How to Get an IRIS TCC: The Full Application Guide

What an IRIS TCC Actually Is

A Transmitter Control Code is a five-character identifier the IRS assigns to an organization that has been approved to send information returns electronically. Think of it as your filing license: until IRIS can tie an incoming submission to an approved TCC, the system has no way to know who you are or that you have cleared the agency's suitability checks. The code that begins with the letter D on your approval letter is the thing that makes everything else possible.

There is one detail that catches almost everyone, including filers who have transmitted for years: your FIRE TCC does not transfer to IRIS. Publication 5717 is explicit that a TCC obtained for FIRE, AIR, or any other system cannot be used in the IRIS Taxpayer Portal, and there is no conversion path between them. A brand-new IRIS application is the only way in, which means a seasoned FIRE transmitter and a first-time filer start the IRIS clock at exactly the same place — zero — and on exactly the same timeline.

It helps to read this guide alongside the broader IRIS registration and TCC overview, which sets the application in the context of the whole migration. What follows here is the deep version: every requirement, in the order you will actually hit it, with the regulatory source for each claim so you can verify it against the IRS yourself.

TP or A2A: Which TCC Do You Need?

IRIS gives you two ways to file, and each runs on its own kind of TCC. The Taxpayer Portal (often shortened to TP) is the web channel, where you key returns in by hand or upload a CSV. Application-to-Application (A2A) is the developer channel, where your own software sends XML directly to the IRS over an authenticated API. Deciding between them is the first real fork in the road, because the two TCCs are not interchangeable and choosing the wrong one is a common reason an otherwise-valid application has to be redone.

If you are weighing this against your current setup, our breakdown of how the IRIS TCC differs from your old FIRE TCC walks through what changes and what you can do with the code you already have. For everyone else, pick the channel that matches how you will really file, because that choice drives the roles you select and the steps that come after approval.

Before You Start: The Prerequisites

The application form itself is short. The work is in everything you have to line up before you open it, and missing any one of these is what turns a one-hour task into a multi-week round trip. Have the following ready and the application moves quickly.

• An IRS e-Services account for every person named on the application. External users must register with the IRS credential service provider before they can touch the IRIS Application for TCC, so each Responsible Official, Contact, and Authorized Delegate needs their own login.
• ID.me identity verification completed for each of those people. The IRS routes e-Services sign-in through ID.me, which means a government photo ID plus a selfie match for every individual on the application — this is the gate that stops most first attempts.
• Your organization's legal name and EIN, exactly as the IRS has them. Publication 5717 requires the firm's legal business name, business structure, and EIN, and it will not accept an SSN or ITIN in the EIN field. A single mismatched character here is the number-one cause of rejection.
• A real Responsible Official with authority to act for the organization, along with their date of birth, SSN or ITIN, and contact details — because the RO is the person who electronically signs and submits the application under penalty of perjury.
• The five-digit PIN each Responsible Official created on first sign-in, since that PIN is the electronic signature used to accept the terms of agreement.

Responsible Officials, Delegates, and the Three Roles

Before you start clicking through the form, it is worth understanding who the application expects you to name and what each role can do, because these terms recur throughout e-Services and they have precise meanings. Getting a person assigned to the wrong role is a quiet source of delay that surfaces only when someone tries to act and the system refuses them.

The people on the application

A Responsible Official (RO) is an individual with authority over the organization who initiates, signs, and submits the IRIS Application for TCC. At least one RO is required, and each one signs the terms of agreement with the five-digit PIN created at first sign-in. An Authorized Delegate (AD) is an optional helper the RO can add to maintain the application; depending on the change, ADs may also need to re-sign the submission page when the application is revised. A Contact is simply the person the IRS reaches out to with questions. Naming two Responsible Officials rather than one is a practical safeguard: if the only RO leaves the organization, an application with a single official can be left stranded.

The roles you request

Separate from who is on the application is what the organization is asking to do. On the Portal application, Publication 5717 has the RO select one role — Issuer if you are filing only for your own business (your EIN must match the EIN on the application), or Transmitter if you are sending returns on behalf of others. The A2A application in Publication 5718 is broader and lets a single firm request up to three roles at once: Software Developer for an organization writing origination or transmission software to IRS specifications, Transmitter for a third party sending data directly to the IRS, and Issuer for a business filing its own returns. Choose the roles that describe what you will genuinely do, because they shape both your TCC and the testing the IRS will expect of you.

How to Apply, Step by Step

Once your prerequisites are in place, the IRIS Application for TCC runs in a predictable order. You do not have to finish in a single sitting — the application saves and issues a tracking number — but the sequence below is the path from a blank form to a code that begins with D.

The Suitability Review — and Why It Governs Your Deadline

After you submit, the IRS runs a suitability check on the organization and the people named on it before any code is issued. This is not instant. Publication 5717 instructs filers whose application sits in Submitted Pending Review status for more than 45 days to contact the Help Desk — which tells you, in the IRS's own words, that a month and a half of waiting is within the normal range, not a sign that something has gone wrong. The review cannot be expedited, and refiling does not speed it up.

