EFIN requirements for tax preparers: the data security part

The short answer

An EFIN, the Electronic Filing Identification Number, is what the IRS assigns to a firm it accepts into IRS e-file. IRS Publication 3112 says the firm "submits an e-file application, meets the eligibility criteria and must pass a suitability check before the IRS assigns an Electronic Filing Identification Number (EFIN)." Applicants that are accepted become Authorized IRS e-file Providers, and Publication 3112 puts data security duties on Providers. Publication 3112 says: "Providers must safeguard taxpayer information from unauthorized disclosure, use and destruction."

This page covers only the security side. The application steps are in Publication 3112.

Protect the EFIN itself

Publication 3112: "Providers must protect their EFINs and ETINs from unauthorized use and never share them." It says sharing includes accepting payment for the use of an EFIN or ETIN ("e.g., renting, leasing, purchasing") and transferring an EFIN or ETIN to another entity when the business changes hands "by sale, gift or other disposition." The new owner has to get their own EFIN, which only the IRS can issue.

Publication 3112 says that when the IRS "determines that a Provider is renting, leasing, or purchasing another Provider's EFIN, or is allowing others who have not passed suitability to use the Provider's EFIN, the Provider will be sanctioned." And: "When an EFIN or ETIN is compromised, IRS will take the appropriate actions to protect IRS e-file." The text does not say what those actions are.

Protect the client data behind it

Publication 3112 puts several duties on Providers in one section:

• "Providers must safeguard taxpayer information from unauthorized disclosure, use and destruction."
• They "must be diligent in detecting and preventing identity-theft fraud patterns and schemes" to protect taxpayers and IRS e-file from identity-theft refund fraud.
• "Providers must have security systems in place to prevent unauthorized access by third parties to taxpayer accounts and personal information."
• "Providers must implement security and privacy practices that are appropriate for the size, complexity, nature and scope of their business activities."

Publication 3112 also says the Gramm-Leach-Bliley Act and the FTC's implementing rules "are applicable to Providers." Publication 1345 puts it this way: "According to the FTC Safeguards Rule in Part 314 (16 C.F.R.), tax return preparers must create and enact security plans to protect client data." It adds that failing to do so "may result in a FTC investigation," and that failures leading to unauthorized disclosure "may subject you to penalties under sections 7216 and/or 6713 of the Internal Revenue Code." See the FTC Safeguards Rule guide for what that rule requires.

Publication 1345 also lists multi-factor authentication for anyone accessing taxpayer information and says it "is required under FTC Safeguards Rule Part 314." More in the MFA guide.

Register your websites

If you collect taxpayer information through a website for federally e-filed returns, Publication 3112 says "the IRS requires Providers to register with the IRS all websites that collect taxpayer information, either directly or through third parties." You send the IRS your EFIN, the name of a Principal or Responsible Official from the application, and the URLs, "prior to the website being accessible on the Internet." Any changes to that information "must be made to the e-file application within three business days."

The six standards in Publication 1345

Publication 1345 says the IRS "has mandated six security, privacy, and business standards to supplement the Gramm-Leach-Bliley Act." The first five apply to Online Providers of individual income tax returns, a term Publication 3112 defines. In short, and only for those that own or operate a website that handles taxpayer information (the full text is in Publication 1345), they are:

• A valid and current Extended Validation SSL certificate using TLS 1.2 or later and minimum 2048-bit RSA/128-bit AES.
• Weekly external network vulnerability scans by an independent third-party vendor on the PCI Approved Scanning Vendors list, with action taken on the vulnerabilities found and scan reports kept at least one year.
• A written information privacy and safeguard policy, certified by a privacy seal vendor acceptable to the IRS.
• Protection against bulk filing of fraudulent returns.
• A domain name registered with a U.S. registrar accredited by ICANN, locked and not private.

The sixth, reporting of security incidents, is "now mandated for all Providers." The rule: "report security incidents to the IRS as soon as possible but not later than the next business day after confirmation of the incident." An event "that can result in an unauthorized disclosure, misuse, modification, or destruction of taxpayer information (e.g., breach)" counts. Providers that are EROs only "must contact their local stakeholder liaison," following the IRS page "Data Theft Information for Tax Professionals." For the full steps see what to do after a data theft.

What Pub 4557 and Pub 5708 say about the EFIN

Publication 4557 lists basic security steps for tax professionals. Under internal controls it includes: "Check e-File Applications and PTIN accounts weekly for total returns filed using EFINs and PTINs; deactivate unused EFINs." That is a step the guide suggests, not a rule written as "must."

It also names a warning sign of data theft: "The number of returns filed with tax practitioner's Electronic Filing Identification Number (EFIN or Preparer Tax Identification Number (PTIN)) exceeds number of returns you actually filed." To check an EFIN total, it says to:

• Access your e-Services account and your EFIN application.
• Select "EFIN Status" from the application.
• Contact the IRS e-help Desk if the return totals exceed the number of returns you filed.

Among its suggestions for recovering from a data theft, Publication 4557 lists: "Determine how the intrusion or theft occurred and make any required fixes before resuming tax preparation activities and being issued a new Electronic Filing Identification Number (EFIN)."

Publication 5708 is a sample WISP from the IRS and the Security Summit. Its Sample Attachment C, on security breach procedures, gives this as an example: "Go to IRS e-Services and check your EFIN activity report to see if more returns have been filed on your EFIN than you transmitted." It is sample language for your office to adapt. A free WISP generator makes a draft plan from your answers.

Keep the application current

Publication 3112 says Providers "must submit updates within 30 days of a change of any information." The IRS "will inactivate EFINs with a Principal or Responsible Official that is deceased if the firm does not remove the individual within 30 days of the date of death." It also inactivates an EFIN when it gets undeliverable mail or cannot reach the Provider, and then "rejects all returns submitted by the Provider until the appropriate updates are made and the IRS reactivates the EFIN."

What the IRS can look at

Publication 3112 says the IRS monitors Providers by reviewing IRS records and by visiting their offices and other places where they do IRS e-file work. Monitoring "may include, but is not limited to" items such as "Observing office and security procedures."

Sources

• IRS Publication 3112, IRS e-file Application & Participation (Rev. 11-2025): irs.gov/pub/irs-pdf/p3112.pdf
• IRS Publication 1345, Authorized IRS e-file Providers of Individual Income Tax Returns (Rev. 12-2025): irs.gov/pub/irs-pdf/p1345.pdf
• IRS Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024): irs.gov/pub/irs-pdf/p4557.pdf
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf

This is general information, not legal advice.