(GENERAL-23-34) Access and Use of Federal Tax Information (FTI) for Federal Student Aid Programs Beginning with the 2024-25 FAFSA Processing Cycle (Updated April 18, 2024)

On December 19, 2019, the Fostering Undergraduate Talent by Unlocking Resources for Education Act (FUTURE Act) (P.L. 116-91) amended the Higher Education Act of 1965, as amended (HEA), and the Internal Revenue Code of 1986 (IRC) to, among other things, permit a Free Application for Federal Student Aid (FAFSA^®) contributor, including an applicant for federal student aid and their parent(s) or spouse, the ability to consent to the disclosure and use of their federal tax information (FTI) for purposes of determining an applicant’s eligibility for federal student aid. The Consolidated Appropriations Act of 2021 (P.L. 116-260) also amended the HEA under the provisions of the FAFSA Simplification Act in December 2020, which was further amended by the Consolidated Appropriations Act of 2022 (P.L. 117-103).

These laws, among others, require the U.S. Department of Education (Department) to create a simplified FAFSA experience and explain the use of FTI and FAFSA data to eligible institutions and our partners, i.e., institutions participating in the Title IV, HEA programs, state higher education agencies, scholarship organizations designated by the Secretary of Education prior to December 19, 2019, and any applicable third-party servicer or state contractor. In March 2022, the FAFSA Simplification Act Technical Corrections Act (FSATCA) moved the general effective date for full implementation of the FAFSA Simplification Act (including the use of FTI) back one year, to July 1, 2024, coinciding with the beginning of the 2024-25 award year.

This electronic announcement provides our partners with guidance and expectations pertaining to the treatment of FTI received for the 2024-25 award year and beyond and addresses an institution’s obligation to ensure the privacy and security of FAFSA data (including FTI) provided to it under the HEA and the IRC. This announcement describes requirements to label FTI as controlled unclassified information (CUI) and obtain FAFSA contributor consent for the disclosure and use of their information. It also explains modifications to the Student Aid Internet Gateway (SAIG) Mailbox and general FAFSA data use reminders for our partners under these new requirements beginning with the 2024-25 FAFSA processing cycle.

Federal tax information received from the U.S. Department of the Treasury may only be used by our partners for purposes of administering financial aid programs, including determining eligibility for, and amounts of, funds under the Title IV, HEA programs and other financial aid programs offered by our partners. Per Internal Revenue Service (IRS) Publication 1075, FTI consists of (1) tax data elements and (2) information derived from a tax return that is in the Department’s possession or control, which are covered by the confidentiality protections of the IRC. Return information includes, but is not limited to, information extracted from a return, including, FTI, names of dependents; the taxpayer’s name, address, and identification number; status of whether a return was filed, under examination or subject to other investigation or processing, including collection activities. Return information also includes any FTI that is received by the Department from the IRS through any mechanism, including FTI received through data exchanged via a matching program. Return information or information derived from a tax return does not include the Department’s Student Aid Index (SAI) or indicators of Pell Eligibility which use underlying FTI in their calculations. See Federal Tax Information and System Processing section below for additional information about FTI.

Since the 2009-10 award year, the IRS data retrieval tool (DRT) has provided millions of applicants and families the ability to transfer their FTI from the IRS to complete the FAFSA form. Eligible applicants who have already filed their federal income tax return are transferred to the IRS website during the FAFSA process to authenticate their identities, are notified of the data that will be transferred, and elect or decline to have their FTI transferred into the FAFSA. Under the IRS DRT solution, the IRS does not directly provide FTI to the Department; rather, the tool permits taxpayers to transfer their data into their respective FAFSA form. Once tax data is transferred into the FAFSA by the taxpayer, it is considered “FAFSA data” under the Department’s purview and is not subject to IRC confidentiality requirements but remains subject to the data use and privacy restrictions in Section 444 of the General Education Provisions Act, which is commonly referred to as the Family Educational Rights and Privacy Act (FERPA), Section 483(a)(3)(E) of the HEA (prior to amendments under the FAFSA Simplification Act), and the Privacy Act of 1974, as amended. The Department then provides that data to our partners based on the applicant identifying up to 10 institutions on their FAFSA.

