A lot of firms treat licensure as a box to check. But if you want to grow your firm, acquire another firm, take on clients in a new state, or expand the services you offer, licensure decides what's possible. It determines where you can serve clients, what services you can provide, and your standing with regulators. When something slips, the result can be fines, reissued reports, lost licenses, and a mention in public state board minutes. As I always tell people, you don't want to end up as an example in one of our presentations.
In our recent webinar, my colleague Julia Woislaw and I walked through four licensure compliance risks we expect to hit firms in 2027. If you missed it, you can watch the recording. Here's a recap of what we covered.
Start with a five-question self-check
Before getting into the risks, ask whether your firm could answer these questions today:
- In which states is each of your CPAs licensed right now?
- Which pathway did each CPA use to get licensed?
- Which states require a firm permit for the services you provide?
- Did any individual license or firm permit lapse recently?
- Will your growth plans still meet CPA-majority ownership rules in every state you serve?
If any of these gave you pause, you're not alone. The answers touch every risk below.
Risk 1: 2026 legislation reshaped licensure and mobility
Licensure has two sides, and both have to work. The firm needs the right permits and registrations to practice in a state. Each CPA needs the right license or practice privileges to serve the engagement, and sometimes "who can sign" and "who can serve" are two different questions. A spreadsheet of firm license numbers doesn't tell you what those licenses actually allow you to do.
That question got harder this year. Since early 2025, 45 jurisdictions have changed their CPA licensure laws. Julia and I have each worked in the profession for more than 10 years, and this is more change, moving faster, than either of us has seen. Most of the remaining states are working on changes for 2027 or 2028.
Mobility now follows the individual CPA
Most states now offer a new pathway alongside the traditional 150-hour rule: a bachelor's degree plus two years of experience instead of the extra 30 credit hours. That's good news for recruiting and retention. But any time licensure changes, practice privileges change too.
Under the old substantial equivalency model, mobility depended on which state licensed you. Every CPA from a given state got the same answer. Now, in most states, mobility depends on how each CPA got licensed. Three CPAs from the same state who took different paths may get three different answers, and CPAs licensed under older legacy pathways may not fit any of the new rules. This affects your whole team, not just new hires.
To evaluate mobility, you now need six facts on every CPA:
- Initial license: where and when they were first licensed
- Other licenses: every state where they hold a license, including inactive or retired status
- Residency: where they live, which matters especially for remote staff
- Principal place of business: as each state defines it
- Education path: credit hours and degree
- Experience: one or two years, and whether it was supervised or verified
The last two are new for most firms, and there's no national database for them. You'll have to ask each CPA directly.
What state boards are disciplining
State board minutes, which are public, show the same issues again and again: failure to renew on time, failure to be properly licensed where the firm does attest work, and failure to complete CPE. Firms also tell us about missing a state that required a firm license, or a CPA who moved and never got licensed in their new principal place of business. These are process failures, not judgment calls, and they can be caught with good internal controls.
The consequences are real. In one Minnesota case, an out-of-state firm performed attest work for more than a year without the required firm registration. The $15,000 fine was arguably the smaller problem: the firm had to reissue every report from that period. In Kansas, a firm received a $50,000 fine, a public censure, and a bill for the board's costs, including attorney fees.
What you can do today
Inventory every CPA, including licenses held, pathway used, residence, and principal place of business. Map your firm permits by state and by type of service, attest and non-attest, along with where the clients they cover are located. Start a legislative and regulatory watch that tracks effective dates and which of your people each change affects. And assign an owner for mobility checks before anyone is staffed on an out-of-state engagement.
One attendee asked whether mobility matters only for the signing partner. It matters for everyone. The signing partner needs to be licensed or have mobility in that state and meet any attest competency requirements. Other CPAs on the engagement need practice privileges too. Hawaii is the strictest example: it has never offered individual CPA mobility, so a CPA practicing there needs a Hawaii license. And if guidance isn't in law or rule, don't rely on it. Get it in writing.
