The ITIN Expiry Problem Nobody Talks About During Onboarding

A compliance team at a staffing platform ran into something odd last quarter. A contractor based in Mexico, someone they had onboarded and paid without issues for two years, suddenly triggered a mismatch during re-verification. Same name. Same ITIN. Same W-8BEN on file. Nothing had changed on the contractor's side.

The team assumed it was a system glitch. They re-ran the TIN match. It passed. They moved on.

Three months later, they received a CP2100 notice from the IRS flagging that contractor's information return. The ITIN had expired. Not because it was revoked or fraudulent. Because the contractor had not filed a U.S. federal tax return in three consecutive years.

This is a failure mode that most onboarding flows do not account for. And if you are onboarding non-resident contractors at any meaningful volume, it is almost certainly sitting in your pipeline right now.

The Rule That Changes Nothing and Breaks Everything

The IRS rule is straightforward. If an ITIN is not included on a U.S. federal tax return for three consecutive tax years, it expires on December 31 after the third year. No notification is guaranteed. No flag appears on the number itself.

The ITIN does not get deleted or reassigned. It still looks valid. It still follows the correct format (9XX-XX-XXXX with the right middle-digit range). It still matches the name in IRS records.

But for purposes of filing, claiming treaty benefits, and certain credit determinations, it is no longer active. The identifier is structurally intact and functionally dead.

This is not a new rule. It was formalized under the PATH Act, which also mandated expiration for all ITINs issued before 2013 based on their middle-digit ranges. But the three-year non-use provision is the one that keeps catching businesses off guard, because it is invisible until it causes a problem downstream.

TIN Matching Says "Pass." The ITIN Is Still Expired.

Here is where the operational gap lives.

The IRS TIN Matching program checks one thing: does this name-and-number combination exist in IRS records? If the answer is yes, it returns a match. If the name is wrong, the format is invalid, or the number was never issued, it returns a mismatch.

What it does not check: whether the ITIN is currently active or expired.

An expired ITIN will pass TIN matching every time, as long as the name and number are correct. The IRS has explicitly stated that expired ITINs may continue to be used on information returns like Forms 1099 and 1042-S. The system is designed for reporting accuracy, not for surfacing expiry status.

This means your onboarding flow can collect a W-8BEN, run TIN verification, get a clean result, and still be holding an expired identifier. The verification did its job. The problem is that "verified" and "valid" are not the same thing, and most systems treat them as if they are.

The gap does not show up at onboarding. It shows up months later: when a B Notice arrives, when the contractor tries to file a return and discovers their ITIN is expired, when a treaty-rate withholding decision gets challenged because the ITIN was not active during the relevant tax year.

This Is Not an Edge Case

The scale of the ITIN expiry problem is larger than most compliance teams realize.

The IRS has issued approximately 25.1 million ITINs since the program began in 1996. At the end of 2016, the IRS deactivated roughly 12.4 million of them under PATH Act provisions. Another 2.8 million expired at the end of 2017. The three-year non-use rule continues to expire ITINs every year for anyone who stops filing.

Well over half of all ITINs ever issued are now expired or inactive. And the renewal rate is low. When the IRS projected that 450,000 taxpayers would need to renew in 2017, they received only about 176,000 applications. Even after mailing letters to approximately 875,000 households with expiring ITINs, fewer than 100,000 additional renewals came in. That is less than a 10% response rate.

For any business that onboards non-resident contractors, freelancers, or foreign vendors at volume, expired ITINs are not a theoretical risk. They are a statistical certainty in the pipeline.

Where It Hits Hardest

The industries most exposed are the ones with high volumes of non-resident payees and heavy information-return obligations.

Gig platforms and contractor marketplaces top the list. They onboard large numbers of foreign freelancers, file thousands of 1099s and 1042-S forms annually, and make withholding decisions based on W-8BEN data. A small percentage of expired ITINs across that volume translates into significant penalty exposure. The IRS can assess up to $290 per incorrect information return, with caps reaching $3.5 million per year for large filers.

Professional services firms that engage non-resident consultants in IT, engineering, design, or legal work face similar exposure. These firms often apply treaty-rate withholding based on W-8BEN data, and an expired ITIN weakens the reliability of that treaty claim. If the IRS later determines the withholding agent should not have relied on a W-8BEN with an expired ITIN, the agent can be held liable for the under-withheld tax, plus interest and penalties.

Higher education and research institutions paying stipends, grants, and honoraria to foreign scholars are another high-risk category. They operate in a heavily scrutinized withholding environment, and incorrect TINs draw audit attention disproportionate to their dollar value.

