IRS Section 7216 consent for offshore bookkeeping: what CPA firms need before a file leaves the US

Every US CPA firm that talks to us about offshore bookkeeping asks the same question in the first call: do we need our clients' permission before your team sees their data? The answer sits in Internal Revenue Code Section 7216 and its regulations, and it depends less on where your vendor is than on what kind of information the vendor touches.

We are a Chartered Accountancy firm in Ahmedabad that does this work for US firms, so we have a stake in getting it right. This is a practitioner's map of the rules, with the regulation cited for each point. It is not legal advice; your firm's counsel or ethics resource should sign off on your own consent forms.

What Section 7216 covers, and what it costs to get wrong

Section 7216 makes it a crime for a tax return preparer to knowingly or recklessly disclose or use tax return information for any purpose other than preparing the return, unless an exception or the taxpayer's consent applies. A violation is a misdemeanor with a maximum of one year in prison, a fine of up to $1,000, or both (Treas. Reg. 301.7216-1(a)). The civil side is Section 6713: $250 for each improper disclosure or use, capped at $10,000 a year, rising to $1,000 per disclosure and $50,000 a year where the disclosure is tied to identity theft.

The definitions are wide. A 'tax return preparer' includes anyone in the business of preparing returns or providing auxiliary services in connection with them. 'Tax return information' is any information, including a name, address or identifying number, furnished in any form or manner for, or in connection with, the preparation of a tax return (301.7216-1(b)(2) and (b)(3)).

Is bookkeeping data tax return information?

Not automatically. The regulation excludes information that was obtained otherwise than in connection with preparing a return, even if identical information later reaches the preparer. The IRS's own example: data a firm holds for another purpose is not tax return information until it is used to populate the return, and from that point the information associated with the return is (301.7216-1(b)(3), Example 2).

In practice, for a firm that both keeps the books and prepares the return, the line blurs quickly. The same trial balance drives the 1120-S, the same general ledger answers the preparer's questions. This is how we would sort the work:

What the offshore team touches	Likely treatment	Our practical view
Monthly bookkeeping in the client's QuickBooks Online or Xero, furnished for keeping the books	Generally outside the definition	Still get consent if the same books will feed a return your firm prepares
Year-end adjustments, tax workpapers, book-to-tax reconciliations	Tax return information	Consent before any access
Draft individual or business returns, tax organizers, prior-year returns	Tax return information	Consent before any access; mask SSNs on 1040-series work
Client lists, names and addresses gathered during tax engagements	Tax return information (names and addresses are named in the definition)	Consent before sharing, even for scheduling or admin help

If you cannot say with confidence which bucket a client file sits in, treat it as tax return information and get the consent. The form costs a signature; the penalty is per disclosure.

What changes when the recipient is outside the US

Inside the US, the regulations let staff of the same firm share return information to prepare returns, and let one preparer pass information to another for return preparation in limited cases, without consent. Neither exception travels. If the recipient is located outside the United States or its territories, the taxpayer's consent is required before any disclosure, including to your own firm's offshore staff (301.7216-2(c)(2) and (d)(1)).

Hosting does not change this. In the regulation's Example 3, a contractor abroad that only views data stored on a US server still needs the taxpayer's prior consent (301.7216-2(d)(3)). Working inside your QuickBooks Online or tax software subscription is better for security and control, but it is still a disclosure for Section 7216 purposes.

The Social Security number rule

For Form 1040-series taxpayers, a US preparer may not even obtain consent to send the taxpayer's SSN to a preparer outside the US. The SSN has to be masked or redacted before the rest of the information goes across (301.7216-3(b)(4)(i)).

There is one exception. The SSN can be disclosed with consent if both the US firm and the offshore recipient maintain an 'adequate data protection safeguard', which Rev. Proc. 2013-14 section 5.07 defines as a management-approved security program that meets one of the privacy or security frameworks it lists, both when consent is obtained and when the disclosure is made. The consent must then carry a longer statement that names the SSN and the safeguard (section 5.04(1)(e)(ii)).

For most bookkeeping and return-support work, masking is simpler and safer than building the safeguard case. Set your tax software and document portal so the offshore team never sees a full SSN.

What a valid consent must contain

1. Your firm's name and the taxpayer's name (301.7216-3(a)(3)(i)(A)).
2. The purpose of the disclosure and who receives it, for example your offshore bookkeeping or return-support provider (301.7216-3(a)(3)(i)(B)).
3. The specific tax return information to be disclosed (301.7216-3(a)(3)(i)(C)).
4. The taxpayer's signature and date, obtained before any disclosure. There is no retroactive consent (301.7216-3(a)(3)(i)(E) and (b)(1)).
5. A duration if you want one. If the form is silent, consent lasts one year from signature (301.7216-3(b)(5)).
6. An affirmative choice by the taxpayer. Opt-out consents, where the client has to untick a box, are not permitted (Rev. Proc. 2013-14 section 5.04(2)).

