IRC 7216 Client Consent for Outsourcing Tax Work to India — A US CPA Guide

What IRC Section 7216 Actually Says

IRC Section 7216 prohibits any tax return preparer from knowingly or recklessly disclosing or using tax return information for any purpose other than preparing or assisting in preparing a tax return, unless the taxpayer provides written consent.

This applies to everything a client hands you: prior-year returns, W-2s and 1099s, QuickBooks files, payroll records, brokerage statements, and any other information used in preparing the return. If you send any of that to an Indian CA firm — even just the QuickBooks file — without a signed consent form, you are in violation of federal law.

The penalty is criminal: up to one year in prison and a $1,000 fine per violation under IRC Section 7216(a). The corresponding civil penalty under Section 6713 is $250 per disclosure, up to $10,000 per year. Beyond the statute, it also constitutes a breach of the AICPA Code of Professional Conduct Rule 1.700.001 (Confidential Client Information).

What a Valid 7216 Consent Form Must Include

Treasury Regulation Section 301.7216-3 specifies exactly what a consent to disclose must contain. A valid form requires all of the following:

• Taxpayer name — the individual or business entity whose tax information is being shared
• Recipient name and address — the full legal name of the Indian CA firm and its address in India
• Purpose of disclosure — specifically, workpaper preparation, bookkeeping reconciliation, or whatever the Indian team will be doing
• Description of information — the specific documents or data being shared (e.g., QuickBooks company file, prior-year 1040, bank statements for the period)
• Tax year(s) covered — the specific tax period(s) the consent applies to
• Taxpayer signature and date — the form must be signed and dated by the taxpayer
• Expiration date — the consent is valid for one year from the date signed unless you specify a shorter period

The form does not need to be lengthy. A well-drafted 7216 consent can be half a page. Its job is to be specific, not comprehensive.

The Easiest Way to Get Every Client Signed — Embed It in Your Engagement Letter

The most common mistake CPA firms make with 7216 consent is treating it as a separate form to chase down mid-season. By January, you do not have time to send reminder emails and wait for responses. The fix is simple: make the 7216 consent a standing paragraph in your engagement letter.

Every client signs an engagement letter at the start of the tax year. Add a clearly labeled section titled "Consent to Disclose Tax Information to Third-Party Service Providers." Name the Indian firm, describe the purpose, list the types of documents that may be shared, and include a checkbox or signature line. Client signs the engagement letter — consent is done for the year.

If you are adding an Indian CA team mid-season and have clients who have not yet signed a consent for the current year, send a one-page standalone form. Keep signed copies in the client file — digital signatures via DocuSign or similar are acceptable.

What You Can Share Once Consent Is Signed

A properly executed 7216 consent authorizes you to share the specific information described in the form. In practice, for a CPA using an Indian CA team for workpaper preparation, this typically covers:

What the Indian CA Firm Should Also Sign

The 7216 consent form protects you with the client. Separately, you need the Indian CA firm to sign two documents before any files are shared:

Non-Disclosure Agreement (NDA): Confirms that all client information shared is confidential, cannot be disclosed to any third party, and must be returned or destroyed at the end of the engagement. The NDA protects you from downstream leakage by the Indian firm.

Data Processing Agreement (DPA): More detailed than an NDA. Specifies how client data is stored (cloud storage, local servers, or encrypted drives), who within the Indian firm can access it, what security standards apply, how data is transferred (secure portal, not plain email), and how long it is retained. The DPA satisfies the AICPA Code's confidentiality requirements and mirrors the spirit of data protection obligations.

Both documents should be signed before the first client file is transferred — not after. At Sharma Jyoti and Co, we provide a standard NDA and DPA as part of onboarding, drafted to address US CPA requirements specifically.

IRC 7216 Compliance Checklist for CPA Firms Using Indian CA Support

The PTIN Question — Does the Indian CA Need One?

No. A PTIN (Preparer Tax Identification Number) is required only for individuals who sign and file US tax returns. An Indian CA firm prepares workpapers — the cleaned books, the reconciled trial balance, the supporting schedules — but never signs or files the return. That final step belongs to the CPA.

Because the Indian firm never signs or files the return, no PTIN is required. Treasury Circular 230, which governs practice before the IRS, does not apply to the Indian firm for the same reason. The CPA remains fully responsible for the final return and acts as the signing preparer.

Cost of Getting This Wrong vs Cost of Getting It Right

The downside of skipping 7216 consent is severe — up to $1,000 per violation with criminal exposure, plus license risk and client relationship damage. The cost of getting it right is a paragraph in your engagement letter template and 20 minutes with a lawyer to review the language once.

For a solo or small CPA practice, the math is straightforward. An Indian CA team costs $6–$15 per hour for workpaper preparation, versus $35–$65 per hour for a US bookkeeper or $75–$150 per hour for a seasonal US CPA hire. A practice processing 200 returns per season can save $30,000–$60,000 in labor costs by using Indian CA support — for the price of one updated engagement letter.

Frequently Asked Questions