How long do tax preparers keep records? Year-end portal cleanup for CPA firms

Most CPA firms know the federal minimum for how long tax preparers keep records. Fewer have decided when to delete them. Each filing season the client portal takes in another round of W-2s, brokerage statements and ID scans, and in most firms nothing ever leaves. The weeks before the 2027 filing season are the right time to set a written schedule and act on it.

How long do tax preparers have to keep copies of returns?

At least three years after the close of the return period, under federal law. 26 CFR 1.6107-1(b) requires the signing preparer to keep either a completed copy of each return or a record of the taxpayer's name, taxpayer identification number, taxable year and return type, and to keep it available for IRS inspection for that period.

The "return period" is not the calendar year. 26 U.S.C. 6060(c) defines it as the 12-month period beginning July 1. A 2025 individual return filed in April 2026 falls in the return period that ends June 30, 2026, so the federal floor for that copy runs to June 30, 2029.

E-file signature forms have their own clock. IRS Publication 1345 requires the Electronic Return Originator to keep Forms 8878 and 8879 for three years from the return due date or the IRS received date, whichever is later, and allows them to be stored as electronic images.

These are minimums. Your firm's own policy may set longer periods for business reasons, for attest workpapers governed by professional standards, or because a client is under examination. The point of a written schedule is that the firm decides those periods once, on purpose, and applies them consistently.

Does the FTC Safeguards Rule require you to delete old client data?

Yes, with exceptions. Tax preparers are financial institutions under the FTC Safeguards Rule, and 16 CFR 314.4(c)(6) requires procedures for the secure disposal of customer information "no later than two years after the last date the information is used" to serve that customer.

The rule allows longer retention when the information is necessary for business operations or other legitimate business purposes, when another law or regulation requires it, or when targeted disposal is not reasonably feasible because of how the data is stored. It also requires the firm to "periodically review your data retention policy to minimize the unnecessary retention of data."

Read together with the IRS rules above, this produces a simple test for every file: is there a legal requirement or a documented business reason to keep it? If not, and the client relationship ended more than two years ago, the Safeguards Rule expects it to be gone.

Why does the client portal matter more than the file room?

Because the portal is where client documents pile up. Portals collect W-2s, 1099s, brokerage statements, bank records, prior-year returns and identity documents, and unless someone sets expiration rules, they keep all of it. A portal that has run since 2018 can hold every document every client ever uploaded, including clients who left years ago.

Every one of those files is in scope if the portal or a staff login is compromised. Under 16 CFR 314.4(j), an unauthorized acquisition of unencrypted information involving 500 or more consumers must be reported to the FTC within 30 days of discovery. The number of affected people, and the cost of notifying them, scales with what you kept. Files you were entitled to delete two years ago add to the count.

The same applies to the places documents spread after they leave the portal: shared drives, email attachments, scanned copies in a document management system, the tax software's own document store, and staff laptops.

What should a written retention schedule cover?

A useful schedule names each category of record, the retention period, the reason for that period, and the system where the record lives. For a tax practice, that typically means:

• Retained copies of returns, or the client list allowed under 26 CFR 1.6107-1.
• Forms 8879 and 8878 under Publication 1345.
• Source documents clients upload to the portal or send by email.
• Engagement letters, consent forms and correspondence.
• Workpapers for tax and for any attest work, which may carry separate professional requirements.
• Records of former clients, with the date the relationship ended.

Before purging client-provided material, remember the duty to return it. 31 CFR 10.28 requires a practitioner, at a client's request, to promptly return the client's records needed for federal tax compliance. Many firms give clients a window to download their documents before a scheduled purge and say so in the engagement letter. Your schedule should also say who approves exceptions, such as a pending examination or litigation hold. This article describes what the rules say; your counsel or ethics adviser should confirm the right periods for your firm.

How do you purge files so they cannot be recovered?

Use the deletion method that matches the medium, and confirm it worked. IRS Publication 4557 tells tax professionals to shred or burn paper containing taxpayer information, to "wipe clean or destroy old computer hard drives and printers that contain sensitive data," and to dispose of customer information consistent with the FTC's Disposal Rule. For electronic media, NIST SP 800-88 Rev. 2 is the federal reference for sanitization methods.

In a portal or cloud platform, deleting a folder is often the start of the process:

• Check whether deleted items move to a recycle bin or retention area, and how long they stay there.
• Check version history, which can keep earlier copies of a file after the current one is removed.
• Ask the vendor how long deleted data persists in its backups, and get the answer in writing.
• Remove synced copies on laptops and file shares, and old exports sitting in staff downloads folders.

Keep a short log of what was purged, when, under which rule, and who approved it. That log is also the evidence an examiner or insurer will ask for when they want to see the retention policy in operation.

What should you do before December 31?

The weeks before filing season are the last quiet window of the year.

• Pull a list of portal accounts and flag every client with no activity in the past two years.
• Confirm each flagged client is outside any federal retention period and is not under examination or a legal hold.
• Notify former clients that their portal will close on a set date and give them time to download their documents.
• Purge files and accounts past their retention date, including recycle bins and version history.
• Update your WISP's retention section to match what you actually did, and note the date of the review.
• Set portal auto-expiration rules, if your vendor supports them, so next year's cleanup is smaller.

How does s90 help?

s90 helps CPA firms and tax practices map where client data lives, write a retention schedule that fits the IRS and FTC rules, and carry out the purge across portals, file shares, email and devices with a record of what was removed. We tie the work back to your WISP and your pre-season workstation hardening so the policy and the practice match before the 2027 filing season starts. If a year-end cleanup is on your list, we would be glad to help plan it.