Tax Preparer Compliance Checklist for a New Firm
A tax preparer compliance checklist covers the registrations and duties you need before you sign or file returns for compensation: a PTIN for every paid preparer, an EFIN for the firm, a CAF number for representation, Circular 230 conduct duties, a written information security plan, and ongoing CPE.
A tax preparer compliance checklist covers the registrations and duties you need before you sign or file returns for compensation: a PTIN for every paid preparer, an EFIN for the firm, a CAF number for representation, Circular 230 conduct duties, a written information security plan, and ongoing CPE.
Last updated: September 2026
How to use this checklist
Work top to bottom. The registrations gate each other — you cannot e-file without an EFIN, and the EFIN application involves suitability checks that take time, so starting in December for a January launch is cutting it fine.
This is general guidance, not legal or tax advice. Confirm the current rules with your state board of accountancy and the IRS before you rely on them.
Registrations: what it is, who needs it, how to get it
PTIN
What it is: the Preparer Tax Identification Number that must appear on returns you prepare for compensation. Who needs it: every individual paid preparer, not the firm. How: apply or renew through the IRS online PTIN system; it renews annually, typically in the fall.
EFIN
What it is: the Electronic Filing Identification Number that authorizes the firm to e-file. Who needs it: the firm, via the IRS e-Services application. How: apply well ahead of the season — the process includes suitability checks and, for some applicants, fingerprinting.
CAF number
What it is: the Centralized Authorization File number that ties your client authorizations together. Who needs it: preparers who represent clients or request account information. How: it is issued the first time you submit an authorization form; you do not apply for it separately.
State preparer requirements
What it is: additional registration or education imposed by a small number of states on paid preparers. Who needs it: preparers working in those states. How: check the state revenue department and, for CPAs, the board of accountancy.
Firm permit
What it is: your board of accountancy's registration of the firm itself. Who needs it: firms holding out as CPA firms. How: apply through the board; renewals run on their own annual cycle, separate from your individual license.
E-Services account
What it is: the IRS portal used for the EFIN application and related firm administration. Who needs it: the responsible official at the firm. How: register with identity verification before you start the EFIN process.
Circular 230 requirements in plain terms
Circular 230 governs practice before the IRS. The duties that bite hardest for a new firm are the everyday ones: exercise due diligence on the accuracy of what you prepare and represent, do not take a position you cannot support, respond promptly to IRS records requests, return client records on request even in a fee dispute, and avoid conflicts of interest unless they are disclosed and consented to in writing.
The practical implication is documentation. Due diligence you cannot evidence is indistinguishable from due diligence you did not perform. A workflow that forces the preparation checklist, the reviewer sign-off and the client approval to be recorded in the same place as the work is the cheapest form of protection available to a small firm.
WISP and the FTC Safeguards Rule for accountants
Tax and accounting practices handling customer information are treated as financial institutions under the FTC Safeguards Rule, which requires a written information security plan.
- Designate a qualified individual responsible for the security program — in a small firm this is usually an owner.
- Carry out a written risk assessment covering where client data lives: laptops, cloud systems, email, portable drives and paper.
- Apply access controls so each staff member can reach only the client data their role requires, and review access when someone changes role or leaves.
- Use multi-factor authentication on email, practice systems and anything holding client documents.
- Encrypt data in transit and at rest, and stop sending tax documents as unprotected email attachments.
- Keep a written incident response plan that names who is called, in what order, if data is exposed.
- Train staff at least annually and record that the training happened.
- Review the plan yearly and after any material change, such as a new system or a new office.
Peer review, CPE and other ongoing duties
If your firm performs attest work — audits, reviews and in most states compilations — enrollment in a peer review program is generally required, with the first review due within a set period after the first engagement. If you deliberately keep the firm to tax, bookkeeping and advisory work, this obligation usually does not apply, which is one reason many new firms stay out of attest in year one.
CPE is the duty most likely to be left to December. Requirements are set by your state board and commonly include an ethics component, with specific rules on which providers and formats count. Enrolled agents have their own IRS requirement on a three-year cycle. Record hours as you complete them; reconstructing a year of certificates under audit is miserable.
How Remindoo helps
Remindoo tracks the firm's own deadlines the same way it tracks client deadlines. PTIN renewal, EFIN-related firm administration, license and firm permit renewals, CPE cut-offs and the annual WISP review become recurring tasks with owners and automated reminders, instead of dates living in one person's head.
Roles and permissions support the access control part of your security plan: each staff member sees the clients and documents their role requires, and access changes when the role changes. Client communication and document requests run through the system rather than through unprotected email attachments.
Remindoo does not file anything with the IRS and has no IRS integration. It is the practice management and CRM layer around the tax software you choose.
Related reading
Frequently asked questions
How do I get a PTIN?
Apply through the IRS online PTIN system. You will need identifying information and, in most cases, your prior-year individual return. The number is issued to you personally rather than to the firm, and it must be renewed each year, typically in the fall.
How long does an EFIN application take?
Plan for weeks rather than days. The application runs through IRS e-Services and includes suitability checks, and some applicants must submit fingerprints. Apply months before the season you intend to file in, and confirm current timelines with the IRS.
What is a CAF number and do I need to apply?
A CAF number identifies you in the IRS Centralized Authorization File so your client authorizations are linked. You do not apply for it separately; it is assigned the first time you file an authorization form, and you reuse it afterwards.
Does a small firm really need a WISP?
Yes. The FTC Safeguards Rule applies to tax and accounting practices handling customer information regardless of size, and a written information security plan is a core requirement. A solo practice needs a proportionate plan, not an absent one.
Do I need peer review if I only do tax and bookkeeping?
Generally no. Peer review requirements attach to attest work such as audits and reviews, and in most states compilations. If your firm performs none of those, enrollment usually is not required — but confirm the position with your state board.
How many CPE hours do I need?
It depends on your state board, and enrolled agents follow separate IRS rules on a three-year cycle. Most requirements include an ethics element and restrict which providers and delivery formats count. Check your board's current rules and record hours as you earn them.
Can practice management software file returns with the IRS?
Remindoo does not. It manages clients, work, deadlines, documents and payments, and integrates with Xero and QuickBooks. Filing happens in your tax software, and no IRS integration or e-file capability is offered or implied.
Track every renewal in one place
PTIN, CPE, license and firm permit dates alongside client deadlines, with automated reminders.