IRS Publication 4163 is the IRS’s technical and procedural rulebook for authorized e-file providers transmitting business tax returns through the Modernized e-File (MeF) system. It tells software developers, transmitters, and Electronic Return Originators how to build return packages, how to secure transmissions, how to test software before going live, what to do when a return is rejected, and what will get their authorization suspended or pulled. The publication is refreshed each year to match the current processing cycle, so working from a prior year’s copy is a common way to fall out of compliance.
Who the Publication Applies To and What It Covers
Publication 4163 governs business and specialty filings sent through MeF. That includes Form 1120 (corporate income tax), Form 1065 (partnership returns), the Form 990 series (exempt organizations), extensions on Form 7004, excise returns on Form 720, and several other business forms.1Internal Revenue Service. Modernized e-File Overview Individual returns and their e-file rules live in a separate publication.
MeF itself is the IRS’s internet-based intake platform. It uses XML for return data and returns acknowledgments in near real-time, so you know within moments whether a submission was accepted or rejected.1Internal Revenue Service. Modernized e-File Overview
Getting Authorized to Transmit
You cannot touch MeF without an Electronic Filing Identification Number (EFIN). Apply through the IRS’s e-Services portal and expect the process to take up to 45 days.2Internal Revenue Service. Become an Authorized e-File Provider
The application has three parts. You identify your firm and each principal and responsible official, and you select your provider type (for example, Electronic Return Originator if you prepare and file for clients). Principals and responsible officials who are not already a CPA, attorney, or enrolled agent must be fingerprinted through the IRS’s Livescan process.3Internal Revenue Service. Tax Pros – Become an Authorized e-File Provider in Three Steps The IRS then runs a suitability check that may include credit, tax compliance, criminal background, and prior e-file noncompliance reviews.2Internal Revenue Service. Become an Authorized e-File Provider
The EFIN is tied to your firm and is not transferable. Sell the business and the new owners apply for their own. Each office location where transmissions occur needs its own EFIN as well.4Internal Revenue Service. How to Maintain, Monitor and Protect Your EFIN
Security Requirements You Have to Meet
MeF moves federal tax information, and the security rules are non-negotiable.
Transport Encryption
All transmissions must use current TLS. The IRS shut off TLS 1.0 and 1.1 in production in 2022, so anything older than TLS 1.2 will fail to connect.5Internal Revenue Service. Modernized e-File Status
Authentication
Transmitters authenticate with a username and an X.509 digital security certificate. The certificate must come from an IRS-authorized Certificate Authority such as IdenTrust or ORC, and it has to be stored in the IRS directory through the Automated Enrollment process.6Internal Revenue Service. Security During Transmission of MeF Returns Using the Internet No certificate, no connection.
Digital Signatures
Signatures inside the return package must use SHA-256 or higher. SHA-1 is no longer accepted for signatures or digests, and any submission using it will error out. Providers with RSA certificates can also use SHA-384 or SHA-512.5Internal Revenue Service. Modernized e-File Status
Data Breach Reporting
If client data is compromised, report the breach first to your local IRS Stakeholder Liaison, who notifies Criminal Investigation and other internal teams.7Internal Revenue Service. Data Theft Information for Tax Professionals If 500 or more people are affected, you also file with the FTC using its Safeguards Rule Security Event Reporting Form.8Federal Trade Commission. Safeguards Rule Security Event Reporting Form
How Return Packages Are Built
Every MeF return is XML. The IRS publishes XML Schema Definition (XSD) files for each accepted form, defining which data elements are required, the order they appear in, and the data type each field accepts. A return that doesn’t match the published schema is rejected on arrival.
Schemas and business rules are distributed through the Secure Object Repository (SOR), which you reach through your e-Services account. An active registered user account is required to reach the SOR mailbox.9Internal Revenue Service. Modernized e-File (MeF) Schemas and Business Rules The IRS updates schemas periodically, so check for new versions before each filing season.
