CAF Numbers in “Pending Review” Status

OPR Resources

Circular 230 Tax Professionals

Circular No. 230 (Rev. 6-2014)

Frequently Asked Questions

News and Guidance from OPR

Disciplinary Sanctions - IRB

OPR Webinars

Issue Number:  2024-05

Inside This Issue

To fulfill their professional obligations, practitioners—attorneys, certified public accountants, enrolled agents, and tax return preparers who participate in the Internal Revenue Service’s Annual Filing Season Program—must comply with Circular 230, Regulations Governing Practice before the Internal Revenue Service (31 CFR Subtitle A, Part 10), which is administered and enforced by the IRS’s Office of Professional Responsibility (OPR). Only the OPR has authority to suspend or revoke, through disbarment, a practitioner’s eligibility and authority to practice before the IRS.

A prerequisite to representing a taxpayer before the IRS is filing a Form 2848, Power of Attorney and Declaration of Representative. Validly completed authorizations, which specify the tax periods and taxes to which they relate, are recorded on the IRS’s Central Authorization File (CAF).[1]

To prevent unauthorized disclosure of taxpayer information, in certain circumstances a practitioner’s CAF number may be suspended pending an IRS review into whether the CAF number has been compromised owing to identity theft or other fraud. This article provides background on the IRS’s procedures relating to suspended CAF numbers, including how an affected practitioner can expedite the resolution of a CAF number review.

What Is a CAF Number and Why Is It Important?

To enhance taxpayer confidentiality and to facilitate interaction between practitioners and IRS personnel, each practitioner is assigned a nine-digit CAF number.[2] CAF numbers, which are different from a tax professional’s preparer tax identification number (PTIN) or their Social Security number (SSN), are used by the IRS to determine and verify the extent of a practitioner’s authority to represent a taxpayer before the IRS and receive and inspect the taxpayer’s confidential tax information. The IRS also uses CAF numbers to fulfill and keep track of requests for client information (like transcripts) while safeguarding both the client’s and the tax professional’s personal information. Thus, consistent with the taxpayer privacy provisions of IRC 6103, IRS employees will check the CAF to ensure they are dealing only with someone with actual authority to act on behalf of a taxpayer and to request disclosure of the taxpayer’s return information. The CAF number itself is personal identifiable information (PII) and should, as much as possible, be kept secure.

What Might Cause a CAF Number to Be Placed in “Pending Review” Status?

Given the sensitivity of taxpayer information, the IRS is continually reviewing and strengthening its practices to guard against identity theft and the improper disclosure of taxpayer information. In connection with those effort to authenticate an individual’s identity and authorization to receive sensitive information, the IRS has long requested personal information, in addition to their CAF number, from practitioners (or anyone accessing tax-related information by means of a Form 8821). The purpose of the authentication process, including the validation of the individual’s SSN, is to protect both taxpayers and the tax professionals who are working on their behalf.[3]

Beyond this basic authentication step, the IRS has a process for IRS employees to refer authorizations with suspicious characteristics for further review. Under this process, the status of the affected CAF account will be coded to “P” for “pending review,” indicating that the CAF number is currently under review for potential compromise and may be subject to fraudulent use. To safeguard taxpayer information pending the review, the practitioner to whom the CAF number was assigned will be unable to rely on the CAF or IRS employees to authenticate the practitioner’s authority to represent taxpayers until the review process is complete. For security reasons, IRS customer service representatives assigned to the Practitioner Priority Service (PPS), or other call sites cannot, for example, interact with the practitioner about a represented taxpayer’s tax matter. The process is akin to the freeze that a credit card company imposes when their fraud-prevention measures are activated, though for a compromised CAF number, the confidential information of multiple clients as well as the practitioner could be at stake.

What might cause a CAF number to be suspended pending review? First, the suspension may have absolutely nothing to do with anything the practitioner has done. If the practitioner has included their CAF number in a document appropriately shared with a client or other third party and that document (e.g., a copy of a Form 2848 or Form 8821) is exposed because of a physical or digital data breach experienced by the client or third party, the CAF number could be compromised and misused—in particular, by a malicious actor who files a fraudulent authorization form with the IRS to gain access to taxpayer information. In addition, there could be aspects of a practitioner’s tax practice that, while legitimate, might trigger IRS red flags.

The line between actual fraudulent use of a CAF number and its mere appearance can be very thin, as can the line between a compromised number and one that is uncompromised but has anomalous yet innocuous attributes. As a result, “false positives” sometimes occur, with practitioners’ legitimate, uncompromised CAF numbers being suspended pending review.

A practitioner may learn that this has happened to them in different ways. For example, they might contact the IRS to discuss a client’s tax matter and be informed that the conversation cannot occur because the practitioner’s authority to represent the client cannot be verified. Regrettably, because of privacy concerns or other restrictions, the IRS employee who is dealing with the practitioner (or the taxpayer) may not be able to share any additional information with them, only exacerbating their confusion.

Once a preliminary determination is made that a practitioner’s (or other tax professional’s) CAF number may have been compromised and is placed in review, the practitioner will receive a letter by mail from the IRS—generally from IRS Criminal Investigation (CI) —letting them know their CAF is under review.

To help expedite the review process:

• The individuals who receive these letters are asked to verify their identities by sending to the IRS a notarized document that includes pictures of their photo identification.
• The notarized document should be returned to CI using the mailbox provided in the letter within 30 days from the date of the letter.
• The return of the notarized document will then begin a dialogue of verifying their client listings and, if needed, the issuance of a new CAF number. The dialogue may be done over the phone in some cases to accelerate the process.

For those CAF holders whose CAF number is confirmed to be compromised, the IRS will work with the CAF holder to assign them a new CAF number and move their clients to the tax professional’s new CAF number.

The holders of all CAF numbers currently coded as “pending review” have been contacted. The individuals who are told that their CAF account is in “pending review” status can contact the IRS directly by email at CICAF@ci.irs.gov.

Protecting confidential taxpayer data is of paramount concern to the IRS. At the same time, the IRS recognizes that suspending a CAF number pending review can have significant effects on a practitioner’s ability to provide valuable services to their clients. For these reasons, the IRS is continually working to identify, adopt, and refine procedures to detect, address, and prevent actual or possible fraud. Notably, the IRS recently implemented new security measures applicable to how tax professionals can order by phone tax transcripts generated through the Transcript Delivery System (TDS). Tax professionals will now need to call the PPS line to request transcripts be deposited into the professional’s Secure Object Repository (SOR) mailbox. Transcripts will only be provided via phone contact with the PPS; IRS employees on other phone lines may no longer be authorized to provide transcripts through the SOR delivery method. When they call the PPS, tax professionals will need to pass currently required authentication and verify the Short Identification (ID) number associated with their SOR mailbox.

As with these new measures, the OPR intends for the IRS to explore ways that may improve the resolution process for potentially compromised CAF numbers and minimize the burden imposed on practitioners.

Back to Top