A&M Offshore Accounting (Private) Limited · Serving U.S. CPA firms and small businesses (571) 681-6266moinmalik@amoffshore.com
Home  ›  Guides › Choosing an overseas provider
Guide

How to Choose an Overseas Bookkeeping Provider

A due-diligence checklist for CPA firms, enrolled agents and tax practices: what to ask, what good answers look like, and the red flags.

In short

What should a CPA firm check before using an overseas bookkeeping provider?

Check six things: that the provider is a verifiable registered business; who actually does and reviews the work; how client data is accessed, exchanged and removed; what confidentiality agreement it will sign; how quality is proven on a pilot; and what happens if the relationship ends. Be wary of any provider that asks for online banking credentials, will not sign an NDA, or cannot say who touches your client files.

Last updated 3 October 2026 · General information, not tax, legal or accounting advice

1. Is the provider a real, verifiable business?

Ask for details you can check yourself, then check them.

  • Company name, registration number and country of registration, and whether the registry or regulator lists it
  • Verifiable professional credentials, such as badges that can be confirmed on the issuer's own page
  • A named contact, a U.S. telephone number or video call, and a business email on the provider's own domain
  • How long the founder and team have actually done this work, separate from how long the company has existed

2. Who does the work, and who reviews it?

“Our team” can mean very different things.

  • Are the people doing the work employees of the provider, freelancers, or a subcontractor?
  • Is any client work passed on to anyone outside the company?
  • Who reviews the work before it reaches you, and is that person named?
  • How many clients can the team take on well, and will the provider say no when it is full?

3. How is client data accessed, exchanged and removed?

This is where most of the real risk sits, and geography matters far less than controls.

  • Does the provider need online banking usernames or passwords? It should not. Statements and accounting-system access are enough.
  • Is access granted through user or accountant permissions that the client or firm controls and can revoke without asking the provider?
  • How are statements and documents exchanged? A secure method you approve is better than ordinary email attachments.
  • Where will client files be held, for how long, and what happens to them when the engagement ends?
  • What controls does the provider actually have in place, such as multi-factor authentication and device security? Ask for specifics in writing, and treat any claim of a certification as something to verify.

4. What confidentiality terms will it sign?

Prefer your own paper where you have it.

  • Will the provider sign your firm's NDA or confidentiality agreement, and a data-processing agreement if you use one?
  • Are its staff bound by confidentiality obligations, and can it show you?
  • What does it commit to if client information is affected by an incident, and how quickly will you be told?
  • In a white-label engagement, how will it treat your clients? The signed agreement should address non-solicitation.

5. What should you check with your own adviser?

U.S. tax professionals may have disclosure and consent obligations when client tax information is provided to an overseas service provider. Each firm is responsible for determining and satisfying its applicable legal, regulatory, professional, and client-consent requirements. This information is provided for general awareness and is not legal or tax advice.

A provider can cooperate with your approved procedures, but it cannot decide your obligations for you. Be cautious of any provider that tells you what your own legal or professional obligations are.

6. How will quality be proven?

Do not take claims of accuracy on trust.

  • Start with a pilot on one client or one cleanup project.
  • Look for books reconciled to the statement and reconciliation reports, not “close enough” figures.
  • Agree delivery dates in writing, and ask how you will be told if one is at risk.
  • Check how errors are handled and who bears the cost of rework.

7. What happens if something goes wrong, or you want to leave?

An exit plan is part of due diligence, not pessimism.

  • Do the books stay in the client's own accounting file, so a new provider can pick up where the old one stopped?
  • Is there any lock-in, notice period or cancellation fee?
  • What does handover look like: file, reports and working documentation in the format your next provider needs?
  • What is the provider's plan if its key person is unavailable? A small provider should be able to answer this plainly.

8. How is it priced?

You should know the cost before you quote your own client.

  • Is the price a flat figure per client company, agreed in writing, or open-ended hourly billing?
  • Is cleanup or catch-up priced separately and fixed in advance?
  • Is there a minimum volume or a long commitment, or can you start with one client?

Red flags

  • Asks for online banking usernames or passwords
  • Will not sign your NDA, or will only sign its own
  • Is vague about who actually touches your client files
  • Cannot give registration details you can verify, or credentials that can be confirmed
  • Promises perfect accuracy, unlimited capacity or fixed turnaround without seeing the work
  • Pushes you to commit a whole portfolio before a pilot
  • Cannot explain how access is removed
  • Tells you what your own legal obligations are

How A&M Offshore Accounting answers these questions

These are the answers A&M Offshore Accounting gives, so you can compare them with any provider.

  • Verifiable business: A&M Offshore Accounting (Private) Limited, CUIN 0353769, NTN J841289, PSEB registration Z‑25‑21943/26; five Intuit credentials, each verifiable on Credly.
  • People: an in-house team of employees, with the founder reviewing client work before delivery. Client work is not subcontracted to third parties.
  • Data: no online banking credentials; client- or firm-controlled QuickBooks access that can be revoked; ordinary email is not the preferred method for sensitive documents.
  • Confidentiality: will sign your firm's NDA or use its own; the signed agreement controls.
  • Quality and exit: every firm engagement starts with one pilot client; the books stay in the client's own file.
  • What it does not claim: A&M is not a CPA firm and does not hold SOC 2 or ISO 27001 certification. Specific controls can be documented during vendor due diligence.

Vendor due diligence →   Security & data protection →

Questions

Frequently asked questions

Is it safe to use an overseas bookkeeping provider?

Safety depends on the controls and agreements in place, not on the provider's country. Check who does the work, how access and documents are handled, what confidentiality terms are signed, and how quality is proven on a pilot.

Should a firm ask an overseas provider for SOC 2 or ISO 27001?

It is reasonable to ask. Many small providers do not hold either, so also ask what controls they do have, get the answers in writing, and decide whether that meets your firm's policy.

Does a firm need client permission to use an overseas provider?

U.S. tax professionals may have disclosure and consent obligations when client tax information is provided to an overseas service provider. Each firm is responsible for determining and satisfying its applicable legal, regulatory, professional, and client-consent requirements. This information is provided for general awareness and is not legal or tax advice.

Should a provider ever ask for online banking logins?

No. Bookkeeping can be done from statements and accounting-system access granted by the client or firm. A request for banking credentials is a red flag.

Run a pilot before you commit

Start with one client and judge the work and the controls yourself.