Ethical Transitions: AICPA Requirements on Transferring Client Files During CPA Firm Sales and Mergers

By Joshua P. Hayes, CPA, Tax Partner, Eide Bailly LLP 

The Foundation: Confidentiality and Client Autonomy 

As the accounting profession continues to evolve through an enormous increase in consolidation, mergers, and acquisitions, the handling of confidential client information remains a cornerstone of professional responsibility. At the heart of the AICPA’s guidance is the principle of client confidentiality. CPAs are ethically prohibited from disclosing confidential client information without the client’s explicit permission. This obligation does not dissolve during a firm’s sale or merger. Instead, it becomes even more critical, as sensitive financial and personal data may be transferred to a new entity. 

The AICPA’s rules ensure that clients retain control over their information and are given the opportunity to make informed decisions about whether their data should be shared with a successor firm. Those requirements are included in the AICPA Code of Conduct at ET Section 1.400.205, Transfer of Files and Return of Client Records in Sale, Transfer, Discontinuance or Acquisition of a Practice. 

When Client Consent Is Required 

The requirement for client consent depends on the nature of the transaction and the future role of the selling CPA. If the selling CPA or firm completely relinquishes ownership in the successor firm, they must obtain written client consent before transferring any files. This includes all records containing confidential information, whether in physical or electronic form. 

The written request must: 

• Clearly explain the nature of the transaction.
• Identify the acquiring firm.
• Provide a 90-day window for the client to respond. Inform the client that their consent will be presumed if they do not respond within the 90-day period. 

When Consent Is Not Required 

If the selling CPA becomes an equity owner in the successor firm—regardless of the percentage of ownership—the requirement to obtain written client consent is waived. The rationale is that the seller maintains a continuing interest in the firm and, by extension, in the client relationship. 

However, if the seller becomes a non-equity partner, employee, or consultant, the written consent requirement remains in effect. This distinction is crucial, as misclassifying the seller’s role could lead to ethical violations and disciplinary consequences. 

In situations where a CPA discontinues a practice, but does not sell or transfer the practice to a successor firm, there is not a consent requirement; however, the CPA is required to: 

• Notify each client in writing of the discontinuation of the practice; and
• Make arrangements to return any client records required to be provided in the Records Request interpretation of the Code of Conduct. 

Shared Responsibilities: Seller and Successor 

Both the selling and acquiring firms are responsible for ensuring compliance with the AICPA’s rules. The acquiring firm must not access or use any client files until either: 

• Written consent is obtained, or
• The 90-day period has elapsed without a response. 

This shared responsibility underscores the importance of collaboration and due diligence during the transition process. Firms should establish clear protocols for tracking consent requests, documenting responses, and ensuring that no premature access to client data occurs. 

Best Practices for Client Communication 

Transparent and timely communication is essential for maintaining client trust during a firm transition. The AICPA recommends that the written consent request include: 

• A concise explanation of the sale or merger.
• The name and contact information of the acquiring firm.
• A clear statement that the client’s files will be transferred unless they object within 90 days.
• Instructions for how to withhold consent or ask questions. 

Firms may also consider offering clients the opportunity to meet with representatives of the acquiring firm. This can help ease concerns, answer questions, and foster continuity in the client relationship. In cases where the client is unable to be contacted, client files and records not transferred should be retained in a confidential manner and in accordance with the firm’s record retention policies OR as required by other regulatory requirements, whichever is longer. 

Legal and Regulatory Considerations 

While the AICPA’s rules provide a strong ethical foundation, CPAs must also be mindful of state laws and federal regulations that may impose additional requirements. For example: 

• Some states may require stricter consent procedures.
• The Gramm-Leach-Bliley Act (GLBA) and other data privacy laws may affect how client information is handled.
• State boards of accountancy may have their own rules regarding client confidentiality and file transfers.

Firms should consult legal counsel to ensure full compliance with all applicable laws and regulations. 

Risk Mitigation and Compliance Strategies 

To reduce the risk of ethical or legal violations, firms should implement the following strategies: 

• Start early: Begin the consent process well before the transaction is finalized.
• Use standardized templates: Ensure consistency and clarity in client communications.
• Train staff: Educate employees on confidentiality rules and consent procedures.
• Maintain documentation: Keep detailed records of all client notifications and responses.
• Monitor access: Restrict access to client files until proper consent is confirmed. 

Conclusion: Ethical Transitions Build Trust 

The transfer of client files during a CPA firm sale or merger is more than a logistical task—it is an ethical obligation. The AICPA’s guidance under ET §1.400.205 provides a clear and practical framework for navigating these transitions while safeguarding client confidentiality and trust. 

By securing proper consent, communicating transparently, and adhering to both ethical and legal standards, CPAs can ensure that firm transitions are conducted with professionalism and integrity. As the accounting profession continues to evolve, these principles remain essential to maintaining public confidence and upholding the values that define the profession. 

About Eide Bailly 
Eide Bailly helps businesses work smarter — financially, operationally, and strategically. As a Top 25 CPA firm, we bring practical expertise in tax, audit, advisory, and technology services to improve performance, reduce risk, and support long-term growth. With a team of 3,500+ professionals across the U.S., we’re dedicated to solving our clients’ toughest challenges and empowering them to grow with confidence.