Do tax preparers need multi-factor authentication?

Leer en español

The short answer

Yes. The FTC Safeguards Rule, 16 CFR Part 314, covers tax preparers. Section 314.2 lists "an accountant or other tax preparation service that is in the business of completing income tax returns" as a financial institution. Section 314.4(c)(5) requires multi-factor authentication for any individual accessing any information system, unless your Qualified Individual approves reasonably equivalent or more secure access controls in writing. The small office exemption does not remove it. Of MFA, IRS Publication 4557 says: "This is required for all companies regardless of size."

What the FTC rule says

Section 314.4 opens with "you shall," then lists the elements of your information security program. Paragraph (c)(5) reads:

"Implement multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls;"

In plain words: anyone who accesses an information system must use multi-factor authentication, which means at least two different types of factor (defined below). A password plus a second password is not two types.

The rule allows one exception. Your Qualified Individual, the person you designate to oversee, implement and enforce your program, may approve other access controls instead. Those controls must be reasonably equivalent or more secure, and the approval must be in writing. It does not allow weaker access controls. Section 314.4(a) says the Qualified Individual "may be employed by you, an affiliate, or a service provider."

"Information system" is defined in section 314.2 as electronic information resources "containing customer information or connected to a system containing customer information." So it covers the systems that hold client data and the ones connected to them.

Does the small-office exemption change it?

No. Section 314.6 says:

"Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers."

Paragraph (c)(5) is not on that list. So an office that keeps customer information on fewer than 5,000 consumers still has to meet the MFA requirement. The exemption counts consumers, not staff. See the FTC Safeguards Rule guide for the four parts that do drop out.

What the IRS publications add

Publication 4557 (Rev. 6-2024) puts MFA in its list of internal controls: "Implement multi-factor authentication for anyone accessing customer information on your system." It also says:

• "Tax software products for both taxpayers and tax professionals now offer multi-factor authentication."
• "Use the most secure option available, not only for your tax software, but other products such as email accounts and storage provider accounts."
• MFA and a secure VPN "should be minimum standards for remote access to the firm's office network."

Its glossary gives IRS e-Services as an example. e-Services is protected by IRS Secure Access, "a two-factor authentication process." It adds: "Tax professionals should always use the highest multifactor authentication available."

Publication 5708 (Rev. 8-2024) is the IRS guide to writing a WISP, with a sample template. Its sample policy says: "Remote access will only be allowed using multi-factor Authentication (MFA) in addition to username and password authentication." That is sample language for you to adapt to your office.

What counts as MFA

Section 314.2 defines it as "authentication through verification of at least two of the following types of authentication factors":

• "Knowledge factors, such as a password"
• "Possession factors, such as a token"
• "Inherence factors, such as biometric characteristics"

Publication 4557 gives one example: you enter your username and password "plus a security code sent as a text to your mobile phone before you can access an account."

Where to turn it on

These are the categories the IRS texts name. Check each one in your office.

• Tax software. Publication 4557 says tax software products "now offer multi-factor authentication."
• Email. Publication 4557 says to protect email accounts with "two-factor authentication if available."
• Remote access. Publication 4557 says MFA and a secure VPN "should be minimum standards" for remote access to the office network.
• Cloud storage. Publication 4557 suggests "multi-factor authentication options" for a cloud storage service.

The rule itself is not limited to these four. Paragraph (c)(5) covers any individual accessing any information system, as defined above.

Put it in your plan

Under user access, Publication 5708's planning list includes "Multi-factor Authentication Policy controls." Under remote access, it says to "Set policy requiring multi-factor authentication for remote access connections." The free WISP generator makes a draft. For a template, see the WISP template guide.

Sources

• 16 CFR 314.2, 314.4, 314.6 (eCFR, 2026-10-01): ecfr.gov, Part 314
• IRS Publication 4557 (Rev. 6-2024): irs.gov/pub/irs-pdf/p4557.pdf
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf

This is general information, not legal advice.