When Your Payroll Provider Fails to Deposit Your Taxes: Why the IRS Still Comes After You

Here is the sentence that surprises almost every small business owner who learns it the hard way: if your payroll company withdraws the tax money from your bank account and never sends it to the IRS, you still owe the taxes. All of them. Plus penalties and interest.

It does not matter that you paid on time. It does not matter that the provider's dashboard showed green checkmarks. It does not matter that the provider committed fraud. Under federal law, the employer is ultimately responsible for the deposit and payment of federal employment taxes — and for most payroll arrangements, outsourcing the work does not outsource the liability.

This guide explains exactly where that liability sits under each type of payroll arrangement, how the Trust Fund Recovery Penalty can reach your personal assets, the early warning signs that a provider is in trouble, and the fifteen-minute verification habit that protects you.

The Rule: Liability Follows the Employer, Not the Paycheck​

When you run payroll, three streams of federal money leave your business:

• Federal income tax withheld from employee paychecks
• The employees' share of Social Security and Medicare (FICA), also withheld
• Your employer share of FICA, plus federal unemployment tax (FUTA)

The first two streams are called trust fund taxes because you are holding your employees' money in trust for the government. The IRS treats those dollars as its own from the moment they are withheld. A payroll provider that collects them from your account and fails to deposit them has, in the government's view, spent money that was never anyone's to spend — and the IRS collects from the party the statute makes responsible, which is you.

If deposits stop, penalties and interest accrue on your account, not the provider's. The failure-to-deposit penalty scales with lateness: 2% of the underpayment for deposits 1–5 days late, 5% for 6–15 days, 10% beyond 15 days, and 15% if the tax remains unpaid more than 10 days after the IRS issues its first notice. On a business that runs $60,000 of monthly payroll taxes, a provider that quietly stops depositing for one quarter can leave you owing roughly $180,000 in tax plus an $18,000 penalty layer before you ever learn there is a problem.

Employers caught in a provider collapse often end up paying twice: once to the provider that took the money, and again to the IRS that never received it. Recovering the first payment means standing in line in a bankruptcy or receivership, usually behind secured creditors, often for pennies.

The Trust Fund Recovery Penalty: When Business Debt Becomes Personal Debt​

The exposure does not stop at the business. Under Section 6672 of the tax code, the IRS can assess the Trust Fund Recovery Penalty (TFRP) against any "responsible person" who "willfully" fails to collect or pay over trust fund taxes. The penalty equals 100% of the withheld income tax and the employees' share of FICA — and it attaches to individuals: owners, officers, and anyone with signature authority and control over which bills get paid.

A corporation or LLC does not shield you here. The TFRP is designed to pierce straight through the entity to the people who controlled the money.

Two things matter in a provider-failure scenario:

• Willfulness is the government's burden, and provider fraud cuts in your favor. Courts have recognized that an employer who properly funded a payroll provider, monitored the account, and was actively deceived has a strong defense against willfulness. In one case involving a manufacturer whose provider embezzled the employment taxes rather than depositing them, officers were initially assessed a six-figure TFRP and later won abatement because the fraud gave them reasonable cause.
• Willfulness includes what you do after you find out. The moment you learn deposits were missed, paying other creditors before the IRS — vendors, rent, even net payroll — can convert an innocent employer into a "willful" one. If you discover a shortfall, the trust fund taxes go to the front of the line, immediately.

Reasonable reliance on a competent provider can also support penalty abatement for the failure-to-deposit penalties themselves. But abatement is discretionary relief you request after the damage, with documentation. The goal of everything below is to never need it.

The Four Payroll Arrangements — and Who Actually Holds the Liability​

"Payroll company" is not one legal category. The IRS recognizes several distinct third-party arrangements, and the liability picture changes dramatically depending on which one you signed.

Payroll Service Provider (PSP): You Carry Everything​

The standard arrangement, and what most small businesses have. A PSP calculates paychecks, prepares Forms 941 and 940 under your EIN, files W-2s, and initiates tax deposits from your funds.

A PSP assumes no liability whatsoever for your employment tax obligations. If it fails to deposit, files late, or disappears, every consequence lands on you. You are buying clerical convenience, not protection.

Reporting Agent: Still You​

A reporting agent is a PSP with electronic filing authorization, designated on Form 8655. It files returns electronically under your EIN and must deposit your taxes through the Electronic Federal Tax Payment System (EFTPS).

Like a PSP, a reporting agent assumes no employment tax liability. The arrangement does come with two structural protections worth having: EFTPS deposits create an audit trail you can independently verify, and reporting agents are required to give you a written statement reminding you that you — not the agent — remain responsible for timely filing and payment. If your provider never mentioned that, ask why.

Section 3504 Agent: Shared Liability​

A Section 3504 agent is appointed with Form 2678 and IRS approval. The agent files aggregate returns under its own EIN (with Schedule R breaking out each client) and — this is the key difference — assumes liability for federal income tax withholding and FICA alongside you.

"Alongside" is doing real work in that sentence. Liability is joint, not transferred: the IRS can pursue the agent, you, or both. It is a meaningful improvement over a PSP because there is now a second solvent party on the hook, but it is not a shield. FUTA generally stays yours to file under your own EIN.

Certified Professional Employer Organization (CPEO): The Real Transfer​

A CPEO is the only arrangement in which liability genuinely moves. CPEOs are certified by the IRS under a program that requires bonding, independently audited financials, and quarterly assertions. The relationship is reported on Form 8973, and the CPEO files aggregate returns under its own EIN.

For remuneration the CPEO pays to your work-site employees, the CPEO is solely liable for the employment taxes. If a certified CPEO fails to deposit, that is the CPEO's problem with the IRS — not yours — for the wages it paid.

