How Long to Keep W-9 Forms (and How to Dispose of Them)
IRS sources give W-9 retention periods of three and four years. See what each says, a simple retention schedule, and how to dispose of old W-9s securely.
Two IRS sources give different answers. The backup withholding regulation requires a payor to keep a W-9 for 3 years from the date the account is opened, while the IRS's independent-contractor page says to keep it for four years. Many firms simply keep W-9s at least four years after the last payment to the vendor; that is a common practice, not a rule. When the retention period ends, dispose of the form securely rather than letting it sit in an inbox or a filing cabinet.
General information, not tax or legal advice.
The short answer
- Regulation: 3 years from the date the account is opened.
- IRS contractor page: four years.
- Filed 1099 copies: at least 3 years from the due date, or 4 years if federal or backup withholding was imposed.
- No expiration date: a W-9 doesn't expire; a change in name, TIN or exemption triggers a new one.
- Our recommendation: keep each W-9 at least four years after the due date of the last 1099 you filed for that vendor (or after the last payment, if no 1099 was needed), then dispose of it securely.
Our accounting firm document collection guide covers the full workflow, from request to disposal.
Why this matters in a real workflow
Discard W-9s too early and you may lack the form you relied on if the IRS questions a vendor's TIN. Keep them forever and every old SSN or EIN stays in storage, while firms covered by the FTC Safeguards Rule have a disposal duty. The fix is a written schedule: a set period, a clear start date and a named owner.
What the IRS says
The two retention periods
The IRS's independent-contractor page says to keep the W-9 in your files for four years (IRS: Forms and associated taxes for independent contractors).
The backup withholding regulation requires a payor to keep a W-9 for 3 years from the date the account is opened (26 CFR 31.3406(h)-3).
The IRS instructions for requesters of Form W-9 don't give a retention period, so these two sources are the ones to reconcile. The regulation's clock starts when the account opens. For a long-running vendor, that period can end while you still rely on the form, which is why we measure from the last 1099 instead.
Copies of the 1099s you file
Keep copies of filed information returns, or be able to reconstruct the data, for at least 3 years from the due date. Keep them 4 years for Form 1099-C, or if any federal or backup withholding was imposed (Publication 1099 (2026)).
General record periods
The IRS's general rule is 3 years for most records and at least 4 years for employment tax records. Other parties, such as insurers or creditors, may require you to keep records longer (IRS: How long should I keep records?).
W-9s don't expire, but they do get replaced
Neither the W-9 nor the backup withholding certificate regulation sets an expiration date for a W-9. A payee must give you a new W-9 if the name or TIN on the account changes. They must also update you if they are no longer an exempt payee, for example a C corporation that elects S status (Form W-9, Rev. March 2024).
Disposal: what the rules actually cover
The FTC Safeguards Rule, for covered firms
For businesses covered by the FTC Safeguards Rule, customer information must be disposed of securely within two years of last use, unless it is required to be kept by law or regulation or is needed for a legitimate business purpose (16 CFR Part 314). In our reading, tax retention periods fall within that exception, so the two-year clock doesn't cut a W-9 retention period short. The FTC's business guide states the same two-year disposal duty (FTC Safeguards Rule: What Your Business Needs to Know).
Who is covered? The rule names an accountant or tax preparation service that is in the business of completing income tax returns as a financial institution. Firms that prepare tax returns are covered; bookkeeping-only firms should confirm with counsel whether the rule applies to them. Customer information means any record, in paper, electronic or other form, containing nonpublic personal information about a customer, so paper files count.
The FTC Disposal Rule is narrower than it sounds
The FTC Disposal Rule requires reasonable disposal measures, such as shredding paper or erasing media, for information derived from consumer reports. It isn't a general W-9 disposal rule (16 CFR Part 682).
IRS guidance on how to destroy records
IRS Publication 4557, written for tax professionals, advises physically destroying old drives and devices and shredding documents that contain taxpayer information (Publication 4557). The FTC says to keep only what your business needs (FTC: Protecting Personal Information).
A simple retention schedule
The "minimum per source" column restates the sources above. The last column is our recommendation, not an IRS rule; confirm it with your tax adviser and write it into your records policy.
| Record | Minimum per source | Our recommendation |
|---|---|---|
| Vendor W-9 | 3 years from account opening (regulation); four years (IRS contractor page) | At least 4 years after the due date of the last 1099 filed for the vendor, or after the last payment if no 1099 was needed |
| Superseded W-9 (vendor sent a new one) | No separate period in the sources we checked | Keep on the same schedule as the returns it supported |
| Copies of filed 1099s | At least 3 years from the due date; 4 years if federal or backup withholding was imposed, or for Form 1099-C | 4 years from the due date for all of them, to keep one rule |
| Stray copies (email attachments, downloads, scans on desktops) | None found | Delete once the W-9 is saved to your records system |
The periods in the first two columns come from the regulation, the IRS contractor page and Publication 1099.