Risk 2: Too many teams, not enough handoffs
The person responsible for licensure compliance often isn't the person making the decision that creates the risk. A partner accepts a client in a new state. HR approves a remote move. Scheduling assigns someone to an engagement without knowing where they live and work. Operations misses a renewal notice. Compliance and quality find the gap during peer review or a PCAOB inspection, when it's too late. Each decision makes sense within its own team, but someone has to connect the dots.
Take the remote move, which we see constantly. HR approves a move from Texas to Georgia. Payroll, benefits, and the HRIS all get updated. But did anyone reassess that CPA's ability to practice from Georgia? Many states require residents to hold a license there, and mobility doesn't apply to residents.
Most firms manage this with some mix of four approaches: no central system at all, a spreadsheet, one expert, or outside counsel. Each has a gap. Separate records mean no complete picture. A spreadsheet is manual, error-prone, and only as current as its last update. The one expert is invaluable, but they're also a single point of failure if they're out or decide to retire. Outside counsel matters for complex transactions, but it's reactive and expensive. Tracking licenses is not the same as determining eligibility.
Build handoffs around four trigger events
Every firm will assign these differently, but here's a starting point:
|
Trigger event |
Handoff |
What to check |
|---|---|---|
|
New hire or relocation |
HR to Compliance and Scheduling |
Licenses held, residence, principal place of business, mobility eligibility |
|
Client or engagement in a new state |
Partner to Compliance and Scheduling |
Firm permit required, individual eligibility, who can sign |
|
Renewal or lapse window |
Compliance to Partners and Ops |
Firm and individual renewals, CPE, fees paid |
|
Ownership or structure change |
Partners to Compliance and Counsel |
CPA-majority test in every state, required board notices |
A good handoff has a sender, a recipient, a deadline, and a documented answer. Forwarding an email isn't a process. And for clients you've served across state lines for years, review the current rules before you sign the next engagement letter. With this much change, what worked last year may not work now.
Set a review cadence
Event-driven checks catch most issues, and recurring reviews catch what slips through. Run trigger checks when the event is planned, before the affected work begins. Monthly, look at licenses and permits expiring in the next 90 days, new hires, relocations, and any lapses. Quarterly, compare out-of-state engagements against your permits and mobility rules, and review upcoming legislative changes. Annually, audit all firm and individual licensure, review ownership against each state's rule, and refresh policies and owners. Whatever cadence fits your firm's size and risk, every review needs a clear action, a clear owner, and follow-through.
Risk 3: Hidden licensure risks in M&A
Deal activity in the profession is bigger than ever. There were 194 CPA firm deals in 2025, up 26% from the year before. Roughly half of the top 30 U.S. firms now have private equity owners, and Capstone Partners estimates about $40 billion in PE capital has gone into CPA firms. (Sources: CLEAR, Sept. 10, 2025; NASBA Private Equity Task Force briefing to the Washington State Board of Accountancy, Jan. 30, 2026; CPA Practice Advisor, citing Capstone Partners data.)
What often gets missed in the excitement is simple: when you buy a firm, you inherit its licensure history. Here's how that can play out. Your firm buys a smaller practice and folds in its clients and staff. Those staff keep signing attest reports for clients in a neighboring state. Then a board finds the firm held no permit in that state for the past year. The fines and reissued reports now land on the buyer. A firm-permit matrix by state and service, reviewed before signing, would have caught it.
Questions to ask before you sign
- Firm licenses and permits: Which states and services are covered? Are any permits pending or lapsed? What's the firm's peer review status?
- People: How was each CPA licensed? Who relies on mobility today, especially report signers? Where do staff actually live?
- Discipline and history: Have there been board actions or complaints? Any reports issued without proper licensure? Any changes, such as ownership, name, or location, that were never reported to a board?
- Ownership and structure: Does the firm meet CPA-majority rules in every state? How will the deal change that? Are there side agreements on control?
Sequence diligence in three phases
Before you sign, send a licensure request list, check state board records, and price in any remediation. Between signing and closing, fix lapses and missing permits, confirm the required filings, and plan ownership changes. In the first 90 days, move to one system of record, recheck eligibility, and file changes on time. Many states require notice within about 30 days of an ownership or name change, and some require it within as few as 10.