The FUTURE Act has changed this process for the 2024-25 award year and thereafter by amending the IRC to permit the disclosure of FTI for the purpose of determining an applicant’s eligibility for, and amount of, federal student aid and to further provide a method by which the Department may receive a taxpayer’s FTI directly from the IRS with an individual’s approval and consent. The statutory authority enables the Department to receive FTI from the IRS through a matching program to, among other things, determine the eligibility and amounts of federal student aid for which an applicant is eligible. FTI will be sent directly from the IRS to the Department rather than from FAFSA contributors via the IRS DRT, thus providing a more streamlined FAFSA experience. FTI is categorized as Controlled Unclassified Information/Specified Tax (CUI//SP-TAX) and may contain sensitive personally identifiable information (PII). Accordingly, all FTI must be handled—at minimum—in accordance with the confidentiality protections of the IRC and subject to Section 6103(l)(13) of the IRC requirements as well as the use restrictions of FTI under Section 483 of HEA as amended by the FAFSA Simplification Act. The use restrictions that are specific to FTI do not apply to manually entered income information on the FAFSA as such data is not considered FTI; however other privacy restrictions could apply as mentioned above.

The IRC and HEA collectively outline the process by which a taxpayer may permit the Department to receive FTI for purposes of applying for federal student aid. The approval and consent process captures the necessary approvals for use and disclosure of FTI by the IRS, as well as consent for the Department to use and disclose PII provided on the FAFSA form to the IRS to request FTI. The process to provide approval and consent for purposes of FTI must be completed annually by FAFSA contributors when completing the FAFSA form. For example, upon completing the FAFSA form for the first time, an individual applying or contributing to a FAFSA form will provide the necessary approval and consent only once for the entire 2024-25 FAFSA cycle. Once an applicant provides their consent and approval, the question asking for consent will not be presented in future instances (e.g., when an applicant corrects the FAFSA to add a school). For each successive FAFSA cycle in which an applicant applies for federal student aid, the FAFSA contributors (including parent(s) or spouse as necessary) will be required to provide approval and consent for the respective FAFSA cycle (e.g., 2025-26; 2026-27; 2027-28) to allow the Department to obtain, use, and disclose the necessary FTI from the IRS for the respective tax year (i.e., 2022 FTI for the 2024-25 FAFSA cycle).

To provide approval and consent, FAFSA contributors (including parent(s) or spouse) must agree to (1) the Department’s use and disclosure of their information (e.g., name and Social Security number) to match with the IRS; (2) the disclosure of their FTI by the IRS to the Department; (3) the use of their FTI by a Department official to determine an applicant’s eligibility for federal student aid and the amount for which they are eligible; and (4) the redisclosure of FTI by the Department to an eligible institution, state higher education agency, or a designated scholarship organization (e.g., institutional or state financial aid). Only the Department has the authority to obtain approval and consent for the use and disclosure of FTI for such purposes. Our partners are not permitted to obtain approval and consent on behalf of FAFSA contributors (including parent(s) or spouse) for the use and disclosure of FTI.

Once a FAFSA contributor has provided approval and consent for use and disclosure of FTI for a FAFSA cycle (e.g., the 2024-25 FAFSA cycle), they cannot revoke consent for that cycle. The ability to revoke consent is not needed for FAFSA purposes because the FAFSA contributor is providing a one-time consent for a specific tax year and an annual consent is required for each FAFSA cycle.

FTI can only be stored/held in the FTI Module (FTIM), which is a new Federal Student Aid (FSA) system designed to ensure compliance with IRS Publication 1075 requirements as well as the broader security of the data received. The Department’s FAFSA processing system (FPS), which will replace the central processing system (CPS), will send information to FTIM to calculate the student aid index (SAI) using both FTI and FPS data provided by the contributors on the FAFSA. In no circumstances will FPS receive FTI from FTIM; it will only receive the SAI and intermediate values. With the approval and consent of the applicant and, if applicable, parent(s) or spouse of the applicant, FTI will be available to institutions, state higher education agencies, and designated scholarship organizations, via the Institutional Student Information Record (ISIR). FTI will not be available in FAA Access, nor will FTI corrections be permitted through the system. While modifications to FTI are not permissible, FAFSA applicants may work with their postsecondary institution to request a professional judgement. Similar to the existing FAFSA process, FTI will not be made available to the applicant and other contributors on the online FAFSA or the applicant's Student Aid Report (SAR).