Recommended workflow
Our recommended practice, not an IRS procedure:
- Write the policy (controller or firm owner). Adopt the schedule above or your adviser's version, and name a records owner.
- Save one retained copy (AP). Store each W-9 in your records system as soon as it arrives, then delete stray copies.
- Tag the start date (AP). Record the date of the last payment and the last 1099 for each vendor, so the retention clock is clear.
- Replace on change (AP). Request a new W-9 when a name, TIN or exemption changes, and mark the old one as superseded.
- Review once a year (records owner). After 1099 season, list W-9s and 1099 copies past their retention date.
- Dispose securely (records owner). Shred paper, delete electronic copies from every location, and log what was disposed of and when.
Exception path: if a vendor is under a B-notice, backup withholding, an audit or a dispute, put a hold on their records and ask your tax adviser before disposing of anything.
Example scenario
Example scenario: Cedar Point Accounting, a made-up four-person firm that prepares tax returns, handles AP for a client. In its annual review, the records owner finds a W-9 for a caterer last paid three years ago; under firm policy it stays until four years after the due date of the caterer's last 1099. A sign printer that changed its name sent a new W-9, so the old one is marked superseded and kept on schedule. Five W-9 PDFs in a shared inbox are deleted because the retained copies are already filed.
Common mistakes
- Quoting one period as the IRS rule. The regulation and the IRS contractor page give different periods; cite both.
- Writing "the IRS requires seven years." None of the sources above says that.
- Keeping W-9s forever "just in case." Covered firms have a disposal duty once records are no longer needed or required.
- Treating the inbox as the archive. Stray copies outlive the policy and get missed at disposal time.
- Assuming the FTC Disposal Rule covers W-9s. It applies to information derived from consumer reports.
Checklist
- Written retention policy with a named records owner
- One retained copy per W-9, stored in your records system
- Last payment and last 1099 dates recorded per vendor
- Superseded W-9s marked and kept on schedule
- Annual review after 1099 season
- Paper shredded and electronic copies deleted everywhere, with a disposal log
- Holds placed on vendors under a B-notice, audit or dispute
See also our year-end W-9 checklist and vendor onboarding checklist.
How W9Vault supports this workflow
W9Vault is a collection channel, not an archive. You send the vendor a secure upload link that expires after 7 days, and they upload the completed W-9 as a PDF, JPG or PNG up to 20 MB. Files are encrypted in the vendor's browser before upload, so the server never receives the plaintext file. Your dashboard shows whether each request is sent or completed.
Uploaded files are automatically deleted 30 days after upload for completed requests. Download the W-9 and save your retained copy in your own records system within that window; your retention schedule applies to that copy. W9Vault is designed to support a secure collection workflow; the customer remains responsible for their own tax, recordkeeping and security obligations.
Collect W-9s without leaving copies in your inbox
Send vendors a secure, expiring upload link, then file one retained copy in your own records.
Frequently Asked Questions
The backup withholding regulation says 3 years from the date the account is opened, and the IRS independent-contractor page says four years. Many firms keep W-9s at least four years after the last payment. That is a practice, not a rule; confirm your policy with your tax adviser.
Neither the form nor the backup withholding certificate regulation sets an expiration date. A vendor must give you a new W-9 if their name or TIN changes, and must update you if they are no longer an exempt payee.
Firms covered by the FTC Safeguards Rule, which include firms that prepare tax returns, must dispose of customer information securely within two years of last use unless the law requires keeping it or there is a legitimate business need. The separate FTC Disposal Rule covers only information derived from consumer reports.
Official resources
- IRS: Forms and associated taxes for independent contractors
- 26 CFR 31.3406(h)-3
- Publication 1099 (2026)
- IRS: How long should I keep records?
- Form W-9, Rev. March 2024 (PDF)
- 16 CFR Part 314 (FTC Safeguards Rule) and FTC Safeguards Rule: What Your Business Needs to Know
- 16 CFR Part 682 (FTC Disposal Rule)
- IRS Publication 4557, Safeguarding Taxpayer Data (PDF)
- FTC: Protecting Personal Information, A Guide for Business