Stack the realistic pieces together — ID.me for every person, the application itself, the suitability window, and any IRS follow-up — and the honest end-to-end runway is measured in months, not weeks. That single fact should reshape how you plan your filing season.

A2A Only: The API Client ID, JWKS, and Consent

If you chose the Taxpayer Portal, your TCC is the finish line — you can skip ahead to the rejection reasons. A2A filers, though, have a whole second act that many people do not realize exists until their TCC arrives and they discover they still cannot transmit. Publication 5718 lays out four more gates: a separate API Client ID application, a cryptographic key upload, a consent grant, and assurance testing. None of them can begin until your A2A TCC is approved.

1. Apply for an API Client ID

The API Client ID is what lets your software actually talk to IRS systems, and it lives in a different application from your TCC. Publication 5718 directs you to irs.gov/iris, where you choose Get an API Client ID, sign in, select Individual on the organization page, and start a new API Client ID Application with the IRIS box checked under Select APIs. One caution worth repeating from the Pub: keep selecting Individual each time you return to the application until it reaches completed status, because picking the wrong organization context strands the work you have already done.

2. Upload a JWKS built on a valid X.509 certificate

Before the Client ID is issued, you must upload a JSON Web Key Set (JWKS) — the file that carries the public key the IRS will use to verify everything your software signs. Publication 5718 is specific about what it must contain: a public key using the RSA algorithm, and an X.509 certificate expressed through both the x5t (SHA-1 thumbprint) and x5c (certificate chain) parameters. Self-signed certificates are not allowed, but you may reuse the same public certificate you already use for other IRS programs such as MeF or AIR. The certificate is validated during the application, and only then is your Client ID released.

Under the hood, this key is what makes the OAuth flow work. As Publication 5718 describes, your software authenticates with your Client ID and a pair of signed JWTs — one proving the client application, one proving the user — which the IRS verifies against your uploaded key before returning a short-lived access token your software then uses to call the intake API.

3. Grant consent in the IRS Consent App

A Client ID that exists is not yet a Client ID that is allowed to act. Publication 5718 requires the Transmitter to log in to the IRS Consent App and explicitly authorize the Client ID to operate on the organization's behalf. The Pub flags the one step everyone gets wrong on the first pass: on the Select Your Organization page, choose the organization tied to your IRIS TCC application — not the API application itself. From the API Authorization Management page you select Setup, enter your IRIS Client ID, and then grant access twice: once to TEST so you can run ATS, and once to PROD so you can transmit live returns.

When consent completes, the app hands you your full IRIS UserID — a value in a form like dasmith-345870 — which your software must use when generating access tokens. Write it down; you will need it the moment you start testing.

4. Pass ATS, then go live

The last gate is the Assurance Testing System. Using your TEST consent, you submit defined test scenarios so the IRS can confirm your XML is well-formed and your transmission behaves correctly before any real taxpayer data flows. Our walkthrough of IRIS ATS testing covers the scenarios and the common failures in depth; the point here is simply that ATS is mandatory for A2A and that it sits between your approved TCC and your first production filing.

Every production transmission is wrapped in a manifest that carries your TCC and identifies the payload, and the IRS validates that envelope before it ever looks at your returns. A representative shape looks like this:

That snippet is illustrative — the exact element names and the full schema are defined in Publication 5718, and you should treat the Pub as the source of truth rather than any example. The practical takeaway is that A2A is not a single approval but a chain of them, and each link has to be in place before the next one will function.

A Sensible Companion: Enrolling in TIN Matching

TIN Matching is a separate e-Services program, not part of the TCC application, but it is worth setting up in the same pass because it prevents a category of penalty before you ever file. It lets an authorized payer check a TIN, name, and TIN-type combination against IRS records, so you catch a mismatched recipient name or number before it becomes a B-notice or a rejected return.

Publication 2108-A describes the enrollment path, and the prerequisites overlap neatly with what you have already done for the TCC. Every user in the firm needs an ID.me account to reach e-Services, after which the firm's Principal — defined as a partner or someone owning at least five percent of the firm, or a corporate officer — completes the Application to TIN Match and assigns roles such as Responsible Official, authorized agent, and delegated user to everyone else who needs access. Because the identity proofing is shared, enrolling here while your team is already verified is far easier than coming back to it later under deadline.

Common Rejection Reasons (and How to Avoid Them)

Most TCC problems trace back to a short list of fixable causes, and because a fresh submission restarts the review, each one effectively costs you weeks. These are the ones worth getting right the first time.

Skip the TCC Entirely: The e1099f Advantage

Everything above is required only if you intend to become a registered transmitter yourself. There is a second, legitimate path: file through an IRS-authorized provider that already holds an IRIS TCC, which removes the application, the wait, and the A2A setup from your plate entirely.

If you would rather not become a registered transmitter, this is the fastest compliant path to IRIS — CF/SF included.

Frequently Asked Questions

Not tax advice. This guide is general information about IRS procedures and may change as the IRS updates IRIS. The official IRS publications linked above are authoritative; confirm current requirements there and consult a tax professional for your situation.