Accounting & Financial Answering Service: What to Check

Any answering service can pick up a CPA firm's phone. The difference is whether it can survive the second week of April, and whether sharing your clients' messages with it is allowed under the rules your firm is bound by. This guide covers both from the primary sources: IRS data, the section 7216 regulations, the FTC Safeguards Rule, the AICPA code, FINRA and the SEC. We sell an AI receptionist and say where our own product falls short.

Size it for one week in April

Seven flat weeks, then three steep ones, then a cliff. The deadline week alone brought about as many returns as the two weeks before it combined, and every accounting firm on an answering service's books peaks in the same week. So the question for a provider is how many of your calls it can take at the same moment in that week, and what the next caller hears. The October 15 extension deadline is a second, smaller peak.

A phone message is tax return information

Under 26 CFR 301.7216-1(b)(3), tax return information is "any information, including, but not limited to, a taxpayer's name, address, or identifying number" furnished in connection with a return. "Maria Lopez called about her 2025 return, call her back on this number" is all protected. Unauthorised disclosure is a crime under section 7216 and carries a civil penalty of $250 per disclosure, up to $10,000 a year, under section 6713.

The lawful basis most firms will rely on is 301.7216-2(d)(1): disclosure without consent to a preparer providing "auxiliary services in connection with the preparation of any tax return". It has two conditions, and both decide what you buy:

• The recipient must be located in the United States. Agents - or software processing - abroad means you need client consent under 301.7216-3. Our live answering service comparison shows which providers state agent location and which do not.
• No substantive advice. An agent who explains a notice is outside the exception.

The regulation does not name answering services, so treat the fit as an interpretation to confirm with counsel. Two further duties apply regardless:

• AICPA membersmust have a confidentiality contract with the provider or the client's specific consent (interpretation 1.700.040).
• The FTC Safeguards Rule covers tax preparation firms and requires you to choose providers able to safeguard customer information, require it by contract and periodically assess them (16 CFR 314.4(f)). IRS Publication 5708 puts "Receptionist / Phones/Scheduling" in its sample access list: your answering service belongs in your written security plan, with minimal access.

Five things the script must never do

1. Take or read back an SSN, bank details or a password.
2. Send documents or confirm what is in a file.A "client" asking for last year's return gets a callback to the number on file. Publication 5708 lists "phone call grooming by a bad actor" as a training topic.
3. Interpret an IRS notice. Take the notice number and the date printed on it and flag it: a CP2000 needs a response within 30 days of that date.
4. Let a frightened caller pay anyone. The IRS says it will not call to demand immediate payment by gift card or wire. Line: "Please don't pay anything until [name] has called you back."
5. Give any opinion."I'll make sure [name] calls you about that."

Financial advisers: orders and records

• No orders. FINRA Regulatory Notice 17-30: "only appropriately registered persons can accept an order from a customer". The script takes a callback request and tells the caller no instruction has been accepted.
• Messages can be records. Advisers must keep written communications about recommendations and orders (Rule 204-2(a)(7)). Route answering-service messages into your archived channel, not to a personal phone by text: the SEC's off-channel communications sweep had charged more than 100 firms with over $2 billion in penalties by November 2024.
• 72-hour breach notice. The Regulation S-P amendments, in force for smaller firms since June 3, 2026, require service providers to notify you within 72 hours of a breach. Put it in the contract.

Paying for a seasonal business

Month-to-month plans let you resize by season (PATLive: "upgrade, downgrade, or cancel anytime"). Assumed firm: 100 minutes a month for nine months, 500 in each of three peak months.

With AI the limit is concurrency, not minutes: our Solo plan (99 euros, 1,000 minutes) answers one call at a time, so a firm whose lines ring together in April needs Team (299 euros, three at a time) - pricing. On integrations: no provider page we read names Karbon, Canopy, TaxDome or CCH Axcess. Canopy has a public API; Karbon limits its API to Business and Enterprise tiers. We do not integrate with any of them either; we book into Google Calendar, Outlook and Cal.com and send messages by webhook.

Six clauses for the contract

1. Confidentiality and safeguards in writing (AICPA 1.700.040; 16 CFR 314.4(f)).
2. Every person and system handling your calls is in the US, or you are told so you can get consent.
3. Breach notice to you within 72 hours.
4. What is recorded, how long it is kept, how you get it deleted.
5. No advice, no notice interpretation, no financial instructions accepted.
6. Simultaneous-call capacity on your account in April, and what overflow callers hear.

Not verified: TaxDome blocked our requests; CCH Axcess was not researched; the IRS had not announced the 2027 season opening. None of this is legal advice.