Practitioner Guide | Wave 69b

IRC 6713: Civil Penalty for Preparer Disclosure or Use of Return Information

Last reviewed: July 2026  |  datePublished: 2026-07-24  |  dateModified: 2026-07-24

Most tax preparers know that sharing a client's return information without permission can create legal trouble. Fewer know that federal law imposes a standalone civil penalty for exactly this conduct, separate from and in addition to any criminal exposure. IRC 6713 is that civil penalty statute. It applies to every "tax return preparer" as defined in the Code, and it does not require a finding of criminal intent. The notice arrives, the window to challenge it is short, and a practitioner who has never heard of IRC 6713 is already at a disadvantage.

This guide covers what IRC 6713 covers, how it differs from the criminal statute at IRC 7216, what consent is required to avoid it, and what defenses are available once an assessment has been made. It is written for tax preparers, CPA firm owners, and attorneys representing preparers in disciplinary or penalty proceedings.

1. What IRC 6713 Covers

IRC 6713 imposes a civil money penalty on any tax return preparer who discloses or uses taxpayer return information for a purpose not authorized by the Code. The penalty is $250 per unauthorized disclosure or use, subject to a maximum of $10,000 per calendar year per preparer. Verify current penalty amounts directly at IRC 6713(a), as Congress may amend these figures.

"Return information" has the same meaning as under IRC 6103 and includes any data furnished to a preparer in connection with preparing a return: income, deductions, account numbers, identification numbers, and the existence of a filing relationship itself.

The statute covers two types of conduct: (1) disclosure, meaning transmitting or sharing return information with a third party, and (2) use, meaning employing return information for a purpose other than preparing or filing the taxpayer's return. Both are addressed in the regulations at Treas. Reg. 301.7216-1 through 301.7216-3.

2. The Civil/Criminal Distinction: IRC 6713 vs. IRC 7216

IRC 6713 is the civil penalty. IRC 7216 is the criminal statute covering the same underlying conduct. Understanding the difference matters because the two tracks are independent and can run simultaneously from the same act.

IRC 7216 makes it a federal crime to knowingly or recklessly disclose or use a taxpayer's return information for purposes other than those authorized by the Code. A conviction under IRC 7216 can result in imprisonment of up to one year and/or a fine of up to $1,000 per violation. The criminal statute requires the government to prove a mental state: knowing or reckless conduct.

IRC 6713, by contrast, does not require proof of criminal intent. A preparer who was unaware that a disclosure was prohibited is not, on that basis alone, excused from the civil penalty. This asymmetry is the most important practical difference between the two statutes, and it is discussed further in the defense strategy section below.

3. What Counts as "Disclosure"

A disclosure is any communication of taxpayer return information to a third party who is not authorized to receive it. The critical point is that intent is not a required element for the civil penalty. The following examples each constitute a disclosure for IRC 6713 purposes:

• Mentioning a client's income, tax liability, or financial position to a business partner, even in passing conversation
• Discussing a client's financial details during a marketing pitch to a prospective joint-venture partner
• Transmitting a client's contact information, derived from a tax return, to a third-party marketing service
• Sending return data to a software vendor whose contract does not cover that data transfer as a permitted exception
• Sharing a client's filing status or entity structure with a lender, investor, or referral source without consent

The disclosure does not have to be intentional or commercially motivated to trigger IRC 6713. An inadvertent email to the wrong recipient, or a careless remark that reveals return information to a non-client, is still a disclosure under the statute.

4. What Counts as "Use"

A "use" of return information occurs when a preparer employs that information for a purpose beyond preparing or filing the taxpayer's return, without consent or a regulatory exception. The most common practical scenario involves marketing: a preparer uses the client contact information gathered during the return-preparation engagement to send unsolicited promotional emails, newsletters, or solicitations for other services.