Risk 4: Ownership structures face greater scrutiny
Ownership feels straightforward: CPAs need to own more than 50% of the firm. But you have to understand what each state is actually measuring. Some look at financial interest, some at voting rights, and some, like Washington, at both. Counting CPAs on staff doesn't answer the question.
Many states add conditions by firm structure. Florida, for example, has different requirements for partnerships and corporations, including rules about which partners or shareholders must hold an active Florida license. California excludes limited partnerships from its permitted structures altogether.
Non-CPA owners face their own conditions. Mississippi, New York, North Carolina, and others require active participation, so non-CPA owners can't be passive investors. West Virginia defines that as at least 20 hours a week. Oklahoma has CPE requirements for non-CPA owners, and several states add ethics requirements.
Why boards are asking more questions
The rise in private equity funding has brought more alternative practice structures. Typically, a CPA-owned attest firm signs audit and attest reports, while a separate, investor-backed entity provides tax and advisory services. The two share a brand, people, systems, and service agreements. That shared middle is where boards are focusing, and you should be ready to answer three questions:
- Who controls attest decisions such as staffing, promotions, and the client roster? Walk through who makes the final call on accepting clients, assigning staff, evaluating performance, and approving additional audit work.
- Does a nominal CPA majority still mean real control? Look at voting provisions, appointment rights, veto rights, and side agreements, not just percentages.
- How do shared services and branding affect independence? Map and document the relationships so your independence team can evaluate every relevant party.
A useful internal exercise: if a commercial priority conflicts with an audit quality decision, who resolves it, and where is that authority documented?
What regulators are doing
Several states are already acting. Oregon has discussed this at multiple board meetings in 2026 and is considering requiring the non-attest entity to register with the board. California has called publicly for regulatory visibility into ownership arrangements, CPA authority over attest services, and independence in both fact and appearance. Virginia's 2026 to 2027 strategic plan names alternative practice structures and sets a goal of drafting legislative changes by December 1, so 2027 legislation is possible. Maryland is evaluating whether its existing frameworks protect the public interest.
At the national level, the AICPA Professional Ethics Executive Committee's first exposure draft on independence in alternative practice structures drew significant feedback, including concerns that it would be hard to implement. A second exposure draft is expected this month. It will carry a 120-day comment period, and if adopted, the rules would take effect one year later. That means changes could arrive as early as 2028. Even if you don't plan to submit a comment letter, read the draft.
Review your ownership before a regulator does
Map every owner, direct and indirect. Test and document the CPA majority in every state where you're licensed. Check non-CPA owner conditions such as active participation and CPE. Have counsel and compliance read your agreements for control rights. Confirm that board filings are current, including after partner admissions and retirements. And model the next deal, admission, or retirement before it happens. We've seen firms take on outside funding, drop below CPA majority without realizing it, and learn after closing that their firm license was no longer valid. That's not how you want to find out.
Your priorities through early 2027
That's a lot to keep track of, so here's where I'd start. In the next 10 days, run the five-question check, name a licensure owner if you don't have one, and flag the states that affect your practice. Before December 31, inventory your firm and individual licenses and permits, document your handoffs, and check ownership by state. In the first quarter of 2027, run diligence checks on any deals in progress, hold your first cross-team checkpoint, and keep tracking AICPA and state board updates.
For staying current across 55 jurisdictions, your state CPA societies are an excellent resource, especially for licensure and mobility changes. The AICPA and NASBA also publish broader updates. Julia and I share a lot of this on LinkedIn too, so feel free to connect with us there.
Tracking licenses isn't the same as determining eligibility
Knowing that someone holds an active license answers one question. Knowing where your firm and your people can actually perform each service is a different one. CPA QualityPro by LCvista brings it together in one place. It tracks law and rule changes and runs firm and individual mobility checks. It gives every team the same view with deadline alerts. It manages multiple firms in one account for M&A, and it tracks ownership percentages with a change log.
If you missed the session, watch the recording or download the slides to use with your own team.
