What Is a CPEO? IRS Certification, Explained for Employers

The first time I read a professional employer organization agreement line by line, the sentence that stopped me was not about price. It was the one saying the provider would report, withhold and remit federal employment taxes on our behalf. Read casually, that sounds like the obligation moves. For most providers in this market, legally, it does not move at all.

That gap has a name in the tax code. The IRS runs a voluntary certification program for professional employer organizations, created by the Small Business Efficiency Act inside the Tax Increase Prevention Act of 2014, with the first certifications taking effect on January 1, 2017. An organization that qualifies and keeps qualifying becomes a certified professional employer organization, and one statute, section 3511, changes who the government can bill when the money that left your bank account never reaches Treasury.

This page is about that single difference and the machinery holding it up: what an organization has to do to get certified and stay certified, what section 3511 says word for word, how the annual wage bases behave when you move onto or off a provider in the middle of a year, what happens to your employment tax credits, how to check the public list in a few minutes, and the four categories certification does not touch at all. I build FirstHR, which is an onboarding and HR platform and not a payroll provider, so I have nothing to sell you on either side of this question.

What a CPEO Is

A CPEO is a professional employer organization that applied to the IRS, met the standards in section 7705 of the Internal Revenue Code, and received certification. It is a federal tax status attached to a specific legal entity. It is not a license to operate, not a quality score, and not an endorsement of the service by any part of the government.

The program is voluntary. Nothing stops a provider from running a large, competent, decades-old business without ever applying, and many have chosen exactly that. Certification costs money and imposes standing obligations, so the decision to seek it is a business decision the provider makes, not a threshold every serious operator has crossed.

Four eligibility gates sit at the front of the process. The applicant must be a business entity created or organized in the United States. It must maintain one or more established physical business locations in the United States where a significant part of its operations is carried out and its records are kept. It must show a history of financial responsibility, organizational integrity and tax compliance. And its responsible individuals, meaning the owners, officers and managers the IRS names in the regulations, must be mostly United States citizens or residents with collective knowledge of employment tax compliance, payroll handling and business management.

One detail about the mechanics matters more than it sounds. Certification attaches to entities, not to brands. A national provider commonly operates through dozens of affiliated corporations and limited liability companies, each of which applies separately, so the public list can be long while the number of distinct commercial brands on it stays small. When you check a provider, you are checking the entity whose name appears in your signature block, not the logo on the marketing site.

What an Organization Has to Do to Hold the Certification

Certification is not a one-time exam. It is a standing set of obligations with a bond, an annual audited financial statement, a quarterly attestation from a CPA and an annual re-verification, and failing any of them can cost an organization its status. That ongoing burden is the reason the certification carries information at all.

Getting in runs through an IRS online registration system in sequence: identity verification for every responsible individual, then a responsible individual personal attestation from each of them that produces an identification number, then a controlled group license where affiliated entities apply together, and then the application itself. A user fee of $1,000 is paid at submission through the federal payment portal.

The suitability review goes deeper than most vendor due diligence. The regulations contemplate criminal background checks including fingerprints for responsible individuals, checks on tax compliance, professional experience, credit history and professional sanctions, and a screen against the federal sanctions list. Late or unfiled federal, state or local tax returns count against the applicant unless there is reasonable cause. So does any history of dishonesty, fraud or breach of trust. Providing false or misleading information to the IRS is itself grounds for denial.

Two structural requirements deserve a mention because they are unusual. The organization generally must use the accrual method of accounting unless the IRS approves something else, which makes the audited statements comparable year to year. And it must hold cash and make tax payments through United States financial institutions of the type described in section 265(b)(5), which keeps the deposit money inside the regulated banking system.

Read that table as a client rather than as a compliance officer. Every row is a place where an organization in financial trouble starts to slip before its clients notice anything. A missed quarterly attestation, a working capital figure that turns negative, a bond that was not increased by March 1: those are early signals, and the IRS sees them on a schedule while you would not see them at all.

Section 3511 and What Sole Liability Actually Means

Section 3511(a) of the Internal Revenue Code says a certified professional employer organization is treated as the employer, and no other person is treated as the employer, of any work site employee performing services for a customer, but only with respect to remuneration remitted by that organization. The parenthetical exclusion is the entire value of the certification, and the two qualifiers around it are the entire risk of misreading it.

