Your Books Went Offshore in Paragraph Four

A founder I work with runs a 61-person specialty distributor at $17M revenue. In February her CPA firm sent a two-page PDF titled "annual consents." She signed both pages and moved on. In July her insurance broker sent over the cyber renewal application, which asked her to list every third party that processes company financial records and the country each one operates in.

She called me because she couldn't answer it. We pulled the February PDF. Paragraph four named a processing entity in Bengaluru.

What that form does and doesn't cover

Offshore staffing went from roughly 10 to 15% of small and mid-size US accounting firms in 2020 to something closer to 30 to 35% today. This isn't a scandal. Firms can't hire, and the work still has to get done. But the disclosure regime around it is narrower than most owners assume.

Section 7216 is a criminal statute. A preparer who discloses your tax return information without written consent faces up to a year and a $1,000 fine. Civil penalties under Section 6713 run $250 per wrongful disclosure, capped at $10,000 per calendar year, per firm. Read that cap again. Ten thousand dollars is the annual ceiling on a firm's exposure for disclosing client data it had no consent to send. That number exists to discipline preparers. It was never designed to make you whole.

Consent protections are also strongest where you probably care least. Revenue Procedure 2013-14 prescribes exact wording for 1040-series returns, including underlined language when a Social Security number crosses the border. Your 1120-S or 1065 consent has no mandated script. And your monthly close, AP coding, and bank reconciliations aren't tax return information at all. Section 7216 doesn't reach them. Your engagement letter is the only document that says where that work happens, and most engagement letters say nothing.

One useful rule: consent can't be retroactive. Treasury Reg. 301.7216-3(b)(1) blocks a firm from papering it after the return goes out for signature. If a consent request arrives late in the season, ask what already moved.

Where the gap actually costs you

Sending your close to Bengaluru isn't the risk. Not being able to name who touches your data is the risk.

It surfaces in three places, none of them tax. Cyber carriers now underwrite on subprocessor detail, and "I'll check with my accountant" reprices a renewal. Enterprise customers who made you sign a data processing addendum put your accounting vendor chain in scope whether you enumerated it or not. Buy-side diligence asks the same question with lawyers attached.

Four questions, in writing

Send them to your firm this month. Which functions on our engagement are performed outside the United States, by which legal entity, in which country. Does that entity have access to Social Security numbers, bank credentials, or payroll records. Where does our data sit at rest, and for how long after the engagement ends. Send me every Section 7216 consent we've signed since 2023.

A firm doing this well answers in a day. A firm that needs two weeks is drafting rather than retrieving.

The work happening overseas is probably competent. Learning about it from an insurance application is the expensive part.