US tax and bookkeeping firms have no federal anti-money-laundering program to follow, so the checks that carry real consequences are the e-file identity steps, the authentication the IRS asks for on Form 2848 and Form 8821, and your own data-security duties. This list covers all three for tax year 2026 returns, filed in 2027, plus the entity papers a bookkeeping client should hand over.
Who sends itSent by the firm owner or senior preparer to each new client after the engagement letter is signed and before any return, payroll or books work begins. Run it again when a returning client adds an entity or changes owners.
Reviewed November 10, 2026 · 30 items
0 of 30 ticked
01Who the individual is
02Who the entity is
03Authority to act
04IRS e-file and identity theft checks
05Red flags and what to do
06Your records and security
What firms get wrong
Accepting a bank letter or a prior return as proof of an EIN instead of the CP575 notice or Letter 147C.
Using a Form 2848 that lists only past years, then discovering you cannot act on the 2026 return.
Treating your own ownership-threshold policy as an IRS rule and refusing a client who will not name a minority partner.
Applying 2024 and 2025 beneficial ownership guidance to US-formed LLCs after FinCEN exempted them.
Letting a client type a Social Security number into an email or a note field instead of uploading the card.
Opening an attachment from an unknown prospect on the same computer that holds client files.
Get this checklist when it changes
We'll email you when this checklist changes, and about once a month with new checklists and templates. Unsubscribe any time. Privacy
Questions about this checklist
Is a know-your-client check legally required for US tax preparers?
There is no single US rule that matches UK-style anti-money-laundering checks for tax and bookkeeping firms. The checks with a specific source are the e-file identity steps in Publication 1345 and the authentication the IRS describes for Forms 2848 and 8821. Everything else on this list is firm policy.
Do I need to collect beneficial ownership reports from LLC clients?
Not for US-formed companies. FinCEN's BOI page, updated August 11, 2026, says they are exempt under a final rule effective August 14, 2026. Foreign entities registered to do business in a US state or tribal jurisdiction can still be covered by the March 2025 interim rule unless exempt, so check FinCEN's page before you tell a foreign-formed client either way.
How long do I keep Form 8879 and the identity record?
IRM 3.42.5 says the ERO must retain Form 8879 for three years from the return due date or IRS received date, whichever is later. The IRS does not set a period for your identity log, so most firms keep it as long as the return file.
How can a client send ID without emailing it?
Use a secure client portal or upload link instead of email or text, and delete any ID a client sends by email after moving it into the client file. Your written security plan should say who can open stored ID images.