The 90-Day Consent Rule for CPA Firm Sales: What It Covers, and What It Doesn’t

If you’re buying or selling an accounting practice, you’ve probably heard there’s a 90-day “silence means yes” rule for transferring client files. That concept exists, but it’s not a blanket permission slip. Two systems control this space:

1. Professional ethics / state rules governing transfer of “client records” when a practice is sold or combined; and

2. Federal tax-privacy law (IRC §7216) governing “tax return information.”

Here’s the clean way to keep both happy.

Part 1: The 90-day rule (client records under ethics/state rules)

Under AICPA ethics guidance for practice transitions, the selling firm should send each client a written request for consent to transfer that client’s records to the successor firm. The notice may state that consent will be presumed if the client does not object within at least 90 days. Many state boards follow a similar approach; some have their own timing or notice mechanics.

What to know:

• The 90-day presumption typically applies to client records that are not “tax return information.”

• State law controls the details. Some states codify a 90-day notice; others vary wording or retention requirements. Always check the board/regs where the selling practice is licensed.

Part 2: §7216 shuts the door on “presumed consent” for tax return information.

“Tax return information” has its own federal privacy regime. Unless a specific exception applies, a preparer needs affirmative, written taxpayer consent that meets Treas. Reg. §301.7216-3. Importantly, opt-out or “silence means yes” does not satisfy §7216.

There are only two narrow sale-context allowances without taxpayer consents—and both are limited:

1. Due diligence disclosures under a confidentiality agreement. You can share limited tax return information with a prospective buyer to evaluate the deal, under a written NDA that restricts use/disclosure strictly to that diligence purpose. That is a disclosure, not a file transfer.

2. Transfer of a limited “taxpayer list.” In connection with selling a return-prep business, you can transfer a list containing only very basic fields (e.g., client name/contact, entity type, return form number). Anything beyond that requires signed §7216 consents.

Bottom line: For any transfer of actual tax files or broader return information, you need affirmative written IRC §7216 consents. The 90-day presumed-consent idea does not apply to this category.

Practical two-track playbook for your transaction

Track A — Client records (ethics/state rule path):

• Send a client notice that (1) identifies the successor firm, (2) requests consent to transfer client records, and (3) states that if the client doesn’t object within at least 90 days, consent will be presumed (if permitted by applicable state rules).

• Don’t move these records until you have express consent or the 90-day period runs (again, subject to state-specific rules).

• Keep proof of mailing and any responses as required by your state board.

Track B — Tax return information (IRC §7216 path):

• Use a separate consent document for each client whose files contain tax return information. Make it an affirmative opt-in (no opt-outs), include the mandated statements, and collect signatures (wet or compliant e-signature).

• Remember the formatting/timing rules (there are extra specifics for individual filers).

• Keep these consents in the file and ensure the buyer understands the permitted use/scope.

During LOI & diligence (both tracks):

• For tax return information, share only what’s necessary under a tight NDA; treat diligence as a disclosure, not an early transfer.

• For non-tax client records, follow whatever your state’s ethics/board rule requires for notice and timing.

Copy-ready starter language (edit to fit your state and deal)

Client notice (non-tax records):

We intend to transfer certain client records to [Successor Firm] in connection with the sale of our practice. Please let us know if you consent to this transfer. If we do not receive an objection from you within 90 days of the date of this letter, we may treat your non-response as consent where permitted by applicable professional rules, and transfer your client records to [Successor Firm] at that time. If you object, we will not transfer your records.

§7216 consent (tax return information):

By signing below, you authorize [Seller Firm] to disclose your tax return information (as defined in Treas. Reg. §301.7216-1) to [Buyer Firm] for the purpose of completing the sale of [Seller Firm] and transitioning your services to [Buyer Firm]. You are not required to sign this consent. This consent is valid through [date]. You may revoke your consent at any time before we act on it by notifying us in writing. (Include all required §7216 content; use separate consents for distinct disclosures/uses.)

Common pitfalls (and quick fixes)

• Combining notices. Don’t mash the 90-day client-record notice and the §7216 consent into one document. Different laws, different standards.

• Moving too soon. Don’t transfer records before (a) express consent or the end of your notice period (per your state rule) and (b) for tax info, without §7216 consents in hand.

• Over-sharing in diligence. Keep tax information sharing narrow and NDA-bound; remember, diligence ≠ transfer.

• Assuming all states are the same. The 90-day idea is common, but states differ. Confirm the board rule where the seller is licensed.

The takeaway

Use a two-track approach: the 90-day notice (as permitted by your state’s rule) for non-tax client records, and signed §7216 consents for tax return information. That structure keeps your deal on rails—and keeps both your professional rules and federal privacy law squarely on your side.