De-CAFinating Your Client Authorizations—Practice Good Records Hygiene by Filing a FOIA Request for a CAF77 Report and Withdrawing Unneeded Authorizations

Having trouble viewing this email? View it as a Web page.                                                                                                                                                  Bookmark and Share Banner
Alerts from Office of Professional Responsibility (OPR) March 11, 2024

OPR Resources

Circular 230 Tax Professionals

Circular No. 230 (Rev. 6-2014)

Frequently Asked Questions

News and Guidance from OPR

Disciplinary Sanctions - IRB

OPR Webinars

Issue Number:  2023-03

Inside This Issue

De-CAFinating Your Client Authorizations—Practice Good Records Hygiene by Filing a FOIA Request for a CAF77 Report and Withdrawing Unneeded Authorizations

To fulfill their professional obligations, practitioners—attorneys, certified public accountants, enrolled agents, and tax return preparers who participate in the Internal Revenue Service’s Annual Filing Season Program—must comply with Circular 230, Regulations Governing Practice before the Internal Revenue Service (31 CFR Subtitle A, Part 10), which is administered and enforced by the IRS’s Office of Professional Responsibility (OPR).

This article discusses how a practitioner can enhance their compliance with Circular 230 by withdrawing authorizations when a client engagement ends and routinely requesting a listing of all authorizations from the IRS’s Central Authorization File (CAF) Unit and canceling unneeded authorizations.

What Is the CAF Number, and Why Is It Important?

A prerequisite to representing a taxpayer before the IRS is filing a Form 2848Power of Attorney and Declaration of Representative. Completed authorizations, which specify the tax periods and taxes to which they relate, are recorded on the CAF.[1]

To enhance taxpayer confidentiality and to facilitate interaction between practitioners and IRS personnel, each practitioner is assigned a nine-digit CAF number.[2] Typically, this occurs when the practitioner files their first authorization with the IRS. Practitioners may, however, inadvertently be assigned additional CAF numbers if they fail to include their CAF number on an authorization filed with the appropriate CAF unit. As such, practitioners are encouraged to include their CAF number on all later authorizations to avoid unintended additional CAF numbers. CAF numbers are critical to ensure IRS employees, consistent with the taxpayer privacy provisions of IRC 6103, are dealing only with someone with actual authority to act on behalf of a taxpayer. IRS employees will check the CAF to validate the authorization.

Circular 230

Several provisions of Circular 230 implicate a practitioner’s obligations when dealing with their authorizations from clients and their responsibility to protect confidential client information. These provisions complement not only the privacy and penalty provisions of the Internal Revenue Code—including the penalties in IRC 6713 (civil) and IRC 7216 (criminal) for unauthorized use or disclosure of taxpayer information—but also nontax legislation enacted in 1999 that gave the Federal Trade Commission authority to prescribe regulations establishing requirements of data safeguarding for various businesses including professional tax return preparers.[3]

Section 10.35 of Circular 230 provides that a practitioner must possess the necessary competence to engage in practice before the IRS, and overall competence has been construed to encompass technological competency. Under section 10.51(a)(15), a practitioner’s willfully disclosing or improperly using tax return information constitutes disreputable conduct that could subject the practitioner to OPR discipline. Similarly, section 10.51(a)(18) authorizes the OPR to discipline a practitioner for willfully representing a taxpayer before the IRS unless the practitioner is authorized to do so.

In addition, section 10.36 imposes an obligation on practitioners who have or share the principal authority and responsibility for a firm’s tax practice to have in place “adequate procedures” to ensure compliance by its members, associates, and employees—including contractors—with Circular 230. Also, while not framed as a mandatory requirement (“must”) but as an aspirational standard (“should”), section 10.33 provides that tax advisors should adhere to “best practices” in providing advice and preparing or assisting in the preparation of a submission to the IRS, including compliance with Circular 230’s standards of practice, and correlatively protect client confidences and guard against identity theft.

Importance of Withdrawing Unneeded Authorizations

A Form 2848 will remain in effect until it is (1) revoked by the taxpayer, (2) withdrawn by the representative, or (3) removed from IRS records under the established IRS records retention schedule.[4] As long as an authorization is listed as active in the CAF, the possibility exists that a cyberthief could misuse the authorization to gain access to valuable taxpayer information. Because a practitioner’s obligation to maintain client confidences never ends, they should withdraw their authorization after a tax engagement ends.

There is no fixed form for withdrawing an authorization, but it must be done in writing, must list all pertinent tax matters and tax periods, and must contain the withdrawing representative’s signature and date. A straightforward way to meet these requirements is to write “WITHDRAW” across the top of the first page of a copy of the Form 2848 with a current signature and date below the annotation and then file it with the same CAF unit where the form was originally filed. The form instructions list where the request should be sent and provide additional guidance on what the practitioner should do if they do not have a copy of the authorization form.

