OPR: Withdrawing Old Client Authorizations Protects Client Data

The IRS’ Office of Professional Responsibility (OPR) has issued an alert recommending that Circular 230 practitioners routinely withdraw client authorizations when the authorization is no longer needed. To ensure they are withdrawing or canceling all unnecessary authorizations, OPR suggests that practitioners request a list of all their authorizations from the IRS’ Central Authorization File (CAF) Unit.

What is a CAF number.

A CAF number is a nine digit number usually assigned to a practitioner the first time they file a Form 2848, Power of Attorney and Declaration of Representative. IRS employees will ask for a practitioner’s CAF number and check the CAF to validate the practitioner’s authorization to represent the taxpayer before disclosing any taxpayer information.

OPR recommends that practitioners maintain an up-to-date list of open client authorizations filed with the CAF and to withdraw those that are no longer needed, such as when a client engagement ends. Tax practitioners that keep such a list can confirm the accuracy of their records by requesting a list of active authorizations-a CAF77 request-from the IRS under the Freedom of Information Act (FOIA). A sample of the request is available on the IRS’s FOIA Guidelines webpage.

Note. While keeping an up-to-date listing of authorizations is always a best practice, requesting a CAF77 report would be especially prudent if the practitioner is leaving, selling, or retiring from their practice.

Circular 230 obligations.

Circular 230 practitioners — attorneys, certified public accountants, enrolled agents, and tax return preparers who participate in the Internal Revenue Service’s Annual Filing Season Program — are responsible for protecting confidential client information, not only under Circular 230, but also under Code Sec. 6713 and Code Sec. 7216, which provide civil and criminal penalties for the unauthorized use or disclosure of taxpayer information.

The Federal Trade Commission also has authority to establish data safeguarding requirements for professional tax return preparers.

Under Circular 230 tax practice leaders must have “adequate procedures” to ensure that their firm’s members, associates, employees, and contractors comply with Circular 230. This includes adhering to Circular 230’s standards of practice when providing advice, preparing or assisting in the preparation of tax returns or other submissions to the IRS, protecting confidential client information, and guarding against client identity theft.

Why withdraw unneeded authorizations.

Withdrawing unneeded authorizations is important because a practitioner’s obligation to maintain client confidences never ends and an active authorization on the CAF could be used by a cyberthief to gain access to valuable taxpayer information.

According to OPR, Form 2848 will remain in effect until it is (1) revoked by the taxpayer, (2) withdrawn by the representative, or (3) removed from IRS records under the established IRS records retention schedule. The IRS purges most authorizations seven years from the taxpayer signature date. However, authorizations relating to estate tax returns are purged after 15 years and all authorizations expire on the death of the taxpayer and are removed from the CAF when the IRS receives verification of the date of death.

How to withdraw unneeded authorizations.

Practitioners who want to withdraw an authorization must do so in writing, list all pertinent tax matters and tax periods covered by the authorization and must be signed and dated by the withdrawing representative.

OPR notes that the easiest way to withdraw an authorization is to write “WITHDRAW” across the top of the first page of a copy of the Form 2848, sign and date the form below the annotation and then file it with the same CAF unit where the form was originally filed.

Note. The Form 2848 instructions list where the withdrawal request should be sent and provide additional guidance on what the practitioner should do if they do not have a copy of the authorization form.

An efficient and secure alternative to filing paper withdrawal requests with the CAF unit is to use the IRS’ Tax Pro Account. Among other things, Tax Pro Account allows tax practitioners to manage their authorizations, including withdrawing active authorizations. Once a tax practitioner links their CAF number to their Tax Pro Account, they can manage all their active authorizations and can simply check-a-box to withdraw unneeded authorizations.

For more information about Form 2848, see Checkpoint’s Federal Tax Coordinator ¶T-1149. For more about Form 8821, see Checkpoint’s Federal Tax Coordinator ¶S-6311.