Last reviewed: July 2026 | datePublished: 2026-07-24 | dateModified: 2026-07-24
IRC 7216 is the federal criminal statute that governs what a tax return preparer may do with a client's return information. Unlike a civil penalty that a firm might absorb as a cost of doing business, IRC 7216 carries criminal misdemeanor exposure, up to one year in prison and a fine of up to $1,000 per offense, with each unauthorized disclosure or use potentially counting as a separate offense. (Verify current penalty figures against the statute at IRS.gov.) For most tax professionals, a single IRC 7216 conviction is career-ending. This guide explains the offense, who it covers, what Treasury Regulations allow, what consent looks like, and how the statute interacts with its civil counterpart, IRC 6713, and with related provisions such as IRC 6103, IRC 7525, and the emerging challenge of AI-assisted tax preparation tools.
IRC 7216 is a criminal statute. A knowing or reckless unauthorized disclosure or use of return information is a federal misdemeanor. Civil penalty exposure under IRC 6713 is a separate and concurrent risk. If you receive any inquiry suggesting a criminal referral under IRC 7216, engage criminal defense counsel immediately before communicating further with federal investigators.
IRC 7216(a) makes it unlawful for any person who is engaged in the business of preparing, or providing services in connection with the preparation of, tax returns to knowingly or recklessly disclose any information furnished to such person for, or in connection with, the preparation of any such return, or to knowingly or recklessly use any such information for any purpose other than to prepare, or assist in preparing, any such return. The statute covers both disclosure (sharing with a third party) and use (employing the information for a prohibited purpose internally). Verify the full statutory text at IRS.gov or the Cornell LII U.S. Code database.
The mental state element distinguishes IRC 7216 from its civil counterpart, IRC 6713. Under IRC 7216, the government must prove the preparer acted knowingly or recklessly. A preparer who inadvertently discloses return information through a data breach caused by a vendor, without any knowing or reckless conduct on the preparer's part, may have a viable defense that the criminal mental-state threshold was not met. By contrast, IRC 6713 imposes a civil penalty without requiring proof of criminal intent, making it easier for the IRS to assess.
Each unauthorized disclosure or use may constitute a separate criminal offense under IRC 7216. A firm with a data-sharing practice that reaches dozens of clients in a single tax season is not looking at a single violation; it is looking at potentially dozens, each carrying its own fine and imprisonment exposure. This per-offense structure is one of the sharpest risk amplifiers under the statute, and it is why compliance frameworks matter far more than after-the-fact remediation.
IRC 7216 treats each unauthorized disclosure or use as a separate violation. A firm that shares return data for 50 clients without proper consent is not looking at one misdemeanor. Practitioners and firm partners should understand that aggregate exposure scales with client volume, not with the number of incidents.
IRC 7216 applies to persons "engaged in the business of preparing, or providing services in connection with the preparation of, tax returns." The operative definition of "tax return preparer" traces to IRC 7701(a)(36) and is further refined in Treas. Reg. 1.7216-1. The scope is broader than many practitioners assume.
| Category | Coverage Under IRC 7216 / Reg. 1.7216-1 | Practitioner Note |
|---|---|---|
| CPAs and enrolled agents | Clearly covered when compensated for return preparation | Applies even to a single return prepared for compensation |
| Attorneys who prepare returns | Covered when tax return preparation is the service rendered | Separate from any privilege under IRC 7525 |
| Sole-proprietor preparers | Covered; no entity structure required | Individual exposure, not just firm-level |
| Tax preparation firms and franchises | Covered at firm level; employees and partners may have individual exposure | Firm-wide data-sharing policies create firm-wide risk |
| Tax prep software companies | May be covered if their product populates and transmits return data for compensation | Verify scope at IRS.gov; active area of regulatory development |
| Volunteer preparers (VITA/TCE) | May fall within the regulatory definition; verify against Reg. 1.7216-1 | Consult IRS guidance for volunteer program specifics |
| Employees who assist in preparation | Persons who prepare a substantial portion of the return may be covered | Data-entry staff and paraprofessionals are not automatically excluded |
| Third-party service providers | A provider who receives return data to perform a service related to preparation may be covered | AI tool vendors and data analytics providers should assess coverage |
| IRS employees | Not covered by IRC 7216; IRC 6103 governs IRS employee confidentiality separately | See our IRC 6103 guide for the parallel framework |
Verify the current scope of "tax return preparer" under IRC 7701(a)(36) and Treas. Reg. 1.7216-1 at IRS.gov, as Treasury has updated these definitions over time and may do so again.
