How long to keep a W-9 on file
Four years is the working answer, and the number is derived rather than stated. Neither Form W-9 nor its instructions sets a retention period. The clock comes from general recordkeeping law, and it starts later than most people assume.
Four years, and where the four comes from
- Stated on the form?
- No. Neither the form nor the requester instructions sets a period
- Working minimum
- Four years, from the general employment tax recordkeeping rule
- Clock starts
- When the tax becomes due or is paid, whichever is later, for the last return the form supported
- Electronic storage
- Permitted. Revenue Procedure 97-22 sets the conditions
- Hard copy
- You must be able to produce one for an electronically submitted form
- Separate clock
- Three years of B notice history under Publication 1281
- What the file actually is
- A database of Social Security numbers
There is no W-9 retention rule, and that is the useful starting point
People go looking for a sentence in the instructions that says how long to keep these things, and there is no such sentence. The Instructions for the Requester of Form W-9 tell you how to solicit, how to run an electronic system, when to withhold, and what a substitute form may look like. On archiving they say one thing, about being able to supply a hard copy if the IRS asks.
So the period comes from elsewhere. A completed W-9 is a business record supporting positions you took on filed returns: the name and TIN you put on a 1099, the exempt payee code you honored, the decision not to withhold. The IRS instruction for records of that kind is to keep employment tax records for at least four years after the date the tax becomes due or is paid, whichever is later. Backup withholding is withheld federal income tax, reported annually on Form 945, so the four-year rule reaches a W-9 through the withholding it either supported or excused. Income tax records generally run on a three-year limitations period. Four years is the longer of the two and the number most policies land on.
None of that is a citation you can wave at an examiner as W-9-specific authority, and pretending otherwise does no one any favors. What it is, is a defensible construction with primary support, which is more than "our policy is seven years" offers.
The clock starts later than you think
Here is the mistake that turns a sensible policy into a liability. A retention schedule keyed to the signature date on the form will purge the forms you most need.
A W-9 has no expiration, so a single form can support a decade of information returns. Consider a vendor who signed in March 2019 and has been paid every year since. Under a four-years-from-signature rule that form becomes deletable in 2023. It is also the only document substantiating the name and TIN on the 1099 you filed for 2026. Delete it on schedule and you have destroyed your own evidence for a return still well inside its examination window.
Retain each Form W-9 for four years after the end of the last return period in which it supported a filing. In practice that means a form stays live for as long as the vendor relationship does, plus four years after the final 1099. Vendor master systems rarely model this, so the retention flag usually has to be driven off the last payment date rather than off the document date. Why the form itself never expires
A schedule that survives an examination
The W-9 is one document in a small file, and the rest of the file is what actually wins a penalty argument. Retain the group together, on the longest clock in it.
| Record | Keep for | Why it exists |
|---|---|---|
| The Form W-9 itself | Four years after the last return period it supported | Substantiates the name, TIN and classification you reported |
| A superseded W-9 | Four years after the last return period it supported | The only evidence of what governed earlier years |
| Solicitation records: initial, first annual, second annual | Four years after the last affected filing | The reasonable cause file. Detail |
| CP2100 listings and copies of B notices sent | Three years from the date of the first CP2100, at minimum | Publication 1281 requires tracking for the two-in-three-year rule. Detail |
| Undeliverable B notices returned to you | Three years | Same tracking clock, and proof the mailing went out |
| SSA and IRS validation documents | With the W-9 file | A Letter 147C or Social Security card copy is what stopped the withholding |
| TIN Matching results | With the vendor record | Shows the pair was checked before filing. Detail |
| Form 945 and deposit records | Four years after the tax became due or was paid, whichever is later | Withheld tax records |
Splitting these across systems is how organizations end up with a W-9 in the vendor master, the solicitation emails in a mailbox that was deleted when the clerk left, and the B notice copies in a filing cabinet nobody has opened since the office move. The documents are only worth anything together.
Electronic storage, and what makes it acceptable
Paper is permitted and almost nobody uses it. Electronic storage is fine, including scanning the paper forms and destroying the originals, provided the system does what Revenue Procedure 97-22 requires. The requirements are unglamorous and worth reading before you commit to a platform, because a shared drive full of scanned PDFs named after whoever downloaded them meets roughly none of them.
Two things follow for W-9s specifically. Scanning is not archiving: a scan sitting in a folder with no index and no description of the process is a picture of a record rather than a record. And the requester instructions independently require you to be able to supply a hard copy of an electronically submitted Form W-9 if the IRS asks, so a signup flow that captures the data into database columns and keeps no reproducible form is a gap. Electronic W-9 system requirements
Every W-9 file is a file of Social Security numbers
This is the part that gets treated as an afterthought, and it deserves to be the first design constraint. A payer with four hundred vendors holds four hundred full legal names paired with addresses and taxpayer identification numbers, a large share of which are Social Security numbers, collected from people who had no practical choice about handing them over. That is not a tax record store. It is an identity theft target that happens to satisfy a tax obligation.
