Do you need your clients' consent to send tax returns to an offshore preparer?

A busy season fills the desk, and sending some of the work to a team in another country looks like the obvious way out. Before any return leaves the building, there is one rule to settle. The short answer is yes, you need the client’s written consent, and the rules around it are more specific than most firms expect.

What does Section 7216 prohibit?

Section 7216 of the Internal Revenue Code makes it a misdemeanor for a tax return preparer to knowingly or recklessly disclose return information, or to use it for anything other than preparing the return. The penalty is a fine of up to $1,000, up to one year in prison, or both, plus the costs of prosecution (26 U.S.C. 7216(a), retrieved October 12, 2026).

A civil penalty sits alongside it. Under 26 U.S.C. 6713, a paid preparer who makes a prohibited disclosure or use owes $250 for each one, with a cap of $10,000 for the calendar year.

The definition of preparer is wider than people assume. It covers anyone engaged in the business of preparing returns, and it also covers anyone “providing services in connection with the preparation of” returns. A firm that hires out part of the work is inside the rule, and so is the vendor that receives it.

When is consent required for an offshore preparer?

Whenever the recipient is a tax return preparer located outside the United States, the taxpayer’s consent is required before any disclosure (26 CFR 301.7216-3(a)(3)(i)(D), retrieved October 12, 2026). The consent must be written, knowing and voluntary, and it has to come before the information moves. There is no retroactive consent.

This applies to your own staff too. A colleague in the same firm can use return information to help prepare a return, but if that person sits outside the United States, the regulation requires consent first (26 CFR 301.7216-2(c)(2)). A contractor abroad is the same. The location of the person who receives the information decides the question, not the type of contract.

The consent has to name the preparer and the taxpayer, state the purpose and the recipients, say what information is covered, and carry the taxpayer’s signature and date. The exact wording the IRS requires for Form 1040 clients is set out in a separate guide.

What about Social Security numbers?

For Form 1040 series clients, a US preparer generally cannot obtain consent to disclose a Social Security number to a preparer outside the United States. The number has to be redacted or masked before the information goes abroad (26 CFR 301.7216-3(b)(4)).

There is one exception. Consent for the number can be obtained only when both preparers maintain an adequate data protection safeguard at the time the client consents and at the time of disclosure. Rev. Proc. 2013-14 describes that as a management-approved and implemented security program with administrative, technical and physical safeguards. The program must meet or conform to one of the listed frameworks, which include the AICPA/CICA Privacy Framework and the requirements of IRS Publication 1075 (Rev. Proc. 2013-14, section 5.07).

Put plainly, a firm cannot rely on the offshore provider’s word that its systems are secure. Both sides need a documented program, and the consent request itself must say so.

Can you make consent a condition of the engagement?

It depends on what the client is consenting to. For most disclosures, conditioning your services on consent makes the consent involuntary, and an involuntary consent is not valid (26 CFR 301.7216-3(a)(1)).

The exception is the case this article is about. When the disclosure is to another preparer who will help prepare the return, the regulation allows the firm to condition the engagement on consent. The IRS wording for that case says the firm “may decline to provide you with tax return preparation services or change the terms (including the cost)” if the client does not sign (Rev. Proc. 2013-14, section 5.04(1)(b)).

Put differently, you can tell a client that offshore preparation is how you do the work, and that the fee or the engagement depends on it. You cannot hide it, and you cannot backdate it.

What happens if consent is missing?

The exposure is both criminal and civil, and it attaches per disclosure. The $250 civil penalty applies to each prohibited disclosure or use, so a batch of returns sent without consent produces many violations, not one. The cap of $10,000 for the year limits the civil amount, and the criminal provision has no such cap.

There is also a practical cost. A client who finds out afterward that the return was handled abroad without a signature has a legitimate complaint, and the signed consent is the document that answers it.

What should a firm do before the next busy season?

Three things settle most of the risk. Decide which returns will go offshore and which systems will carry the data. Put the right consent in front of each affected client before any file moves. Keep the signed consent with the engagement record, since the consent period runs one year from signature when it states no other duration.

If you are choosing a provider, ask for its written security program and which framework it follows. The answer decides whether Social Security numbers can ever be part of the transfer.

This article is general information about US tax-return rules. It is not tax or legal advice, and your firm should confirm how the rules apply to its own engagements.