What happens if a tax preparer has no WISP?

The short answer

The IRS publications say what may follow, and they use the word "may." Publication 4557 says that failing to create and enact a security plan "may result in an FTC investigation." Publication 1345 says that "not taking necessary steps to implement or correct your security program may result in sanctions from the FTC." A WISP is a written information security plan.

The IRS publications name no FTC fine amount, and this page cites no FTC enforcement case.

Why the plan is required in the first place

Section 314.2 of the FTC Safeguards Rule lists "an accountant or other tax preparation service that is in the business of completing income tax returns" as a financial institution. The IRS puts the consequence in one line in Publication 4557: "According to the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data." Two sentences later it says: "Failure to do so may result in an FTC investigation." For the rule itself, see the FTC Safeguards Rule guide.

What Publication 1345 adds

Publication 1345 is the handbook for authorized IRS e-file Providers. It repeats the point: "Failure to do so may result in a FTC investigation." It then says:

"Not taking necessary steps to implement or correct your security program may result in sanctions from the FTC. Failures that lead to an unauthorized disclosure may subject you to penalties under sections 7216 and/or 6713 of the Internal Revenue Code (I.R.C.)."

Our reading: the penalties in the second sentence attach to an unauthorized disclosure. The publication does not say that having no plan is, by itself, an offense under those two sections. Both statutes are about disclosing or using information furnished for preparing a return. Neither mentions a security plan.

What section 6713 says

Section 6713 of the Internal Revenue Code sets a money penalty: the person "shall pay a penalty." It applies to a person who is in the business of preparing income tax returns, or providing services in connection with preparing them, or who prepares a return for compensation, and who "discloses any information furnished to him for, or in connection with, the preparation of any such return" or "uses any such information for any purpose other than to prepare, or assist in preparing, any such return." Subsection (a) sets the penalty:

"shall pay a penalty of $250 for each such disclosure or use, but the total amount imposed under this subsection on such a person for any calendar year shall not exceed $10,000."

Subsection (b) raises both numbers when the disclosure or use is made "in connection with a crime relating to the misappropriation of another person's taxpayer identity." In that case the text substitutes "$1,000" for "$250" and "$50,000" for "$10,000." Subsection (c) says the exceptions in section 7216(b) apply here too.

What section 7216 says

Section 7216 is the criminal one. It covers the same kind of person, and it adds a state of mind: the person must act "knowingly or recklessly." Such a person "shall be guilty of a misdemeanor." On conviction, the person:

"shall be fined not more than $1,000 ($100,000 in the case of a disclosure or use to which section 6713(b) applies), or imprisoned not more than 1 year, or both, together with the costs of prosecution."

Section 7216(b) lists exceptions. For example, subsection (a) does not apply to a disclosure "pursuant to an order of a court." Read the full text before relying on any exception.

If you are an authorized IRS e-file Provider

Publication 3112 covers applying to and taking part in IRS e-file. It says that violating a provision of Publication 1345 or of Publication 3112 "may be subject to e-file Provider sanctions," and that those sanctions "may include suspension, expulsion or other legal action." Its "Sanctioning" section says a sanction "may be a written reprimand, suspension or expulsion from participation from IRS e-file, depending on the seriousness of the infraction." Before a more stringent sanction, "the IRS may issue a warning letter that describes specific corrective action the Provider must take." It also says the IRS "may also sanction without issuance of a warning letter."

Publication 3112 says that Providers "must implement security and privacy practices that are appropriate for the size, complexity, nature and scope of their business activities." It also says "The IRS may sanction any Provider when the firm or any of its Principals or Responsible Officials fails to comply with any requirement or any provision of this publication, as well as other publications and notices that govern IRS e-file." It does not say which infraction level a missing plan would be. The levels are set "in the opinion of the IRS."

What Form W-12 asks

Form W-12, the PTIN application and renewal form, has line 11, "Data Security Responsibilities." It reads: "I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information." The form says "You must check a box" and offers Yes and No, and it points to Publications 5708 and 4557. The line asks you to confirm that you know about the requirement. The requirement itself comes from the Safeguards Rule described above. See the line 11 guide.

Where to start

Publication 5708 is the IRS guide to writing a plan, with a sample. Our Pub 5708 guide walks through it. The free WISP generator makes a draft plan.

Sources

• 16 CFR 314.2 (eCFR, 2026-10-01): ecfr.gov, Part 314
• IRS Publication 4557 (Rev. 6-2024): irs.gov/pub/irs-pdf/p4557.pdf
• IRS Publication 1345 (Rev. 12-2025): irs.gov/pub/irs-pdf/p1345.pdf
• IRS Publication 3112 (Rev. 11-2025): irs.gov/pub/irs-pdf/p3112.pdf
• IRS Publication 5708 (Rev. 8-2024): irs.gov/pub/irs-pdf/p5708.pdf
• IRS Form W-12 (Rev. 10-2026): irs.gov/pub/irs-pdf/fw12.pdf
• 26 U.S.C. 6713: law.cornell.edu/uscode/text/26/6713
• 26 U.S.C. 7216: law.cornell.edu/uscode/text/26/7216

This is general information, not legal advice.