not fix
It will not make a weak process secure. If files move by personal email or an offshore laptop has no encryption, the consent only means the client agreed to a disclosure. It does not mean the disclosure was safe.
It will not settle state rules or client contracts either. Some state boards and some engagement letters set their own confidentiality terms, and those apply on top of federal law.
Frequently asked questions
Do CPA firms need client consent to use offshore staff?
Yes, if tax return information will be disclosed to anyone located outside the United States. The rule applies to the firm's own employees abroad as well as to outside providers, and consent must be signed before the first disclosure.
Can a tax firm send Social Security numbers to an offshore team?
Only with the client's consent and only if both the US firm and the offshore recipient maintain an adequate data protection safeguard as defined in Rev. Proc. 2013-14. Otherwise the SSN must be masked or redacted before the information leaves the United States.
How long does a Section 7216 consent last?
As long as the form states. Where no duration is given, consent lapses one year after the client signed.
Can Section 7216 consent be signed electronically?
Yes. The client must affirmatively enter a PIN of at least five characters, type their own name, or enter five or more characters unique to them, and the software may not pre-fill the signature.
What is the penalty for disclosing tax return information without consent?
Civil penalties start at $250 per disclosure, up to $10,000 a year, rising to $1,000 and $50,000 where the disclosure relates to identity theft. A knowing or reckless disclosure is also a misdemeanour carrying a fine and up to one year in prison.
Where CFOLogic fits
CFOLogic works with accounting and tax firms as a delivery partner: monthly close, AP and AR, FP&A and CFO support, delivered in your name and inside your own software. Delivery is hybridshore: a US lead in your time zone with a team of employees at our Center of Excellence in Pune, India. We are not a CPA firm, so the consent obligation and the decision about what reaches offshore staff stay with your firm, and we work to the controls you set.