How long should a tax firm keep client files?

A copy, or a list. Section 6107(b) gives the preparer a choice: keep "a completed copy of such return or claim", or keep "on a list, the name and taxpayer identification number of the taxpayer". The regulation adds the taxable year and the type of return to the list, and asks for a record of "the name of the individual tax return preparer required to sign" each one, under 1.6107-1(b)(1)(ii). Both have to be available for inspection if the IRS asks. The regulation also treats a firm that employs the signing preparer as "the sole signing tax return preparer", so the record is the firm's to keep.

Three years after the return period closes. A return period is "the 12-month period beginning on July 1 of each year", under 26 U.S.C. 6060(c). The record is kept "for the 3-year period following the close of the return period during which the return or claim for refund was presented for signature". So a return presented for signature in March 2026 falls in the return period that closes on June 30, 2026, and its record is kept through June 30, 2029. Where a return "becomes due (with extensions, if any) during a return period following" the one it was signed in, the three years run from the close of that later period. A return signed in June 2026 and due in October 2026 on extension is kept through June 30, 2030.

The penalty is per failure, and the figure moves. Under 26 U.S.C. 6695(d) a preparer who doesn't comply with 6107(b) "shall pay a penalty of $50 for each such failure, unless it is shown that such failure is due to reasonable cause and not due to willful neglect", with a cap of $25,000 "with respect to any return period". Section 6695(h) raises those amounts for inflation for returns filed after 2014, so $50 and $25,000 are the statute's base figures. The adjusted figures for a given year are not ones Claremont has verified, and this page prints none.

"In any format" means every copy. The disposal procedure covers customer information "in any format". That is the paper file, the PDF in the client folder, the copy attached to an email, the tax software archive and the version someone pasted into a tool. A procedure that shreds the paper and leaves the rest is half a procedure.

Two years from the last use for that client. The clock runs from "the last date the information is used in connection with the provision of a product or service to the customer to which it relates". For a tax client that is usually the last work done on the account, which for a continuing client moves every year. The duty is to have and follow a procedure that disposes within two years, with the exceptions below.

Three exceptions, in the rule's words. Information can be kept past two years where it "is necessary for business operations or for other legitimate business purposes", where it "is otherwise required to be retained by law or regulation", or "where targeted disposal is not reasonably feasible due to the manner in which the information is maintained". The first and the third are judgments the firm makes and should write down; the second is where Section 6107 comes in.

And a review, on a schedule. Paragraph (c)(6)(ii) asks the firm to review its retention policy periodically "to minimize the unnecessary retention of data". The rule sets no interval. A date in the calendar, with a partner's name beside it, is what makes the review happen.

The return record is kept because a law requires it. The Safeguards Rule's second exception, information "otherwise required to be retained by law or regulation", is exactly what Section 6107 and its regulation are. So the copy or the list stays for its three years, and the disposal procedure doesn't touch it. The two rules agree once each is read for what it covers.

Everything else gets a decision. The workpapers, the correspondence, the source documents the client sent and the drafts are not what 6107 names. For those, the Safeguards Rule asks for a procedure that disposes within two years of last use, or a written reason under one of the other two exceptions. A firm that keeps every file forever has made a choice; the rule asks it to write the reason down.

The list holds less than the copy. Section 6107 lets a firm keep a list of names and identification numbers instead of full copies. A list is a smaller store of sensitive data than a cabinet of complete returns, and it satisfies the statute. Whether the firm needs the copies for its own work is a separate question, and one of the exceptions above may answer it.

The rule doesn't define it. Section 314.4(c)(6)(i) allows retention where the information "is necessary for business operations or for other legitimate business purposes" and stops there. No list, no examples, no test. That leaves the judgment with the firm, and a judgment nobody wrote down is hard to defend later.

Write the reason beside the record. For each kind of record the firm keeps past two years, the schedule should say which exception covers it and why. The test of a good reason is whether a partner who wasn't in the room can read it next year and agree. This page offers no example reasons on purpose: a reason copied from a website is the kind that fails that test.

Review it when the review comes round. A reason that was true at the time can stop being true. The periodic review in (c)(6)(ii) is where the firm checks each one and deletes what no longer qualifies.

The exception counts the files you maintain. Four paragraphs of the Safeguards Rule do not apply to a firm that maintains customer information on fewer than 5,000 consumers. The word is maintain, so a former client whose return is still on the server counts, and a former client whose file was disposed of under the procedure above doesn't.

Disposal is how a firm near the line stays under it. A firm with twenty years of returns on a file share can hold far more than 5,000 consumers' information while serving a few hundred clients a year. The disposal procedure, applied, is the lever. Our brief What does the FTC Safeguards Rule ask a small tax firm to write down? says what the four paragraphs are and what still applies below the line.

Your state board and your engagement letters. A state board of accountancy can set its own record-keeping rule, and an engagement letter can promise a client a period. Neither has been read for this page, so it sets no period from them. Check both before the schedule is signed.

E-file records. IRS Publication 1345 sets the rules for Authorized IRS e-file Providers, including what they keep and for how long. Its current revision is not one Claremont has verified, so this page sets no e-file period. Read the publication itself, and put its period in the schedule in its own words.

HIPAA, if it reaches you. An accounting firm that is a HIPAA business associate keeps its Security Rule policies and records for six years under 45 CFR 164.316(b)(2)(i). That applies to the firm's own documentation, and the agreement with the practice says what happens to the patient information itself at the end of the engagement. Our brief Is your firm a HIPAA business associate when it serves a medical practice? covers both.