It is a best practice to maintain an up-to-date list of client authorizations that a practitioner has open with the IRS and to withdraw those that are no longer needed, for example, because the related client engagement has ended. A tax practitioner can confirm the accuracy of their records by requesting a list of active authorizations—a CAF77 request—from the IRS under the Freedom of Information Act (FOIA). A sample of the request is available on the IRS’s FOIA Guidelines webpage.

After processing the CAF77 request, the IRS will provide a printout or electronic copy of the practitioner’s current authorizations. The practitioner may review the list and send a signed withdrawal request for all authorizations that should be removed from the CAF. The CAF unit will then remove the authorizations.

While keeping an up-to-date listing of authorizations is always a best practice, requesting a CAF77 report would be especially prudent if the practitioner is leaving, selling or retiring from their practice.

Option to Eliminate the Paper by Using Tax Pro Account

An efficient and secure alternative to filing paper withdrawal requests with the CAF unit is to use IRS online tools such as the Tax Pro Account,[5] which provides a means to safeguard sensitive taxpayer data from cyberthreats.

Tax Pro Account is a secure, mobile-friendly, digital, self-service application that enables tax professionals to act on a taxpayer’s behalf, view the taxpayer’s information online, and manage their authorizations—including withdrawals of active authorizations—more quickly and efficiently. Establishing a Tax Pro Account for clients is easy, does not require paper forms, and eliminates risks associated with storing and sending paper records. Note, however, that the client must have an IRS Online Account. Tax professionals can use Tax Pro Account to send online power of attorney (as well as tax information authorization) requests directly to a taxpayer’s individual IRS Online Account for review and signature. Once the taxpayer approves and electronically signs a request, it will be processed and written to the CAF in real-time—no faxing, mailing, uploading, or long waits. Similarly, the tax professional can withdraw authorizations on demand.

If a practitioner links their CAF number to their Tax Pro Account, they can manage all active authorizations, not just those created using Tax Pro Account. Viewing their list of all active authorizations on their Tax Pro Account, a practitioner can simply check-a-box to instantaneously withdraw unneeded authorizations, no matter when or how they were created.


Consistent with section 10.33 of Circular 230, practitioners should practice good records hygiene, including having procedures in place to maintain an up-to-date list of all client authorizations and to withdraw those that are no longer needed, for example, because the related client engagement has ended.

[1] In addition to submitting a Form 2848, a practitioner may submit a more limited authorization request—Form 8821, Tax Information Authorization (TIA)—to authorize any individual, corporation, firm, organization, or partnership a taxpayer designates to inspect or receive that taxpayer’s confidential information verbally or in writing for the type of tax and the years or periods listed on the form (or to delete or revoke a prior TIA ). The designee on a Form 8821 need not be an attorney, CPA, enrolled agent, or Annual Filing Season Program participant. Significantly, however, a TIA does not authorize a designee to speak on the taxpayer’s behalf; to execute a request to allow disclosure of returns or return information to another third party; to advocate the taxpayer’s position regarding federal tax laws; to execute waivers, consents, or closing agreements; or to represent the taxpayer in any other manner before the IRS.

[2] CAF numbers differ from a tax professional’s preparer tax identification number (PTIN).

[3] See OPR Alert No. 2023-10, Careful WISP(er)—Professional Responsibility and Data Security: Practitioners’ Obligation to Have a Written Information Security Plan. Under section 10.51(a)(15), if a practitioner’s lax or grossly negligent approach to data security leads to disclosure or improper use of tax return information, they could potentially be subject to OPR discipline.

[4] Generally, authorizations recorded on the CAF are purged seven years from the taxpayer signature date, though authorizations relating to estate tax returns (Form 706) are purged after 15 years, and qualifying student and law graduate authorizations are valid for only 130 days from the taxpayer signature date. In addition, all authorizations expire on the death of the taxpayer, and they will be deleted from (or updated to “deceased” in) the CAF after the IRS receives verification of the date of death, usually from the Social Security Administration, representative, surviving spouse, or next of kin.

[5] Tax Pro Account is currently available only for authorizations concerning individual taxpayers, but plans are underway to expand Tax Pro Account to business accounts. For additional information on forthcoming changes to Tax Pro Account, see IR-2023-182, IRS delivers new capabilities to Tax Pro Account; latest expansion part of effort to improve technology, tools to help tax professionals serve clients (Sep. 29, 2023).





Back to Top

Thank you for subscribing to the IRS Newswire, an IRS e-mail service.

If you know someone who might want to subscribe to this mailing list, please forward this message to them so they can subscribe.

This message was distributed automatically from the mailing list IRS Newswire. Please Do Not Reply To This Message.