The following data received by the Department from the IRS are considered FTI, starting with award year 2024-25 data:

The ISIR will also include an IRS response code. The code will indicate the status of the tax filer/ FTI with the IRS, to include one of the following:

Based on the IRS response code and FTI that are received from the IRS, FPS will decide if the user should provide manually entered FTI. In those limited circumstances, the manually entered data would be used in the SAI calculation. For example, manually entered data would be used in a situation where a (federal) non-filer has foreign income and the taxpayer was found by the IRS, but the IRS is unable to provide information for that individual. It is important to note that the mere existence (or lack thereof) of an individual taxpayer in IRS systems and the individual’s respective FTI is considered FTI (e.g., status of non-filing).

Beginning with the 2024-25 FAFSA cycle, the ISIR will have blocks of data that are for specific purposes related to FTI. The FTI block will include four (4) subgroups:

For more information on system processing of FTI, please review the Department’s December 28, 2022, Electronic Announcement: Publication of the 2024-25 Draft FAFSA Specifications Guide.

As noted above, FTI is categorized as CUI//SP-TAX and may contain sensitive PII. Accordingly, all FTI must be handled—at minimum—in accordance with the confidentiality protections of Section 6103(l)(13) of the IRC and in accordance with all applicable privacy laws, regulations, and policies.

The U.S. National Archives and Records Administration (NARA) has established a CUI Registry that serves as the authoritative reference for all CUI category markings. FTI is a category of CUI and is required to have a banner marking the information as CUI. A federal aid applicant’s ISIR will include two (2) FTI label fields:

All the ISIR fields within the two label fields will be the FTI received from the IRS for the applicant and, if applicable, the other subgroups listed above. Partners that receive ISIR data must retain the CUI labeling of FTI wherever the data is stored and used within their student information system(s). This includes ensuring CUI labels appear when FTI is inspected or used for purposes of determining an aid applicant’s eligibility and the awarding of federal, state, and/or institutional financial aid programs. For example, when a financial aid administrator inspects or uses FTI for the purpose of federal student aid, the appropriate CUI labels (above) must appear with the FTI. CUI labels may appear at the beginning and end of FTI (as outlined above), or FTI may be labeled individually with CUI//SP-TAX.

The SAIG mailbox is the tool that allows Federal Student Aid partners to securely exchange batch data with Federal Student Aid Application Systems, which includes, among other things, FAFSA data and FTI. Beginning with the 2024-25 FAFSA cycle year, every partner enrolled to receive ISIRs will be required to enroll for an FTI SAIG mailbox, sign an updated SAIG enrollment agreement, and install (upgraded) SAIG software in order to continue receiving ISIR data. The revised SAIG agreements are targeted to be released in Fall 2023 and must be completed prior to the launch of the 2024-25 FAFSA.

Our partners should begin preparing for this setup process and ensure appropriate leadership teams are informed of the forthcoming requirements to ensure there is no delay in the receipt of ISIR data for the processing of financial aid offers to future and current students for the 2024-25 award year. The new SAIG agreements will require compliance with the protection of the FTI provided to our partners by the Department, including return information obtained in support of the administration of the federal student aid programs, and an acknowledgement of the criminal and civil penalties for the unauthorized inspection or disclosure of FTI. The Department will release future communications to keep our Partners informed of the forthcoming requirements and deadlines in the months ahead.

Partners that receive ISIRs must protect federal student aid information provided to them by the Department or otherwise obtained in support of the administration of the federal student aid programs. As previously described above, all FTI received by our partners is classified as CUI//SP-TAX and is permitted, with approval by the applicant and, if applicable, their parent(s) or spouse, for redisclosure by the Department to our partners under Section 6103(l)(13)(D)(iii) of the IRC. While our partners are not subject to IRS Publication 1075 - Tax Information Security Guidelines, we encourage our partners to use this publication as a resource when developing and implementing information security standards as it pertains to FTI. Again, our partners are required to maintain appropriate receipt, handling, marking, and safeguarding of CUI data since FTI is a subcategory of CUI.

