Launching a payroll business means forming a legal entity, registering with the IRS as a reporting agent, carrying professional liability coverage and any required bonds, running software that meets federal data security standards, and registering in every state where your clients have employees. The order matters, because you cannot legally file returns, move client funds, or store employee data until specific credentials and safeguards are in place. Here is how to start a payroll business step by step, along with the personal liability rules that make this industry different from most service companies.
Form the Entity and Separate the Money
Most payroll firms organize as an LLC or S-corporation. Filing articles of organization with your secretary of state runs $50 to $500 depending on the state. Once the formation documents come back approved, apply for a Federal Employer Identification Number through the IRS’s online application, which issues the EIN instantly. You’ll name a responsible party and provide their Social Security Number or ITIN.1Internal Revenue Service. Responsible Parties and Nominees
Open two bank accounts, not one. You need an operating account for your firm’s revenue and expenses, and a separate trust or escrow account to hold client payroll funds. When a client wires $80,000 for Friday’s payroll, that money isn’t yours. It sits in the segregated account until wages go out and taxes are deposited. Commingling client money with operating funds is one of the fastest ways to destroy a payroll business, and as you’ll see below, it also creates personal legal exposure that no entity structure can shield you from.
Banks are required to verify the identity of every individual owning 25 percent or more of a legal entity, so each qualifying owner will need government-issued ID and a taxpayer identification number when you open accounts.2FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Beneficial Ownership Requirements for Legal Entity Customers
Register With the IRS as a Reporting Agent
Filing employment tax returns and making tax deposits for clients requires reporting agent status. Each client signs Form 8655, which grants you authority to sign and file Forms 940, 941, 943, 944, and 945, and to make federal tax deposits through the Electronic Federal Tax Payment System.3Internal Revenue Service. Reporting Agents File (RAF) Line 9 captures your firm’s legal name; Line 15 specifies exactly which returns you’re authorized to handle.4Internal Revenue Service. Form 8655 – Reporting Agent Authorization
Completed forms go to the IRS Accounts Management Service Center in Ogden, Utah, or by fax to 855-214-7523 in batches of up to 25. The authority becomes effective when the IRS receives the signed form.
Get an EFIN Before You File Anything
Reporting agents file electronically, which means you need an Electronic Filing Identification Number obtained through the IRS e-Services portal. The application has three stages: creating an e-Services account, submitting firm information covering every principal and responsible official, and passing a suitability check that includes credit review, tax compliance verification, and a criminal background investigation.5Internal Revenue Service. Become an Authorized E-File Provider Principals who are not licensed CPAs, attorneys, or enrolled agents must be fingerprinted through an authorized vendor.
The first time you file a third-party authorization with the IRS, you’ll be assigned a Centralized Authorization File number. This nine-digit identifier tracks every client authorization tied to your firm. If you ever misplace it, the Practitioner Priority Service line (866-860-4259) can retrieve it.6Internal Revenue Service. What Is a CAF Number
Understand Your Personal Liability for Client Taxes
This is where payroll differs from every other service business. Federal law imposes the trust fund recovery penalty on any person responsible for collecting and paying over employment taxes who willfully fails to do so. The penalty equals 100 percent of the unpaid taxes, not a percentage of them.7Office of the Law Revision Counsel. 26 U.S. Code 6672 – Failure to Collect and Pay Over Tax, or Attempt to Evade or Defeat Tax Your LLC will not save you. The IRS looks through the entity to the individual with authority and responsibility to make the deposit.
As a payroll provider, you are almost certainly a responsible person under this statute. You control deposit timing, hold signature authority, and decide when funds move. If a client sends you payroll funds and you use them for anything other than their intended purpose, even briefly, you are exposed. The segregated trust account isn’t good practice, it’s a survival requirement.
Insurance and Bonding
Professional liability insurance, also called errors and omissions coverage, is not optional. A miscalculated withholding, a late deposit, or a mishandled W-2 can cost a client thousands in penalties, and they will come to you. Solo operators and small firms typically pay $500 to $1,500 per year for limits of $500,000 to $1 million, rising as client count and transaction volume grow.
Surety bonds add another layer. Several states require payroll providers to carry them, with amounts varying by state and by the volume of funds handled. Firms pursuing IRS Certified Professional Employer Organization status calculate the bond at 5 percent of federal tax liabilities, with a floor of $50,000 and a ceiling of $1 million. Even where a bond isn’t mandated, carrying one signals financial credibility to prospects about to hand you their payroll funds.
Fidelity bonds cover employee theft or embezzlement inside your own firm. Any staff member with access to client bank accounts is a risk worth insuring against once you start hiring.
Choose Payroll Software That Won’t Sink You
The software you run determines how many clients you can serve and how many mistakes you’ll make. Most startups license a white-label SaaS platform: a third-party system you brand as your own. These handle federal and state withholding calculations, quarterly Form 941 filings, year-end W-2s, and direct deposits through the ACH network.8Internal Revenue Service. E-File Employment Tax Forms Pricing is typically a monthly base fee plus a per-employee charge.
When comparing platforms, look for:
- A multi-state tax engine that automatically applies the correct state and local rates. If even one client has employees in multiple states, you need this, and getting it wrong is one of the most common payroll errors.
- Automated generation and electronic filing of Forms 940, 941, and 944 without manual keying.
- An employee self-service portal for pay stub and W-2 downloads, which cuts a surprising amount of support work.
