How Long to Keep Tax Records: IRS Retention Rules for Taxpayers and Firms

IRS tax records retention is tied to the period of limitations on the return, not a single “keep everything seven years” rule. For most income tax returns, keep supporting records 3 years after filing. Keep them 6 years if you omitted more than 25% of gross income, 7 years for a worthless-securities or bad-debt claim, and indefinitely if no return was filed or the return was fraudulent. Employment tax records: at least 4 years.¹

Last verified: September 15, 2026. Periods below follow the IRS page “How long should I keep records?” (reviewed June 30, 2026). This is general information, not legal advice. Confirm current wording on IRS.gov and your state board before you write a destruction date into a WISP.

The IRS periods at a glance

The IRS measures these years from when the return is filed. A return filed before the due date is treated as filed on the due date. Keep copies of filed returns as well as the documents that support the lines.¹

Situation	How long to keep records
Typical income tax return (no special situation below)	3 years after filing
Claim for credit or refund after you filed	3 years from original filing or 2 years from payment, whichever is later
Claim for a loss from worthless securities or a bad-debt deduction	7 years
Unreported income that is more than 25% of gross income shown on the return	6 years
No return filed	Indefinitely
Fraudulent return	Indefinitely
Employment tax records	At least 4 years after the tax becomes due or is paid, whichever is later

Those rows are the taxpayer/business recordkeeping clock. They are not a “delete on day 1,096” mandate for a CPA firm’s entire client vault — see firm copies below.

Property records and other non-tax holds

Records connected to property generally stay until the period of limitations expires for the year you dispose of the property — you need them for depreciation and for gain or loss. If you received property in a nontaxable exchange, keep the old-property records as well as the new.¹

When tax purposes no longer require a file, the IRS still says to check other holds: insurance, creditors, and (for a firm) your engagement letters and state board. Do not treat IRS.gov as the only clock.¹

The IRS also explains why businesses keep books — income sources, deductible expenses, basis, and the burden of proof — in its recordkeeping overview and Publication 583, Starting a Business and Keeping Records.²

What tax firms should keep (vs what taxpayers keep)

A household can follow the table above for their own 1040 package. A tax firm holds other people’s return information. That triggers extra rules that are not the same as “3 years then shred”:

• WISP / FTC Safeguards Rule. Your Written Information Security Plan must say what you retain, where it lives, and how you dispose of it. The Safeguards Rule also requires secure disposal of customer information no later than two years after last use unless retention is otherwise required — IRS periods and legal holds are “otherwise required.” See WISP requirements for tax firms and IRS Publication 4557 (Safeguarding Taxpayer Data) and Publication 5708 (WISP template).³
• §7216 / §6713. Use and disclosure of taxpayer return information is restricted even inside software and portals. Retention is not permission to reuse the file for marketing. See Section 7216 explained.
• Firm copies of returns. Many practices keep client copies longer than the client’s 3-year clock because of amended returns, exams, and successor-preparer requests. Put that number in the engagement letter and the WISP. Do not invent a federal “preparers must keep seven years” rule unless your counsel or state board says so.

Practical rule: the IRS table is the floor for tax substantiation. Your WISP is the policy for how long the firm’s copy lives, who can see it, and when it is destroyed.

Tax return storage: email folders are not a retention system

Keeping PDFs in Gmail does not satisfy “I can produce the file and show who accessed it.” A retention policy needs:

1. One place per client and tax year (not a personal inbox).
2. Access logs.
3. A destruction or archive step that matches the WISP — including the FTC disposal clock once IRS and legal holds expire.

If clients still send W-2s by email, stop that pipe: how to send tax documents securely. For the cabinet itself, see tax document management software and XyloDocs security (Pub 1075–aligned controls, WISP-ready logs).

Where XyloDocs fits

XyloDocs is an AI client communication platform for tax firms. It stores client documents by person and tax year, with encryption and an audit trail, so a retention policy has something to attach to. It does not set your legal retention period and it does not replace a WISP. Communication (SMS, WhatsApp, portal) is $49/month platform base, unlimited free client accounts, $9/month per extra seat, metered usage — pricing. Optional tax software launches for the 2027 season.

Bottom line

Do not memorize “seven years” as the only IRS answer. Most returns: 3 years. Omitted income over 25%: 6. Worthless securities / bad debt: 7. No return or fraud: keep forever. Employment tax: 4 years. Property: until you dispose of it plus the limitations period. Then write the firm’s longer copy policy into the WISP and actually destroy what you no longer have a legal reason to hold.

FAQ

How long does the IRS say to keep tax records?

Generally 3 years after you file, with longer clocks for omitted income (6 years), certain loss claims (7 years), employment tax (4 years), and indefinite retention if you never filed or filed a fraudulent return.¹

Should a CPA firm keep client files for 7 years?

Many firms choose 7 as a policy buffer. That is a WISP and engagement-letter decision, not a single IRS “preparer 7-year” line. Start from the IRS table, then add exam, amended-return, and state-board needs.

What are IRS document retention requirements for tax preparers?

Preparers follow the same substantiation periods for records that support a return, plus FTC Safeguards / WISP rules on inventory, access, encryption, and disposal, plus §7216 on use and disclosure. Pub 4557 and Pub 5708 are the IRS documents to keep next to the WISP.³

Can I delete a client’s W-2 after three years?

Only if no longer period applies (property, omitted income, employment tax, legal hold, your stated firm policy). If the W-2 supports basis in an asset you still hold, the 3-year clock is the wrong clock.¹

Sources

1. IRS, “How long should I keep records?” irs.gov/…/how-long-should-i-keep-records (page last reviewed June 30, 2026).
2. IRS, “Recordkeeping,” irs.gov/…/recordkeeping; Publication 583, Starting a Business and Keeping Records.
3. IRS Publication 4557, Safeguarding Taxpayer Data; Publication 5708, WISP template; FTC Safeguards Rule (16 CFR Part 314). Firm explainer: WISP requirements for tax firms.

Last verified: September 15, 2026. Not legal advice.