Accounting Outsourcing to India: A Guide for US CPA Firms

Who this guide is for

This guide is for two kinds of reader. The first is a US CPA firm that is thinking about sending part of its bookkeeping, accounts payable, reconciliation or tax-preparation support work to accountants in India. The second is a small business owner who wants to know what an Indian bookkeeping team can take over and what to ask before financial data leaves the country.

The work can be done remotely, but the decision is mostly about rules and controls, not staffing. Federal tax-preparer confidentiality rules, the AICPA Code of Professional Conduct, the FTC Safeguards Rule and Indian labour and data-protection law all shape how an engagement should be set up. This guide covers each, then qualifications, time zones, security, onboarding, performance measures and cost. For the wider picture of finance roles, see our guide to building a remote finance and accounting team and the ranked countries for accounting outsourcing.

What gets outsourced and what stays

A useful way to split the work is by judgement; our guide to tasks you can outsource to a bookkeeper covers the bookkeeping side. Repeatable, well-documented tasks that follow a checklist are the ones firms usually consider delegating. Anything that involves signing, advising or accepting responsibility for the result stays with a named professional in your firm or business.

Work that is commonly delegated

• Bookkeeping: transaction coding, categorisation and data entry into your accounting software.
• Accounts payable and accounts receivable: entering vendor bills, preparing payment batches for approval, sending invoices and following up on open items.
• Reconciliations: bank, credit card and sub-ledger reconciliations, with exceptions listed for review.
• Month-end preparation: accrual schedules, supporting schedules and draft management reports.
• Tax-preparation support: organising client documents, populating workpapers and data-entering source information into tax software, for review by the preparer who signs.
• Audit support: preparing schedules, tying out balances and assembling documents requested by the engagement team.

Work that stays with you

• Sign-off on financial statements and tax returns, and any professional opinion or attestation.
• The client relationship: engagement terms, advice, difficult conversations and representation.
• Approving payments, accounting policy decisions and final review of everything the offshore team prepares.

Engagement models: dedicated hire, firm-to-firm or BPO

There are three common ways to set up an Indian accounting team. They differ in who employs the people, who manages the daily work and what the contract promises.

A dedicated remote hire

You recruit one or more accountants or bookkeepers who work only for you, as in a dedicated team model. They may be employed through an employer of record that handles Indian payroll and registrations, or through your own Indian entity. You direct the daily work and carry the supervision duty. This resembles staff augmentation. For the legal route in India, see the India hiring guide.

Firm-to-firm outsourcing

You contract with an Indian accounting firm that supplies a service, often under a managed services arrangement. The Indian firm employs and manages the staff, and your contract defines scope, turnaround and quality in a service level agreement and a statement of work. Your oversight duty under professional standards remains, so build review into the process.

A business process outsourcing provider

A business process outsourcing (BPO) provider runs a defined process, such as accounts payable processing, on its own premises with its own tools and managers. Finance and accounting work that needs more judgement is sometimes described as knowledge process outsourcing; our comparison of BPO and KPO explains the difference. If you are weighing a provider against building your own team, read staff augmentation vs BPO and in-house vs outsourcing.

Whichever model you choose, run proper checks before you sign. Our guides on vendor due diligence and on exit planning and vendor transition list what to ask, including how you would get your data and workpapers back if the relationship ends.

US rules that shape an offshore engagement

Four layers of US rules and standards matter for most CPA firms and tax preparers: federal law on the confidentiality of tax return information, the AICPA Code of Professional Conduct, the FTC Safeguards Rule and state licensing or board rules. A business outsourcing only its own books faces fewer obligations than a firm handling client returns, but the data-protection logic applies to both.

Section 7216: consent for disclosing tax return information

Section 7216 of the Internal Revenue Code makes it a misdemeanour for a tax return preparer to knowingly or recklessly disclose tax return information, or use it for anything other than preparing or assisting in preparing the return, unless an exception applies. The statute provides for a fine of up to $1,000 (up to $100,000 where section 6713(b) applies), imprisonment of up to one year, or both (26 U.S.C. 7216).

The regulations set out when a preparer may share information with another preparer. Under 26 CFR 301.7216-2(d), a preparer may disclose tax return information without consent to another preparer located in the United States to assist in preparing a return or to obtain auxiliary services, as long as the services are not substantive determinations or advice affecting the tax liability reported. A substantive determination involves analysis, interpretation or application of the law. For a preparer outside the United States, that exception is not available, and IRS guidance states that if the preparer receiving the information is located outside the United States, the taxpayer’s consent under 301.7216-3 is required before any disclosure (Rev. Proc. 2013-14, IRB 2013-3).