Other examples of unauthorized "use" include:

• Using a client's income or asset profile to target that client for upselling financial products without consent
• Mining return data to segment a client list for a firm's own marketing campaigns
• Using a client's entity structure, learned from preparing their return, to market formation or restructuring services without a compliant consent form
• Retaining return information beyond the preparation engagement and using it to re-engage the client in a subsequent year without fresh consent

The line between a permitted operational use (such as maintaining client files for follow-up on open items) and an unauthorized marketing use is drawn primarily by the consent rules and permitted-use exceptions in the regulations, discussed in Sections 5 and 6 below.

5. Consent Requirements Under Treas. Reg. 301.7216-3

To use or disclose taxpayer return information for marketing or other non-preparation purposes, a preparer must obtain written consent from the taxpayer that satisfies the requirements of Treas. Reg. 301.7216-3. The regulation prescribes both the content and format of a valid consent. A form that falls short of these requirements offers no protection against IRC 6713 or IRC 7216.

A compliant consent must be:

• In writing and signed by the taxpayer, before the disclosure or use takes place
• Separate from the engagement letter and from any other consent the taxpayer signs; consent buried in the body of a fee agreement or engagement terms is not valid
• Specific as to purpose: the form must identify the particular disclosure or use for which consent is given; a general release of "all return information for any purpose" does not comply
• Not bundled with other consent items: each distinct use or disclosure purpose requires its own consent
• Compliant with the regulation's form requirements, including required language describing the taxpayer's right to refuse and the consequences of refusal

6. Permitted Uses and Disclosures Without Consent

Treas. Reg. 301.7216-2 lists categories of disclosures and uses that are permitted without taxpayer consent. These exceptions are specific and should not be interpreted broadly. The principal permitted categories include:

• Preparing and filing the return: all disclosures and uses reasonably necessary to prepare, sign, and file the taxpayer's return are permitted, including to software vendors and e-file providers that are covered by the regulation's treatment of "return preparation services"
• Responding to an IRS examination: disclosures made in the course of an IRS audit, inquiry, or examination of the taxpayer's return
• Peer review programs: disclosures to quality review programs specifically listed in Treas. Reg. 301.7216-2, where the review is conducted under confidentiality protections
• Certain litigation support: disclosures necessary to support litigation in limited circumstances identified in the regulation
• Disclosures to other preparers: sharing return information with another preparer who is assisting in preparing the same return, subject to the conditions of the regulation

If a disclosure does not fall within one of the enumerated exceptions in Treas. Reg. 301.7216-2, the preparer needs a valid consent under Treas. Reg. 301.7216-3 or the disclosure is unauthorized under IRC 6713.

7. Cloud Software and Third-Party Data Sharing

A significant area of IRS focus in 2025 and 2026 involves tax preparation software that shares client return data with third-party advertisers, data brokers, or analytics platforms, often without the preparer's full awareness. Standard software privacy policies have been found to permit the sharing of "aggregate" or "anonymized" data that may still constitute return information under IRC 6103 and the 7216/6713 standards.

The relevant question is not whether the software vendor initiated the data transfer, but whether the preparer authorized it and whether it was covered by a permitted exception under Treas. Reg. 301.7216-2. If the software's data-handling practices fall outside the permitted exceptions, the firm may be treated as the disclosing party for IRC 6713 purposes, regardless of whether a human employee made the disclosure.

Practical steps for firms using cloud-based tax software:

• Review the data processing agreement or privacy addendum from each software vendor
• Confirm that third-party data transfers are limited to those permitted under Treas. Reg. 301.7216-2
• If the vendor agreement does not clearly limit data sharing to permitted uses, consult counsel before continuing use of the platform

Verify current IRS guidance on third-party data sharing by tax software at IRS.gov, as the agency has signaled ongoing enforcement attention in this area.