Start with what the rule covers. Subtitle C of the code holds federal income tax withholding, Social Security and Medicare, and federal unemployment tax. Those are the taxes section 3511 moves. Sole liability means that for those wages, on those taxes, the organization is the taxpayer and you are not a backstop.

Now the first qualifier: the rule reaches only remuneration the certified organization actually remits. Wages you pay outside the arrangement stay yours. A discretionary bonus written from the operating account, a final paycheck cut in-house during an offboarding scramble, a payment to a person the agreement never covered: each of those is your employment tax obligation, reported under your own employer identification number. Providers usually insist that everything run through them for exactly this reason.

The second qualifier is the work site employee definition, and it is where distributed teams get surprised. A work site employee is a covered employee at a location where at least 85 percent of the individuals performing services for the customer are covered employees. The determination is made separately for each work site and each customer, and an individual who qualifies at any point in a calendar quarter is treated as qualifying for the whole quarter.

The regulations also say a work site cannot be an individual's residence or a telework site unless the customer requires the person to work there. If there is no physical location where the person regularly performs services, the work site becomes the location from which the customer assigns work. Noncontiguous locations count separately unless they sit within 35 miles of each other, operate in the same industry, and the customer elects to combine them.

For anyone outside that definition, section 3511(c) still treats the certified organization as an employer, but the exclusivity phrase is absent from the text. That is not an accident of drafting. It means shared liability rather than transferred liability for non work site employees, which is a real gap for a company whose people are scattered across home offices in a dozen states.

You can read the operative language yourself at 26 U.S. Code section 3511, and it is worth ten minutes. It is one of the few employment tax provisions short enough to read end to end without a specialist, and the phrasing tells you more than any provider brochure will.

Why That One Rule Is the Whole Point

Without certification, handing over the money does not hand over the obligation, and that is the sentence every owner should carry out of this article. The IRS states the general rule for outsourced payroll in plain language, and the general rule has no exception for a well-drafted service agreement.

Picture the failure concretely. You wire the full payroll amount every other Friday. The provider withholds income tax and the employee half of Social Security and Medicare from each paycheck, adds the employer half, and reports the wages under its own EIN on an aggregate Form 941 with a Schedule R allocating amounts to each customer. Then it stops depositing. Cash flow problems, a bad acquisition, outright fraud: the cause does not change the outcome.

Months later a notice arrives. With an uncertified provider, the assessment can land on your company for taxes you already funded once, plus failure to deposit penalties and interest running from the original due dates. The trust fund portion, meaning the income tax and employee Social Security and Medicare withheld from paychecks, carries its own exposure under section 6672, which can reach the people at your company with authority over the money in their personal capacity. Your recourse is a claim against a company that has typically stopped answering the phone.

This is not a theoretical scenario invented to sell certification. The IRS warns about it on the same outsourcing page, noting prosecutions of individuals and companies that posed as payroll service providers and stole funds intended for employment tax payments, and the Small Business Efficiency Act was written to give the model a version where that failure cannot land on the client. The structural downsides of the model are a separate discussion, but this specific one is solvable, and certification is how you solve it.

The Bond, the Audited Financials and the Quarterly Assertions

Sole liability is only worth as much as the entity carrying it, which is why the certification is built on a surety bond, an annual audited financial statement showing positive working capital, and a quarterly assertion examined by a CPA. Those three requirements are the reason a certified organization is a different credit risk from an uncertified one.

The bond comes first. A certified organization posts a bond from a qualified surety on Form 14751 for the payment of federal employment taxes, in an amount equal to the greater of 5 percent of its liability under section 3511 for the preceding calendar year, capped at $1,000,000, or a floor of $50,000. The bond period runs from April 1 through March 31, and by March 1 each year the organization has to determine whether the coming period requires a larger bond. Members of a controlled group are covered by a single bond naming each of them as a principal.

Be honest with yourself about what that bond does. On a very large book of business, $1,000,000 against a federal employment tax liability measured in the hundreds of millions is not insurance for every client. The bond is a solvency test and a partial recovery source, not a guarantee that every dollar is backed. The protection that actually matters to you is statutory, in section 3511, and the bond exists so that Treasury has a claim as well.

The financial statements do more work than the bond. By the last day of the sixth month after the fiscal year ends, the organization files audited statements with an unmodified CPA opinion under generally accepted accounting principles, plus a note laying out a detailed working capital calculation showing a positive result. Negative working capital is tolerated only in narrow circumstances: no more than two consecutive fiscal quarters, with an explanation the IRS accepts and evidence that the shortfall does not create a material risk to collection of federal employment taxes.

