IRS Publication 1345 is the rulebook for Authorized IRS e-file Providers who transmit individual income tax returns. It sets out how to apply for the program, what an Electronic Return Originator must do on every return, how to secure taxpayer data, and how the IRS sanctions providers who don’t comply. Breaking its rules can bring a written reprimand, a one- or two-year suspension, or permanent expulsion.
Who Has to Follow These Rules
Federal law requires any tax return preparer who reasonably expects to file more than 10 individual income tax returns in a calendar year to file them electronically. The statute calls these preparers “specified tax return preparers,” and it reaches returns for individuals, estates, and trusts.1Office of the Law Revision Counsel. 26 USC 6011 – General Requirement of Return, Statement, or List Prepare 11 or more covered returns in a year and electronic filing stops being optional.
A narrow waiver exists for preparers in areas without broadband internet access (dial-up and satellite do not count), but you have to apply for it rather than simply opting out.1Office of the Law Revision Counsel. 26 USC 6011 – General Requirement of Return, Statement, or List Everyone else who wants to file electronically must first become an Authorized IRS e-file Provider under Publication 1345.
Becoming an Authorized E-File Provider
The application is entirely online through the IRS e-Services portal. You create an account, complete an application for your firm, and submit it electronically.2Internal Revenue Service. Become an Authorized E-File Provider
During the application, you identify your firm, list each Principal and Responsible Official, and pick a provider role. The most common roles are Electronic Return Originator (ERO), Transmitter, and Software Developer. The ERO is the entity that either prepares the return or collects it directly from the taxpayer for electronic submission. Principals or Responsible Officials who are attorneys, CPAs, or enrolled agents must enter their current professional status; those without such credentials must be fingerprinted through the IRS-authorized vendor.2Internal Revenue Service. Become an Authorized E-File Provider The firm must designate a Responsible Official as the primary IRS contact and provide a physical business address; a P.O. box will not work.
After you submit, the IRS runs a suitability check that can include a credit check, a tax compliance review, a criminal background check, and a review of any prior e-file noncompliance. You must disclose any past convictions under federal tax laws or previously assessed preparer penalties. Expect up to 45 days for a decision. If approved, the IRS sends an acceptance letter with your six-digit Electronic Filing Identification Number (EFIN), which identifies your firm on every electronic transmission.2Internal Revenue Service. Become an Authorized E-File Provider
What EROs Must Do on Every Return
The ERO prepares the return, obtains the taxpayer’s signature, and transmits the return to the IRS. Most of the process runs through Form 8879, the IRS e-file Signature Authorization.
Form 8879 and the Taxpayer PIN
The ERO completes Part I by transferring specific amounts from the prepared return. The taxpayer then verifies the return, including any direct deposit information, and signs the form. That signature authorizes the ERO to enter or generate the taxpayer’s five-digit PIN for the e-filed return. The PIN cannot be all zeros.3Internal Revenue Service. Form 8879 – IRS E-File Signature Authorization
The signed Form 8879 stays with the ERO. It is never transmitted to the IRS.3Internal Revenue Service. Form 8879 – IRS E-File Signature Authorization You cannot transmit the return until you have the completed, signed form in hand, and the information on the electronic return must be identical to the copy given to the taxpayer.
Records You Have to Keep
You must retain the signed Form 8879 for three years from the return’s due date or the date the IRS received the return, whichever is later.4Internal Revenue Service. IRS E-File Record Keeping Requirements for EROs You also keep a copy of the tax return itself and the taxpayer’s written consent to disclose tax return information. That consent obligation flows from Treasury Regulation 301.7216-3, which bars a preparer from disclosing or using return information without written authorization.5eCFR. 26 CFR 301.7216-3 – Disclosure or Use Permitted Only With the Taxpayers Consent
Due Diligence
EROs have an affirmative duty to recognize and prevent fraud in the e-file program, including strict compliance with Earned Income Tax Credit due diligence for inquiry and record-keeping. You must also maintain an acceptable cumulative error and reject rate. An excessive rate is one of the fastest routes to an enforcement action.