8. OBBBA 2025 and Heightened Preparer Oversight in 2026

The One Big Beautiful Budget Act of 2025 (OBBBA) expanded the IRS's preparer oversight authority. Under the expanded framework, the IRS has broader tools for monitoring and disciplining return preparers, and the combination of Circular 230, IRC 6713, and IRC 7216 represents the core regulatory perimeter around preparer conduct.

As of 2026, practitioners and firm owners should be aware that the IRC 6713/7216 enforcement environment is operating at heightened attention. Verify current OBBBA preparer oversight provisions at IRS.gov for the most recent IRS guidance and any implementing rules that may have issued after the date of this guide.

For firms subject to Circular 230, a violation of IRC 6713 can also trigger a referral to the IRS Office of Professional Responsibility (OPR), potentially leading to a Circular 230 disciplinary proceeding independent of the civil penalty assessment. These two tracks are not mutually exclusive.

9. How the IRS Assesses the IRC 6713 Penalty

The IRC 6713 civil penalty is an IRS-assessed penalty, not a self-reported one. The IRS can assess the penalty upon discovery of an unauthorized disclosure or use, which may occur through an audit, a complaint from a taxpayer, a referral from the Department of Justice, or information obtained in the course of another examination.

The normal deficiency procedures applicable to income tax do not govern IRC 6713 assessments directly. Once assessed, the penalty is collectible through the IRS's standard collection procedures. Collection Due Process (CDP) rights under IRC 6330 may be available, allowing the preparer to request a CDP hearing before or after levy action begins. The CDP window is short, and missing it can significantly limit available remedies.

Practitioners receiving a Notice of Proposed Assessment or a Notice of Tax Due related to an IRC 6713 penalty should consult counsel promptly to evaluate all available challenge procedures, including CDP rights and any substantive defenses to the underlying penalty. Verify current assessment and challenge procedures with tax counsel, as procedural rules may have changed.

10. Defense Strategy for IRC 6713 Assessments

Lack of knowledge is not a defense to the IRC 6713 civil penalty. This is the most important thing a preparer facing an assessment needs to understand at the outset. The absence of bad intent, the preparer's good character, and the fact that no taxpayer was harmed are not, standing alone, defenses to the civil penalty.

The two defenses that can actually defeat an IRC 6713 assessment are:

1. The disclosure was permitted under Treas. Reg. 301.7216-2. If the challenged conduct falls within one of the enumerated exceptions, there is no violation. The preparer bears the burden of demonstrating that the disclosure fell within a specific listed category and met the conditions of that exception.
2. Valid consent was obtained under Treas. Reg. 301.7216-3. If the preparer secured a written, taxpayer-signed, purpose-specific consent form before the disclosure or use occurred, and that form complies with the regulatory requirements, the disclosure or use was authorized and the penalty does not apply. Documentation is everything: the consent form must exist, be correctly executed, and be retained in the client file.

Secondary procedural challenges include the IRC 6751(b) supervisor-approval requirement, discussed in Section 11 below, and any applicable statute of limitations arguments. These are procedural rather than substantive and are distinct from defenses to the underlying conduct.

11. Coordination with IRC 6751(b): The Supervisor-Approval Requirement

IRC 6751(b) requires that certain penalty assessments be personally approved in writing by an IRS supervisor before the penalty is assessed. This supervisory-approval requirement applies to IRC 6713 civil penalty assessments. An IRC 6713 penalty assessed without the required supervisor sign-off is procedurally invalid and subject to challenge, regardless of the merits of the underlying disclosure allegation.

The Chai and Graev line of Tax Court cases, and the IRS's own regulatory response in TD 10017, have shaped the procedural landscape for the supervisor-approval requirement. Practitioners defending against an IRC 6713 assessment should always request documentation of the supervisor's written approval as a threshold matter in any challenge proceeding.

For a full discussion of the supervisor-approval requirement and how to raise it in a penalty challenge, see the IRC 6751(b) Supervisory Approval Practitioner Guide.

IRC 6713 vs. IRC 7216: Comparison Matrix

Frequently Asked Questions