Section 7216 Consent for Offshore Tax Return Preparation: What the Regulations Require

A firm that sends individual tax return work to a preparer outside the United States is disclosing tax return information, and Internal Revenue Code section 7216 governs that disclosure. The statute is criminal. The regulation, 26 CFR 301.7216-3, sets the consent rules, and Revenue Procedure 2013-14 prescribes the language. This post covers each layer and the one rule that stops many offshore arrangements cold: the restriction on disclosing a Social Security number abroad.

The statute and its penalty

Section 7216(a) makes knowing or reckless unauthorized disclosure or use of tax return information by a tax return preparer a misdemeanor. The penalty is a fine of not more than $1,000, imprisonment of not more than one year, or both, together with the costs of prosecution. Where section 6713(b) applies, the fine ceiling is $100,000. Section 7216(b) lists exceptions, including disclosures made under other provisions of the Code, disclosures under court order, and disclosures and uses that Treasury regulations permit.

Those regulations decide the practical question. The default under 301.7216-3(a)(1) is that a preparer cannot disclose or use a taxpayer's tax return information before obtaining the taxpayer's written consent. The consent must be knowing and voluntary. Conditioning the preparation of the return on the taxpayer's agreement to a disclosure makes the consent involuntary, subject to the preparer-to-preparer exception in 301.7216-3(a)(2).

When offshore preparation needs consent

The regulation carries preparer-to-preparer provisions in 301.7216-2(c) and (d). Sending information to a preparer located outside the United States is a separate case: 301.7216-3(a)(3)(i)(D) requires the taxpayer's consent before any disclosure to a preparer outside the United States, and Rev. Proc. 2013-14 section 5.04(1)(e) repeats that requirement with a cross-reference to 301.7216-2(c) and (d). The consent is a signed, dated written document. Section 301.7216-3(a)(3)(i)(E) requires the taxpayer's signature and date.

The SSN rule: 301.7216-3(b)(4)

For taxpayers filing the Form 1040 series, 301.7216-3(b)(4) sets a hard restriction:

• A preparer located in the United States cannot obtain consent to disclose the taxpayer's Social Security number to a preparer located outside the United States.
• When the taxpayer consents to disclosure of other return information, the US preparer must redact or otherwise mask the SSN before disclosure.
• One exception exists. The US preparer discloses the SSN through an adequate data protection safeguard, as defined by IRS guidance, and verifies those safeguards in the consent request.
• An SSN the US preparer received from the offshore preparer can be sent back to that preparer without consent.

Rev. Proc. 2013-14 supplies two separate sets of mandatory language for the offshore case. The first covers disclosure with the SSN fully masked and states that the consent covers disclosure of the taxpayer's return information to a tax return preparer located outside the United States. The second covers disclosure of the SSN under the safeguard exception and states that the SSN will be disclosed and that a data protection safeguard protects the information. The firm selects the language that matches the actual workflow. A workflow that sends unmasked SSNs without a verified safeguard has no valid consent available.

For a firm, the operating consequence is plain. Build the offshore workflow so that SSNs never leave the US environment: mask them in the source documents, use a taxpayer reference number in the offshore workspace, and re-attach the SSN at the US review and e-file step.

Rev. Proc. 2013-14: form and content

Revenue Procedure 2013-14 sets the form and content of a consent to disclose or use Form 1040 series return information. The requirements that matter here:

• The consent contains all required elements and the mandatory language for the type of disclosure, and the taxpayer signs and dates it.
• It is formatted so the taxpayer can read it, and it pertains solely to the disclosure or use it authorizes. One document can cover multiple disclosures if each is specifically and separately identified, but a single document cannot authorize both uses and disclosures (301.7216-3(c)(1)).
• The consent is knowing and voluntary. For most disclosures, a firm that makes return preparation conditional on consent invalidates the consent. The exception is disclosure to another tax return preparer to assist in preparing the return, including a preparer outside the United States: under 301.7216-3(a)(2) the firm may condition its services on that consent, and the Rev. Proc. 2013-14 language for that context says the firm may decline to provide services or change their terms if the taxpayer does not sign.
• The consent states its duration. When it states none, the consent is valid for one year from the date the taxpayer signed.

Use the sample language in the revenue procedure. Paraphrase it and the consent can fail the mandatory-language requirement. The IRS publishes the document at irs.gov.

Operating checklist

1. Decide the workflow. Masked SSN, or verified safeguard exception. Document the choice.
2. Draft from the revenue procedure. Use the mandatory language for the disclosure type, and keep the offshore consent separate from other consents and from the engagement letter.
3. Collect signature and date before any information moves. A consent signed after the disclosure does not cure it.
4. Track duration. Record the expiration date from the consent and refresh before a new tax year's work begins when the consent states one year or less.
5. Mask and test. Add a pre-transfer control that checks every document in the offshore workspace has the SSN removed.
6. Keep the consent. File it with the return workpapers under the firm's retention policy.

How 7216 fits with the other rules

Section 7216 stands beside the AICPA confidentiality rules, not in place of them. A firm that complies with the Code's ET 1.700.040 route still needs the 7216 consent for return information. An auxiliary service provider under the 7216 regulations may also be a third-party service provider under the AICPA interpretation, so test each provider against both (Journal of Accountancy, March 2015). For the ethics side, see ET 1.700 confidentiality and client data offshore and the overview of offshore workpaper preparation under the AICPA Code. The FTC Safeguards Rule adds data-security duties for the same data: see the FTC Safeguards Rule for CPA firms.

Audit-only work does not trigger 7216, because 7216 covers tax return preparers and their tax return information. A firm with audit and tax clients maintains consent practices for the tax side and the ET 1.700.040 route for the audit side.

Sources

• 26 U.S.C. 7216 (misdemeanor; $1,000 fine; one year; $100,000 where 6713(b) applies; exceptions in (b)): https://www.law.cornell.edu/uscode/text/26/7216
• 26 CFR 301.7216-3, consent requirement, (b)(4) SSN disclosure outside the United States, signature and duration rules: https://www.ecfr.gov/current/title-26/chapter-I/subchapter-F/part-301/subpart-ZZ/section-301.7216-3
• Rev. Proc. 2013-14, form and content of consent to disclose or use Form 1040 series tax return information: https://www.irs.gov/pub/irs-drop/rp-13-14.pdf
• Journal of Accountancy, "AICPA confidentiality rule" (March 2015), on auxiliary service providers under 7216 and third-party service providers: https://www.journalofaccountancy.com/issues/2015/mar/aicpa-confidentiality-rule.html

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error