IRS 2026 Security Summit: Mandatory MFA for Tax Prep Firms Under FTC Safeguards Rule
The 2026 IRS Security Summit established multifactor authentication (MFA) as a mandatory compliance requirement for tax preparation firms under the FTC Safeguards Rule, effective September 19, 2026. This shift elevates MFA from a recommended cybersecurity practice to a regulatory obligation, with firms facing liability risks for non-compliance or failure to document approved exceptions.
Key takeaways
- The FTC Safeguards Rule mandates MFA for tax preparation firms, effective September 19, 2026.
- A Qualified Individual may approve alternative access controls as exceptions, but this must be documented in writing.
- Taxpayers can obtain IP PINs and create IRS Online Accounts to enhance their security and prevent fraud.
- The Security Summit's 2026 efforts included the Nationwide Tax Forum, concluding with an event in San Diego from September 15–17.
Context: The Regulatory Landscape
The FTC Safeguards Rule, currently in effect as of September 19, 2026, imposes specific cybersecurity obligations on tax preparation firms. This rule mandates the implementation of MFA to protect access to customer information, marking a significant departure from previous guidance that treated MFA as optional. The rule also provides a narrow exception: a designated Qualified Individual within the firm may approve in writing an alternative access control deemed equivalently secure.
The Security Summit, a public-private partnership operational since 2015, focuses on protecting the tax system from identity theft and fraud. The 2026 effort included the Nationwide Tax Forum, culminating in a final event held from September 15–17, 2026, in San Diego. This initiative underscores the importance of robust cybersecurity measures in safeguarding taxpayer data.
What's Changing: MFA as a Compliance Obligation
Tax preparation firms must now implement MFA to comply with the FTC Safeguards Rule. MFA strengthens account security by requiring at least two independent factors to verify identity, such as a password combined with a security code or biometric information. This requirement is distinct from previous cybersecurity awareness messaging, as it carries regulatory enforcement implications.
A Qualified Individual at a tax preparation firm may approve in writing an alternative access control as an exception to the MFA requirement. This exception pathway allows firms to implement other security measures that are deemed equivalently secure, but must be documented and approved by a designated individual within the firm.
Implications for Tax Preparation Firms
The FTC Safeguards Rule's MFA mandate imposes significant compliance obligations on tax preparation firms. Firms that fail to implement MFA or document an approved exception face regulatory exposure and potential liability risks. This regulatory framework distinguishes the current guidance from general cybersecurity best practices, emphasizing the necessity of MFA for protecting customer information.
Firms must ensure that their cybersecurity measures meet the regulatory requirements, with a specific exception pathway available for those who can demonstrate equivalent security through alternative access controls. This compliance obligation is not optional, and firms must take immediate action to meet the requirements outlined in the FTC Safeguards Rule.
Tools for Identity Theft Defense
The IRS provides several tools to help taxpayers protect their identities and prevent fraud:
IP PIN: An Identity Protection PIN is a six-digit number known only to the taxpayer and the IRS, valid for one calendar year. A new IP PIN is issued annually, and taxpayers must obtain their own IP PIN via IRS.gov. Tax professionals cannot obtain an IP PIN on behalf of clients.
IRS Online Account: Taxpayers are encouraged to proactively create IRS Online Accounts to secure their tax identity and prevent fraudsters from registering accounts in their names. This tool provides an additional layer of security by allowing taxpayers to manage their tax information directly with the IRS.
MFA: The mandatory implementation of MFA by tax preparation firms under the FTC Safeguards Rule enhances account security. This requirement ensures that at least two independent factors are used to verify identity, significantly reducing the risk of unauthorized access.
Outlook and What to Watch
Tax preparation firms must prioritize compliance with the FTC Safeguards Rule's MFA mandate to avoid regulatory exposure. The narrow exception pathway for alternative access controls provides flexibility but requires proper documentation and approval.
Taxpayers should take advantage of the available tools, such as IP PINs and IRS Online Accounts, to enhance their own security measures. As cybersecurity threats continue to evolve, staying informed about regulatory changes and implementing robust defense mechanisms will be crucial for both firms and individual taxpayers.
Frequently asked questions
- What is the FTC Safeguards Rule MFA mandate?
- The FTC Safeguards Rule requires tax preparation firms to implement multifactor authentication (MFA) to protect customer information. This rule, effective as of September 19, 2026, mandates the use of at least two independent verification factors to access sensitive data.
- Who can approve an exception to the MFA requirement?
- A designated Qualified Individual within a tax preparation firm may approve in writing an alternative access control deemed equivalently secure as an exception to the MFA requirement.
- How can taxpayers obtain an IP PIN?
- Taxpayers must obtain their own Identity Protection PIN (IP PIN) via IRS.gov. Tax professionals cannot obtain an IP PIN on behalf of clients. The IP PIN is a six-digit number valid for one calendar year and is issued annually.
- What are the benefits of creating an IRS Online Account?
- Creating an IRS Online Account allows taxpayers to secure their tax identity and prevent fraudsters from registering accounts in their names. This tool provides an additional layer of security by enabling taxpayers to manage their tax information directly with the IRS.
- What was the focus of the 2026 Security Summit?
- The 2026 Security Summit, part of a public-private partnership operational since 2015, focused on protecting the tax system from identity theft and fraud. The initiative included the Nationwide Tax Forum, concluding with a final event in San Diego from September 15–17.
