A client uploads a W-2, two Schedule K-1s, and last year’s tax return. Your offshore preparer needs those documents to begin working on the file.
The firm uses cloud-based tax software, and the preparer connects through a remote desktop. But who approved access to this client’s information? Can the preparer download the documents? And who makes sure that access ends when the assignment is complete?
These are the questions CPA firms need to settle before sharing taxpayer information overseas.
Protecting client data when outsourcing tax preparation services requires proper disclosure consent, secure document collection, controlled remote access, individual user permissions, and ongoing provider oversight.
The IRS reinforced the importance of these safeguards in its August 2026 reminder about Written Information Security Plans.
Here’s how to put those protections into your existing tax preparation workflow.
Suppose your offshore preparer works entirely through a U.S.-hosted virtual desktop. Client documents never leave that server, and downloading and printing are disabled.
Do you still need the client’s permission to share their tax information overseas?
Generally, yes.
The Treasury regulations under Section 7216 specifically address this situation. In one example, an offshore contractor can only view taxpayer information on a U.S. server. The regulation still requires consent because the information is being disclosed to someone outside the United States.
When a U.S. tax preparer receives taxpayer information and wants to disclose it to an offshore preparer, IRC Section 7216 generally requires the taxpayer’s prior consent, subject to applicable regulatory exceptions.
For Form 1040-series returns, IRS Revenue Procedure 2013-14 specifies additional requirements. Consent generally needs its own written document, although that document may be attached to an engagement letter. It must contain the required disclosures and be affirmatively signed.
So an ordinary engagement-letter signature shouldn’t automatically be treated as Section 7216 consent.
There’s also a separate professional responsibility to consider. The AICPA Code of Professional Conduct addresses informing clients about third-party service providers and maintaining confidentiality. Those ethical requirements don’t replace the IRS consent rules.
Have someone in your firm verify the applicable authorization before the return enters the offshore preparation queue.
A client’s Social Security number needs particular attention.
For the applicable Form 1040 overseas-disclosure rules, the SSN generally must be masked or redacted unless the specific conditions for disclosing it are met. Those conditions include adequate data protection safeguards maintained by both the U.S. and offshore preparers, along with compliant taxpayer consent. The IRS explains these requirements in Revenue Procedure 2013-14.
For example, if your operations team receives a completed organizer but the required offshore consent is missing, keep that return out of the offshore assignment queue. Resolve the authorization first, or consider domestic preparation if the client declines.
Your client emails a brokerage statement, uploads a W-2 to the portal, and sends an updated K-1 directly to the tax manager.
The documents have arrived. But now the firm has copies in three places, and the preparer may not know which K-1 is current.
That’s where secure tax document sharing needs more thought than simply choosing somewhere to store files.
Use an approved portal to collect source documents and manage missing-information requests. Tax practice management software such as Canopy or TaxDome can help keep those requests tied to the appropriate engagement.
For instance, if a preparer identifies a missing K-1, the client-facing team can request it through the portal. Once received, an authorized staff member checks the document and makes it available to the assigned preparer.
Access permissions still matter. A portal isn’t automatically secure because it comes with accounting software. The firm must configure user access, authentication, and document-sharing settings appropriately.
Ask your team how it handles revised tax documents.
If a client replaces an incorrect 1099, can the reviewer identify the latest version? Does the original remain available where record retention requires it? And could an outdated copy still be sitting in an employee’s inbox?
Prefer controlled document links and approved storage locations over routinely forwarding sensitive attachments.
That doesn’t mean every email is unsafe. An appropriately secured email system can serve legitimate purposes. The concern is sending unprotected taxpayer documents through channels the firm cannot adequately control.
The IRS’s October 2026 security reminder also warns tax professionals about fraudulent document requests and malicious email attachments. Staff should verify suspicious requests before opening or sharing files.
A virtual desktop infrastructure (VDI) allows an offshore preparer to work within a remotely delivered desktop environment.
Instead of routinely transferring client documents to an individual computer, the preparer can access authorized tax software and files within the managed environment.