Treas. Reg. 1.7216-2 lists categories of disclosure and use that do not require taxpayer consent. These exceptions are specific; they do not create a broad "professional judgment" carve-out. A disclosure must fit squarely within a listed exception or consent is required. Always verify the full current text of Treas. Reg. 1.7216-2 at IRS.gov or Treasury.gov before relying on any exception, because the regulation is the controlling authority and it is subject to amendment.
The exceptions described in this section summarize Treas. Reg. 1.7216-2 for practitioner orientation only. The regulation is the controlling authority. Verify every exception and its conditions at IRS.gov or Treasury.gov before relying on it. Treasury has amended this regulation in the past, and practitioners should not assume that a summary they read online reflects the current version of the rule.
| Exception Category | General Description (Verify at IRS.gov) | Common Practitioner Scenario |
|---|---|---|
| Return preparation assistance | Disclosures to third parties who assist in preparing the same return, such as a sub-preparer or specialist reviewer | Sending a Schedule K-1 to a partnership tax specialist retained for a single engagement |
| Within-firm quality review | Disclosures to employees, partners, or contractors of the same firm for quality or peer review of the return | A senior CPA reviewing a junior preparer's work product before filing |
| Court orders and subpoenas | Disclosures required by a court order or legal process | A summons served on the firm requiring production of a client's return file |
| IRS inquiries and examinations | Disclosures in connection with an IRS examination, audit, or other official proceeding involving the taxpayer's return | Providing workpapers to an IRS revenue agent during a correspondence audit |
| Qualified peer review programs | Disclosures to peer review programs specifically listed or described in the regulation | AICPA peer review program reviews; verify the specific program is named in the regulation |
| Error correction | Disclosures to correct an error in the return that may have been caused by another preparer | Notifying a prior preparer of a carry-forward error discovered during the current-year engagement |
| Investigative or regulatory purposes | Certain disclosures to authorized federal or state investigative or regulatory bodies as described in the regulation | Responding to a state board of accountancy investigation of the preparer's own conduct |
| Fiduciary and estate administration | Certain disclosures in connection with estate or fiduciary matters as described in the regulation | Sharing return data with an estate executor for estate administration purposes |
| Disclosed returns submitted to IRS | The act of filing the return with the IRS is a permitted disclosure | E-filing or paper filing the return on behalf of the client |
This table is a practitioner orientation summary only. The regulation contains conditions and qualifications that do not appear in the brief descriptions above. Read the current text of Treas. Reg. 1.7216-2 at IRS.gov or Treasury.gov before relying on any exception.
When a disclosure or use is not covered by a Treas. Reg. 1.7216-2 exception, valid taxpayer consent is the only other protection from IRC 7216 liability. Treas. Reg. 1.7216-3 governs what valid consent looks like. The regulation imposes specific formal requirements; generic engagement-letter language does not satisfy them.
The consent requirements described here reflect general features of Treas. Reg. 1.7216-3 for practitioner orientation. Verify all requirements against the current text of the regulation and any IRS guidance at IRS.gov before implementing a consent program. Treasury has amended these requirements in the past, and the regulation is the controlling authority, not any summary.
The IRS has published revenue procedures and FAQs addressing specific consent scenarios, including marketing solicitations and third-party software data sharing. Practitioners should check IRS.gov for the most current guidance on consent form content and format before deploying client-facing consent programs.
| Statute | Nature | Standard | Penalty / Sanction | Key Distinction |
|---|---|---|---|---|
| IRC 7216 | Criminal | Knowing or reckless | Up to 1 year imprisonment and/or up to $1,000 fine per offense (verify at IRS.gov) | The only criminal statute directly targeting preparer disclosure; no annual cap |
| IRC 6713 | Civil | No criminal-intent requirement | $250 per disclosure, capped at $10,000 per calendar year (verify at IRS.gov) | Civil counterpart; lower bar to assessment; same acts can trigger both statutes |
| IRC 6103 | Civil/Criminal | Governs IRS employees and federal officers | Civil damages and criminal sanctions for IRS employees; separate framework | Does not govern private preparers; different statute with different scope |
| IRC 7525 | Privilege (FATP) | Limits what a client can be compelled to reveal about communications | No penalty statute; governs evidentiary privilege | Protects communications; does not authorize a preparer to disclose to third parties |
| IRC 6694 / 6695 | Civil | Preparer conduct penalties for return positions and filing failures | Various civil penalties; no imprisonment | Different subject matter; these govern return positions, not data disclosure |
The IRC 6103 framework, which governs IRS employee and federal-officer disclosures, is frequently confused with IRC 7216. They are entirely separate statutes with different covered persons, different standards, and different enforcement mechanisms. A private preparer who discloses return information is subject to IRC 7216 and IRC 6713, not IRC 6103.
