Outsourcing payroll is normal. Most small businesses do it. The payroll company calculates withholding, pays the employees, files the Forms 941 and makes the federal tax deposits. You fund the account and get on with running the business.
Then one day a notice arrives saying no deposits were made for two quarters. You call the payroll company. The line is disconnected.
This is one of the worst calls a business owner can make to a tax lawyer. Here is how the IRS approaches it.
The Employer Stays Responsible
The IRS states its position on its own website, on the page about outsourcing payroll duties: the employer is ultimately responsible for the deposit and payment of federal tax liabilities. If the provider does not pay, the IRS may assess penalties and interest on the employer's account, and the employer may also be held personally liable for certain unpaid federal taxes.
IRM 5.7.3.4.3 says the same thing in procedural terms. Common law employers may designate a third party to take over some or all of their federal employment tax withholding, reporting and payment duties. But the use of a third-party payer such as a payroll service provider or professional employer organization does not relieve the common law employer, or the employer's responsible people, of the responsibility of ensuring that all federal employment tax obligations are met.
So the business owes the tax. And the Trust Fund Recovery Penalty question for the owners and officers remains open.
The Exception: Certified PEOs
There is one structural exception worth knowing. IRC 3511 creates certified professional employer organizations, or CPEOs. Under section 3511(a), for purposes of employment taxes, a CPEO is treated as the employer, and no other person is treated as the employer, of any work site employee performing services for a customer, but only with respect to remuneration remitted by the CPEO to that employee.
That is a significant difference from an ordinary payroll service or an uncertified PEO. If your arrangement was with an IRS-certified PEO and the wages were remitted by the CPEO, the employment tax liability for those wages sits with the CPEO. Section 3511(e) excludes customers related to the CPEO under the related-party tests in sections 267(b) and 707(b), applied at 10 percent.
Do not assume. Confirm whether your provider was actually certified and whether the wages at issue were remitted by it.
The TFRP Analysis for You
Even when the business owes the tax, the Trust Fund Recovery Penalty still requires responsibility and willfulness for each person. IRM 5.7.3.4.3 lists the willfulness factors Revenue Officers consider for a responsible person within a client of a third-party payer:
- whether you had knowledge of a pattern of noncompliance by the third-party payer at the time the delinquencies were accruing;
- whether the third-party payer used fraud or deception to conceal its noncompliance from you;
- whether you had received prior IRS notices indicating that employment tax returns were not filed, were inaccurate, or that taxes were not paid; and
- what actions you took to ensure your federal employment tax obligations were met after becoming aware of the delinquencies, such as timely reporting the problem to the IRS and proper authorities, making sure current taxes were reported and paid, and working with the IRS on a reasonable plan to resolve past debts.
Read those factors carefully. They are the outline of your defense. A business owner who was deceived, who received no IRS notices, and who acted quickly once the problem surfaced is in a very different position from one who ignored notices for months.
The IRM also tells Revenue Officers to consult Area Counsel in any case involving whether a third-party payer is a responsible person, and it notes that a payroll provider and responsible people within it can themselves be assessed the TFRP. That does not get the business off the hook for its own tax, but it can matter for who else shares the penalty.
How the IRS Will Investigate
The Form 4180 interview has a section devoted to third-party payers. IRM 5.7.4.2.4 says Section VI of the form contains payroll service provider and PEO questions to assist the Revenue Officer when a PSP or PEO is involved. Expect questions about the contract, how you funded the provider, whether you checked deposits, and when you found out.
The Revenue Officer may also check the IRS's Reporting Agent File. IRM 5.7.4.2.7 explains that payroll companies acting as reporting agents are authorized by the business on Form 8655, Reporting Agent Authorization, and that IRS systems can identify which forms and periods a reporting agent was authorized for. It also lists copies of the contract between the business and the third-party payer, and payments to third-party payers, among the records a Revenue Officer may review.