Format rules matter too. Each disclosure consent is its own document, separate from any consent to use information (section 5.01 and 5.05). Paper forms must be at least 8.5 by 11 inches in 12-point type or larger, with nothing on the page except the consent (section 5.02). Electronic consents must be signable, datable and printable on each screen (section 5.03). Give the client a copy of the signed consent at the time of signing (301.7216-3(c)(3)).

Rev. Proc. 2013-14's mandatory wording applies to taxpayers who file Form 1040-series returns. For business clients filing 1120, 1120-S or 1065, the regulation still requires consent before an offshore disclosure, but the Rev. Proc. lets you use its language or another consent that meets the regulation (section 4). Using the 1040 wording for every client keeps your staff on one form.

Sample consent wording (Form 1040-series, SSN masked)

The statements below are the IRS's mandatory text from Rev. Proc. 2013-14 section 5.04(1)(b), (d) and (e)(i), for a disclosure to a preparer outside the US for help preparing the return, with the SSN masked. The bracketed parts are yours to fill in. If the disclosure is for a purpose other than preparing the return, section 5.04(1)(a) applies instead and adds that the client is not required to sign to get your tax services. Check the current text with your counsel before you use it.

Federal law requires this consent form be provided to you. Unless authorized by law, we cannot disclose your tax return information to third parties for purposes other than those related to the preparation and filing of your tax return without your consent. If you consent to the disclosure of your tax return information, Federal law may not protect your tax return information from further use or distribution.

If you agree to the disclosure of your tax return information, your consent is valid for the amount of time that you specify. If you do not specify the duration of your consent, your consent is valid for one year from the date of signature.

This consent to disclose may result in your tax return information being disclosed to a tax return preparer located outside the United States.

I, [taxpayer name], authorize [your firm name] to disclose to [offshore provider name, city, country] my tax return information for tax year [year], namely [list the information, for example: general ledger, bank and credit card statements, Forms W-2 and 1099 received, prior-year return with SSN masked], to allow [offshore provider] to assist in the preparation of my [year] income tax return. Duration of consent: [date or period].

If you believe your tax return information has been disclosed or used improperly in a manner unauthorized by law or without your permission, you may contact the Treasury Inspector General for Tax Administration (TIGTA) by telephone at 1-800-366-4484, or by email at complaints@tigta.treas.gov.

Signature of taxpayer, printed name and date. Keep the signed copy with the engagement file and give one to the client.

A workflow that keeps the firm clean

1. List every client whose files the offshore team will touch, and sort them with the table above.
2. Send the consent with the engagement letter, as a separate document, before any file moves. Do not bury it in the engagement terms.
3. Record the signature date and expiry for each client, and stop access when a consent lapses or the client declines.
4. Mask SSNs in your tax software, document portal and any workpaper the offshore team opens.
5. Keep the work inside systems you own, with named user access you can revoke the same day.
6. Put the Section 7216 and 6713 obligations in writing in your agreement with the offshore provider, including that it may not reuse or pass on the information.

Questions to ask any offshore partner

• Which of your clients' files will you need, and which can you work without?
• Do you work inside our systems, or do you need data exported to yours?
• How do you handle SSNs: do you ever see them, and if so under which security framework?
• Who on your side is accountable for confidentiality, by name and qualification?
• What happens to our data and access when one of your people leaves?

Where ADAPT fits

ADAPT & Associates LLP is a Chartered Accountancy firm in Ahmedabad, India, regulated by the Institute of Chartered Accountants of India and led by six CA partners with 7 to 10 years of experience each. We are not a US company and we do not give US legal advice. We work inside your QuickBooks Online, Xero or Sage subscription under NDA, with access you grant and can revoke. Before any work touches tax return information, your firm needs the client's Section 7216 consent, and we will tell you where we think that line falls on each engagement.

White-label or direct, the overnight handoff, access and security, and how the one-month pilot works. See US bookkeeping services from India

Hourly, FTE and retainer rates from India in 2026, and the review cost that decides whether you save money. Read: offshore bookkeeping cost for CPA firms

Price an offshore team per client book or per role against your own payroll numbers. Open the offshore bookkeeping cost calculator

Tell us your client count, software and which files would move. We will reply with a scope and a fixed monthly number. Book a scoping call