The form itself carries the warning, under Misuse of TINs: a requester that discloses or uses TINs in violation of federal law may be subject to civil and criminal penalties. Organizations that are also tax return preparers carry the further duties in IRC 7216 and 6713. State breach notification law applies to this data in every state that has such a statute, which is all of them.
- Set access by role and review it. The list of people who need to read a TIN is much shorter than the list who currently can.
- Mask TINs in every downstream view, report and export. Show the last four digits and nothing more, so a vendor master extract stops being a breach.
- Encrypt at rest, and keep the encrypted store off general-purpose file shares and out of ticketing systems.
- Log reads as well as writes. A retention policy with no access log cannot tell you what a compromised account saw.
- Keep W-9s out of email permanently. Forms that arrive as attachments should be moved into the system of record and the message deleted, including from the sent folder of whoever forwarded it. Collection channels
- Treat a W-9 arriving with new banking details as a fraud attempt until you have verified it by a channel you initiated.
Every extra year of retention is another year of breach surface, and "we keep everything forever" is not a conservative choice so much as an unexamined one. Retention beyond the period you can justify adds risk without adding defense. Pick a period, write it down, and enforce it.
Purging, properly
A purge that removes the primary record and leaves the copies is theater. Most organizations discover on their first real deletion request how many places a W-9 went.
Decide what is actually eligible
Run the eligibility test against the last return period the form supported, and check the account against your B notice tracking window. A form inside either clock stays.
Find every copy
The document store, the ERP attachment table, the mailbox it arrived in, the sent folder it was forwarded from, the shared drive where somebody staged it, the ticketing system, the offshore data warehouse, and any full-database backup. Enumerate these once and write the list down; you will use it every year.
Decide the backup question deliberately
Immutable backups often cannot be edited, which is usually the correct security tradeoff. Then say so in the policy: primary stores purge on schedule, backups age out on their own retention cycle. An undocumented gap between the two is what turns a purge into a misrepresentation.
Destroy rather than delete
Cryptographic erasure or secure overwrite for electronic records, cross-cut shredding for paper. A file moved to a trash folder is still a file.
Log the destruction
Record what was destroyed, on what date, under which policy, and by whom. A destruction log is what lets you tell an examiner why a record is absent, which is a much better position than having no answer.
Two changes cut the size of the problem more than any storage control. Collect through a portal or an e-signature system so forms never exist as email attachments. And tell sole proprietors in the request that an EIN is free and works in Part I, because every vendor who takes that route is one fewer Social Security number in your custody. EIN instead of SSN
Frequently asked questions
How long should a payer keep a Form W-9?
At least four years. Nothing in the form or its instructions sets a period, so the figure comes from the general employment tax recordkeeping rule: keep those records for at least four years after the date the tax becomes due or is paid, whichever is later. Backup withholding is withheld tax reported on Form 945, which puts a W-9 inside that rule.
When does the four years start?
Not on the day the vendor signed. The form is evidence supporting the returns it was used for, so the useful start date is the last return period it supported. A W-9 signed in 2021 that justified the name and TIN on a 1099 filed for 2026 has a clock running from that 2026 filing, so deleting by signature date empties exactly the wrong drawer.
Can I keep W-9s electronically and shred the paper?
You can, provided the storage system meets the requirements in Revenue Procedure 97-22: it has to index, store, preserve, retrieve and reproduce the records in legible form, you must be able to describe the system to the IRS, and you must be able to produce hard copies on request. The requester instructions carry the same hard-copy point for electronically submitted forms.
A vendor asked me to delete their W-9. Do I have to?
Almost certainly not while the record still substantiates a return you filed. Tax records generally sit outside consumer deletion rights, and destroying evidence of what you reported creates a problem for you rather than solving one for them. Where a state privacy statute is being invoked, that is a question for counsel and not for a reference site.
Do I keep the old W-9 when a vendor sends a new one?
Keep both. The superseded form is the only evidence of what you reported in the years before the change, and entity classification changes are exactly what an examiner asks about. Version the record instead of overwriting it, and mark which form governed which tax years.
We collected a W-9 and never paid the vendor. Keep it?
It supports no return, so no retention rule reaches it, and it is still a Social Security number sitting in your systems. Purging unused forms shrinks the thing an attacker would want. Check first whether the account is inside a B notice tracking window before you delete anything.
General information, not tax advice. This page explains a federal tax form in plain English. It is not legal, tax, or accounting advice, and W9Form.org is not affiliated with the IRS. Verify everything against the official Form W-9 page on IRS.gov and speak to a licensed professional about your own situation. How we source and review these pages.