Quick answer

Before a US tax return preparer discloses tax return information to a preparer located outside the United States, the firm must obtain the taxpayer's written, signed and dated consent under IRC Section 7216 and Treasury Regulation 301.7216-3. For individual (Form 1040-series) returns, the consent must follow the mandatory format set out in Revenue Procedure 2013-14: a separate standalone document, at least 12-point type, containing prescribed statutory language.

If the offshore preparer will receive the taxpayer's Social Security Number, the consent must say so explicitly and the firm must maintain adequate data protection safeguards. The common alternative is to mask the SSN before transmission, which triggers a different set of mandatory language.

Consent must be obtained before disclosure. There is no retroactive cure.

What Section 7216 actually prohibits

Section 7216 makes it a criminal offence for a tax return preparer to knowingly or recklessly disclose or use tax return information other than in connection with preparing that return, unless an exception applies or the taxpayer consents.

"Tax return information" is broad. It covers anything the taxpayer gives you, anything you derive from it, and the return itself. A trial balance, a bank statement, a K-1, a prior-year return, a client's email describing a transaction - all of it.

The penalties:

Provision	Type	Exposure
IRC §7216	Criminal misdemeanour	Up to $1,000 fine and/or up to one year imprisonment, plus costs of prosecution, per violation
IRC §6713	Civil penalty	$250 per unauthorised disclosure or use, capped at $10,000 per calendar year

The civil penalty applies without any knowledge requirement. A firm that inadvertently transmitted 200 returns offshore without valid consent would hit the annual cap immediately, and would additionally face state board scrutiny and professional liability exposure.

Why offshore is treated differently from domestic

This is the point most firms miss.

Under Treasury Regulation 301.7216-2, a preparer may disclose tax return information to another tax return preparer located within the United States for the purpose of preparing that return, without obtaining consent. This is why you can send a return to a domestic per-diem preparer or a US-based contractor without a consent form.

That exception is expressly limited by geography. The moment the preparer receiving the information sits outside the United States, the exception no longer applies and consent becomes mandatory.

It follows that an offshore preparer working on a virtual desktop hosted in the United States is still an offshore preparer. The relevant question is where the person is, not where the server is. Firms occasionally argue the opposite. Do not build a compliance position on it.

The Social Security Number problem

Regulation 301.7216-3(b)(4) creates a special rule for SSNs going offshore. You have two workable paths.

Path A - disclose the SSN

Permitted only if both conditions are met:

1. The consent specifically states that the taxpayer's SSN will be disclosed to a preparer outside the United States, and
2. both the US firm and the offshore preparer maintain adequate data protection safeguards as defined in the regulations.

The consent must then include this mandatory statement:

"This consent to disclose may result in your tax return information being disclosed to a tax return preparer located outside the United States, including your personally identifiable information such as your Social Security Number ("SSN"). Both the tax return preparer in the United States that will disclose your SSN and the tax return preparer located outside the United States which will receive your SSN maintain an adequate data protection safeguard (as defined by applicable regulations) to protect privacy and prevent unauthorized access of tax return information. If you consent to the disclosure of your tax return information, Federal law may not protect your tax return information from further use or distribution."

Path B - mask the SSN

The US firm redacts or replaces the SSN with a substitute identifier before transmission, and restores it on re-import. Many firms prefer this because it removes the safeguards argument entirely and is simpler to defend on examination.

If you mask, the consent instead states that the SSN will not be disclosed, and includes the corresponding mandatory language confirming the substitution.

Practical note: masking only works if it is systematic. A masked SSN on the return cover sheet is worthless if the offshore team also receives an unredacted W-2 PDF, a prior-year return, or a bank statement showing the number. Audit the whole document set, not just the return.

Format requirements for 1040-series consents

Revenue Procedure 2013-14 imposes strict formatting on consents relating to individual returns. These are not stylistic preferences; a non-conforming consent is an invalid consent.

