How to Become an ERO: EFIN, Suitability Check, and Security Plan

To become an Electronic Return Originator, you need a Preparer Tax Identification Number and an Employer Identification Number, then you submit an e-file application through the IRS e-services portal, pass a suitability check (which includes fingerprinting unless you are already an attorney, CPA, or Enrolled Agent), and receive an Electronic Filing Identification Number, or EFIN, that authorizes you to transmit federal returns. Here is how to become an ERO step by step, and what compliance looks like once you are approved.

What an ERO Is

An Electronic Return Originator is the IRS-authorized provider that originates the electronic submission of a tax return to the IRS. In practice, the ERO collects the taxpayer’s information, prepares the return, obtains the taxpayer’s signature authorization, and transmits the completed return electronically. The rules governing ERO obligations are set out in Revenue Procedure 2007-40.¹

Get Your PTIN and EIN First

Anyone who prepares or helps prepare federal returns for compensation must have a valid Preparer Tax Identification Number before preparing any returns.² The PTIN fee is $18.75 for 2026, and it renews annually.³

Your tax preparation business also needs an Employer Identification Number, which serves as the firm’s primary identifier on the e-file application. If you don’t already have one, apply online through the IRS at no cost.⁴

Create an IRS E-Services Account

The application itself lives inside the IRS e-services portal. Before you can access it, you verify your identity through ID.me, which requires a photo of a government-issued ID (driver’s license, state ID, or passport) and a selfie taken with a smartphone or webcam.⁵

Complete the E-File Application

Once you have access to the portal, select “Electronic Return Originator” as your provider type.⁶ The application asks for:

Business details: your EIN, business structure (sole proprietorship, partnership, corporation, and so on), and the physical address of each office location where e-filing will occur.
Principals and responsible officials: the full legal name, date of birth, and Social Security Number of every owner or partner, and of the person designated to oversee daily e-file operations.
Contact information: professional email addresses and phone numbers for official IRS correspondence.

Every entry must match existing federal records. Mismatches can cause delays or automatic rejection. Each physical office where you transmit returns needs its own EFIN, so operating from multiple branches means submitting a separate application for each location.⁷

Every individual named on the application, whether as a principal or a responsible official, must have a valid Social Security Number and be a legal U.S. resident or citizen.⁸

Submit Fingerprints (Unless You’re Exempt)

Applicants who are already credentialed as attorneys, CPAs, or Enrolled Agents are generally exempt from fingerprinting.⁹ Everyone else must schedule an appointment with the IRS-authorized fingerprinting vendor to submit biometric data for a federal background check. The appointment carries a fee, and fingerprinting is done after you submit the e-file application, not before.⁸

Pass the Suitability Check

The IRS screens every applicant. The suitability check covers:⁶

Criminal history, including felony convictions and any history of financial crimes among principals and responsible officials.
Tax compliance. All individual and business returns must be filed and current. Outstanding liabilities generally require a formal installment agreement.
Credit history, through a credit check run by the IRS.
Prior e-file compliance, if you have previously participated in the program.

The review can take up to 45 days from submission. If approved, the IRS mails an acceptance letter with your unique EFIN, which authorizes you to sign and transmit returns electronically through professional tax software.⁶

If Your Application Is Denied

You have 30 calendar days from the date of the denial letter to submit a written response to the address or fax number listed in the letter. The IRS will reconsider based on that response. If the denial is upheld, a second letter gives you the right to appeal to the IRS Office of Appeals, and you must file that written appeal, with detailed reasons and supporting documentation, within 30 calendar days of the second denial. Missing the deadline ends your right to appeal.¹⁰ If the denial was based on a suitability issue such as an unfiled return or unresolved tax debt, you can generally reapply once you fix the underlying problem.¹¹

After You’re Approved

Choose IRS-Approved E-File Software

Your EFIN by itself does not transmit returns. You also need professional tax software from an IRS-authorized provider that holds a valid software identification number.¹² The IRS maintains a searchable list of approved providers. If you plan to collect electronic signatures on Form 8879, the e-file signature authorization, your software must include identity verification that records the taxpayer’s name, Social Security Number, address, and date of birth.¹³

