Power of Attorney, Disclosure & Taxpayer Privacy (2025)

Power of Attorney — Form 2848

Authorizes a representative to act on the taxpayer's behalf before the IRS. Must specify:

• Taxpayer information (name, TIN, address)
• Representative(s) authorized (name, CAF number, address) — maximum 4 representatives per form
• Tax matters and years/periods covered (must be specific — "all years" or "all taxes" will be REJECTED)
• Specific acts authorized

Signature: Taxpayer must sign. Representative accepts by signing Part II and declaring under penalty of perjury that they are subject to Circular 230.

Future periods: May be listed, but only up to 3 years after the date IRS receives the POA. Past periods may always be listed.

Electronic filing: Per the Taxpayer First Act, IRS MUST accept e-signed Form 2848 (and Form 8821). Submit via the online "Submit Forms 2848 and 8821 Online" portal or the practitioner's Tax Pro Account.

Who can be a representative: Must be eligible to practice before the IRS (attorney/CPA/EA/ERPA/enrolled actuary), OR a person qualifying under limited-practice rules (e.g., a family member, fiduciary, or AFSP Record of Completion holder who prepared the return). The representative must use their own name (not a firm name) and their PTIN.

Substitute POA: IRS may accept a non-Form 2848 document (e.g., a durable POA) IF it contains all required information: taxpayer name/address/TIN; representative name/address; tax types and form numbers; specific periods/years; (for estate tax) decedent's date of death; a clear expression of the scope of authority; and the taxpayer's signature/date. The representative must attach a signed, dated declaration under penalty of perjury. If any required info is missing, the substitute POA may be rejected.

Durable POA vs. IRS Form 2848: An IRS Form 2848 terminates if the taxpayer becomes incapacitated/incompetent. A durable POA survives incapacity (and can be drafted to take effect immediately). A durable POA must still be supplemented by a completed Form 2848 (with the required info) for the representative to act before the IRS. ALL POAs terminate at the taxpayer's death.

Revocation / Withdrawal

• Taxpayer revokes: write "REVOKE" at the top of page 1, sign and date, then mail/fax to IRS (identifying the affected matters/periods). Filing a new POA for the same matter automatically revokes the prior one — unless the taxpayer specifically asks that the old POA remain in effect.
• Representative withdraws: write "WITHDRAW" at the top of page 1, sign and date, and submit to IRS (or use the all-electronic Tax Pro Account).
• Death of the taxpayer or representative also terminates the POA.
• After a taxpayer's death, an executor must first file Form 56 (Notice Concerning Fiduciary Relationship) before filing a new Form 2848 for the estate.

Form 56 — Fiduciary Relationship

Used to notify IRS of a fiduciary relationship (typically for estates and certain trusts). Once IRS receives Form 56 and the fiduciary is legally appointed, the fiduciary (e.g., executor) is treated as the taxpayer with all the taxpayer's powers — no Form 2848 needed. For an estate, file Form 56 after court appointment and after obtaining the estate EIN. A Form 2848 is invalid after the taxpayer's death — the executor must file Form 56 first.

Representative Signing the Taxpayer's Return

A representative generally may NOT sign a taxpayer's individual income tax return unless BOTH: (1) the IRC/regulations permit it, AND (2) the taxpayer specifically granted signature authority on the POA. IRS permits a representative to sign when the taxpayer cannot because of:

• Illness or injury
• Continuous absence from the U.S. (incl. Puerto Rico) for 60+ days before the return's due date
• Other good cause approved by IRS on specific request A copy of the authorizing POA must accompany the signed return.

Tax Information Authorization — Form 8821

Authorizes any person/entity to inspect and/or receive confidential tax info for listed tax types/periods but does NOT authorize representation. Commonly used by banks (mortgage verification), employers, financial advisors. Any past period may be listed; future periods limited to 3 years after IRS receipt. E-signature accepted.

Centralized Authorization File (CAF)

IRS database tracking authorizations. When a Form 2848 or 8821 is processed, the representative is assigned a 9-digit CAF number (distinct from SSN/PTIN/enrollment number). Being assigned a CAF number does NOT by itself confirm eligibility to practice. CAF entry enables automatic IRS correspondence copies to the representative.

• Joint filers must each file a separate Form 2848 for the authorization to be recorded on CAF.
• Substitute/durable POAs are NOT recorded on CAF unless attached to a Form 2848.
• IRS will not record future periods beyond 3 years after the year of receipt.
• Practitioners can view all their CAF client authorizations via Tax Pro Account (replacing the old FOIA-request method for CAF lists).

Third-Party Designee (Form 1040 "Checkbox" Authority)

On the return, the taxpayer may designate a person to discuss THAT return's processing (incl. refund status) with IRS. Taxpayer checks "Yes," provides designee name, phone, and a self-chosen 5-digit PIN the designee must confirm. This "checkbox authority":

• Is narrower than a Form 8821 (only the current return's processing)
• Expires at the due date of the next year's return
• Allows oral info exchange only; the designee may NOT receive refund checks or represent the taxpayer on other matters

Return Copies & Transcripts

Transcript types: Return transcript (line items + schedules, as originally filed), Account transcript (assessments, payments, penalties), Record of Account (combines return + account), Wage & Income transcript (W-2/1099 data). Form 4506-T does NOT authorize representation.

