A Lender Wants Your Client's Tax Returns. What Do You Need to Do?

A client is refinancing, and the lender wants their last two tax returns. Or an attorney handling a divorce wants the file, or a new bookkeeper needs last year’s workpapers. You’ve done this many times, and it usually means attaching a few PDFs to an email.

An FTC regulation, the tax code and a couple of IRS publications cover this, and between them they answer most of the questions that come up. I’ve pulled together the parts that matter. Treat this as general information, not legal or tax advice, and since the rules change, check the current versions linked at the end.

Does this apply to a firm my size?

Yes. The FTC Safeguards Rule covers “an accountant or other tax preparation service that is in the business of completing income tax returns.”¹ The IRS guide to writing a security plan says it applies to tax and accounting professionals “regardless of size.”²

The rule excuses firms that hold data on fewer than 5,000 people from four of its requirements, mostly paperwork.³ You still have to encrypt your clients’ data and dispose of it securely.

You may have noticed this on your PTIN renewal. Line 11 of the form asks you to confirm: “I am aware that paid tax return preparers are required by law to create and maintain a written information security plan that provides data and system security protections for all taxpayer information.”⁴

Can I just email the returns?

Only if you encrypt them. The Safeguards Rule says you must “protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest.” If you really can’t encrypt it, the person who runs your security plan can approve another way to protect it.⁵

IRS Publication 4557 spells it out: “Send only password-protected and encrypted documents if you must share files with clients via email or use Secure File Transfer Protocol (SFTP) to transmit files instead of email.”⁶ If you use the IRS’s sample security plan from Publication 5708, it already includes a policy that client data “will not be in any unprotected format, such as e-mailed in plain text” unless you encrypt it or protect it with a password.²

My client asked me to send it. Do I still need their permission?

Usually, yes, in writing. Under the section 7216 regulations, you “may disclose or use tax return information as the taxpayer directs as long as the preparer obtains a written consent from the taxpayer.”⁷

The regulations list the times you don’t need consent, such as working with another preparer on the same return, dealing with the IRS, or responding to a court order. One of them names lenders. If you practice law or accountancy and also do other work for the client, such as their books or financial statements, you can share their return information with a lender in the normal course of that work.⁸ The client can tell you not to, and your own professional rules still apply. If you’re not sure the exception covers what you’re doing, get the signed consent.

The fines start small and add up. The IRS can charge $250 each time you share a return without permission, up to $10,000 a year, and more if someone uses it to steal an identity.⁹ If you do it knowingly or recklessly, you can also face a misdemeanor charge, with a fine of up to $1,000 and up to a year in prison.¹⁰

What can the lender see once they open it?

Everything you sent. Encryption protects the email on the way, and your client’s signed consent lets you send it, but neither one takes anything out of the return. The lender can read your client’s Social Security number, their children’s names and Social Security numbers, and the bank account the refund went into, and all of that now sits on the lender’s systems.

It matters because criminals target tax practices. The IRS cites “nearly 300 data breaches reported impacting as many as 250,000 clients” in the first half of 2025.¹¹ The Safeguards Rule also expects you to get rid of client data within two years of last using it, unless you have a business or legal reason to keep it.⁵ You can do that with your own files. You can’t do it with the returns you emailed to a lender.

Does the lender need all of it?

Sometimes, and they’ll tell you if they do. Often they need less. An attorney may only want the income figures, and a financial adviser may only want one schedule. A lender checking income probably has no use for your client’s children’s Social Security numbers. A quick email asking what they need can save you sending the whole return.

The IRS does something similar on its own forms. It lets businesses print only the last four digits of a Social Security number, like XXX-XX-1234, on many of the forms they have to send out, such as a 1099 sent to a contractor.¹² That rule only covers those forms, but the same idea works for anything you send. The last four digits usually tell the lender they have the right person.

What if I just black out the numbers?

Check that they’re really gone. If you draw a black box over a number in a PDF, the number can still be sitting underneath, and anyone can copy it or find it with a search. People have made this mistake for years, and we wrote about some of the better-known cases in The Redaction That Wasn’t.

Scanned pages need extra care. Clients often hand you a scan or a phone photo of a W-2 or a bank statement. Those pages have no text for a search to find, so searching for a Social Security number finds nothing, even though you can see the number on the page. The software has to read the page with OCR (text recognition) first. How to Redact Scanned PDFs goes into this.

Where does this go in my security plan?

Your written security plan already has to say how you protect client data, so you could add a short section there on sending returns to other people. In it, you might note where you keep signed consent forms, which encrypted service you use to send files, and what you take out before sending a return to someone who doesn’t need all of it.

Where Lex Cloak fits

Lex Cloak is a desktop app for Mac and Windows. It finds Social Security numbers, account numbers, names and other details in your clients’ returns and statements, including scanned pages, and marks them for you to check. When you confirm them, it removes them from the PDF you save instead of just covering them, and your clients’ files stay on your computer. It doesn’t make your practice compliant, and no software can, but it makes it easier to send the lender only what they need. You can read more about redacting client tax documents.

Sources

I checked these sources on 14 October 2026. The FTC and the IRS revise their rules and publications from time to time, so check the current version before you rely on any of them.

1. 16 CFR § 314.2(h)(2)(viii), FTC Safeguards Rule, definition of financial institution. ecfr.gov
2. IRS Publication 5708 (Rev. 8-2024), Creating a Written Information Security Plan for your Tax and Accounting Practice. irs.gov
3. 16 CFR § 314.6, exceptions for institutions holding information on fewer than five thousand consumers. ecfr.gov
4. IRS Form W-12 (Rev. October 2025), IRS Paid Preparer Tax Identification Number Application and Renewal, line 11. irs.gov
5. 16 CFR § 314.4(c)(3) (encryption) and § 314.4(c)(6) (disposal). ecfr.gov
6. IRS Publication 4557 (Rev. 6-2024), Safeguarding Taxpayer Data: A Guide for Your Business. irs.gov
7. 26 CFR § 301.7216-3(a), disclosure or use permitted only with the taxpayer’s written consent. ecfr.gov
8. 26 CFR § 301.7216-2, permissible disclosures or uses without consent, including paragraph (h)(1) for lawyers and accountants. ecfr.gov
9. 26 U.S.C. § 6713, civil penalty for disclosure or use of information by preparers of returns. law.cornell.edu
10. 26 U.S.C. § 7216(a), criminal penalty for knowing or reckless disclosure or use. law.cornell.edu
11. IRS news release IR-2025-88, 26 August 2025. irs.gov
12. 26 CFR § 301.6109-4, IRS truncated taxpayer identification numbers. ecfr.gov