Then the quarterly rhythm. By the last day of the second month after each calendar quarter, the organization files a statement signed under penalties of perjury asserting that it withheld and deposited all federal employment taxes, an examination level attestation from a CPA confirming the assertion, and a working capital statement as of the quarter end. Add the audited statements and the annual verification 30 days before each certification anniversary with its $1,000 fee, and the organization is proving itself to the IRS six times a year, every year. The full requirement set is published on the IRS page on maintaining certification.

The IRS can suspend or revoke certification when an organization fails to satisfy any of it, and both outcomes are published. That is what turns a paperwork calendar into something you can actually use: the failure to keep up becomes visible to you before it becomes expensive for you.

The Wage Base Restart Problem When You Switch Mid-Year

Moving employees onto or off a provider mid-year changes the entity paying wages, and the annual wage bases are tracked per employer, so the counters can reset and the same tax gets paid twice on the same dollars. Section 3511(b) removes that problem for certified organizations by making the organization a successor employer when the contract starts and a predecessor employer when it ends.

The mechanics are worth understanding because the money is real. Social Security tax applies at 6.2 percent on each side up to an annual wage base, which the Social Security Administration set at $184,500 for 2026. Federal unemployment tax applies to the first $7,000 of each employee's wages at a gross 6.0 percent, generally reduced to 0.6 percent by the state credit. Both stop for the year once the base is cleared, and both start over when a new employer begins counting from zero.

Without certification, you fall back on the general successor employer rule in section 3121(a)(1), which lets a successor count wages the predecessor paid only where the successor acquired substantially all the property used in a trade or business of the predecessor and employed the same people immediately after the acquisition. A service agreement with a payroll provider is normally not an acquisition of a trade or business, which is exactly why the certification carve-out had to be written into the statute.

Run the arithmetic for a team with several high earners and the duplication stops being a rounding error. Four people who have already cleared the Social Security base, moving to an arrangement that restarts the counters, expose the employer to as much as $45,756 in duplicated tax on wages that were taxed once already, which is four times the $11,439 ceiling on a single employee. The same exposure exists in reverse when you leave, which is why the exit deserves as much attention as the entry.

Section 3511(b) is symmetric on purpose. When the service contract begins, the certified organization is the successor and you are the predecessor. When it terminates, you are the successor and the certified organization is the predecessor. The counters travel with the employee in both directions for federal purposes, which removes the single biggest hidden cost of changing arrangements mid-year.

Two caveats keep this honest. State unemployment wage bases and experience ratings follow state successorship law, not section 3511, so state unemployment accounts need their own answer state by state. And the cleanest solution remains an effective date of January 1, which sidesteps the whole question regardless of certification status.

What Happens to Your Employment Tax Credits

Section 3511(d) keeps the specified employment tax credits with you rather than with the provider, and computes them as though you paid the wages the certified organization actually paid. That is a straightforward answer to a question that gets genuinely messy without certification, because the entity that paid the wages is normally the entity that claims a wage-based credit.

The statute lists the credits it protects: the research credit under section 41, the Indian employment credit under section 45A, the credit for the employer share of Social Security taxes paid on employee cash tips under section 45B, the clinical testing credit for certain rare disease drugs under section 45C, the small employer health insurance credit under section 45R, the military spouse retirement plan credit under section 45AA, the work opportunity credit under section 51, the empowerment zone employment credit under section 1396, and any additional section the Secretary specifies.

Three of those matter to ordinary small employers far more than the rest, and one of them is currently in a lapse. The work opportunity credit reaches employers who hire from targeted groups and has been worth thousands per qualifying hire, but the authority to claim it on wages paid after December 31, 2025 ended on January 1, 2026 and Congress has not reauthorized it. The section 45B tip credit is a standing item for any restaurant or bar. The section 45R credit matters to small employers buying coverage through the small business marketplace.

Preserving eligibility is not the same as preserving the paperwork, and this is where clients lose credits they were entitled to. The work opportunity credit runs on pre-screening: Form 8850 has to be signed on or before the offer date and filed with the state workforce agency no later than the 28th day after the individual starts work. Nothing in section 3511 extends that window or does the filing for you. If your provider handles the screening as part of onboarding, confirm the deadline discipline in writing. If it does not, someone on your side owns it from the first day.