Financial institutions and payment processors handling cross-border remittances or investment income round out the picture. Any entity applying reduced treaty withholding rates needs to consider whether the ITIN backing that claim is still active.

How This Plays Out in Practice

The returning freelancer. A design contractor from Brazil worked with a US agency in 2021 and 2022, then took a break. No US tax returns filed for 2022, 2023, or 2024. Their ITIN expired on December 31, 2024. In early 2025, the agency re-engages the same contractor. TIN matching returns a clean pass because the name and number still exist in IRS records. The agency files a 1042-S at year-end. Six months later, a CP2100 notice arrives. The ITIN was expired for the entire engagement period.

The treaty-rate trap. A Canadian software consultant provides a W-8BEN with an ITIN and claims a reduced withholding rate under the US-Canada tax treaty. The fintech paying them verifies the TIN, gets a match, and withholds at the treaty rate of 15% instead of the default 30%. But the consultant has not filed a US return since 2020. The ITIN expired in 2023. If the IRS audits the withholding agent and determines the W-8BEN was unreliable because the ITIN was inactive, the fintech is liable for the difference: 15% of every payment made, plus interest and penalties.

The W-8BEN renewal coincidence. A gig platform refreshes W-8BEN forms on a three-year cycle. A contractor's form comes up for renewal in 2025. The platform collects a new W-8BEN, runs TIN matching, and everything checks out. What nobody catches: the contractor has not filed a US return since the original W-8BEN was signed three years ago. The three-year W-8BEN cycle and the three-year ITIN non-use window expired in the same period. The refreshed form looks current. The ITIN behind it is not.

The bulk filing surprise. A staffing company files 4,000 Forms 1042-S in January. Roughly 8% of their non-resident contractors hold ITINs. Of those, an unknown number have expired ITINs that passed TIN matching throughout the year. The company discovers the problem in March when a batch of B Notices arrives. Each incorrect return carries a potential penalty of up to $290. At 30 to 40 affected records, that is $8,700 to $11,600 in penalties, plus the operational cost of re-soliciting correct TINs, filing corrected returns, and potentially retroactively applying backup withholding.

What Your Onboarding Flow Is Not Catching

The fix is not complicated. But it requires treating ITIN validation as a separate step from TIN matching, because TIN matching was never designed to answer the question you actually need answered.

Check middle-digit ranges. All ITINs with middle digits 70 through 88 have expired. ITINs with middle digits 90, 91, 92, 94, 95, 96, 97, 98, and 99 that were assigned before 2013 have also expired. This is a deterministic check. You can run it against the ITIN format before making a single API call.

Ask when the contractor last filed a U.S. return. If the answer is "more than three years ago" or "never," the ITIN is expired under the non-use rule. This is a self-reported data point, but it narrows the risk immediately and gives you a decision point before proceeding.

Build a policy decision for expired ITINs. When you identify an expired ITIN, you need a documented path forward. Three options exist.

First, require the contractor to renew the ITIN before first payment. Renewal takes 7 to 11 weeks via Form W-7, so plan for that delay. Second, proceed with payment but apply 30% default withholding instead of a treaty rate. Third, accept the expired ITIN for information reporting only, with documentation that no treaty benefit is being claimed.

Each option has trade-offs in speed, compliance risk, and contractor experience. The point is to have a defined policy, not to figure it out when the B Notice arrives.

Cross-reference ITIN status at W-8BEN renewal. W-8BEN forms are typically refreshed every three years. That is the same interval that triggers ITIN expiry for non-use. If a contractor's W-8BEN is up for renewal, their ITIN may have expired in the same window. Treat these as linked events, not independent ones.

Do not rely on the contractor to know. The IRS does not guarantee expiration notices. Many ITIN holders do not realize their number has expired until they try to file a return and discover credits are being denied or refunds are delayed. Your onboarding system needs to catch this, because the contractor often cannot.

This is something we see regularly at Signzy when processing onboardings across the US market. Expired ITINs pass every standard TIN check cleanly, and the compliance team only finds out when a B Notice or a withholding dispute surfaces months later. The pattern is consistent enough that we now treat ITIN expiry as its own verification step, separate from name-number matching.

The One Thing to Change

TIN matching tells you the number exists. It does not tell you the number still works.

If your onboarding flow treats a TIN match as proof that an ITIN is valid, you have a gap. The gap does not cause an error today. It causes a B Notice in six months, a withholding dispute in nine, and a penalty assessment at year-end.

Add an ITIN expiry check as a discrete step in your verification workflow. It is a small addition. The cost of not having it compounds quietly until it does not.