That gives the firm more control over where information is handled, provided the environment is configured and monitored properly.
Don’t rely solely on the provider saying it uses VDI.
Ask for a demonstration using a test document. Can the preparer download it locally, print it, copy its contents, or redirect it to a personal storage location?
The restrictions should match the firm’s security requirements and the work the preparer genuinely needs to perform.
You may also hear providers mention Remote Desktop Protocol (RDP). RDP is a technology for accessing a remote computer; VDI is a broader method of delivering managed desktops. Neither guarantees security by itself.
The connection, user account, remote environment, and device used to access it all require appropriate protection.
Disha’s recommendation about office-based offshore teams is relevant here.
A controlled office can provide managed computers, visitor restrictions, approved work locations, screen-locking policies, and limits on personal storage devices.
But office attendance alone doesn’t establish that taxpayer information is protected.
Ask whether preparers use company-managed workstations, whether personal devices are permitted, and who monitors compliance with the provider’s policies.
An office-only offshore tax preparation arrangement can be part of a firm’s security requirements. It isn’t a universal legal mandate.
And remember: even when remote access prevents downloading, the firm still needs to satisfy any applicable Section 7216 consent requirements before making taxpayer information available overseas.
A preparer assigned five business returns shouldn’t be able to open every client’s tax folder. Yet that’s exactly what can happen when a firm gives its offshore team one broad account or leaves inherited permissions untouched.
Start with least-privilege access: give each person access to the clients, applications, and functions required for their role. The tax manager may need broader visibility than the person entering a Form 1065. Neither should have permissions simply because they’re convenient to assign.
Each preparer needs a named account. Shared logins make it harder to tell who opened a document or changed a return, especially when several people work across time zones.
Require multi-factor authentication (MFA) for access to taxpayer information and check how it’s enforced across the virtual desktop, tax software, and document portal. The FTC Safeguards Rule requires MFA for covered institutions, with a specified exception for equivalent controls approved in writing by the qualified individual.
Have your administrator test permissions with a preparer’s account. Can it open an unassigned client’s return? If so, correct the access rather than assuming the provider will avoid that folder.
Keep logs showing account activity, and assign someone to review unusual access. When a preparer changes roles or leaves the engagement, remove permissions promptly. Role-based access control only protects client data if the assignments behind it stay current.
Your firm’s Written Information Security Plan (WISP) should reflect how taxpayer information is actually handled, including work performed outside your office. A plan that describes local laptops but says nothing about offshore access leaves an obvious gap.
The IRS’s August 2026 reminder calls for tax professionals to maintain, test, and update their security plans. Identify who approves offshore access, who checks the provider’s safeguards, and who responds if something goes wrong.
Ask for policies covering devices, staff training, access reviews, and incidents. If the provider supplies a SOC 2 Type 2 report, check which systems and period it covers. It isn’t a universal security certification or proof that every workstation is protected.
Don’t stop at the documents. Ask the provider to demonstrate the actual restrictions its preparers work under.
The FTC Safeguards Rule requires covered firms to set contractual security expectations and monitor their service providers. Clarify permitted work locations, subcontractors, confidentiality, incident notifications, and how retained data will be handled.
The AICPA Code of Professional Conduct also addresses confidentiality when members use third-party service providers, including agreements and reasonable assurance of safeguards.
Use this short offshore tax data security checklist during onboarding:
Control | Verify |
Consent | Authorization before offshore access |
Remote access | Download restrictions tested |
Accounts | Named users and MFA |
Oversight | Policies and assigned contacts |
Incident response | Escalation responsibilities |
Retention | Return or deletion terms |
A signed agreement is useful only when the firm follows through on the controls it describes.
An offshore preparer might use approved software to extract figures from a Schedule K-1. But what if the same person uploads the document to an unapproved AI chatbot to investigate a discrepancy?
The virtual desktop might be secure while the taxpayer’s information has been sent to another service.
Ask the provider which AI tax preparation tools it uses, what information each tool receives, and whether documents are retained or used for model training. Find out whether outside vendors or subcontractors can access those records. Your firm may need to assess additional disclosure and consent requirements before authorizing those tools.
