Blog · 16 October 2026

IRS Private Debt Collection and CP40: TIGTA’s 2026 Fair Tax Collection Review for US CPA Firms

By Keshav Bansal, CA

IRS private debt collection usually reaches a client as a CP40 notice saying an old balance has been handed to an outside agency. On September 23, 2026, the Treasury Inspector General for Tax Administration (TIGTA) issued Report 2026-300-057, its Fiscal Year 2026 statutory review of potential Fair Tax Collection Practices (FTCP) violations. It covers July 1, 2024, through June 30, 2025, and it looks at both IRS collection employees and the private collection agencies (PCAs) working IRS accounts. Here is what TIGTA found, how the PCA program works and what to tell clients who get a CP40.

What TIGTA found

TIGTA reviewed 506 IRS employee misconduct cases and identified 32 potential FTCP violations in the IRS’s Automated Labor and Employee Relations Tracking System (ALERTS). Most involved contacting a represented taxpayer and bypassing the authorized representative. Only 16 of the 32 were correctly coded as FTCP violations; TIGTA found the other 16 coded as other types of misconduct.

TIGTA also found 735 potential FTCP violations that frontline collection managers had flagged in the Embedded Quality Review System (EQRS) but that were never reported in ALERTS as IRS procedures require. All 735 related to communicating with a represented taxpayer without the required consent: 588 in Campus Collection (mostly taxpayers calling the Automated Collection System for help), 136 in Field Collection and 11 for failing to verify a power of attorney. IRS Collection Policy and Chief Counsel officials said many sample cases were not violations, citing reasons such as a Form 2848 that did not cover every tax year discussed.

On the private side, TIGTA identified 51 potential Fair Debt Collection Practices Act (FDCPA) violations and 5 potential FTCP violations by PCA employees. They included:

• 28 potential FDCPA violations for failing to give timely validation of debts, after programming issues at one PCA delayed or failed to issue letters;
• 18 for communicating sensitive information, such as the existence of a debt, to an unauthorized third party;
• 5 for failing to verify attorney or POA representation, or for using profanity; and
• 3 potential FTCP violations where the employee did not check whether the taxpayer was still represented.

TIGTA said the disciplinary actions for all 56 were consistent with each PCA’s policies, and no case in the period produced monetary damages for taxpayers. It made three recommendations on coding guidance, consent rules when represented taxpayers call in and EQRS guidance for managers. The IRS partially agreed with all three. Deloitte’s Tax News & Views (October 2, 2026) summarized that the IRS favored updated guidance and written communication over additional training in some areas.

How the IRS private debt collection program works

Section 32102 of the Fixing America’s Surface Transportation (FAST) Act (Pub. L. 114-94, 2015) amended IRC §6306 to require the IRS to use qualified tax collection contracts for “inactive tax receivables.” Under §6306(c), that means an assessed balance the IRS removed from active inventory for lack of resources or inability to locate the taxpayer, one not assigned to an IRS employee more than 2 years after assessment, or one that has gone more than 365 days without interaction after assignment.

Section 6306(d) and the IRS exclude taxpayers who are deceased, under 18, in a designated combat zone, identity-theft victims, living substantially on SSI or SSDI, or with adjusted gross income not above 200% of the poverty level. Accounts under examination, litigation, criminal investigation or levy, in a pending or active offer in compromise or installment agreement, under appeal, or classified as innocent spouse cases are also excluded.

The IRS private debt collection page (last updated August 21, 2026) says that since September 23, 2021, an assigned account will be handled by one of three agencies: CBE Group Inc., Coast Professional, Inc. or ConServe.

What a CP40 client should expect

• Two letters first. The IRS sends Notice CP40, then the PCA sends its own initial contact letter. Both carry a taxpayer authentication number. The IRS FAQ says the PCA will not phone before sending its letter, and the IRS says the taxpayer’s representative also gets written notice of the transfer.
• Payments go to the IRS. A PCA will never ask to be paid directly or by prepaid debit, iTunes or gift card. Options include IRS Direct Pay, EFTPS, a debit or credit card through a payment processor (for a fee), a check payable to the United States Treasury, or a preauthorized direct debit payable to the Treasury.
• No enforcement. PCAs cannot levy or file a Notice of Federal Tax Lien, decide offers in compromise, report an account currently not collectible or charge a fee for a payment plan. They can set up plans that pay in full within seven years or by the collection expiration date.
• No threats. The IRS says PCAs must be courteous and will not threaten. Section 6306(b)(2) requires contracts to bar contractors from anything IRS employees are barred from doing, including the §6304 FTCP rules: no contact at inconvenient times (8 a.m. to 9 p.m. local is assumed convenient), no harassment and no bypassing a known representative. Section 6306(g) also applies the FDCPA.

If the client would rather not deal with the PCA, the IRS FAQ says the request must be made in writing to the PCA. Where the client really needs a payment plan, offer or hardship status, our guides to IRS collection alternatives and currently not collectible status and CDP hearings cover the options the IRS, not the PCA, decides.

Spotting scams

Verify before anyone shares data. Check that the caller names one of the three agencies on IRS.gov, exchange portions of the authentication number from the CP40, and confirm the assignment on the client’s IRS account transcript, where the IRS FAQ says a transaction code 971 shows “Collection referred to a private debt collection agency.” Any demand for gift cards or payment to the agency itself, or any threat, is a red flag.

Remedies when collection goes wrong

Section 7433 lets a taxpayer sue the United States when an IRS employee recklessly, intentionally or negligently disregards the Code in collection. Damages are capped at the lesser of $1,000,000 ($100,000 for negligence) or actual, direct economic damages plus costs; administrative remedies must be exhausted and suit filed within 2 years. Under §7433A and §6306(f), a similar action for PCA misconduct is brought against the contractor, not the United States.

Checklist for US CPA firms

• Read the CP40 with the client and note the agency name and authentication number.
• Pull the transcript to confirm the referral and the balance by year.
• File or update Form 2848 to cover every tax year in play; in TIGTA’s review, IRS officials cited a 2848 that missed years as a reason a contact was not a violation.
• Log every contact (date, caller, what was said) in case a §6304 or FDCPA issue surfaces.
• Route payments to the IRS only, and decide whether a PCA plan or an IRS alternative fits better.

Where Tax Brew fits

Tax Brew supports US CPA firms with US tax return preparation support and bookkeeping, including prior-year cleanup. Your firm keeps the advice, the representation and the signature. The first 20 hours are free for qualifying engagements. See our services, or email info@taxbrewglobal.com.

Sources: TIGTA, Report No. 2026-300-057, “Fiscal Year 2026 Statutory Review of Potential Fair Tax Collection Practices Violations” (Sept. 23, 2026) and TIGTA bulletin (Sept. 28, 2026); Deloitte Tax News & Views (Oct. 2, 2026); IRS, “Private debt collection,” “Private debt collection frequently asked questions,” “Private debt collection – Accounts assigned to private collection agencies” and “Understanding your CP40 notice” (IRS.gov); 26 U.S.C. §§6304, 6306, 7433 and 7433A (Cornell LII); Pub. L. 114-94, §32102. This is general information, not legal advice. As of 16 October 2026.