- ACH integration, including same-day ACH if clients need it.
Building proprietary software gives you more control but demands substantial development investment. For most new payroll businesses, a white-label platform is the practical starting point.
Meet the FTC Safeguards Rule
Payroll providers handle Social Security numbers, bank accounts, salaries, and tax information for every employee on every client’s roster. The FTC Safeguards Rule at 16 CFR Part 314 applies to financial institutions, a category that includes tax preparation firms and entities engaged in financial activities like payroll processing.9eCFR. Part 314 Standards for Safeguarding Customer Information You must develop a written information security program with specific technical safeguards.
Core requirements include encrypting customer information both in transit and at rest, requiring multi-factor authentication for anyone accessing your systems, conducting annual penetration testing plus vulnerability assessments at least every six months, maintaining a written incident response plan, and disposing of customer data no later than two years after it was last used for a service. A breach affecting 500 or more consumers must be reported to the FTC within 30 days of discovery.9eCFR. Part 314 Standards for Safeguarding Customer Information
There is a partial exemption for smaller operations. Firms maintaining information on fewer than 5,000 consumers are not required to document risk assessments, follow the specific penetration testing schedule, maintain a written incident response plan, or deliver a board-level security report. The core security program still applies. You can’t skip encryption or access controls just because you’re small.
Larger and mid-sized prospects will ask whether you carry a SOC 2 Type II audit report. It isn’t legally required, but it’s increasingly a deal-breaker for those clients. Small firms typically spend $30,000 to $50,000 and take three to six months to achieve it, including the mandatory observation window.
Onboard Clients With the Right Paperwork
Onboarding documentation determines whether the first payroll runs cleanly or blows up. Each client provides their federal EIN and any state tax identification numbers for withholding and unemployment insurance. If a business is switching providers mid-year, get the year-to-date payroll register. Without it, you risk over-withholding Social Security taxes past the annual wage base or miscalculating other cumulative limits.
For each employee, you’ll need a completed Form W-4 to determine federal income tax withholding10Internal Revenue Service. About Form W-4, Employee’s Withholding Certificate and a Form I-9 confirming employment eligibility. The employer must complete Section 2 of the I-9 within three business days of the employee’s start date.11U.S. Citizenship and Immigration Services. 2.0 Who Must Complete Form I-9 Collect direct deposit bank details, home addresses for state tax purposes, and any garnishment or benefit deduction orders already in effect.
Your service agreement should spell out who bears the cost when a tax deposit is late. If the client failed to fund the account in time, the agreement should shift penalty liability to them. If you had the funds and missed the deadline, that’s on you. Ambiguity in this clause leads to expensive disputes. The agreement must also include an ACH authorization letting you withdraw funds from the client’s account for wages and tax payments, with clear withdrawal timing. Most providers pull funds two to three business days before payday.
For IRS communications on the client’s behalf, Form 8655 already covers filing and deposit authority. Form 8821 gives you access to notices and transcripts. Form 2848 goes further, allowing you to represent the client during audits or disputes, and both 2848 and 8821 can be submitted through the IRS’s secure online portal.12Internal Revenue Service. Submit Forms 2848 and 8821 Online13Internal Revenue Service. Preparation of Forms 2848 and 8821 and Their Uses
Register in Every State With Client Employees
Beyond federal registration, register with each state’s revenue department wherever your clients have employees. State registration typically involves specifying whether you’ll handle income tax withholding, unemployment insurance, or both, and providing an expected date for the first payroll. Some states activate accounts within days; others take weeks.
State-level rules are inconsistent. Some require surety bonds or specific licenses for payroll service providers beyond a general business license. A heavily regulated state may sit right next to one with almost no industry-specific rules. Check each state’s department of revenue and financial regulation authority before operating there.
One requirement that surprises new payroll businesses is money transmitter licensing. Because you move client funds through your accounts, some states classify payroll processors as money transmitters. Many states exempt payroll companies when the funds go solely to wages, payroll taxes, and employee benefits, but the exemptions are not universal, and operating without a required license carries severe consequences. Research each state’s money transmission laws before accepting clients there.
Deposit Schedules and Record Retention
Once you begin processing payroll, you’ll follow one of two federal deposit schedules. Monthly depositors send taxes accumulated during a calendar month by the 15th of the following month. Semiweekly depositors send taxes on Wednesday-through-Friday wages by the following Wednesday, and taxes on Saturday-through-Tuesday wages by the following Friday. The IRS assigns your schedule based on your lookback-period liability. Missed deadlines trigger graduated penalties that climb the longer a deposit sits unpaid, reaching 15 percent once the IRS has issued a delinquency notice.14Office of the Law Revision Counsel. 26 U.S. Code 6656 – Failure to Make Deposit of Taxes Each missed deposit is penalized independently, so a busy firm can accumulate exposure quickly.
The IRS requires employment tax records for at least four years after the tax becomes due or is paid, whichever is later.15Internal Revenue Service. How Long Should I Keep Records Amended returns and late payments reset the clock, so most firms retain records for at least seven years to cover edge cases involving unreported income or bad debt deductions.
Electronic storage systems must index, preserve, retrieve, and reproduce records with clearly legible characters, and include controls preventing unauthorized creation, alteration, or deletion. You must also maintain documentation describing how the system operates and how it’s indexed. During an examination, you’re responsible for providing whatever hardware, software, and personnel the IRS needs to access your stored records.16Internal Revenue Service. Revenue Procedure 97-22