• Separate document. The consent must stand alone. It cannot be a clause inside your engagement letter, bundled with an e-file authorisation, or combined with a consent for a different purpose.
• Type size. Paper consents must be on 8½ × 11 inch or larger paper with text no smaller than 12-point. Electronic consents must use text at least as large as the standard body text of the surrounding document or interface.
• Signed and dated by the taxpayer, by hand or by a compliant electronic signature method.
• Specific, not general. The consent must identify the intended purpose of the disclosure and the recipient. A consent permitting disclosure to "third-party service providers" as a category will not survive scrutiny.
• Voluntary. You cannot condition provision of services on the client signing. The form must say the client is not required to sign.
• Duration. The taxpayer may specify a period. If none is specified, the consent is valid for one year from the date signed.
• Mandatory statements. Two blocks of prescribed text must appear, reproduced without alteration.

The first is the general statement:

"Federal law requires this consent form be provided to you. Unless authorized by law, we cannot disclose your tax return information to third parties for purposes other than the preparation and filing of your tax return without your consent. If you consent to the disclosure of your tax return information, Federal law may not protect your tax return information from further use or distribution."

The second is the complaints statement:

"If you believe your tax return information has been disclosed or used improperly in a manner unauthorized by law or without your permission, you may contact the Treasury Inspector General for Tax Administration (TIGTA) by telephone at 1-800-366-4484, or by email at complaints@tigta.treas.gov."

Model consent language

Adapt the bracketed fields. Have counsel review before use. Confirm the mandatory language against the current text of Rev. Proc. 2013-14, as prescribed wording is occasionally updated.

 

CONSENT TO DISCLOSE TAX RETURN INFORMATION TO A TAX RETURN PREPARER OUTSIDE THE UNITED STATES

Federal law requires this consent form be provided to you. Unless authorized by law, we cannot disclose your tax return information to third parties for purposes other than the preparation and filing of your tax return without your consent. If you consent to the disclosure of your tax return information, Federal law may not protect your tax return information from further use or distribution.

You are not required to complete this form. If we obtain your signature on this form by conditioning our services on your consent, your consent will not be valid. Your consent is valid for the amount of time that you specify. If you do not specify the duration of your consent, your consent is valid for one year from the date of signature.

Taxpayer name: [Name] Duration of consent: [Specify a date, or leave blank for one year]

I, [Taxpayer name], authorize [Firm name] to disclose to [Offshore provider legal name], located in [Country], the following tax return information for the purpose of preparing my [Tax year] federal and state income tax returns: all information provided by me or obtained by [Firm name] in connection with the preparation of those returns, including supporting documents and schedules.

[Include if the SSN will be disclosed:] This consent to disclose may result in your tax return information being disclosed to a tax return preparer located outside the United States, including your personally identifiable information such as your Social Security Number ("SSN"). Both the tax return preparer in the United States that will disclose your SSN and the tax return preparer located outside the United States which will receive your SSN maintain an adequate data protection safeguard (as defined by applicable regulations) to protect privacy and prevent unauthorized access of tax return information. If you consent to the disclosure of your tax return information, Federal law may not protect your tax return information from further use or distribution.

If you believe your tax return information has been disclosed or used improperly in a manner unauthorized by law or without your permission, you may contact the Treasury Inspector General for Tax Administration (TIGTA) by telephone at 1-800-366-4484, or by email at complaints@tigta.treas.gov.

Signature: ______________________ Date: ____________

 

---

Business returns are different - but not exempt

The Rev. Proc. 2013-14 formatting rules apply to Form 1040-series returns. For partnership, corporate and fiduciary returns, the underlying consent requirement under Regulation 301.7216-3 still applies, but you have more latitude on presentation.

You still need a written consent, signed and dated by an authorised representative of the entity, identifying the recipient and the purpose, obtained before disclosure. Most firms simply use a single conforming template for everything rather than maintaining two standards. It is easier to administer and impossible to criticise.