The Department would like to emphasize that it is unlawful to access, view, use, or disclose (without the express written consent of the applicant) FTI for any other purposes than those authorized by federal law. We remind our partners that FTI received via an ISIR in the 2024-25 FAFSA cycle is considered FTI for purposes of determining eligibility for, and the amount of, Federal student financial aid under a program authorized under Subpart 1 of part A, part C, or part D of Title IV of the HEA, as amended, under Section 6103(l)(13) of the IRC and therefore are not FAFSA data for such purposes. Violations of IRC can result in criminal and civil penalties that include:

In addition to the use and disclosure restrictions that apply to FTI and FAFSA data under IRC 6103(l)(13) and HEA Section 483, respectively, we take this opportunity to remind our partners of their obligation to establish appropriate cybersecurity safeguards to ensure the confidentiality and security of student information consistent with the Federal Trade Commission’s (FTC’s) December 2019 Final Rule for Safeguarding Customer Information. We encourage our partners to review the Department’s February 9, 2023, Electronic Announcement, Updates to the Gramm-Leach-Bliley Act (GLBA) Cybersecurity Requirements, for more information.

Under amendments made by the FUTURE Act to Section 494 of HEA (20 U.S.C. 1098h(c)(1)(B)), an applicant must provide written consent before an institution may redisclose an unredacted SAR, including any return information disclosed under 26 U.S.C. 6103(l)(13), to a scholarship organization (including a Tribal organization (defined in 25 U.S.C. 5204)) or to an organization assisting the applicant in applying for and receiving Federal, state, local, or Tribal assistance, that is designated by the applicant to assist the applicant in applying for and receiving financial assistance for any component of the applicant’s cost of attendance at that institution. Furthermore, an applicant may select and designate another individual, such as an advisor or mentor, to participate in discussions pertaining to data on the FAFSA (including FTI). Institutions must obtain the express written consent of the applicant for such individual to participate in such discussions.

Institutions must maintain these records of written consent obtained under the FUTURE Act for a period of at least three (3) years from the date of the student’s last date of attendance at the institution and upon request must make such records available to the Department for review.

The FAFSA Simplification Act permits institutions, and state higher education agencies administering institutional and state-based financial aid, to use FAFSA information, including FTI, for the application, award, and administration of financial aid to the applicant. However, FTI may not be redisclosed or used for any other purpose, such as for research in promoting college attendance, persistence, and completion. These partners are, however, permitted to use other FAFSA data (non-FTI) for purposes of research consistent with Section 483(a)(3) of the HEA and other applicable laws.

The Department is aware of the research community entering into data-sharing agreements (DSAs) and non-disclosure agreements (NDAs) with our partners that receive ISIRs for purposes of research that include de-identified and identifiable FAFSA data. Current and future DSAs and NDAs need to be consistent with Department’s Guidance on the Use of Financial Aid Information for Program Evaluation and Research and its interpretation of Section 483 of HEA.

Partners that receive FAFSA data are not permitted to redisclose FAFSA data to other parties without the express written consent of the applicant and consistent with the provisions of the SAIG Agreement, except as described by the Guidance linked above. The Department plans to issue further guidance relating to FAFSA data use and how our partners can ensure compliance. A future announcement will expound on the changes made to Section 483 of HEA under the FAFSA Simplification Act, including permitted and restricted use cases of FAFSA/FTI data, and further explain how these recent changes also implicate the provisions of Section 444 of the General Education Provisions Act (commonly known as the Family Educational Rights and Privacy Act of 1974 or FERPA). Unauthorized and impermissible redisclosure of FAFSA/FTI beginning in 2024-25 will carry an additional set of penalties.

In summer 2023, FSA’s Training and Information Services Group will conduct partner training on the topic of consent and FTI for the federal student aid programs. We encourage our partners to attend this and other future training sessions on the implementation of the FUTURE Act and FAFSA Simplification Act. Check here: https://fsatraining.ed.gov/ and the FSA Knowledge Center for announcements and more information: https://fsapartners.ed.gov/knowledge-center.

For information on the Department’s implementation of the FAFSA Simplification Act, visit FSA’s Partner Connect, Knowledge Center, FAFSA Simplification Information. If you need additional information or have specific questions about the Department’s implementation of the FUTURE Act and FAFSA Simplification Act, visit FSA’s Partner Connect, Help Center, Contact Customer Support webpage and select the Topic “FSA Ask-A-Fed/Policy.”