If you are looking at how to outsource tax preparation to India, the rate is the easy half of the decision. Federal law settles the other half, and it settles it before the first file moves. The taxpayer has to sign a consent before any return information crosses the border, and for individual filers the Social Security number has to be redacted unless a specific data safeguard is running on both ends.
Get that order wrong and the exposure is criminal and civil, and it lands on your firm, because the rules put the duty on the preparer who makes the disclosure. You get the rule as written, the wording your engagement letter has to carry, and a way to run a first season so the work comes back in a state your reviewer can stand behind.
What the Rules Regulate Is Location, Not Country
Nothing in the disclosure rules names India. What triggers the consent duty is that the preparer sits outside the United States or its territories and possessions, so a preparer in Manila, Warsaw or Bengaluru is governed by the same paragraph.
Inside the United States, the default runs the other way. Under the disclosure regulations that implement section 7216, an officer, employee or member of a preparer may disclose return information to another officer, employee or member of the same preparer, located in the United States, to help prepare the return, with no consent. The regulation then adds the sentence that governs offshore work: if the person receiving the information is located outside the United States or any territory or possession, the taxpayer's consent is required before any disclosure.
Sending work to a separate provider follows a parallel path. Preparer to preparer disclosures are authorized without consent only to a preparer located in the United States, and only where the services are not substantive determinations or advice affecting the tax liability reported. The regulation defines a substantive determination as one involving an analysis, interpretation or application of the law.
Read together, those two rules settle what the offshore team is allowed to touch. Your India team can do substantive preparation work, but only on the far side of a signed consent.
One narrow exception runs the other way. If the client first handed their return information to a preparer located outside the United States, the same regulation lets that preparer's own officers, employees and members use and share it without consent. That covers a firm's overseas office serving a client already abroad, not a route around the consent your US clients have to sign. The exception's own text stops there. The worked example published with it, at paragraph (c)(4), adds the rest: the firm has to obtain the taxpayer's consent before any subsequent disclosure of that information to a preparer located outside the United States.
The penalties behind them are not administrative. A knowing or reckless unauthorized disclosure is a misdemeanor under section 7216, punishable by a fine of not more than $1,000 or up to one year in prison, or both, together with the costs of prosecution, and Revenue Procedure 2013-14 restates the related civil penalty under section 6713 as $250 for each disclosure or use, capped at $10,000 in a calendar year.
Four disclosures cover most of what a firm actually does with a return, and the consent answer differs for each.
| The disclosure | Consent needed before it happens |
|---|---|
| To a colleague inside your own firm in the United States, to help prepare the return | No |
| To a preparer located outside the United States, including India | Yes, signed and dated first |
| To a separate US preparer for processing or electronic filing, no judgment involved | No |
| To a separate preparer for substantive determinations, anywhere | Yes, signed before the disclosure |
| Source: the disclosure regulations under section 7216. |
The Consent Your Client Signs Before Anything Leaves
A consent is a document with required contents, not a line in a cover email. Under the consent regulation that implements section 7216, every consent has to name the preparer and the taxpayer, identify the intended purpose of the disclosure, identify the specific recipient, specify the return information being disclosed, and carry the taxpayer's signature and date.
Four more rules sit alongside the contents. Consent has to be signed before the disclosure, so there is no curing it afterwards. If the document does not state a duration, it runs for one year from the date the taxpayer signed. A single written document cannot authorize both uses and disclosures, so a use consent and a disclosure consent are two separate pieces of paper. And the taxpayer gets a copy of the executed consent at the time of execution.
There is one point of relief here for firms worried about losing the engagement. The regulation generally treats a consent obtained by conditioning services as involuntary, but it carves out this exact situation: a preparer may condition its preparation services on the taxpayer consenting to disclosure to another preparer who assists with the return. You are allowed to make it a condition of the engagement, and the mandatory wording for that situation differs from the wording used outside a preparation context, so the two are not interchangeable.
The Extra Rules for Form 1040 Clients
Individual filers get a second layer of formatting rules, and they are unusually literal. Revenue Procedure 2013-14 requires a taxpayer's consent to each separate disclosure to sit in its own written document, which may be an attachment to the engagement letter. One document may carry several disclosures, but only if the client can affirmatively select each one inside it. On paper it has to be on 8 1/2 inch by 11 inch or larger sheets, in at least 12-point type, with every word on the sheet relating only to that consent.
The same guidance sets out mandatory statements that have to appear in a fixed sequence, tells you that consent must be affirmative rather than an opt-out box the client deselects, and prohibits presenting a form with blank spaces to be filled in after signing. Electronic consents need a signature method that makes the client actively type something, such as a personal identification number of at least 5 characters or their own name, and software may not supply it for them.
For a disclosure to a preparer outside the United States where the number is masked, the required sentence is short: "This consent to disclose may result in your tax return information being disclosed to a tax return preparer located outside the United States."