Signing Returns Remotely
When a taxpayer is not physically present to sign Form 8878 or 8879, the ERO and its software provider must verify the taxpayer’s identity before accepting an e-signature. Verification typically uses Knowledge-Based Authentication, where the taxpayer answers multiple-choice questions drawn from credit reporting data or public records, and it has to happen every time a taxpayer remotely signs one of these forms.6Center for Agricultural Law and Taxation. IRS Extensively Revises Electronic Signature Methods for Forms 8878 and 8879
A handwritten signature sent by fax, email, or a basic internet upload does not qualify as an e-signature for a remote transaction. The identity verification process must meet at least the Level 2 assurance standard from NIST Special Publication 800-63.6Center for Agricultural Law and Taxation. IRS Extensively Revises Electronic Signature Methods for Forms 8878 and 8879
Fixing a Rejected Return
When the IRS rejects an electronic return, the clock is short. For Form 1040 family returns transmitted on or before the due date, the perfection period is five calendar days after the due date. Correct the errors and retransmit inside that window and the IRS still treats the return as timely filed.7Internal Revenue Service. 3.42.5 IRS E-File of Individual Income Tax Returns
If the return cannot be corrected and retransmitted electronically, the taxpayer has to file on paper. For that paper return to be considered timely, it must be filed by the later of the original due date or ten calendar days after the IRS notice of rejection, with an explanation attached for the late paper filing.7Internal Revenue Service. 3.42.5 IRS E-File of Individual Income Tax Returns
Data Security Obligations
Authorized providers must meet security and privacy standards that build on the Gramm-Leach-Bliley Act.8Internal Revenue Service. E-File Security, Privacy and Business Standards Mandated as of January 1, 2010 The centerpiece is a Written Information Security Plan (WISP) that protects personally identifiable information against unauthorized access and anticipated threats.
At a minimum, your WISP must designate an employee to coordinate the security program, identify and assess risks to client information, evaluate whether current safeguards actually control those risks, and set up monitoring and testing.9Internal Revenue Service. Tax Professional Tips for Creating a Data Security Plan If third parties touch client data (cloud backup, remote support, payroll software), document those relationships and confirm the vendors maintain their own security programs. An incident response plan covering detection, notification, and recovery rounds out the document.
On the technical side, electronic files containing PII must be password-protected or encrypted, and multi-factor authentication is mandatory for anyone accessing taxpayer information. Online providers of individual income tax returns face additional requirements: they must contract with an independent third-party vendor to run weekly external network vulnerability scans following the applicable Payment Card Industry Data Security Standards.10Internal Revenue Service. Publication 1345 – Authorized IRS E-File Providers of Individual Income Tax Returns Online providers also self-certify compliance to the IRS each year.
Monitoring, Sanctions, and Appeal
The IRS actively monitors providers after approval, including site visits to ERO offices and satellite or temporary locations where a monitor may examine files, observe procedures, and check record-keeping.
Violations trigger sanctions calibrated to severity across three tiers:11Internal Revenue Service. 3.42.10 Authorized IRS E-File Providers
- Level One covers minor infractions with little or no impact on e-file quality and generally results in a written reprimand.
- Level Two covers serious infractions that adversely affect e-file quality or taxpayer compliance and results in a one-year suspension. Repeated Level One infractions that go uncorrected can escalate here.
- Level Three covers grave infractions with major impact on program integrity and can result in a two-year suspension or permanent expulsion. Continued Level Two violations after IRS notification can escalate here.
Common enforcement triggers include an excessive error or reject rate, failure to meet data security standards, and noncompliance with ERO due diligence requirements.
Providers who are sanctioned or denied participation have a right to administrative review. Revenue Procedure 2007-40 establishes that right and points to Publication 3112 for the detailed appeal procedures.12Internal Revenue Service. Revenue Procedure 2007-40 You generally have 30 days from the date of the sanction letter to file a written protest.13Internal Revenue Service.