Key takeaways
- The FTC Safeguards Rule covers tax preparation firms and requires a written program, a Qualified Individual and multi-factor authentication.
- The MFA exception needs the Qualified Individual’s written approval of equally secure controls, not a general waiver.
- A link or code sent to the client’s inbox is not a second factor on its own.
- Test the access log in a trial: view, download and share one file, then export the log.
- Clients upload SSNs, EINs, bank details and Form W-9 files through the portal, not by email.
What the FTC rule requires of a tax firm
The FTC Safeguards Rule covers financial institutions, and the FTC guidance lists tax preparation firms among them. The guidance says the test is the activities a business undertakes, not how it labels itself.
The rule requires a written information security program with safeguards appropriate to your size and complexity, 16 CFR 314.3(a), and a Qualified Individual to oversee and implement it. That person reports in writing at least annually to your board, or to a senior officer if there is no board, 16 CFR 314.4(i).
The breach notice clock
The FTC notice duty has applied since May 13, 2024, under Section 314.4(j). A notification event is the acquisition of unencrypted customer information without the authorization of the individual it pertains to. At 500 consumers or more, notice to the FTC is due as soon as possible and no later than 30 days after discovery.
Discovery is the first day the event is known to you. Worked example: on a Tuesday, a staff member sees that a share setting leaves unencrypted tax files for 620 clients open to anyone with the link. The log later shows an unknown user opened files for 540 of them. Unauthorized access to unencrypted data is presumed to be unauthorized acquisition unless you have reliable evidence otherwise, so the 30 days run from that Tuesday.
State breach laws are separate. Each state where an affected client lives may set its own definition, deadline and recipients, and the FTC notice does not satisfy them.
Map each duty to a setting you can test
Multi-factor authentication. The rule requires MFA for any individual accessing any information system, using at least two factors, 16 CFR 314.4(c)(5). A password plus an authenticator app code is two factors. In our reading, a link or code sent to the same inbox the client uses for the password is not a second factor. Get the vendor’s enforced factors in writing.
The exception is narrow. The Qualified Individual must approve in writing the use of reasonably equivalent or more secure access controls. Name the system, the control and the date in that approval. A general note that a legacy login is fine does not meet the wording.
Encryption. The FTC guidance says to encrypt customer information on your system and when it is in transit. Ask the vendor in writing for the minimum TLS version it enforces, whether stored files are encrypted, and who holds the keys. A passing answer names the method, for example: “Stored files are encrypted with AES-256, and the keys sit in a managed key service we can name.” “Bank-level security” answers none of those questions.
Access logs. The guidance says to maintain a log of authorized users’ activity and keep an eye out for unauthorized access. Test it: open one client’s file, view it, download it, share a link, then export that client’s log. If the export lacks your view, download or share, the log fails. Each line needs the user, time, action and IP address.
Access and offboarding. Grant permissions per client folder, so a bookkeeper who picks up a second client sees only that folder, and remove the grant when the engagement closes. Deactivate a leaver’s login on the last day, and compare active portal users with the staff roster each month.
The Qualified Individual and outside help
The rule lets the Qualified Individual be an employee of yours, an affiliate or a service provider, but you keep responsibility for compliance, 16 CFR 314.4(a). If an outside service holds the role, it must sign each MFA exception and the annual report. Put the person’s name and reporting date in the contract, and price the role in writing.
Testing and staff training
The guidance says firms must conduct annual penetration testing and run vulnerability scans every six months unless they use continuous monitoring. Firms that hold information on fewer than 5,000 consumers are exempt from this requirement and from the written annual report to the board (16 CFR 314.6). The rule also allows continuous monitoring in place of periodic testing, 16 CFR 314.4(d)(2). Ask the vendor for the date and scope of its latest penetration test, then cover what it leaves out, such as staff devices.
The guidance also says to provide security awareness training and schedule regular refreshers. Record the attendees and the date, and ask each person what they do when a client email asks for an SSN.
How long to keep client files, and when to delete them
The rule requires disposal of customer information no later than two years after the last use to serve the customer, 16 CFR 314.4(c)(6)(i), with exceptions for business needs and for information retained as required by law, 16 CFR 314.4(c)(6)(ii). A longer IRS period is a legal requirement that controls the deletion date.
The IRS periods are: 3 years as the general period. Six years if you do not report income you should report and it is more than 25% of the gross income shown on your return. Seven years if you claim a loss from worthless securities or a bad debt deduction. Indefinitely if you do not file a return or file a fraudulent one. Employment tax records stay at least 4 years after the tax is due or paid, whichever is later.
Apply the longest period to each file. A client with a bad debt deduction gets 7 years, and a client who never filed is kept indefinitely.
Vendor evaluation checklist
Use this list in the demo and in writing. Log every unanswered item as a gap.
1. Security documents. The written security summary, the date and scope of the latest penetration test, and any SOC 2 report that covers the portal. Put your right to monitor the vendor and its periodic reassessment in the contract, since the guidance says contracts must provide for these.
2. MFA. Two factors mandatory for every staff user, not just available.
3. Encryption. The minimum TLS version, the stored-file encryption statement and the key-management answer, in writing.
4. Logs. Pass the trial test, get the log retention period in writing, and confirm you can export logs yourself.
5. Removal. One action removes a user, and the removal appears in the log.
6. Breach notice. A number of hours in the contract, since “promptly” is not a number. Your FTC notice is due within 30 days of discovery.
7. Exit. Export every client file before you cancel, and get in writing the list of other companies that handle the files.
Moving the existing email history into the portal
Many firms already hold client files in email. Search the mailboxes for SSN, EIN and account-number patterns first.
Decision rule: if an email holds a full SSN or account number and no portal copy exists, upload the attachment to the client folder first, then delete the mailbox copy. If a portal copy exists, delete the mailbox copy and note the date in the client file.
What to ask clients to stop emailing
The FTC rule names no document list, so this list is practice, not law. For a tax practice it is short: SSNs and ITINs, EINs, bank account and routing numbers, driver’s license copies, full prior-year returns, payroll reports that show SSNs, and Form W-9 files. The IRS says Form W-9 is how a client gives the person who must file an information return the correct Taxpayer Identification Number.
Send this at the portal invitation, and again with the first request for a W-9: “Please don’t email your Social Security number, bank account numbers or W-9. Upload those files at the secure link below. Email is fine for questions with no account numbers in them.” Use the same words from every person in the firm.
If a client emails a W-9 anyway, do not reply with the data or forward it. Reply: “Received. I moved this to the secure portal, so please delete the email copy.” Move the attachment to the client’s folder, log it, then follow the mailbox steps above. If a client refuses the portal, record the method in the file.
Rollout for the 2026 returns
Returns for tax year 2026 are filed in 2027, so configure the portal before the first request for that season. Keep a dated export for each control, the vendor’s security summary, the breach-notice clause, the training record, the Qualified Individual’s written report and every written MFA approval.