Business Returns Follow a Different Path
Entity clients sit outside the Form 1040 formatting regime, which makes the paperwork lighter but not optional. A consent for a taxpayer not filing in the Form 1040 series may be in any format, including an engagement letter, as long as it meets the general content requirements, and the rule that splits uses and disclosures into two documents does not apply to it.
The regulation's own example is worth copying in shape. It shows an engagement letter that names the preparer and the taxpayer, carries a signature and date line, states that the taxpayer authorizes disclosure to the preparer's affiliates located outside the United States for the purpose of preparing that year's return, and includes an acknowledgment that the information will go to preparers located abroad. Whoever drafts your letters should be working from that structure rather than from a provider's template.
Social Security Numbers Are the Part Firms Get Wrong
For anyone filing in the Form 1040 series, the default is a flat prohibition. A preparer located in the United States may not obtain consent to disclose that taxpayer's Social Security number to a preparer located outside the United States, and has to redact or otherwise mask the number before the return information goes offshore. That is the baseline in the consent regulation under section 7216, not a best practice.
The One Exception, and What to Ask For
The exception to that is narrow and conditional. The number may be disclosed offshore only through an adequate data protection safeguard as defined by Treasury in published guidance, and only if the consent request itself verifies that the safeguard is maintained. Two narrow carve-outs sit next to it: a US preparer may retransmit a number it originally received from that same offshore preparer, and someone continuously employed in the United States who is briefly travelling abroad is not treated as located outside the country.
Revenue Procedure 2013-14 supplies the definition. An adequate data protection safeguard is a management approved and implemented security program, policy and practice, covering administrative, technical and physical safeguards, that meets or conforms to one of six named frameworks. Both preparers, the one in the United States and the one abroad, have to maintain it when the consent is obtained and when the disclosure is made.
The six in that guidance read best as a checklist you hand the provider. The United States Department of Commerce safe harbor framework is listed with "or a successor program" attached, which is the guidance's own signal that this one was built to be replaced. A foreign law data protection safeguard with a security component means the provider's own national regime, and the example given is the European Commission's Directive on Data Protection. An industry-specific standard generally accepted as best practice covers financial sector schemes, and the example given is the BITS, Financial Services Roundtable, Financial Institution Shared Assessment Program.
The last three in the same guidance are narrower. The AICPA and CICA Privacy Framework is the accounting profession's own. IRS Publication 1075 sets tax information security guidelines for federal, state and local agencies and entities, and the guidance points at its most recent version. The sixth is a catch-all for any framework giving the same level of privacy protection as the other five.
That guidance dates from 2013, so a provider claiming the exception should be able to say which of the six it relies on today and show you the program sitting behind the claim.
The guidance is blunt about reach. When a Social Security number does travel, Revenue Procedure 2013-14 makes you tell the client, in the consent itself, that federal agencies may not be able to enforce United States laws that protect the privacy of that information against a tax return preparer located outside the United States. That is the honest description of what offshoring does to recourse, and your firm is the party still standing in front of it.
The practical reading for a firm sending 1040 work to India is simple enough to put in a checklist. Either you mask the number before the file moves and add it on your side, or you satisfy the exception, document which framework both parties maintain, and use the longer mandatory consent wording that discloses the number will travel.
What Your India Team Can Do, and What Stays in Your Office
Scope is your decision, not the provider's menu, and it is worth settling before you talk to anyone. Form 1040 series returns and entity returns sit under different consent rules, so decide them as two separate questions rather than one. Extensions and estimated payments are high volume and low judgment, which makes them the cheapest first block to test. If state and local returns are part of what you want handled, name that work in the consent rather than assuming it rides along with the federal return.
Workpaper preparation and reconciliations are the easiest block to hand over first, and they tell you the most about a provider's discipline before a return is at stake. Whatever the task is called, the consent duty attaches to the return information you disclose, so write the consent around the information that moves rather than around the job title.
The signature follows responsibility, not geography. A filed return has to carry the identifying number of the preparer required to sign it, under the preparer identification rules, and the definition those rules point to makes the signing preparer the individual who has primary responsibility for the overall substantive accuracy of the preparation of the return. That is a test about who owns the judgment, not about who holds the client. Keep the final judgment with your reviewer, and the signature stays in your office along with the exposure riding on it. Let it drift offshore and you have moved more than preparation work.
The identification requirement reaches further than the signature line. The same regulation requires a preparer tax identification number for any individual compensated for preparing, or assisting in the preparation of, all or substantially all of a tax return, whether or not that person signs. If your India team is doing whole returns rather than data entry, that requirement is a question to put to your provider in writing, and to your own advisor, before the season starts.