The practical ask during diligence is narrow. Confirm that the organization will furnish the wage and hour information you need to compute each credit at your level, name the credits you actually claim in the service agreement, and get clarity on who files what. The statute puts the credit where it belongs. Administration decides whether you ever collect it.

How to Verify a Provider's Status on the IRS List

The IRS publishes three lists: organizations that hold certification along with the effective date of each certification, organizations whose certification is suspended, and organizations whose certification has been revoked. Checking all three against the exact legal entity in your agreement takes a few minutes and is the only reliable way to confirm the status.

The list of certified organizations is refreshed for newly certified entities by the fifteenth day of the first month of each calendar quarter, and a suspension or revocation is added as soon as practicable and no later than the next update after it takes effect. You can pull all three from the IRS public listings page. Do not accept a screenshot from a sales deck or a certification badge on a website as evidence.

One more habit is worth building. Ask the organization for the date of its most recent annual verification and the fiscal year covered by its latest audited financial statements. A certified organization has both answers ready because it produces them for the IRS anyway, and reluctance to share them tells you something the public list will not.

What Certification Does Not Cover

Certification is a federal employment tax status and nothing more. It says nothing about state taxes, nothing about state unemployment accounts, nothing about the benefits your employees receive, and nothing at all about whether the service is any good. Most disappointment with the model comes from expecting the certification to reach further than it does.

State taxes are the first and largest gap. Section 3511 sits in the Internal Revenue Code and moves federal liability only. State income tax withholding and state unemployment tax remain creatures of state law, and states differ on whether these providers report unemployment wages under their own account or under a client-level account. State payroll tax rules vary enough that the answer has to be confirmed for every state where you have a person working.

State registration is the second gap, and it is regularly confused with the federal program. Most states run their own registration or licensing regime for professional employer organizations, entirely separate from IRS certification, with different standards and different renewal cycles. A certified organization that is not registered in the state you are about to hire in has not solved your problem there. Ask for the state list, in writing, before the first hire in a new state.

Benefits are the third gap. Certification does not review plan design, does not guarantee the health plan will still exist next renewal, and does not settle who sponsors the plan for federal benefits law purposes. The same is true of workers compensation. On a master policy your claims usually run under the provider's policy, which means that after several years you can leave with no experience history of your own and get rated as a new risk. Ask for loss runs in your company name, in writing, before you sign.

The last gap is legal rather than financial. Certification does not resolve who employs whom for wage and hour law, discrimination law or labor law. Those questions run on their own tests, and a favorable federal tax status has no bearing on them. If joint employment exposure is what worries you, that concern survives certification untouched.

How to Use This When You Are Deciding

Treat certification as a filter rather than as a decision. It removes one specific and expensive failure mode from the table and it leaves every other question about fit, price and service exactly where it was. That is a useful thing to know and a bad thing to over-read.

If the entity signing your agreement holds a current certification, you can cross two items off the risk register: paying federal employment taxes twice if the provider fails, and restarting the federal wage bases when the arrangement starts or ends mid-year. Those are the two items in this space that produce the largest unbudgeted invoices, and they are now handled by statute rather than by contract language.

If the entity is not certified, you are not automatically looking at a bad provider, but you are looking at a different risk profile that needs compensating diligence. Ask three questions. Will it show you audited financial statements. Is it bonded, through what body, and at what level. Will it indemnify you in writing for federal employment taxes it collects and fails to deposit, and is that indemnity worth anything against a company that would be insolvent by the time you invoked it.

Then put the answers into the agreement rather than into your notes. Name the specific legal entity and its EIN. Require written notice within a defined number of days of any suspension, revocation or voluntary termination of certification. Set the effective date at January 1 where the timing allows. Require loss runs in your name. Specify who prepares Form 8973 and when you sign it.

The real cost per employee comes before any of it, because certification does not make an expensive arrangement cheap. Price the arrangement first. Then use the certification to choose among the providers that survive the pricing.

My own view, after reading more of these agreements than I ever expected to: if you have decided to use this model at all, there is no good reason to accept an uncertified entity when certified ones compete for the same business. The premium, where one exists, is smaller than a single duplicated Social Security wage base on one senior employee. That is a rare case in employment compliance where the right answer is both cheap and easy to verify.

Frequently Asked Questions