What a TIN is, and what the IRS checks
The same process goes by several names: TIN compliance (the vendor term), 1099 compliance (what most AP teams call it), and information-reporting compliance (the tax-department term). They all mean the work described below.
A taxpayer identification number is the nine-digit number the IRS uses to tie a payment to a taxpayer. For individuals it's a Social Security number (SSN) or, for people who can't get one, an Individual Taxpayer Identification Number (ITIN). For businesses, trusts and estates it's an Employer Identification Number (EIN). Every Form 1099 you file carries a payee name and a TIN, and the IRS checks the pair, not the number alone. "Acme Consulting LLC" with the owner's SSN is a mismatch even though both are real, because the IRS's records tie that SSN to a person's name, not the company's.
That pairing rule is the source of most TIN problems. Sole proprietors put the business name where the individual name belongs. Companies change their legal name and keep the old EIN. A vendor types a digit wrong on the W-9 and nobody checks. None of these are fraud; all of them produce a return the IRS can't match, and the IRS treats an unmatchable return as your error, not the vendor's.
The six stages
TIN compliance runs as a loop, and each stage has its own rule and its own record to keep.
| Stage | What you do | The rule behind it |
|---|---|---|
| 1. Solicit | Ask every new payee for a signed Form W-9 (or W-8 for foreign payees) before the first payment, and re-solicit on the IRS schedule if it doesn't arrive. | The solicitation rules in Reg. 301.6724-1 are what make a later penalty waivable. Guide |
| 2. Verify | Match the name/TIN pair against IRS records before you pay, through the IRS TIN Matching Program or a service built on it. | Not required by statute, but it is the "ordinary business care" that reasonable cause depends on, and it prevents most of what follows. Guide |
| 3. Correct | When a pair fails, go back to the vendor with a specific ask (usually: the name on line 1 is wrong) and get a corrected W-9 before filing. | Corrections filed within 30 days or by August 1 are penalized at $60 or $130 instead of $340. Guide |
| 4. File | File accurate returns on time and keep a record of what was verified, when, and what the result was. | IRC 6721 and 6722 penalize each incorrect return and each incorrect payee statement. |
| 5. Respond | When a CP2100/CP2100A arrives, compare it to your records, send B-Notices within 15 business days, and start backup withholding at 24% after 30. | Pub 1281; IRC 3406 makes you liable for tax you should have withheld. Guide · Withholding guide |
| 6. Defend | When Notice 972CG proposes a penalty, respond within 45 days with a reasonable-cause statement and the solicitation log. | IRC 6724(a) waives the penalty for reasonable cause and not willful neglect. Guide |
The pattern. Stages 1 and 2 are cheap and happen at onboarding. Stages 5 and 6 are expensive and happen a year later, under deadline, with a vendor who may no longer answer email. Every dollar of TIN compliance effort moved from the right side of this table to the left side pays for itself several times over.
Who this applies to
Any organization that files information returns: businesses paying contractors (1099-NEC), rent or royalties (1099-MISC), interest or dividends (1099-INT, 1099-DIV), payment settlement entities (1099-K), brokers (1099-B), and government agencies and nonprofits paying vendors. Since the e-file threshold dropped to 10 returns in aggregate, nearly every employer with a handful of contractors is filing electronically, which means the IRS is matching their TINs by machine, which means the CP2100 notices reach small filers that never used to see them.
The obligations are the payer's, not the payee's. The vendor who gave you a wrong TIN suffers backup withholding; you suffer the penalty and the withholding liability.
What non-compliance costs
- Per-return penalties. $340 per return with a missing or incorrect TIN for returns due in 2026, doubled if the payee statement was also wrong (IRC 6722), with annual caps of $4,098,500 ($1,366,000 for businesses under $5 million in gross receipts) and no cap for intentional disregard.
- Backup withholding liability. If you should have withheld 24% and didn't, IRC 3406 makes you liable for the amount, plus penalties and interest, whether or not you can recover it from the payee.
- Staff time. Every CP2100 line is a letter, a follow-up, a withholding change, a deposit, a Form 945 entry, and a vendor who calls to ask why their payment is short. Filers routinely spend more on the response than the penalty would have been.
- Fraud exposure. A vendor whose name and TIN don't match is also, occasionally, not who they say they are. TIN verification at onboarding is the cheapest fraud control an AP department has.
Who should own it
In most organizations it falls between accounts payable (who onboard vendors), tax (who file the returns), and compliance (who worry about sanctions and fraud), and it's owned by none of them until a notice arrives. The workable answer is that AP owns stages 1 through 3, because they happen at onboarding, and tax owns 4 through 6, with one shared system of record so that tax can see the solicitation history AP created. The checklist lays the tasks out by time of year.
Questions people ask
Is TIN matching required by law?
No. Soliciting a W-9 is required (and the solicitation schedule determines whether a penalty can be waived); matching the result against IRS records is voluntary. But because Reg. 301.6724-1 waives penalties only for filers who exercised ordinary business care, and matching is cheap and available, it has become the standard of care.
Does a signed W-9 protect me if the TIN turns out to be wrong?
Partly. It establishes that you solicited, which is the first requirement for reasonable cause. It does not stop the return from mismatching, the CP2100 from arriving, or the B-Notice obligations that follow.
What about foreign vendors?
Foreign payees document with a Form W-8 instead of a W-9 and are generally outside the 1099 and backup-withholding regime (they fall under chapter 3 withholding and Form 1042-S). A foreign vendor appearing on a CP2100 usually means someone filed a 1099 for a payee who should have received a 1042-S.
How long do I keep W-9s and matching records?
At least four years after the return's due date is the general retention rule for information-return records, and Pub 1281 says to track CP2100-listed accounts for three years to apply the second-notice rule. Keep the solicitation log as long as the vendor is active plus four years.