What is a client consent form? The types a tax firm needs

What a consent form is and what it is not

A consent form records that the client knowingly agreed to one defined action. A line in an engagement letter saying the client authorizes the firm to do whatever is needed is an engagement term, not a consent to disclose return information to a third party.

Sort every consent with four questions. Does a rule require it, or is it best practice? Is it tied to one return or to the whole relationship? Who must sign? Can the client refuse without losing the service? Form 8879 is tied to one return; a Form 2848 can cover several years; an engagement letter covers the relationship.

Electronic records and signature consent

The federal E-SIGN Act, 15 U.S.C. 7001(a), says a signature or contract cannot be denied legal effect solely because it is electronic. A drawn signature in a portal is therefore generally enforceable on an engagement letter.

The separate consent matters under 15 U.S.C. 7001(c). Where a law requires information to be given to a consumer in writing, an electronic record satisfies it only if the consumer has affirmatively consented and has not withdrawn consent. Before consenting, the consumer must receive a statement of the right to ask for paper copies and to withdraw consent, plus any consequences or fees of withdrawing. They must also be told the hardware and software needed to open and keep the records, and must confirm consent electronically in a way that shows they can open the file.

Best practice: have the client confirm by opening a test file in the portal, and record the date, email address and wording version.

Form 8879 and the e-file signature

Form 8879 is the IRS e-file signature authorization for an individual income tax return. The IRS Internal Revenue Manual says it must be completed for each individual return prepared using the Practitioner PIN method, and that the ERO must receive the signed form and then sign Part III. The ERO must also confirm taxpayer identity per Publication 1345 before transmitting.

Under Self-Select PIN, the form is required when the ERO enters the taxpayer's PIN and is not required when the taxpayer enters their own PIN. The IRM says the taxpayer can return the signed form by hand delivery, U.S. mail, private delivery service or fax, and points to Publication 1345 for acceptable electronic signature methods, so check that publication before choosing a remote signing tool.

Give the client a copy to review with the completed return, which the IRM requires. Do not mail Form 8879 to the IRS unless asked. Retention is three years from the return due date or the IRS received date, whichever is later.

Form 2848 versus Form 8821

Form 2848 authorizes an individual to represent the taxpayer before the IRS. The representative must be eligible to practice, such as an attorney, CPA or enrolled agent, and must sign and date the Part II declaration. Form 8821 only lets the designee inspect or receive confidential information; it does not authorize the designee to speak on the taxpayer's behalf.

Decision rule: if the client wants you to call the IRS, negotiate or answer a notice for them, use Form 2848. If you only need transcripts to prepare a return, Form 8821 is enough and carries less authority.

Line 3 of Form 2848 must be specific. The IRS will return a power of attorney with a general reference, and the instructions show an entry such as Income, 1040 followed by the year. The IRS will not record future periods that exceed 3 years from December 31 of the year it receives the form.

Line 5a controls one easily missed power. A representative cannot execute consents that allow the IRS to disclose the return or return information to a third party unless the client checks that box. Leave it unchecked by default and check it only when the client asks.

Signature rules differ by route. Electronic signatures on Form 2848 are accepted only when the form is submitted online at IRS.gov/Submit2848; by mail or fax the signature must be handwritten. Form 8821 follows the same rule through IRS.gov/Submit8821, and a Form 8821 for a non-tax-matter purpose must be received within 120 days of the signature date.

A new Form 2848 recorded on the CAF system will generally revoke an earlier one for the same matter, so check for another adviser before filing.

Section 7216 consent for use and disclosure

Section 7216 and Treas. Reg. 301.7216-3 govern what a paid preparer may do with return information beyond preparing the return. When no exception applies, the preparer needs written consent before a use or disclosure. The consent must be knowing and voluntary, signed and dated by the taxpayer, name the preparer and the taxpayer, state the purpose and the specific recipients, and describe the information covered.

Three drafting traps. First, the regulation requires one document to authorize uses and a separate document to authorize disclosures. Second, conditioning your services on the client agreeing makes the consent involuntary, except that you may condition preparation services on consent to disclose to another preparer for return preparation. Third, if you do not state a duration, the consent lasts one year from the date the client signed, so write the period you want. Give the client a copy of the executed consent at signing.

For clients who are not filing a Form 1040-series return, the consent may be in any format, including an engagement letter. For individuals, use a standalone document.

Offshore work is a separate trap: for a Form 1040-series client you may not obtain consent to disclose a Social Security number to a preparer outside the United States, subject to the adequate-safeguard exception in the regulation.

Engagement letter authority and data-sharing clauses

The engagement letter is the contract: scope, fees and who the client is. It is best practice and often a professional-standard expectation, but no federal tax rule dictates its wording. For a business client, a signed engagement letter can double as the section 7216 consent if the language meets the regulation.

Write authority narrowly. Instead of authorizing the firm to deal with any agency, say: authorize the firm to prepare and e-file the 2026 corporate income tax return and to request IRS account transcripts for that entity. Add Form 2848 or Form 8821 only for work that needs it.

A data-sharing consent covers recipients you name: a lender, a landlord, an insurance agent, a payroll provider. Name each recipient and the documents shared, and give an end date. If the client later adds a recipient, collect a new signed consent instead of editing the old one.

What to store and for how long

Store the signed document, signature date and time, signer's name, wording version and, for electronic signing, the tool's audit trail.

Federal sources give one clear number: Form 8879 for three years from the return due date or the IRS received date, whichever is later. The consent regulation gives a default consent life of one year but no retention period. For everything else, set your own written retention period and check your state board's rules and your liability carrier's requirements, which may be longer.

File one folder per client per tax year with the signed Form 8879, the Form 2848 or Form 8821 confirmation, the engagement letter and any 7216 consent. In Usual, a signed request locks, so the document cannot be edited after signing, but the retention schedule is still yours to set. Calendar the end date of every time-limited consent, because an expired consent in the file looks like permission.

A packet that works

Individual client packet: engagement letter, e-delivery consent, Form 8821 or Form 2848 only if needed, a section 7216 consent only if a disclosure is planned. Form 8879 goes out with the finished return.

Wording for a 7216 request: Do you agree that our firm may send your 2026 return information to your mortgage lender, Example Bank, to support your loan application, for 90 days from today? You may decline without affecting our work for you.