Five mistakes firms actually make

1. Burying it in the engagement letter. The most common error. A 1040 consent inside an engagement letter is invalid on its face because it is not a separate document.
2. Obtaining consent after the fact. Consent must precede disclosure. If a return has already gone offshore, a consent signed afterwards does not repair it.
3. Treating a US-hosted server as a domestic disclosure. The exception turns on the preparer's location, not the data's.
4. Rolling consent forward automatically. Absent a specified duration, consent expires after one year. Firms that obtained consent in 2025 and assumed it covers the 2026 season are exposed.
5. Assuming §7216 is the whole obligation. It is not.

What Section 7216 does not cover

Compliance with §7216 is necessary but not sufficient. Sitting alongside it:

• AICPA Code of Professional Conduct. The rule on use of a third-party service provider requires members to inform the client before confidential information is disclosed to an outside provider, preferably in writing, or alternatively to enter a contractual confidentiality commitment with the provider.
• State board rules. Several states impose notification or consent requirements that go beyond federal law. Check your licensing jurisdictions.
• Gramm-Leach-Bliley and the FTC Safeguards Rule. Tax preparation firms are financial institutions for this purpose and must maintain a written information security plan. IRS Publication 4557 sets out the IRS's expectations.
• Your engagement letter. Should describe the use of offshore resources, allocate responsibility for review, and address data handling.
• Client contracts. Some corporate clients contractually prohibit offshore processing of their data regardless of what federal law permits. Check before you assume consent solves it.

Implementation checklist

1. Decide SSN strategy - disclose with safeguards, or mask. Document the decision.
2. Draft the consent; have counsel review it.
3. Build it into your client onboarding and annual organiser flow so it is obtained before any file moves.
4. Configure your document management system to record the signed consent and its expiry date against each client.
5. Add a blocking control: no file transmits offshore unless a valid, unexpired consent is on record.
6. Obtain and retain evidence of the offshore provider's data protection safeguards.
7. Update your written information security plan to reflect offshore processing.
8. Re-paper consents annually.

 

---

Frequently asked questions

Do I need client consent to outsource tax returns offshore? Yes. A written, signed and dated consent under IRC Section 7216 and Treasury Regulation 301.7216-3 is required before any tax return information is disclosed to a preparer located outside the United States. There is no exception for offshore preparers equivalent to the one that exists for US-based preparers.

What happens if a firm discloses tax return information offshore without consent? The firm faces a criminal misdemeanour under Section 7216 carrying up to $1,000 in fines and up to one year of imprisonment per violation, plus a civil penalty under Section 6713 of $250 per disclosure to a maximum of $10,000 per calendar year. State board discipline and professional liability claims are additional exposures.

Can the Section 7216 consent be included in my engagement letter? No, not for Form 1040-series returns. Revenue Procedure 2013-14 requires the consent to be a separate standalone document. Including it in an engagement letter renders it invalid.

How long is a Section 7216 consent valid? For the period the taxpayer specifies. If no period is specified, the consent is valid for one year from the date it was signed. Firms sending work offshore in consecutive seasons must obtain fresh consent.

Does masking the Social Security Number remove the need for consent? No. Masking changes which mandatory language the consent must contain, and removes the requirement to demonstrate adequate safeguards for SSN transmission. The underlying consent obligation remains.

Does Section 7216 apply to bookkeeping work sent offshore? Section 7216 applies to tax return information held by a tax return preparer. Pure bookkeeping for a client to whom you provide no tax services sits outside it, but the analysis is fact-specific and the AICPA third-party service provider rule still applies. Most firms take the conservative route and paper everything.

Can I get consent electronically? Yes, provided the electronic consent meets the format requirements - including text sized at least as large as the surrounding standard body text - and uses a signature method that reliably identifies the taxpayer and records the date.

 

Staunch Fintech prepares US individual and business returns for CPA firms and businesses from India, and we work within our clients' Section 7216 processes rather than around them. If you are building an offshore tax workflow and want to see how the consent, masking and file-transfer controls fit together in practice, get in touch and we will walk you through ours.