Disclosure of Tax Return Information — §6103

Returns and return information are confidential. IRS generally CANNOT disclose to anyone except:

Permitted Disclosures (no taxpayer consent needed):

• To taxpayer or authorized designee
• To state tax agencies (with safeguards)
• To law enforcement (pursuant to court order)
• To Congressional committees
• For tax administration purposes (between IRS functions)
• To contractors doing IRS work
• To Department of Justice for litigation
• To TIGTA for investigations
• To Bureau of Fiscal Service for refund offsets

Disclosure with Consent: Taxpayer may consent to disclosure to lenders, employers, preparers. Consent must state the purpose, recipient, and info disclosed; include preparer and taxpayer names; advise that signing is NOT required and a time period may be set; instruct that misuse may be reported to TIGTA. Electronic consent must use the same font as the website's standard text and require affirmative consent (not opt-out). Unless a specific period is set, written consent is valid for 1 year. Disclosing to an overseas preparer requires written consent even if both are in the same firm.

Penalty for unauthorized disclosure: IRS employee can be fired + criminal liability. Taxpayer can sue IRS for damages (minimum $1,000 per disclosure, punitive for willful).

§7216 / §6713 — Preparer Disclosure & Use of Return Information

"Return information" is broadly defined: anything a preparer obtains (from the taxpayer or otherwise) in connection with preparing a return — including PII (SSN, address, bank accounts), calculations, worksheets, IRS correspondence, software registration info, whether a return is under exam, account balances, etc. The rules apply to paid preparers, e-file originators, tax-software developers, support staff/contractors, and most VITA/TCE volunteers.

Permitted uses WITHOUT consent (no consent needed): disclosure to IRS; pursuant to a court order/subpoena (federal/state/local — info must be specifically described); administrative orders from federal/state agencies or state preparer-licensing boards; reporting a crime in good faith; to a return-processing service; within the same U.S. firm to assist in preparing the return; to the preparer's attorney or IRS employee in an investigation of the preparer; for peer review.

Permitted disclosure to a SECOND taxpayer (without consent) only if ALL are true: the info appears on the first taxpayer's return; it is used to prepare the second taxpayer's return; the two taxpayers are "related" (spouse, parent/child, grandparent/grandchild, partner/partnership, trust-or-estate/beneficiary, corporation/shareholder, controlled group); the first taxpayer's interests do NOT conflict with the second's; and the first taxpayer has not prohibited disclosure. Otherwise, written consent from the first taxpayer is required.

Penalties:

• IRC §6713 (civil): $250 per disclosure, up to $10,000/calendar year. Does NOT require willfulness — even accidental disclosure can trigger it. (Enhanced to $1,000/disclosure and $50,000/year when tied to identity theft — see identity-theft-data-protection.)
• IRC §7216 (criminal misdemeanor): knowing/reckless disclosure or use of return info for a non-preparation purpose — up to $1,000 fine, 1 year imprisonment, plus prosecution costs. (Enhanced to $100,000 max fine when tied to identity theft.)

ACA (Affordable Care Act) Disclosures

A preparer may use a client list (name/address/email/phone) to provide GENERAL educational info about the ACA without consent. But before SOLICITING a client for health-care enrollment or other services, the preparer must first obtain the client's written consent. This applies to VITA/LITC volunteers too.

§7525 — Tax Practitioner Confidentiality Privilege

Limited privilege for federally authorized practitioners (attorneys, CPAs, EAs, enrolled actuaries) covering tax advice communications. Similar to attorney-client privilege but:

• Only for non-criminal tax matters before IRS or federal courts
• Does NOT apply to criminal matters
• Does NOT apply to communications promoting tax shelters/tax-avoidance arrangements
• Does NOT apply in any state tax proceeding
• Does NOT apply to the general preparation of a return (courts have refused privilege for info transmitted for return preparation, even to an attorney — U.S. v. Lawless)
• Does NOT protect the client's identity, engagement letters, or source of fees
• Does NOT apply to corporate tax shelters

Certified Acceptance Agent (CAA)

A CAA ("ITIN Acceptance Agent" on irs.gov) is authorized under a written agreement with IRS to help individuals who don't qualify for an SSN obtain an ITIN. A CAA may verify passport and birth certificate documents for dependents without mailing originals to IRS.

• Apply/renew via Form 13551 (Application to Participate in the IRS Acceptance Agent Program) — submitted electronically through IRS e-Services (no paper accepted)
• Complete mandatory Acceptance Agent training AND forensic (document-authentication) training, submitting the completion certificate to IRS

ITIN Expiration

An ITIN expires if not used on a federal return at least once during 3 consecutive years. Example: an ITIN unused on returns for 2023, 2024, and 2025 expires on 12/31/2026. To renew, file Form W-7 with required documentation. A passport is the only single document that proves both identity AND foreign status; otherwise a combination (national ID, U.S. visa, foreign birth certificate) is needed.

Privacy Act

IRS must safeguard taxpayer information. Taxpayers can access their own records (FOIA requests). Privacy Act statements required on all forms collecting information.