Two caveats keep this honest. First, "certified" is a specific legal status, not a marketing word: many companies call themselves PEOs and operate under co-employment contracts without IRS certification, in which case the sole-liability protection does not apply. Verify any candidate against the IRS's published list of certified CPEOs. Second, the protection covers work-site employees under the CPEO contract — wages you pay outside the arrangement remain yours.

CPEO relationships cost more and bundle HR services you may not want. But if your risk tolerance for a provider failure is zero, it is the only arrangement where the answer to "who does the IRS pursue?" is not "you."

Seven Warning Signs Your Provider Is in Trouble​

Provider failures rarely happen overnight. Money problems leak out in operational symptoms first:

1. IRS notices you did not expect. A CP161 balance-due notice, a failure-to-deposit penalty notice, or any letter referencing missing deposits is a five-alarm signal. Provider fraud survives on the employer never seeing these — which is why some fraudulent providers ask clients to route IRS mail to the provider's address. Never change your IRS address of record to your payroll company's office. The IRS specifically warns that doing so can cut you off from the very correspondence that would expose a problem.
2. Deposits you cannot find in EFTPS. If the provider's reports say "paid" but EFTPS shows nothing, believe EFTPS.
3. Payroll debits that do not match your tax liability. A provider skimming float may pull round numbers, delay withdrawals, or batch oddly.
4. Slipping timelines. Direct deposits landing a day late, W-2s issued at the deadline, quarterly filings "in process" — cash-strapped processors slow down before they stop.
5. Personnel churn and unreachable support. Your account manager leaves, calls go to voicemail, email responses turn vague.
6. Pressure to prepay or switch payment methods. Requests for larger impound balances, earlier funding, or wire transfers instead of ACH suggest a provider using new client money to cover old obligations.
7. News of an acquisition, "restructuring," or sudden rebranding. Not inherently bad, but processor collapses are frequently preceded by ownership changes. A 2019 collapse of a New York payroll processor — which reversed employee paychecks and stranded tax impounds for hundreds of small employers at once — came with almost no public warning; the employers who fared best were the ones already verifying deposits independently.

The Fifteen-Minute Habit That Protects You: Verify in EFTPS​

The single most effective protection costs nothing and is officially recommended by the IRS: enroll in EFTPS yourself, separately from your provider, and check that your deposits are actually arriving.

EFTPS is the Treasury's free deposit system. Even when a provider makes deposits on your behalf, those deposits post to your EIN, and your own EFTPS enrollment lets you see them. You get 16 months of payment history online, available 24/7, with a phone fallback (800-555-4477).

Make it a monthly close ritual:

1. Log in to EFTPS after each deposit due date.
2. Match every expected deposit against your payroll register — date, tax period, and amount.
3. Investigate any gap the same day. A missed deposit caught at day 4 costs a 2% penalty; caught at day 45, it costs 10% plus whatever else the provider has been hiding.
4. If deposits are missing, contact the IRS immediately, file Form 14157 (Complaint: Tax Return Preparer) if fraud is suspected, and pay the trust fund taxes before any other obligation.

While you are at it, confirm the basics of the relationship: deposits made by EFT rather than by the provider's own checks, IRS correspondence coming to your address, and — for reporting agents — the required written responsibility statement in your file.

Reconciling Payroll in Your Own Books​

Independent verification only works if your books give you a number to verify against. That means recording payroll the way the liability actually works, rather than as one opaque "payroll expense" debit:

• Record gross wages, withholdings, and employer taxes separately. Withheld income tax and employee FICA should sit in liability accounts from the moment payroll runs — they are trust fund money, not your money.
• Clear those liability accounts against actual deposits, not against the provider's report. The provider's withdrawal from your bank clears a payable to the provider; only a deposit visible in EFTPS clears the liability to the IRS. Keeping those as two distinct steps in your ledger is precisely what makes a provider failure visible in your monthly close instead of in an IRS notice eighteen months later.
• Reconcile quarterly filings against your ledger. The Form 941 your provider files should tie to your wage and liability accounts to the dollar. Ask for filed copies every quarter and check.

A ledger structured this way turns provider verification from a special investigation into an ordinary reconciling item — the same routine as matching a bank statement.

If the Worst Happens: A Response Checklist​

1. Quantify the hole. Pull EFTPS history and your payroll registers; list every missed deposit by period and amount.
2. Pay the trust fund taxes now, even if it is painful. Every dollar of withheld tax paid over reduces both the balance and your personal TFRP exposure — and paying other creditors first is what "willfulness" looks like.
3. Contact the IRS proactively rather than waiting for the next notice. Proactive contact, a funded-provider paper trail, and prompt payment are the raw material of a reasonable-cause abatement request for the penalties.
4. Preserve everything: contracts, funding confirmations, provider reports, dashboards, emails. Your defense against willfulness is documentation that you funded the taxes and were deceived.
5. File complaints — Form 14157 with the IRS, plus your state attorney general — and consult a tax attorney about claims against the provider and its bond, if any.
6. Move payroll immediately to a new arrangement, and this time weigh a certified CPEO or at least a reporting agent with EFTPS visibility.

Keep Every Deposit Where You Can See It​

The whole defense against payroll provider failure comes down to one principle: never let a third party be the only source of truth about your own tax money. Beancount.io gives you plain-text accounting where every payroll accrual, withholding liability, and tax deposit is an explicit, auditable entry you can reconcile against EFTPS in minutes — transparent, version-controlled, and impossible for a vendor dashboard to obscure. Get started for free and keep your books somewhere no provider can hide a missed deposit.