Bookkeeping firm compliance: the licences, filings and checks

What to take away

This is general business information for firm owners, not accounting, tax, legal or insurance advice for your situation.

Title rules, filing duties and data obligations vary by state and by engagement. Confirm what applies to you with your state board of accountancy, the IRS, FinCEN, and a licensed CPA, enrolled agent or attorney.

Start with the work, not the title

Most compliance failures in a bookkeeping firm start with a service sold before anyone checked whether the firm could legally deliver it. The fix is a service map: a plain list of what you sell, who performs each piece, and what credential or filing that piece requires.

Build the map from the schedule you actually keep, not the menu on your website. If the firm posts payroll, prepares sales tax returns, files 1099-NECs or signs returns, those lines belong on the map with a name beside them.

Each line points at a filing. Tax return preparation points to a PTIN. E-filing points to an EFIN. Payroll pulls in a state withholding account, a state unemployment account and EFTPS enrollment for federal deposits.

Selling services in a state that taxes them adds a registration. Hawaii applies its general excise tax to bookkeeping work at a 4% state rate plus county surcharges of up to 0.5%. New Mexico taxes services under a gross receipts tax with a 4.875% state base. Treat both as typical rates that local rules can move.

The map changes as the firm grows. A solo owner who reconciles in QuickBooks Online all day sits in a different position than a five-person shop that also prepares returns. The permits and licences a bookkeeping firm needs is the starting point for the registration side of that map.

One filing reaches clients more often than it reaches the firm. Beneficial ownership reports under the Corporate Transparency Act changed during 2025, and FinCEN's interim rule exempted domestic companies from reporting. Check the current status before you file or advise on it.

Titles and credentials: the CPA, the EA and the AFSP record

"Accountant" is not a protected term in every state. "CPA" is protected nearly everywhere, and using it without a current license is the fastest way to turn a marketing line into a board complaint. Enrolled agent, certified public accountant and audit or assurance language all carry their own rules.

The CPA license comes from a state board of accountancy. Most boards require 150 semester hours of college credit, passage of the four-section Uniform CPA Examination, and a period of supervised work experience. Renewal is annual or biennial, usually with about 40 hours of continuing education a year.

The enrolled agent credential comes from the IRS. Candidates pass the three-part Special Enrollment Examination, and EAs renew every three years with 72 hours of continuing education, at least 16 hours of it in each year.

Unenrolled preparers can earn the IRS Annual Filing Season Program Record of Completion. It takes 18 hours of continuing education, including a six-hour federal tax law refresher and a two-hour ethics course, plus a valid PTIN.

A firm that sells audit or review work has one more requirement: enrollment in an approved peer review program, with a review every three years.

Write a one-page title policy. It should say which words each role may use in an email signature, a proposal and a LinkedIn profile, and who checks that the underlying credential is still active. Recheck it annually, because licenses lapse quietly.

The same check belongs in hiring. Verifying a credential before an offer is cheaper than discovering the problem after a client does, and the guide to hiring reliable staff for a bookkeeping firm treats verification as a screening step rather than an afterthought.

Software badges are not licenses. A QuickBooks ProAdvisor badge says something about product familiarity and nothing about your legal authority to sign a return or call yourself a CPA.

Circular 230, at 31 CFR Part 10, holds the practice rules for CPAs, enrolled agents, attorneys and others who practice before the IRS. One credential on a resume has no current standing: the IRS Registered Tax Return Preparer program ended after a federal court struck it down in 2013.

PTINs and EFINs: who needs one and who does not

The IRS position is narrower than most owners assume. A bookkeeper who only collects, organizes and records client information generally does not need a Preparer Tax Identification Number. A person paid to prepare, or to substantially assist in preparing, a federal return generally does.

That means the question is about the task, not the job title. A staff bookkeeper who cleans up a year of transactions and hands the file to a CPA may sit outside the rule. The same person who fills in a Schedule C line may not.

Each preparer needs an individual PTIN. There is no firm-level PTIN that covers the team, and a supervising CPA's number does not stand in for a preparer's own. The IRS frequently asked questions on PTINs is the authority to read before you decide.

Apply or renew on Form W-12. The renewal window opens in mid-October and closes December 31, and the IRS user fee has run about $20 in recent filing seasons.

E-filing takes a second number. The firm needs an Electronic Filing Identification Number, or EFIN, issued through IRS e-Services when it applies as an authorized e-file provider. The responsible official named on the application must pass an IRS suitability check, which includes fingerprints.

An EFIN stays with the firm when a preparer leaves. A PTIN follows the person. Keeping both current is what makes the January filing season work.

Data duties: the FTC Safeguards Rule and the written program

The FTC Safeguards Rule applies based on what a business does, not what it calls itself. The Commission names tax preparation firms among the financial institutions it covers, which puts many bookkeeping firms inside the rule even when they never touch a tax return.

If you are in scope, the rule requires a written information-security program. The program needs a qualified individual to run it, a written risk assessment, and access controls.

The remaining elements include encryption of customer information at rest and in transit, multifactor authentication, secure disposal, an incident response plan, and oversight of service providers.

The FTC guidance on the Safeguards Rule sets out the elements.

Two mistakes are common. The first is assuming that encryption alone equals compliance. The second is assuming that a small firm is exempt. Neither holds up.

The amended rule sets a clock as well. A security event affecting 500 or more consumers must be reported to the Commission within 30 days of discovery.

Where those settings live in your stack, and which ones you can actually verify, is covered in the software and KPI guide for bookkeeping firms.