The electronic return is assembled as a single XML submission. Binary attachments (typically PDFs) must be referenced correctly inside the main XML structure, and the whole package, including any electronically signed elements, is wrapped in a ZIP archive for transmission.10Internal Revenue Service. MeF Submission Composition Guide
You have two transmission channels. Application-to-Application (A2A) is a web services channel built for high-volume automated systems. The Internet Filing Application (IFA) is browser-based and better suited to lower-volume providers.10Internal Revenue Service. MeF Submission Composition Guide
Passing ATS Before You Go Live
No software transmits real returns until it passes the Assurance Testing System (ATS). The IRS publishes test scenarios in Publication 5078 for business returns, and each scenario exercises specific complexities such as different calculation paths, attachment handling, electronic signatures, and edge cases in the schema.11Internal Revenue Service. About How Tax Preparation Software Is Approved for Electronic Filing Vendors build test returns from these scenarios, submit them in XML through the ATS environment, and must process every scenario correctly while also proving they can receive and interpret the resulting acknowledgments.
Run the full test suite for each form family your software supports. If you handle both 1120 and 990 series returns, you test both. Transmitters who don’t develop their own software still have to complete a separate Communication Test to prove they can connect to MeF and exchange service requests.12Internal Revenue Service. Publication 5078 – Assurance Testing System (ATS) Guidelines
For the current cycle, ATS testing for exempt organization and other tax-exempt entity returns uses Tax Year 2025 / Processing Year 2026.12Internal Revenue Service. Publication 5078 – Assurance Testing System (ATS) Guidelines
Rejections and the Perfection Period
After transmission, MeF validates the return against the schemas and business rules and sends back an acknowledgment. Acceptance means the return is in for processing. Rejection means errors, and the acknowledgment carries a rule number, an error message, and a severity level that identify exactly what failed and where.
A reject doesn’t automatically make the return late. Publication 4163 provides a perfection period to fix and retransmit. For business returns (1120, 1065, and related filings), you have 10 calendar days from the date of rejection. For extensions on Form 7004 or Form 8868, you have 5 calendar days.13Internal Revenue Service. IRS Publication 4163 – Modernized e-File (MeF) Information for Authorized IRS e-File Providers for Business Tax Returns
The perfection period is never extended. Weekends, holidays, and year-end cutoffs do not push the deadline. If day 10 lands on a Sunday, day 10 is still the deadline. Treat the window as an emergency fix, not a buffer.
Staying Compliant After Approval
Approval is a starting line, not a finish line. Ongoing obligations decide whether your EFIN stays active.
Keep the Application Current
Update your e-file application within 30 days of any change: addresses, phone numbers, principals, responsible officials, and new office locations. A stale application can result in EFIN inactivation, which stops filing immediately.4Internal Revenue Service. How to Maintain, Monitor and Protect Your EFIN During filing season, check your EFIN Status page regularly for the weekly count of returns received under your number, which is how you catch unauthorized use.
Annual Self-Certification
Online providers complete annual self-certification questions confirming compliance with the security, privacy, and business standards in Publication 1345. The window opens each year on October 1, and you register any websites that collect, transmit, store, or process taxpayer information.
Data Safeguards
Beyond MeF’s encryption and certificate rules, providers are expected to maintain broader safeguards: strong passwords, encrypted sensitive files, secure external backups, and proper destruction of old drives that held taxpayer information. Publication 4557 sets out the full framework.4Internal Revenue Service. How to Maintain, Monitor and Protect Your EFIN
Monitoring and Sanctions
The IRS monitors authorized providers and enforces compliance under a three-tier sanction system in the Internal Revenue Manual.14Internal Revenue Service. IRM 4.21.1 Monitoring the IRS e-File Program Level One is a written reprimand for minor infractions like an outdated phone number or a small advertising issue you correct on notice. Level Two is a one-year suspension for serious infractions such as transmitting returns before obtaining taxpayer signatures, failing to update the application after a change in responsible officials, or repeating a Level One violation. Level Three is suspension or expulsion, triggered by major infractions like refusing to cooperate with IRS monitoring, accepting returns from unauthorized providers, or fiduciary crimes such as redirecting client refunds. Expulsion is permanent.
The escalation pattern is the part providers underestimate. Any uncorrected Level One or Level Two infraction can climb to Level Three over time. The IRS does not need to catch a provider committing fraud to expel them; persistent refusal to fix smaller problems gets to the same place.