De-CAFinating Your Client Authorizations—Practice Good Records Hygiene by Filing a FOIA Request for a CAF77 Report and Withdrawing Unneeded Authorizations

To fulfill their professional obligations, practitioners—attorneys, certified public accountants, enrolled agents, and tax return preparers who participate in the Internal Revenue Service’s Annual Filing Season Program—must comply with Circular 230, Regulations Governing Practice before the Internal Revenue Service (31 CFR Subtitle A, Part 10), which is administered and enforced by the IRS’s Office of Professional Responsibility (OPR).

This article discusses how a practitioner can enhance their compliance with Circular 230 by withdrawing authorizations when a client engagement ends and routinely requesting a listing of all authorizations from the IRS’s Central Authorization File (CAF) Unit and canceling unneeded authorizations.

What Is the CAF Number, and Why Is It Important?

A prerequisite to representing a taxpayer before the IRS is filing a Form 2848, Power of Attorney and Declaration of Representative. Completed authorizations, which specify the tax periods and taxes to which they relate, are recorded on the CAF.[1]

To enhance taxpayer confidentiality and to facilitate interaction between practitioners and IRS personnel, each practitioner is assigned a nine-digit CAF number.[2] Typically, this occurs when the practitioner files their first authorization with the IRS. Practitioners may, however, inadvertently be assigned additional CAF numbers if they fail to include their CAF number on an authorization filed with the appropriate CAF unit. As such, practitioners are encouraged to include their CAF number on all later authorizations to avoid unintended additional CAF numbers. CAF numbers are critical to ensure IRS employees, consistent with the taxpayer privacy provisions of IRC 6103, are dealing only with someone with actual authority to act on behalf of a taxpayer. IRS employees will check the CAF to validate the authorization.

Circular 230

Several provisions of Circular 230 implicate a practitioner’s obligations when dealing with their authorizations from clients and their responsibility to protect confidential client information. These provisions complement not only the privacy and penalty provisions of the Internal Revenue Code—including the penalties in IRC 6713 (civil) and IRC 7216 (criminal) for unauthorized use or disclosure of taxpayer information—but also nontax legislation enacted in 1999 that gave the Federal Trade Commission authority to prescribe regulations establishing requirements of data safeguarding for various businesses including professional tax return preparers.^[3]

Section 10.35 of Circular 230 provides that a practitioner must possess the necessary competence to engage in practice before the IRS, and overall competence has been construed to encompass technological competency. Under section 10.51(a)(15), a practitioner’s willfully disclosing or improperly using tax return information constitutes disreputable conduct that could subject the practitioner to OPR discipline. Similarly, section 10.51(a)(18) authorizes the OPR to discipline a practitioner for willfully representing a taxpayer before the IRS unless the practitioner is authorized to do so.

In addition, section 10.36 imposes an obligation on practitioners who have or share the principal authority and responsibility for a firm’s tax practice to have in place “adequate procedures” to ensure compliance by its members, associates, and employees—including contractors—with Circular 230. Also, while not framed as a mandatory requirement (“must”) but as an aspirational standard (“should”), section 10.33 provides that tax advisors should adhere to “best practices” in providing advice and preparing or assisting in the preparation of a submission to the IRS, including compliance with Circular 230’s standards of practice, and correlatively protect client confidences and guard against identity theft.

Importance of Withdrawing Unneeded Authorizations

A Form 2848 will remain in effect until it is (1) revoked by the taxpayer, (2) withdrawn by the representative, or (3) removed from IRS records under the established IRS records retention schedule.[4] As long as an authorization is listed as active in the CAF, the possibility exists that a cyberthief could misuse the authorization to gain access to valuable taxpayer information. Because a practitioner’s obligation to maintain client confidences never ends, they should withdraw their authorization after a tax engagement ends.

There is no fixed form for withdrawing an authorization, but it must be done in writing, must list all pertinent tax matters and tax periods, and must contain the withdrawing representative’s signature and date. A straightforward way to meet these requirements is to write “WITHDRAW” across the top of the first page of a copy of the Form 2848 with a current signature and date below the annotation and then file it with the same CAF unit where the form was originally filed. The form instructions list where the request should be sent and provide additional guidance on what the practitioner should do if they do not have a copy of the authorization form.

It is a best practice to maintain an up-to-date list of client authorizations that a practitioner has open with the IRS and to withdraw those that are no longer needed, for example, because the related client engagement has ended. A tax practitioner can confirm the accuracy of their records by requesting a list of active authorizations—a CAF77 request—from the IRS under the Freedom of Information Act (FOIA). A sample of the request is available on the IRS’s FOIA Guidelines webpage.

After processing the CAF77 request, the IRS will provide a printout or electronic copy of the practitioner’s current authorizations. The practitioner may review the list and send a signed withdrawal request for all authorizations that should be removed from the CAF. The CAF unit will then remove the authorizations.

While keeping an up-to-date listing of authorizations is always a best practice, requesting a CAF77 report would be especially prudent if the practitioner is leaving, selling or retiring from their practice.

Option to Eliminate the Paper by Using Tax Pro Account

An efficient and secure alternative to filing paper withdrawal requests with the CAF unit is to use IRS online tools such as the Tax Pro Account,[5] which provides a means to safeguard sensitive taxpayer data from cyberthreats.

Tax Pro Account is a secure, mobile-friendly, digital, self-service application that enables tax professionals to act on a taxpayer’s behalf, view the taxpayer’s information online, and manage their authorizations—including withdrawals of active authorizations—more quickly and efficiently. Establishing a Tax Pro Account for clients is easy, does not require paper forms, and eliminates risks associated with storing and sending paper records. Note, however, that the client must have an IRS Online Account. Tax professionals can use Tax Pro Account to send online power of attorney (as well as tax information authorization) requests directly to a taxpayer’s individual IRS Online Account for review and signature. Once the taxpayer approves and electronically signs a request, it will be processed and written to the CAF in real-time—no faxing, mailing, uploading, or long waits. Similarly, the tax professional can withdraw authorizations on demand.

If a practitioner links their CAF number to their Tax Pro Account, they can manage all active authorizations, not just those created using Tax Pro Account. Viewing their list of all active authorizations on their Tax Pro Account, a practitioner can simply check-a-box to instantaneously withdraw unneeded authorizations, no matter when or how they were created.

Conclusion

Consistent with section 10.33 of Circular 230, practitioners should practice good records hygiene, including having procedures in place to maintain an up-to-date list of all client authorizations and to withdraw those that are no longer needed, for example, because the related client engagement has ended.

Thank you for subscribing to the IRS Newswire, an IRS e-mail service.

If you know someone who might want to subscribe to this mailing list, please forward this message to them so they can subscribe.

This message was distributed automatically from the mailing list IRS Newswire. Please Do Not Reply To This Message.