De-CAFinating Your Client Authorizations

De-CAFinating Your Client Authorizations

Cross References

• Alerts from the Office of Professional Responsibility dated March 11, 2024
• https://content.govdelivery.com/accounts/USIRS/bulletins/38de000

A prerequisite to representing a taxpayer before the IRS is filing a Form 2848, Power of Attorney and Declaration of Representative . Completed authorizations, which specify the tax periods and taxes to which they relate, are recorded on the IRS’s Central Authorization File (CAF).

To enhance taxpayer confidentiality and to facilitate interaction between practitioners and IRS personnel, each practitioner is assigned a nine-digit CAF number. Typically, this occurs when the practitioner files their first authorization with the IRS. Practitioners may, however, inadvertently be assigned additional CAF numbers if they fail to include their CAF number on an authorization filed with the appropriate CAF unit. As such, practitioners are encouraged to include their CAF number on all later authorizations to avoid unintended additional CAF numbers. CAF numbers are critical to ensure IRS employees, consistent with the taxpayer privacy provisions of IRC Section 6103, are dealing only with someone with actual authority to act on behalf of a taxpayer. IRS employees will check the CAF to validate the authorization.

A Form 2848 will remain in effect until it is: 1) Revoked by the taxpayer, 2) Withdrawn by the representative, or 3) Removed from IRS records under the established IRS records retention schedule.

Under the established IRS records retention schedule, authorizations recorded on the CAF are purged seven years from the taxpayer signature date, though authorizations relating to estate tax returns (Form 706) are purged after 15 years, and qualifying student and law graduate authorizations are valid for only 130 days from the taxpayer signature date. In addition, all authorizations expire on the death of the taxpayer, and they will be deleted from (or updated to “deceased” in) the CAF after the IRS receives verification of the date of death, usually from the Social Security Administration, representative, surviving spouse, or next of kin.

As long as an authorization is listed as active in the CAF, the possibility exists that a cyberthief could misuse the authorization to gain access to valuable taxpayer information. Because a practitioner’s obligation to maintain client confidences never ends, they should withdraw their authorization after a tax engagement ends.

There is no fixed form for withdrawing an authorization, but it must be done in writing, must list all pertinent tax matters and tax periods, and must contain the withdrawing

representative’s signature and date. A straightforward way to meet these requirements is to write “WITHDRAW” across the top of the first page of a copy of the Form 2848 with a current signature and date below the annotation and then file it with the same CAF unit where the form was originally filed. The form instructions list where the request should be sent and provide additional guidance on what the practitioner should do if they do not have a copy of the authorization form.

It is a best practice to maintain an up-to-date list of client authorizations that a practitioner has open with the IRS and to withdraw those that are no longer needed, for example, because the related client engagement has ended. A tax practitioner can confirm the accuracy of their records by requesting a list of active authorizations (a CAF77 request) from the IRS under the Freedom of Information Act (FOIA). A sample of the request is available on the IRS’s FOIA Guidelines webpage:

https://www.irs.gov/privacy-disclosure/freedom-of-information-act-foia-guidelines#collapseCollapsible1679946651208

After processing the CAF77 request, the IRS will provide a printout or electronic copy of the practitioner’s current authorizations. The practitioner may review the list and send a signed withdrawal request for all authorizations that should be removed from the CAF. The CAF unit will then remove the authorizations.

An efficient and secure alternative to filing paper withdrawal requests with the CAF unit is to use IRS online tools such as the Tax Pro Account, which provides a means to safeguard sensitive taxpayer data from cyberthreats. If a practitioner links their CAF number to their Tax Pro Account, then they will have the ability to manage their client authorizations and to withdraw active authorizations.

The Office of Professional Responsibility encourages practitioners to practice good records hygiene, including having procedures in place to maintain an up-to-date list of all client authorizations and to withdraw those that are no longer needed.