The IRS also publishes its own security expectations for tax professionals. The Protect Your Clients; Protect Yourself page points to Publication 4557 and to the steps for reporting and recovering from data loss. Publication 4557 asks for a written security plan, limited access to taxpayer data, and encryption.

The engagement letter, Form 2848 and Form 8821

An engagement letter does the work that no policy manual can. It fixes the service period, the accounting basis, the records the client must supply, and the deadlines both sides are working toward.

It should also answer the questions that cause disputes.
Who owns the bank feed?
Who may release a payment?
Does the firm run payroll or only record it?
What happens when the client misses a deadline?
How long does the firm keep the workpapers?

Emails are not a scope document. If a client asks for extra work, the answer belongs in a signed amendment, not a thread.

Two IRS forms handle access rather than scope. Form 2848 authorizes the firm to represent a client before the IRS. Form 8821 authorizes the firm to receive the client's tax information. Each needs the client's signature, and neither replaces the engagement letter.

Client money, custody and the Form 8300 filing

Custody is a deliberate decision. If the firm can move client money, it has taken on a duty that most bookkeeping engagements never require.

Where custody exists, split the roles. One person prepares the payment run, a second approves it, a third releases it, and the reconciliation is done by someone who did none of the first three. In a small firm that may mean the owner approves and a bookkeeper releases.

The test is whether a single person could create a vendor, release the money and reconcile the account without anyone noticing. If the answer is yes, the control is not there yet.

Cash brings a filing. A firm that receives more than $10,000 in cash in one transaction, or in related transactions, must file Form 8300 with FinCEN within 15 days. The duty attaches to trade or business payments, and a cleanup engagement that settles a large cash balance can trigger it.

Several state boards treat money held for a client as trust property and expect it to sit in a separate account. Ask the board that licenses the firm before the first dollar moves.

Records that hold up later

Every material balance in the books should be traceable to a source document, a reconciliation and an explanation. That trail is what protects the firm when a client, an insurer or a revenue department asks a question two years later.

The daily habits that produce those files are what the SOP checklist for bookkeeping firm operations is built around. A clean close is a by-product of a consistent routine, not a heroic week at month end.

Editing a client's books without a note is the mistake to watch. A one-line memo explaining an adjustment costs seconds and answers the question before it is asked.

Retention needs a number of years, written down. The IRS generally has three years to assess tax on a filed income tax return and four years on employment tax records, so a five-year holding period covers most state board expectations. Client records belong to the client when the engagement ends.

When something goes wrong

Every firm needs a written path for the day a mistake surfaces. Stop the work, preserve the facts, limit access, tell the right people inside the firm, and only then decide what to say outside it.

Call the insurer early. Most policies require prompt notice, and a late call can turn a covered claim into an uncovered one. What a policy will and will not pay for is worked through in the account of insuring a bookkeeping firm.

A data loss adds outside deadlines. The FTC clock above applies to firms in scope, and state breach laws typically require notice to affected residents.

Two moves make a bad day worse: deleting records, and promising a client an outcome before anyone has investigated. Neither is recoverable.

What the sources actually say

Four sources carry most of the weight here, and each is a starting point rather than a substitute for the agency or adviser that owns the exact rule.

The U.S. Bureau of Labor Statistics describes bookkeeping, accounting and auditing clerks as workers who record, classify, check and reconcile financial data, and notes the shift from manual entry toward analytical work.

The IRS PTIN page draws the line between recording data and preparing returns. The FTC Safeguards Rule guidance explains that coverage follows activity, not label. The IRS security page sets out the protective steps it expects of tax professionals.

Two more sources carry weight for credentials. NASBA and the AICPA jointly publish the Uniform Accountancy Act that many state licensing laws follow. Circular 230, at 31 CFR Part 10, governs practice before the IRS.

None of these tells you what your state board requires, what your insurer expects, or what your engagement letter should say. Those come from the board, the carrier and your own counsel.

A first thirty days

Last check

Compliance in a bookkeeping firm is a set of decisions that stay true as services, staff and clients change. Adding a service line or a staff member retests all of them.

Those decisions survive or fail on the ordinary workday, which is what an operational routine is for.

Common questions

Does every bookkeeper on my team need a PTIN?

No. The IRS draws the line at preparing, or substantially assisting in preparing, a federal return for compensation. A bookkeeper who only gathers, organizes and records client data generally falls outside it. Each person who does prepare needs their own individual PTIN.

Does the FTC Safeguards Rule apply to a small bookkeeping firm?

It can. Coverage turns on whether the firm is a financial institution under the rule, and the FTC names tax preparation firms among those covered. If you are in scope, a written information-security program is required regardless of headcount.

Can a bookkeeper sign a tax return?

That depends on the credential the person holds and the rules of the jurisdiction. A PTIN allows someone to prepare and sign in the preparer capacity, but it is not a license to practice public accountancy. Check with your state board of accountancy before anyone signs.

Do I need an EFIN to file a handful of returns?

Yes, if any federal return goes out electronically. The IRS issues the EFIN to the firm through e-Services, and the responsible official has to pass a suitability check first.

Are bookkeeping services taxable?

In most states, no sales tax applies to bookkeeping. Hawaii taxes the service under its general excise tax, and New Mexico taxes it under the gross receipts tax. The state where the work is performed sets the answer.

Who is responsible if a client's books are wrong?

It depends on the engagement letter, the facts and the law, which is why the letter matters so much. The firm owns the work it agreed to perform; the client owns the records and decisions it kept. An insurer and an attorney are the right people to ask about a specific claim.