Build a Written Information Security Plan

Tax professionals are required by law to create and maintain a Written Information Security Plan (WISP). At a minimum, it designates an employee to coordinate the security program, identifies risks to client data across your operations, and sets safeguards that you monitor and test.¹⁴

Because a tax preparation business is a financial institution under federal law, you must also comply with the FTC Safeguards Rule, which requires a written information security program with administrative, technical, and physical safeguards appropriate to the size and complexity of your business.¹⁵ Its key requirements include:

A qualified individual designated to oversee the program.
A written risk assessment of foreseeable threats to client data, reassessed periodically.
Encryption of client information at rest and in transit.
Multi-factor authentication for anyone accessing client data on your systems.
Secure disposal of client information no later than two years after your most recent use of it to serve the client, unless a legal requirement or legitimate business need applies.
Annual penetration testing and vulnerability scans at least every six months, if you do not use continuous monitoring.
Security awareness training for employees, with regular refreshers.¹⁵

Your WISP and your Safeguards Rule compliance overlap heavily, so one comprehensive program can satisfy both.

Keep Form 8879 Records

Every time a taxpayer authorizes you to e-file, you collect a signed Form 8879. You must retain the completed form for three years from the return’s due date or the date the IRS received it, whichever is later. Electronic storage is fine.¹⁶ If you collect electronic signatures rather than wet-ink ones, your software must also record a digital image of the signed form, the date and time of the signature, the e-signature method used, the results of the identity verification check, and for remote transactions, the taxpayer’s IP address and login username.¹³

Expect IRS Monitoring

The IRS actively monitors authorized providers. A monitoring visit generally includes an interview with an authorized individual at your firm, a review of records and files, and an inspection of office procedures. Reviewers may examine your e-file submissions, investigate complaints, look at your advertising, confirm that taxpayer signatures or PINs are properly obtained before transmission, and evaluate whether your security measures prevent unauthorized disclosure of taxpayer data. Some visits are scheduled; referral and follow-up visits may be unannounced. Findings can range from a written warning for minor infractions to a proposed one-year suspension for violations that harm return quality or taxpayers, up to a two-year suspension or permanent expulsion for the most serious violations, including fraud.¹⁷

Protect and Update Your EFIN

Your EFIN is not transferable. If you sell your business, the new owners must apply for their own. Update your e-file application within 30 days any time an individual on it changes, or your business address or phone number changes. Failing to keep the application current can result in your EFIN being inactivated. The IRS also continuously reviews active EFINs and inactivates any that have been compromised.⁷ Guard the number as you would any credential, never share it with other firms, and contact the IRS immediately if you suspect it has been compromised.

1
Internal Revenue Service. Electronic Return Originator (ERO) Technical Fact Sheet
2
Internal Revenue Service. PTIN Requirements for Tax Return Preparers
3
Internal Revenue Service. IRS Reminds Tax Pros to Renew PTINs for the 2026 Tax Season
4
Internal Revenue Service. Get an Employer Identification Number
5
Internal Revenue Service. New Online Identity Verification Process for Accessing IRS Self-Help Tools
6
Internal Revenue Service. Become an Authorized e-file Provider
7
Internal Revenue Service. How to Maintain, Monitor and Protect Your EFIN
8
Internal Revenue Service. IRS e-file Application and Participation (Publication 3112)
9
Internal Revenue Service. Tax Pros – Become an Authorized e-file Provider in Three Steps
10
Internal Revenue Service. IRM 8.7.13 e-file Cases
11
Internal Revenue Service. IRM 3.42.10 Authorized IRS e-file Providers
12
Internal Revenue Service. Approved IRS Modernized e-File (MeF) Business Providers
13
Internal Revenue Service. Frequently Asked Questions for IRS e-file Signature Authorization
14
Internal Revenue Service. Tips to Help Tax Professionals Protect Client Information
15
Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know
16
Internal Revenue Service. Form 8879 IRS e-file Signature Authorization
17
Internal Revenue Service. IRM 4.21.1 Monitoring the IRS e-file Program