The 24% Backup Withholding Trap: A Small Business Guide to W-9s, CP2100 Notices, and Form 945

A web designer invoices your business $5,000. You pay it in full, like always. Three months later, an envelope from the IRS lands on your desk—a CP2100 notice. The Tax ID number on the W-9 you collected from that designer doesn't match IRS records. Now the clock is ticking: you have 15 business days to act, and if your contractor doesn't respond within 30 days after that, you must start withholding 24% of every future payment to them. Forever, until they fix it.

This is backup withholding, and it's one of the most underestimated compliance traps facing small businesses. The Government Accountability Office has long flagged TIN-matching errors as a primary source of unrecovered tax revenue, and the IRS has steadily tightened enforcement. Yet most small business owners hear "backup withholding" and assume it applies to someone else.

It applies to almost anyone who pays an independent contractor, freelancer, attorney, landlord, or vendor reportable on a Form 1099. Here's what triggers it, what to do when the IRS comes knocking, and—most importantly—how to set up your contractor onboarding so you never have to deal with it.

What Backup Withholding Actually Is

Backup withholding is the IRS's enforcement mechanism for situations where a payer can't reliably tie a payment to a verified taxpayer. Instead of trusting that the contractor will report the income themselves, the IRS forces the payer to withhold 24% of the payment and remit it directly. The contractor can later claim the withheld amount as a credit on their tax return—if they file one.

For 2026, the rate remains a flat 24%. There are no brackets, no allowances, no W-4 calculations. If a payment is subject to backup withholding, you withhold 24% off the top.

The rate matters because it's larger than the federal income tax most contractors actually owe on small jobs. A solo freelancer earning $40,000 a year might owe an effective federal rate closer to 12% after deductions. Backing up withholding 24% on every gig means the IRS is sitting on excess money until the contractor reconciles it on their tax return. That delay creates real cash flow pressure—and it's why contractors get angry when you start withholding from them.

Worse, the obligation doesn't fall on the contractor. It falls on you, the payer.

The Two Trigger Programs: B and C

The IRS runs two parallel backup withholding programs.

The "B" Program (BWH-B) is triggered by a missing or incorrect Taxpayer Identification Number. This is the one most small businesses encounter. If the contractor never gave you a W-9, gave you one with a wrong TIN, or refused to sign it, you're in B-program territory.

The "C" Program (BWH-C) is triggered when the IRS notifies you that a payee has chronically underreported interest or dividend income. This program mostly affects banks, brokerages, and investment firms, not small businesses paying contractors. If you're a typical small employer, you can largely ignore the C-program.

The rest of this guide focuses on the B-program, because that's where 99% of small business backup withholding exposure lives.

Which Payments Are Covered

Backup withholding can apply to most payments reportable on a Form 1099 or W-2G:

• Independent contractor compensation (Form 1099-NEC)
• Interest payments (Form 1099-INT)
• Dividends (Form 1099-DIV)
• Royalties, rents, prizes, and awards (Form 1099-MISC)
• Payment card and third-party network transactions (Form 1099-K)
• Gambling winnings (Form W-2G)
• Broker and barter exchange transactions

Several payment types are excluded: real estate transactions (Form 1099-S), foreclosures, cancellation of debt, retirement distributions, unemployment compensation, and state tax refunds. If you're issuing one of those, the backup withholding rules don't reach you.

For most service businesses, the practical concern is 1099-NEC payments to independent contractors, plus 1099-MISC for things like office rent or attorney fees.

The Two Things That Trigger Withholding on a Contractor

You must start backup withholding at 24% in two specific situations:

1. The contractor never gave you a valid TIN. If you're about to make a reportable payment and you don't have a completed Form W-9 in your files, the IRS expects you to withhold 24% from that payment. The W-9 isn't just paperwork—it's the contractor's certification that the TIN they're giving you is accurate and that they're not subject to existing backup withholding.

2. The IRS told you the TIN is wrong. This usually happens via a CP2100 or CP2100A notice (more on these below). Once the IRS has flagged the TIN, you can't keep paying the contractor as if nothing happened. You either get the TIN fixed or you start withholding.

Critical detail: a contractor refusing to give you a W-9 is functionally the same as never receiving one. You don't get to skip the W-9 just because the working relationship started informally. If you're paying $600 or more in a year and need to issue a 1099, you need a valid W-9 in hand.

The CP2100 Cascade: What Happens After the IRS Notices

The IRS matches every 1099 you file against its master TIN database. When something doesn't line up—a name spelled differently, a transposed digit, an EIN listed as an SSN—you receive a CP2100 or CP2100A notice. CP2100 is the bulk version (250+ mismatches); CP2100A is for smaller payers.

Once that notice arrives, a strict timeline starts running—and the start date is the date printed on the notice, not the date you receive it in the mail.

Within 15 business days: Send a "First B-Notice" to the affected payee, along with a blank Form W-9. The B-notice is a specific letter (the IRS provides the template) that tells the contractor their TIN doesn't match and they need to correct it.

Within 30 business days after that: If the contractor doesn't return a corrected W-9, you must begin backup withholding 24% on all future reportable payments to them. You keep withholding until they fix the issue.

If a second CP2100 hits the same payee within three years: You send a "Second B-Notice." This one is harder to cure. The contractor cannot fix it with another W-9. They must obtain official validation directly from the Social Security Administration (Form SSA-7028) or, if it's an entity, an IRS Letter 147C. Until they produce that documentation, you backup withhold.

