A bank account information release form gives your financial institution written permission to share specified account records with a named recipient. To fill it out correctly, you enter your identifying information, list the exact accounts and records covered, name the party receiving the records and the reason, sign and date it within the three-month window the law allows, and deliver copies to both the bank and the recipient. The sections below walk through each part of the form, the rules that shape what you can and cannot authorize, and how to revoke your consent if plans change.
What the Form Must Contain
When a federal government authority is the recipient, the Right to Financial Privacy Act sets five elements the signed authorization must include. If your form is missing any of them, the bank has grounds to reject it, so read it against this checklist before you sign.1Office of the Law Revision Counsel. 12 USC 3404 – Customer Authorizations
- A time limit of no more than three months from the date you sign.
- A statement that you may revoke the authorization in writing at any time before your records are actually disclosed.
- Identification of the specific financial records authorized for release, such as account numbers, transaction date ranges, or account types.
- The name of the government authority receiving the records and the purpose for which they are needed.
- A statement of your rights under the RFPA, including the right to challenge improper disclosures.
The statute requires your signature and the date. It does not require notarization or a witness. Some banks add a notarization line on their own version of the form as an extra identity check, so follow whatever that specific document asks for, but understand that any notary requirement is the institution’s policy rather than a federal legal requirement.
One boundary worth naming up front: the RFPA governs government access to your records. It does not regulate private-party requests. When a mortgage lender or landlord asks you to sign a release to verify your income, the form may look almost identical, but it operates under the institution’s own privacy policies and laws such as the Gramm-Leach-Bliley Act. The mechanics of filling it in are similar; the statutory five-element checklist above is specific to government-authority requests.
Step by Step: Completing the Form
Most banks and government agencies hand you a pre-printed version of this form, so you are filling in blanks rather than drafting from scratch. Work through it in this order.
Your identifying information. Full legal name as it appears on the account, Social Security number, current mailing address, and date of birth. Get these right. A name mismatch between the form and the account records is the fastest way to trigger a rejection.
Account details. Write out the full account number and the institution’s name and branch. If more than one account is involved, list each one separately. Ambiguity here is what causes banks to release either too little or too much.
Records covered. Specify what is being released: statements, transaction history, signature cards, loan documents, and the exact date range. “All records” is broader than most authorizations need to be, and a tighter description protects you.
Purpose. Be specific. “For a tax audit” or “to verify income for a government loan application” is clear. Vague language such as “for financial review” often prompts the bank to send the form back for clarification.
Recipient. Name the government authority that will receive the records, including the agency, department, and the individual agent or office if you know it.
Business accounts. If the authorization covers a business account, include the Employer Identification Number and the name and title of the person signing on behalf of the business. That person must have signing authority for the account. A random employee cannot authorize release of the company’s banking records.
Signature and date. Sign and date the form. The date you sign starts the three-month clock, so record it somewhere you will remember.
Joint Accounts
Joint accounts complicate the signature line, and the requirement depends on how the account is titled. An account set up with “and” between the owners’ names generally requires all owners to sign the authorization. An account titled with “or” between the names may allow a single owner to authorize the release. Bank policies vary by institution and by state law, so confirm with your bank before submitting. When in doubt, get all account holders to sign. An extra signature never invalidates the form, but a missing one can.
If the Records Are Federal Tax Records
This form authorizes release of records held by a financial institution. If what you actually need released is federal tax information held by the IRS, you use a different document: IRS Form 8821, Tax Information Authorization. Form 8821 lets you designate any individual or organization to inspect or receive your confidential tax information for the tax types and periods you specify.2Internal Revenue Service. About Form 8821, Tax Information Authorization It gives view-only access. If you need someone to represent you before the IRS, that requires Form 2848, Power of Attorney and Declaration of Representative.
Where to Submit It
You send the completed form to both the financial institution holding your records and the government authority requesting them. Most banks accept submission through one of three channels:
- A secure online portal, which is usually the fastest route and creates an automatic timestamp.
- In person at a branch, which lets you verify your identity on the spot and confirm the document reached the right department.
- Certified mail with a return receipt, which gives you proof of delivery and a paper trail.
Processing takes time. The bank’s compliance department reviews the form before releasing anything, particularly when the request comes from a federal agency. No financial institution is required to release records until the government authority certifies in writing that it has complied with the RFPA.3Office of the Law Revision Counsel. 12 USC 3403 – Confidentiality of Financial Records That certification adds days, so factor it into any deadlines.
The Three-Month Expiration
An RFPA authorization expires automatically three months after the date of your signature.1Office of the Law Revision Counsel. 12 USC 3404 – Customer Authorizations You cannot write in a longer period. Any language attempting to go further is unenforceable, and if the recipient still needs access after the window closes, you sign a new form.
This built-in sunset is one of the strongest protections the form carries. Even if you forget about the authorization, access shuts off on its own. Note the signing date somewhere you will see it, especially if the underlying process (a loan application, an audit) could stretch past ninety days.
How to Revoke Early
You can revoke your authorization at any time before your records are actually disclosed. The revocation must be in writing. A phone call or verbal request is not enough.1Office of the Law Revision Counsel. 12 USC 3404 – Customer Authorizations Your written revocation should include:
- Your full name and account information, matching the original authorization.
- The date of the original authorization.
- The name of the government authority whose access you are terminating.
- A clear statement that you are revoking the previously granted authorization.
Send it to the financial institution holding your records. Use certified mail or deliver it in person so you have proof of when the bank received it. The revocation takes effect on receipt, but it cannot undo disclosures that already happened while the authorization was valid. If the bank released your statements last week, revoking today does not claw that information back. It only stops future disclosures. Keep your copy of the revocation letter and the delivery receipt with your records, and ask the institution to confirm in writing that access has been terminated.
You also have the right to obtain a copy of every disclosure your financial institution made under your authorization, including the identity of the government authority that received the records.1Office of the Law Revision Counsel. 12 USC 3404 – Customer Authorizations Request that log in writing and compare it against the scope of your original authorization.
What the Form Does Not Do
The authorization controls the boundaries of disclosure, and those boundaries are hard walls. The recipient can see only the records you identified, for the purpose you stated, during the period you authorized. A government agency that receives your checking account statements under this form cannot use that access to browse your investment accounts or dig into transactions outside the date range.
An information release is also not a power of attorney. The recipient gains the right to view your records but cannot move money, close accounts, open credit lines, or make any transactions on your behalf. A power of attorney is a separate legal instrument that grants an agent authority to act for you. If a document you are being asked to sign appears to grant both viewing access and transaction authority, you are looking at something broader than a simple release. Read it carefully first.
Finally, no bank can force you to sign one of these forms. The RFPA explicitly prohibits a financial institution from requiring you to authorize government access as a condition of doing business.1Office of the Law Revision Counsel. 12 USC 3404 – Customer Authorizations Your consent must be genuinely voluntary. If a government authority needs your records and you decline to sign, it still has other legal avenues, but those require the agency to follow separate procedural steps that include notice to you.