Because IRC 7216 requires knowing or reckless conduct, a defendant who can establish that the disclosure was neither knowing nor reckless has a complete defense. This is most viable when a vendor or employee caused a disclosure without the preparer's knowledge, without any reckless supervision failure on the preparer's part. However, firms that maintain inadequate data security or use vendors without reviewing their data-sharing terms may struggle to establish that they were not reckless.
A consent that satisfies Treas. Reg. 1.7216-3 is a complete defense to a charge based on a disclosure or use covered by that consent. The burden is on the preparer to prove the consent was obtained and that it complied with the regulatory requirements. Retain signed consent documents and document the process by which they were obtained.
A disclosure that falls within a specific exception listed in Treas. Reg. 1.7216-2 does not require consent and does not violate IRC 7216. The preparer must be able to identify the specific exception and demonstrate that the disclosure fits within its conditions. A general assertion that the disclosure was "reasonable" or "industry standard" is not a substitute for fitting within a listed exception.
The general federal misdemeanor limitations period under 18 U.S.C. 3282 is five years from the date the offense was committed. Practitioners facing a potential IRC 7216 matter should confirm the applicable limitations period with criminal defense counsel, because specific facts (including any period of concealment or the date the offense was discovered) can affect the limitations analysis.
The defenses outlined here are a legal orientation, not a substitute for criminal defense representation. If a client, IRS agent, or DOJ investigator raises IRC 7216 in any context, the preparer should retain criminal defense counsel before responding. Statements made to investigators without counsel present can waive important rights and complicate any defense.
As of 2026, tax preparation firms are increasingly integrating AI-assisted tools, cloud-based platforms, and third-party data analytics vendors into their preparation workflows. These integrations often involve transmitting client return data, including income figures, Social Security numbers, and filing status, to systems operated or accessed by parties outside the preparer's firm. Practitioners should evaluate whether these data flows constitute disclosures or uses of return information subject to IRC 7216.
Practitioners should evaluate whether transmitting client return data to any AI-assisted tax tool, cloud platform, or third-party vendor falls within a Treas. Reg. 1.7216-2 permitted exception or requires taxpayer consent under Treas. Reg. 1.7216-3. No specific technology product is asserted here to violate IRC 7216. The analysis is fact-specific and depends on how the tool processes and transmits data. Monitor IRS.gov and the Federal Register for current guidance.
This is an emerging area and IRS guidance may evolve. Practitioners should not assume that using an IRS-authorized e-file provider or a well-known commercial tax platform automatically resolves the IRC 7216 question. The analysis is always whether the specific data transmission at issue fits within a statutory or regulatory permission. Consult the current regulatory text at IRS.gov and the Federal Register before reaching a compliance conclusion.
An IRC 7216 compliance program does not need to be complex, but it does need to be systematic. The following framework reflects general practice; adapt it to your firm's size and client base.
Identify every point at which client return data leaves the preparer's direct control: software transmissions, vendor integrations, cloud storage, peer-review submissions, subcontractor handoffs, and marketing-list generation. Each point is a potential disclosure requiring either a Reg. 1.7216-2 exception or a Reg. 1.7216-3 consent.
For each data flow, identify the applicable exception under Treas. Reg. 1.7216-2 and verify the current text of that exception at IRS.gov. If no exception fits, obtain a compliant written consent from the client before the data flows. Do not assume an exception applies; read it.
For any use that requires consent (most commonly, marketing solicitations and non-return-preparation referrals), build a library of Treas. Reg. 1.7216-3-compliant consent forms, one per purpose and recipient category, that comply with current IRS form requirements. Review these forms annually and whenever IRS guidance is updated.
Every employee who touches client data should understand what IRC 7216 prohibits and what permissions exist. Document training. Firms that can show an affirmative, documented compliance program are in a substantially better position to rebut a recklessness finding than firms with no program at all.