The law allows more than most firms should hand over. With consent in place, the offshore team can take the preparation work and a first review pass. Three things belong where the signature is: the final judgment on positions, the review that catches what a preparer missed, and the client conversation. An engagement that quietly moves judgment offshore has not saved you review time, it has moved your risk somewhere you cannot watch it.
The Security Program Is Your Job Too
Consent covers disclosure. Your information security program covers what happens next, and it does not transfer to the provider. The FTC Safeguards Rule requires a covered company to oversee service providers by taking reasonable steps to select and retain providers capable of maintaining appropriate safeguards, requiring those safeguards by contract, and periodically assessing providers based on the risk they present.
That rule reaches your firm directly. The FTC's guidance on who is covered lists tax preparation firms among the examples of financial institutions the Safeguards Rule applies to.
Each of those three is a specific artifact you should be able to produce. Selection means written diligence before the first file moves. Contract means the safeguard obligations are in the agreement rather than in a sales deck. Periodic assessment means a recurring date in your calendar, owned by a named person, not a one time review at onboarding.
The Rule also reaches what happens after a failure. The FTC's guidance notes the Rule was amended in 2023 to require covered entities to report certain data breaches and security incidents, with those notification requirements taking effect in May 2024. Whether a given incident at a provider triggers your reporting duty is a question for your own advisor, but a contract that does not fix how fast the provider tells you makes that question unanswerable in the week it matters.
How to Run the First Season
Six steps, in this order, because each one depends on the one before it.
- Pick the work before you pick the provider. Name the return types and the client segments you are willing to send. Everything downstream, from the consent language to the volume you commit, follows from that list.
- Write the consent into your engagement process. Separate document for Form 1040 clients, engagement letter language for entities, and a rule that nothing moves for a client who has not signed.
- Decide the Social Security number question explicitly. Mask by default, or satisfy the exception and document the framework. Pick one and write it down, because the two paths need different consent wording.
- Do the security diligence before the first file. Selection, contract terms, and an assessment date. Ask who at your firm owns it.
- Run a small block of real returns first. Your own representative work, prepared offshore, reviewed by your reviewer, with rework counted. One real batch tells you more than any reference call.
- Measure review time, not preparation time. If your reviewer spends as long on an offshore return as on an in-house one, the engagement has not delivered capacity yet, whatever the rate says.
When Not to Outsource Tax Preparation to India
Some firms should wait a year, and the honest signals are easy to check.
If a meaningful share of your clients will not consent to disclosure outside the United States, an offshore model cannot cover your whole book, and a partial rollout has to be planned and priced as a partial rollout.
If what you want off your plate is positions, elections and planning calls, you are looking for a colleague rather than a capacity contract. Judgment does not hand off the way preparation does.
If your process lives in one person's head, you will pay for that in rework. A provider cannot follow a standard nobody has written down.
If the season has already started, the ramp lands in the worst weeks of your year. Begin a first engagement in the quiet months instead.
If nobody in your firm will own the consent and safeguard work, do not start. That work is not optional, and unowned compliance work is how a cheap engagement becomes an expensive one.
Questions US Firms Ask
Is Outsourcing Tax Preparation to India Worth It?
It depends on whether your bottleneck is preparation hours or judgment hours. If your reviewers are drowning in first draft preparation, offshore capacity moves the constraint. If the queue is stuck at review and sign off, adding preparers upstream makes the queue longer, not shorter. Track where your hours go for two weeks before you decide.
How Much Does It Cost to Outsource to India?
Any rate you are quoted is one of three inputs, and the other two are set inside your office. The rate buys preparation. Your review time and your rework rate decide the real cost per accepted return, and both are measurable from a single test batch. Compare providers on that unit, not on the hourly number.
Can the Team in India Sign the Return?
Not if your firm is the one making the final call. The return carries the identifying number of the preparer required to sign it, and that is the individual with primary responsibility for the overall substantive accuracy of the return. Offshore staff prepare, your reviewer decides, and your firm signs.
Do We Have to Tell Every Client?
Every client whose return information goes offshore has to sign a consent first, and the consent has to say the information may go to a preparer located outside the United States. There is no version of this where the client finds out later.
The Order That Matters
Scope, then consent, then redaction, then diligence, then the first batch. That sequence is the decision, not paperwork stacked in front of it, because every step in it is a duty the rules put on your firm rather than on the provider you hire.
Do the consent and safeguard work in a quiet month, then test one small block of real returns and count the rework. If the numbers hold, scale in the season. If they do not, you have spent one batch finding out instead of one April.
Accountably places trained offshore accountants and tax preparers inside US CPA and EA firms, ramped on your software and SOPs in about 3 to 4 weeks. Since 2022 that has meant 30+ placements across 20+ US firms. If you want to see how your own returns come back before you commit a season to it, the low risk test is a Free 40-Hour Proof Pilot, a fixed block of your representative work put through multi-layer review so your reviewer grades real output before your name is on the line. Don't trust us. Test us.