The key thing to understand: each CP2100 starts an independent clock for each affected payee. If the notice lists 30 contractors, you're sending 30 letters and tracking 30 separate response deadlines. This is where things go sideways at small businesses without a process.

Form 945: Where the Withheld Money Goes

If you withhold any amount under backup withholding rules during the year, you must file Form 945, Annual Return of Withheld Federal Income Tax, by January 31 of the following year. This is separate from the 941s you file for employee payroll taxes.

The withheld funds also have to be deposited—not held until year-end—using the Electronic Federal Tax Payment System (EFTPS). Deposit frequency depends on the amount: monthly depositors send funds by the 15th of the following month, while semi-weekly depositors face a much tighter schedule. For most small businesses just starting backup withholding, the monthly schedule applies, but verify your status before the first deposit.

You also still issue the 1099-NEC (or other applicable 1099) at year-end, but now Box 4 reports the amount of federal income tax you withheld. The contractor reconciles that amount against their actual tax liability when they file.

The Penalty Math

Even if you collect every cent of backup withholding correctly, you can still face penalties for the underlying information return errors that triggered the CP2100 in the first place.

Under IRC Section 6721, penalties for filing incorrect information returns scale by how late you correct them and the size of your business. Adjusted for inflation, the schedule for returns due in 2026 looks roughly like:

• $60 per return if corrected within 30 days
• $130 per return if corrected by August 1
• $340 per return if not corrected (or corrected later) for general filers
• $680 per return for intentional disregard, with no annual cap

Section 6722 adds a parallel penalty for failure to furnish a correct payee statement to the contractor themselves—often the same dollar amounts. So a single uncorrected W-9 mismatch can stack two penalties: one for the bad 1099 sent to the IRS, and one for the bad copy sent to the contractor.

Then there's the bigger exposure: if the IRS determines you should have backup withheld and didn't, the payer is liable for the tax that should have been withheld. You can lose 24% of the entire payment out of your own pocket, even if the contractor paid all the tax themselves. Penalty abatement is available in some circumstances, but the burden is on you to prove reasonable cause.

For a business that runs $200,000 of contractor payments through a year and gets caught not backup withholding on a few high-dollar payees, the exposure can easily exceed $25,000.

How to Avoid the Whole Mess

The cleanest defense is a contractor onboarding process that makes backup withholding nearly impossible to trigger. Five practices do most of the work:

1. No W-9, no payment. Treat the W-9 as a precondition for cutting the first check, not as paperwork to chase down at year-end. Build it into your contractor agreement workflow. If a vendor balks, that's a signal to look harder at whether they're actually independent and tax-compliant.

2. Use the IRS TIN Matching service. Through IRS e-services, payers can submit name/TIN combinations and get back a match/no-match response—either interactively for a few entries or in bulk for thousands. This catches most data-entry errors and stale W-9s before you file 1099s. It's free and underused.

3. Check the entity classification carefully. Single-member LLCs are a common source of TIN mismatches because owners often write the LLC name on Line 1 instead of their own legal name. The IRS treats a disregarded single-member LLC as the owner for TIN purposes, so Line 1 needs the owner's legal name and the TIN should match the owner (typically their SSN, sometimes an EIN). Get this wrong and you'll see CP2100 notices even when both names are technically real.

4. Refresh W-9s when something changes. Contractors get married, change names, switch from sole prop to S-corp, or update their EIN. A W-9 from 2019 may no longer match 2026 IRS records. Re-collect annually for active vendors, or whenever you notice a change.

5. Keep contractor records audit-ready. Store completed W-9s, payment history, and any IRS correspondence in one searchable place, organized by contractor. When a CP2100 arrives, you don't want to spend three days digging through email. Time matters when the response window is 15 business days from a date printed on a piece of paper that may have taken a week to reach you.

What to Do If a CP2100 Lands Today

If you've already received a CP2100 or CP2100A:

1. Open it immediately. Note the date printed on the notice—that's day zero.
2. Identify each affected payee. The notice lists the names, TINs, and account numbers as you reported them.
3. Cross-check your records. Sometimes the issue is a typo in your filing. If your records show the correct name and TIN, file a corrected 1099 and document why no payee solicitation was necessary.
4. Send First B-Notices to the rest within 15 business days. Use the official IRS template, include a blank W-9, and send by first-class mail. Track delivery.
5. Set a 30-business-day calendar reminder. If you don't have a corrected W-9 by then, start withholding 24% on the next payment.
6. Open a Form 945 deposit cadence if you're withholding for the first time. Don't wait until January.

If you're getting a Second B-Notice for the same payee, do not accept another W-9 from them. They must provide SSA or IRS validation documents. Anything else doesn't reset the clock.

Keep Your Contractor Records Audit-Ready From Day One

Backup withholding penalties almost always come down to one thing: incomplete records when the IRS sends a notice. The businesses that get hurt aren't usually doing anything malicious—they just can't reconstruct what happened, who they paid, what TIN they collected, and when. Plain-text accounting solves that. Beancount.io gives you a transparent, version-controlled ledger where every contractor payment, every 1099 amount, and every withholding adjustment is plain text you can grep, audit, and explain. No black boxes, no vendor lock-in—just a ledger you can defend if a CP2100 ever shows up. Get started for free and see why developers and finance teams are switching to plain-text accounting.