EFIN - PTIN holder Submitting the Electronic Returns 2027

In the context of the IRS Written Information Security Plan (IRS WISP), both EFIN and PTIN holders have specific responsibilities to ensure that taxpayer data is protected, secure, and managed in accordance with regulatory standards. The IRS WISP outlines the minimum data protection standards for entities that handle taxpayer information, including Electronic Return Originators (EROs), tax preparers, and other Providers involved in the e-filing process.

IRS WISP Requirements for EFIN Holders

For EFIN holders, who are often EROs, the IRS WISP mandates comprehensive data security practices to secure the submission and processing of electronic tax returns. Key responsibilities include:

1. Secure Data Handling: EFIN holders must ensure the secure transmission, processing, and storage of taxpayer information, whether they transmit returns directly to the IRS or through an Intermediate Service Provider or Transmitter. The IRS WISP mandates strict measures to protect taxpayer data from unauthorized access, ensuring that EROs implement technical, administrative, and physical safeguards.
2. Authentication and Access Control: Since EFIN holders have the authority to file electronic returns, the IRS WISP requires that only authorized personnel access sensitive taxpayer data. This includes implementing access control measures, multi-factor authentication (MFA), and ensuring that systems and networks are configured to secure data from unauthorized access.
3. Data Sharing Compliance: Under Treasury Regulation §301.7216-2(d)(1), EFIN holders may disclose tax return information to other Providers, such as Intermediate Service Providers or Transmitters, for e-filing purposes without obtaining taxpayer consent. The IRS WISP, however, requires that any such data sharing strictly adhere to regulatory standards and that only necessary information is shared. Providers must document and track any disclosures to other Providers to ensure accountability and traceability.
4. Incident Response and Reporting: The IRS WISP also outlines incident response protocols that EFIN holders must follow in the event of a data breach. This includes immediate action to contain the breach, assessment of the impact, notification of affected parties, and documentation of the response measures.

IRS WISP Requirements for PTIN Holders

PTIN holders, generally individual tax preparers, have additional IRS WISP responsibilities to safeguard taxpayer information while preparing returns and passing them to the ERO. These responsibilities include:

1. Confidentiality of Client Data: PTIN holders must adhere to confidentiality protocols when handling sensitive taxpayer information. The IRS WISP emphasizes that taxpayer data should not be accessed or disclosed without authorization. PTIN holders should ensure that only authorized personnel can view or handle the data, protecting it from internal and external threats.
2. Data Entry Accuracy: PTIN holders are responsible for ensuring that the ERO receives accurate and complete information for electronic submission, including their own identifying information (PTIN, name, address, EIN, if applicable). This is essential to maintain data integrity within the e-filing system and facilitate accurate record-keeping and compliance.
3. Training and Awareness: The IRS WISP requires that PTIN holders remain informed of IRS data security requirements, including training on identifying phishing attempts, secure handling of taxpayer information, and recognizing potential security threats. This ensures that PTIN holders understand and comply with all IRS security protocols.
4. Reporting Security Concerns: PTIN holders are obligated to report any suspicious activity or potential security concerns to their ERO or the IRS, following IRS WISP guidelines. This aligns with the broader incident response requirements and helps prevent potential security breaches that could compromise taxpayer data.

Shared Responsibilities for EFIN and PTIN Holders under the IRS WISP

The IRS WISP creates a unified approach to securing taxpayer information, with both EFIN and PTIN holders playing critical roles in maintaining this security. Shared responsibilities include:

• Compliance with Multi-Factor Authentication (MFA): Both EFIN and PTIN holders are required to use MFA to access systems containing taxpayer information, enhancing protection against unauthorized access.
• Ongoing Security Assessments: Both EFIN and PTIN holders must regularly assess and improve their security practices. The IRS WISP mandates periodic reviews of internal controls, vulnerability assessments, and compliance audits to identify and mitigate potential risks.
• Accurate Record-Keeping: Both EFIN and PTIN holders must ensure that all identifying information entered into the electronic return is accurate. This includes entering the PTIN, name, and address of the preparer, as well as the EFIN, to create a clear record of accountability for each filed return.
• Adherence to IRS Regulations: Finally, both EFIN and PTIN holders must fully comply with IRS regulations, including Treasury Regulation §301.7216-2(d)(1), which permits certain data disclosures among Providers for the purpose of e-filing without taxpayer consent. They must ensure that any disclosures are strictly for e-filing purposes and maintain records of such disclosures for accountability.

Conclusion

The IRS’s IRS WISP provides a structured framework for EFIN and PTIN holders, defining comprehensive data protection measures and protocols. By adhering to the IRS WISP guidelines, EFIN and PTIN holders can ensure the confidentiality, security, and integrity of taxpayer information, contributing to a secure and compliant e-filing process. This collective effort between EFIN and PTIN holders upholds taxpayer trust and reinforces the security standards necessary for the IRS's electronic filing ecosystem.