In its 2026 guidance on responsible AI use in federal tax practice, the IRS warns practitioners about uploading sensitive taxpayer information to unsecured or public systems and recommends enterprise-approved AI with confidentiality safeguards.
There’s no need to prohibit every form of automation. Require approval before client data enters another system, and make sure a qualified person reviews what the tool produces. AI tax preparation security depends on knowing where the information goes and who can use it.
An offshore preparer’s account shows an unfamiliar login. The provider disables it. Now your firm needs to know which files were accessible and whether anything was copied.
Nobody should be assigning those responsibilities during an incident.
Before the first assignment, specify who can suspend accounts, preserve access logs, investigate affected systems, and notify your firm’s security lead. Require the provider to flag suspected incidents promptly, even when the full extent is not yet known. Include IT, legal counsel, and your cyber insurer as appropriate.
If taxpayer information is stolen, the IRS instructs tax professionals to contact their local Stakeholder Liaison immediately.
Covered firms also need to assess FTC Safeguards Rule notification requirements. A qualifying incident involving unauthorized acquisition of unencrypted information of at least 500 consumers must be reported as soon as possible and no later than 30 days after discovery. Compromised encryption keys can bring encrypted information within that definition. Other federal and state reporting duties may apply.
Test the plan with a realistic scenario: an account assigned twenty returns has suspicious activity. Can the provider identify what was accessed, and can your team make the next decision without chasing several managers?
Check that readiness before March. That is what a useful tax data breach response process should achieve.
The return is filed, and the preparer moves on. Why should that person still have access to the completed engagement?
Review access when assignments finish, team members change, or the outsourcing agreement ends. A preparer’s account may remain active for other authorized work, but permissions for clients no longer assigned should be withdrawn.
Agree on which workpapers remain in your firm’s system, whether the provider retains copies, and how they will be returned or deleted. Request confirmation when access or stored data is removed.
The FTC Safeguards Rule generally requires secure disposal within two years after customer information was last used to serve that customer, with exceptions for legitimate business needs, legal obligations, and certain technical limitations.
Your firm’s tax document retention policy must account for those exceptions. Ending offshore access doesn’t mean prematurely destroying records you are required to maintain.
Protecting client data when outsourcing tax preparation services means knowing who can access taxpayer information, where it goes, and when access ends. Consent, portals, VDI, and written policies only help when the firm checks that they work together.
If you’re planning offshore tax capacity, Credfino can help you discuss secure work environments and the controls needed to fit offshore preparation into your existing tax workflow.
Generally, yes, for applicable U.S.-received tax return information. Even view-only access from abroad can require consent under Treasury Regulation §301.7216-2.
It can, when properly secured and managed. Restrict sharing, require appropriate authentication, monitor permissions, and prevent uncontrolled copies of taxpayer documents. A shared-folder link alone does not establish a controlled tax workflow.
Prefer an approved secure portal or appropriately protected transmission. Avoid ordinary unencrypted attachments containing Social Security numbers, returns, or other sensitive information, and verify suspicious document requests before opening attachments.
Yes, named accounts are the safer approach. Combine them with MFA, assignment-based permissions, activity logging, and prompt revocation when access is no longer needed. Shared usernames weaken accountability and audit trails.
That depends on your firm’s approved authentication and device policy. Consider managed authenticators or hardware security keys where personal devices aren’t permitted.
Request relevant access policies, assurance reports where available, staff-training procedures, incident contacts, and demonstrations of controls in the actual offshore environment.
Activate your incident plan: contain access, preserve logs, investigate affected data, and assess client, IRS, FTC, and state notification requirements with appropriate advisers.
Explore eight essential checks for choosing tax preparation outsourcing services, from expertise and compliance to data security and quality control.
Discover seven key areas CPA firms should address when outsourcing tax preparation, including provider selection, data security, compliance, communication.
Explore common mistakes CPA firms make when outsourcing tax preparation, including provider selection, compliance gaps, communication issues, and inadequate quality control.