The consent itself has formal requirements. Under 26 CFR 301.7216-3, a consent must be in writing, signed by the taxpayer, and give the taxpayer a copy at the time of signing; if it does not state a duration, it lasts one year. Rev. Proc. 2013-14 sets mandatory wording for returns in the Form 1040 series, including a statement that the consent may result in tax return information being disclosed to a tax return preparer located outside the United States.

Social Security numbers get special treatment. For Form 1040 series filers, the regulation does not allow a US preparer to obtain consent to disclose the taxpayer’s SSN to a preparer outside the United States unless an adequate data protection safeguard is used; otherwise the SSN must be redacted or masked before the information goes offshore. Rev. Proc. 2013-14 describes an adequate safeguard as a management-approved and implemented security programme with administrative, technical and physical safeguards, maintained by both the US preparer and the offshore preparer when consent is obtained and when the disclosure is made. The IRS maintains a Section 7216 information center with the current guidance.

The AICPA Code: telling clients and protecting confidentiality

If you are a CPA, the AICPA Code of Professional Conduct has three interpretations that apply when you use a third-party service provider, which includes an offshore firm or contractor supplying bookkeeping or tax-preparation help.

• Integrity and objectivity (1.150.040): clients may not expect you to use a third-party service provider, so before disclosing confidential client information you should inform the client, preferably in writing. If the client objects, you should either not use the provider or decline the engagement. You need not inform the client when the provider only supplies administrative support such as record storage, software hosting or authorised e-file transmittal.
• Confidential client information (1.700.040): before disclosing confidential information, you should either enter into a contractual agreement with the provider to maintain confidentiality and give reasonable assurance that it has procedures to prevent unauthorised release, or obtain the client’s specific consent.
• General standards (1.300.040): you should ensure the provider has the professional qualifications, technical skills and resources required, and you must adequately plan and supervise its work so that the services are performed with competence and due professional care.

The AICPA interpretations and section 7216 are separate: meeting the AICPA disclosure duty does not replace any consent that section 7216 requires.

The FTC Safeguards Rule

The FTC Safeguards Rule applies to financial institutions within the FTC’s jurisdiction, and the FTC lists tax preparation firms among its examples. Covered businesses must run a written information security programme. The FTC’s guidance lists, among other elements, a designated Qualified Individual to oversee the programme, encryption of customer information in transit and at rest, multi-factor authentication for anyone accessing customer information, staff training, and oversight of service providers. The IRS also tells tax professionals that FTC regulations require security plans to protect client data and points to its guidance for tax professionals (see Publications 4557 and 5709).

For an offshore engagement, the service-provider element matters most. Under 16 CFR 314.4(f), you must take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards, require them by contract to implement and maintain those safeguards, and periodically assess them based on the risk they present. The rule also requires notifying the FTC as soon as possible, and no later than 30 days after discovery, of a security event involving the unencrypted information of at least 500 consumers.

State boards and other rules

State boards of accountancy and state tax authorities have their own rules on licensing, supervision, client notice and record retention, and these vary from state to state. Check the rules of every state where you or your clients are licensed or located before you design the engagement, and ask your professional liability insurer whether offshore work affects cover. For how these topics fit with wider hiring law, see remote hiring compliance in 2026.

The India side: qualifications, language and time

Qualifications to look for

The best-known Indian accounting credential is the Chartered Accountant (CA) qualification awarded by the Institute of Chartered Accountants of India (ICAI). ICAI’s FAQ on its Scheme of Education and Training describes three levels, Foundation, Intermediate and Final, and a practical training period that is two years under the new scheme. The Institute of Cost Accountants of India (ICMAI) awards the Cost and Management Accountant (CMA) qualification, and its website lists CMA Foundation, CMA Intermediate and a CAT course.

Bookkeeping and accounts-support roles do not always require a professional qualification, so many candidates will hold a commerce degree, experience with specific accounting software, or a short course instead. Our remote accountant and bookkeeper role guide and the entry on bookkeeper terms and pronunciation explain how titles map to duties. Verify any credential with the issuing body, then test practical skills with a paid work sample.

An Indian CA or CMA credential shows training under an Indian professional body. Who may prepare, sign or represent in the United States is decided by US federal and state rules, so treat Indian credentials as evidence of skill, not as permission to sign.

English and time-zone overlap

Our India guide reports that India ranks 74th of 123 countries in the EF English Proficiency Index 2025, in the low band, and that the index describes a national average of self-selected online test-takers rather than any one professional. Test written and spoken English for the role in every interview, including a short written task such as a reconciliation note.

