IRC Section 7216 is the rule every outsourcing conversation eventually reaches. It makes knowing, unauthorized disclosure or use of tax return information by a preparer a criminal matter, with civil penalties alongside under Section 6713. For firms sending preparation work offshore, it's the compliance keystone — and, handled properly, a routine part of intake rather than an obstacle.
What the Rule Covers
"Tax return information" is essentially everything a client gives you for return preparation and everything derived from it. Disclosure to third parties generally requires the client's written consent, with regulations (Treas. Reg. 301.7216) prescribing the format, content, and timing of that consent.
The Offshore Specifics
Disclosure to a return preparer located outside the United States has heightened requirements:
- Consent must be obtained before any return information is disclosed offshore
- The consent must identify that the disclosure will be made to a preparer outside the United States
- If the information includes the taxpayer's Social Security number, it may be disclosed offshore only with specific consent and only where the transmission and offshore environment meet adequate data-protection safeguards — many workflows simply mask or withhold SSNs from the offshore file
- Consents must state the duration they cover and be signed before work begins
Building 7216 Into Your Intake (So It's Never a Scramble)
- Add the offshore-disclosure consent to your standard engagement package, alongside the engagement letter and organizer — obtained once, at intake, before season pressure
- Use the regulatory language requirements exactly; this is not a place for improvised wording
- Track consent status in your workflow system so no return routes offshore without a signed consent on file
- Retain consents with the client file for the prescribed period
What Clients Actually Say
Firms are often surprised: framed plainly — "we use a security-compliant preparation team, your data is protected, your return is reviewed and signed here" — the overwhelming majority of clients sign without concern. Transparency builds more trust than silence.
Provider Responsibilities
Your outsourcing partner should supply a tested consent workflow, accept SSN-masked files where you prefer it, and contractually bind its staff to confidentiality consistent with 7216/6713 exposure. GTPH provides a complete 7216 consent kit — template consents, intake checklist, and tracking guidance — as standard onboarding, because compliance that depends on improvisation isn't compliance.
This article is general information, not legal advice; confirm your consent forms with counsel.