Gather yours first:
- the service agreement and any Form 8655;
- bank records showing every transfer to the provider, with amounts that included the tax portion;
- payroll reports the provider sent you showing taxes "paid";
- any IRS notices received, with dates, and where they were mailed;
- police reports, attorney general complaints, or civil filings against the provider; and
- everything you did after discovery, with dates.
The Address-of-Record Trap
Some payroll companies change the business's address with the IRS to their own office so they receive the notices. The IRS warns against this. Its outsourcing page says the IRS strongly suggests that the employer not change its address of record to the provider's address, because that could limit the employer's awareness of tax matters.
If your provider did this, it cuts both ways. It may explain why you never saw a notice, which helps on willfulness. But the IRS may ask why you allowed it.
What the IRS Recommends You Should Have Done
The same IRS page recommends that employers register for their own Electronic Federal Tax Payment System PIN and use it to periodically verify that payments were made, and it says a red flag should go up the first time a provider misses or makes a late payment. Revenue Officers know this guidance. If you never checked, expect to be asked why.
If you are reading this before anything has gone wrong: enroll in EFTPS for your own employer identification number, look at it every quarter, and keep IRS mail coming to your address.
Resolving the Business Liability
The business still owes the tax, and payroll provider failures often involve large sums owed suddenly by a business that already paid once. Options include full payment, an installment agreement and, in some cases, an offer in compromise. IRM 5.7.4.9 notes a specific cross-reference to IRM 5.8.11.6 for offers submitted by an entity impacted by the fraudulent acts of a payroll service provider. Our guide on offers in compromise involving trust fund taxes covers the general rules, including the IRS requirement that the TFRP be addressed before a business offer on trust fund taxes is investigated.
Penalties on the business account may also be worth challenging. The failure-to-deposit penalty under IRC 6656 does not apply when the failure is due to reasonable cause and not willful neglect. Whether a provider's theft supports reasonable cause depends on facts, including what monitoring you did. See our guide to the failure-to-deposit penalty.
Act Fast and Get Current
The fourth willfulness factor rewards action: report the problem, make sure current taxes are paid, and work with the IRS on a plan. Practically, that means:
- Move payroll to a new provider or in-house immediately.
- Make current deposits yourself through EFTPS and confirm them.
- File any missing Forms 941.
- Contact the IRS with documentation of the provider's failure.
- Prepare for a Form 4180 interview. Read our Form 4180 guide first.
For more on how the firm approaches business payroll tax problems, see the main site's payroll tax page.
Being a victim does not make the tax go away. It does change the willfulness analysis, and that analysis is where these cases are decided. Call (813) 229-7100. Let's talk.
Frequently Asked Questions
My payroll company stole the tax money. Do I still owe it?
Generally yes. The IRS states that the employer is ultimately responsible for the deposit and payment of federal employment taxes even when a third party handles payroll. The main exception involves wages remitted by a certified professional employer organization under IRC 3511.
Can I be personally assessed the Trust Fund Recovery Penalty if my provider failed to pay?
Possibly, but the IRS must still show responsibility and willfulness. IRM 5.7.3.4.3 lists factors including whether you knew of the provider's noncompliance, whether the provider concealed it, whether you received IRS notices, and what you did after you found out.
What is a CPEO and why does it matter?
A certified professional employer organization is treated under IRC 3511 as the employer, and no other person is treated as the employer, for employment tax purposes with respect to wages it remits to work site employees of its customers.
How can I protect my business from payroll provider fraud?
The IRS recommends registering for your own EFTPS PIN and periodically verifying deposits, treating any missed or late payment as a red flag, and not changing your IRS address of record to the provider's address.
Can my business get the failure-to-deposit penalty removed?
IRC 6656 does not impose the penalty when the failure is due to reasonable cause and not willful neglect. Whether a provider's theft qualifies depends on the facts, including what you did to monitor deposits.
This guide is general information, not legal advice, and reading it does not create an attorney-client relationship. Payroll tax cases turn on their own facts and deadlines.