India uses a single time zone, UTC+5:30. According to the same guide, India is 10.5 hours ahead of New York in US winter and 9.5 hours ahead in US summer, so a US morning is an Indian evening. US-facing teams usually agree a shifted schedule or work asynchronously with a daily handover. The time-zone overlap tool shows the shared hours for your own dates, and our guide to managing remote teams across time zones covers handover habits.

Data protection and labour law in India

India’s Digital Personal Data Protection Act, 2023 applies to processing of digital personal data within India. According to the India guide, the Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, with the Data Protection Board provisions applying immediately, the consent-manager rule applying from 13 November 2026, and the rules on notice, consent, security safeguards and breach intimation applying from 13 May 2027.

Take local advice, because the Rules are new. Employment law has also changed. The four labour codes took effect on 21 November 2025, and state rules, which govern most private employers, were still being notified in autumn 2026, according to the same guide. Our India labour codes explainer summarises the changes, and an employer of record or Indian counsel can confirm which rules govern a given hire.

Security controls for offshore finance work

The controls below are practical ways to meet the contractual and Safeguards Rule expectations described above. Our guide to data security when outsourcing covers the wider topic.

• Give every person a named login with multi-factor authentication and least-privilege access: entry and reconciliation rights, not payment-release or bank-detail rights.
• Work inside your systems or a controlled virtual desktop, so client files are not downloaded to personal devices.
• Mask or redact Social Security numbers and other direct identifiers where the task does not need them, and where the consent and safeguard conditions are not met, keep them onshore.
• Separate duties so that the person who prepares a payment is not the person who approves it.
• Keep an access log and review it on a schedule. Remove access on the day a person leaves or changes role.
• Put confidentiality, security requirements, breach notification and data return or deletion into the written contract, and reassess the provider on a schedule.

A 90-day onboarding plan

1. Before day 1: decide the scope, the engagement model and the review owner. Complete your legal review, update engagement letters and client disclosures, and obtain any consents you need. Sign the contract with security and confidentiality terms.
2. Days 1 to 15, access and documentation: set up named accounts with the minimum access, share your chart of accounts, coding rules, close calendar and checklists, and agree communication hours (see our remote onboarding playbook).
3. Days 16 to 45, supervised pilot: assign one routine task or a small set of non-sensitive clients. Review 100 percent of the output, log every error and note its cause.
4. Days 46 to 75, widen the scope: add tasks one at a time, move to sampling where the error log supports it, and hold a weekly review meeting with written notes.
5. Days 76 to 90, stabilise: complete a full close cycle with the new process, review turnaround and accuracy, update the procedures and decide whether to add people or scope.

Keep a written record of the supervision you carried out, to support your position under the AICPA planning and supervision duty.

KPIs for an offshore accounting team

Choose a few measures and define them in writing in the service level agreement. Our remote team KPI scorecard and remote hiring scorecard provide a structure.

• Accuracy: the share of items returned from review with corrections, and the number of errors reaching the client.
• Timeliness: days to complete the close, and whether agreed deadlines for deliverables are met.
• Reconciliation quality: unreconciled items outstanding at close and how long they have been open.
• Control compliance: access reviews and security training completed, incidents reported on time.

Cost: what to price and where to check

Pay in India depends on seniority, software skills and whether the person works for local or international clients. The India guide publishes monthly and annual ranges by role, taken from a named Indian job-market source and dated. These are salary ranges for employees, not what a provider or employer of record will charge you.

To compare these ranges with other countries and roles, use the salary benchmark tool and read the bookkeeper and accountant salary benchmark. To build the full cost of an engagement, including employer contributions, tools, security and management time, use the Remote Hiring Cost Calculator. Include the costs that rarely appear on a quote: your reviewer’s time, consent and disclosure administration, legal review, security tooling and the cost of a transition if you change provider.

Employers pricing an offshore accounting hire can read our comparison of remote accountant salaries by country.

Sources

• 26 U.S.C. 7216: Disclosure or use of information by preparers of returns
• 26 CFR 301.7216-3: Disclosure or use permitted only with the taxpayer’s consent
• IRS: Internal Revenue Bulletin 2013-3, including Rev. Proc. 2013-14
• AICPA Code of Professional Conduct, sections 1.150.040, 1.300.040 and 1.700.040
• FTC: Safeguards Rule, what your business needs to know
• 16 CFR 314.4: Elements of the information security program
• IRS: Protect your clients, protect yourself
• ICAI: FAQ on the New Scheme of Education and Training
• Institute of Cost Accountants of India
• RemoteStaffingWiki: hiring in India (time zone, English proficiency, salary ranges, data protection and labour law, with the sources listed there)

References checked on 31 October 2026. Salary ranges are dated as shown in the table. This page is general information, not legal or tax advice.