Any software or data vendor that receives client return data must be covered by a data agreement that confirms the vendor will not re-disclose or use the data for purposes outside the scope of the services it provides. Verify that the agreement's terms align with the Treas. Reg. 1.7216-2 exception the firm is relying on.
What does IRC 7216 prohibit?
IRC 7216(a) makes it a federal misdemeanor for a tax return preparer to knowingly or recklessly disclose or use return information for any purpose other than preparing, or assisting in preparing, a tax return. The criminal standard requires knowledge or recklessness; inadvertent disclosure alone does not satisfy the mental-state element. Verify current statutory text at IRS.gov or Cornell Law School's U.S. Code repository.
What are the criminal penalties under IRC 7216?
IRC 7216 is a Class A misdemeanor carrying a fine of up to $1,000 and/or imprisonment of up to one year per offense, plus the costs of prosecution. Each unauthorized disclosure or use may constitute a separate offense. Verify current penalty amounts against the statute at IRS.gov, as Congress may amend these figures.
Who is a "tax return preparer" under IRC 7216?
The definition draws on IRC 7701(a)(36) and Treas. Reg. 1.7216-1. It extends beyond CPAs and attorneys to any individual or firm that prepares, or employs people to prepare, all or a substantial portion of a tax return or refund claim for compensation. Tax preparation software companies whose products populate and transmit return data may also fall within the definition. Verify the current scope at IRS.gov and in the applicable Treasury Regulations.
What disclosures are permitted without consent under Treas. Reg. 1.7216-2?
Treas. Reg. 1.7216-2 carves out a list of disclosures that do not require taxpayer consent, including disclosures to assist in preparing the return, to persons reviewing the return within the same firm, to comply with a court order or subpoena, and to qualified peer-review programs specifically listed in the regulation. Practitioners should review the full current text of Treas. Reg. 1.7216-2 at IRS.gov or Treasury.gov to determine whether a particular disclosure falls within a listed exception, as the list is specific and the regulation is controlling.
What are the written consent requirements under Treas. Reg. 1.7216-3?
Treas. Reg. 1.7216-3 generally requires that consent be in writing, signed by the taxpayer, contemporaneous with the proposed disclosure or use, and specific as to the recipient and purpose. Electronic consent may be permitted under conditions prescribed in the regulation. The IRS has issued guidance on form requirements. Verify all consent requirements against current Treas. Reg. 1.7216-3 and IRS guidance at IRS.gov, as the requirements are technically detailed and subject to revision.
How is IRC 7216 different from IRC 6713?
IRC 7216 is a criminal statute. A violation is a federal misdemeanor carrying up to one year imprisonment and a fine of up to $1,000 per offense. IRC 6713 is the civil counterpart: it imposes a penalty of $250 per unauthorized disclosure, capped at $10,000 per calendar year, and does not require proof of criminal intent. The same act can trigger both statutes simultaneously, meaning a preparer who knowingly discloses return information without consent faces both criminal prosecution and civil penalty assessment.
What defenses are available against an IRC 7216 prosecution?
Recognized defenses include: (1) lack of the required mental state, i.e., the disclosure was neither knowing nor reckless; (2) valid taxpayer consent obtained in compliance with Treas. Reg. 1.7216-3; (3) the disclosure fell within a permitted exception under Treas. Reg. 1.7216-2; and (4) expiration of the applicable statute of limitations. Practitioners facing a potential IRC 7216 matter should consult criminal defense counsel to assess the applicable limitations period and the strength of available defenses on their specific facts.
Must preparers evaluate IRC 7216 when using AI-assisted tax software or third-party data pipelines?
Practitioners should evaluate whether transmitting client return data to AI-assisted tax tools, cloud platforms, or third-party software vendors constitutes a disclosure or use of return information subject to IRC 7216 and Treas. Reg. 1.7216-2. No specific technology product is asserted here to violate IRC 7216. Preparers should review vendor data agreements, assess whether a Reg. 1.7216-2 exception applies, obtain compliant consent under Reg. 1.7216-3 where required, and monitor IRS.gov and the Federal Register for current guidance on data-sharing arrangements.
If your firm shares client data with AI tools, cloud vendors, or third-party providers, your IRC 7216 compliance posture needs a current review. Americas Tax works with preparers and firms to identify data-flow risks, build compliant consent programs, and establish firm-wide policies before the IRS comes asking. Schedule a consultation today.
Schedule a Consultation