Tax forms
$600 threshold, 1099-NEC CSV export, and where tax forms live.
If you pay affiliates in the U.S., the IRS requires you to file a 1099-NEC for anyone who earns more than $600 in a calendar year. Rekomi handles the data side: tracking the threshold and generating the export for your accountant.
How the underlying tax form is collected depends on the affiliate's payout rail. Affiliates paid on Stripe Express (including all U.S. affiliates, who provide a W-9) have their form collected and held by Stripe during onboarding. Affiliates paid on the PayPal rail (foreign affiliates, rolling out) upload their W-8 directly to Rekomi. Either way, the year-end export below pulls what it needs for filing.
Threshold tracking
/dashboard/payouts/tax shows every affiliate who has crossed (or is approaching) the $600 threshold for the current tax year. Filter by year. Each row:
- Affiliate name + email
- Total earnings YTD
- Tax form status (None, W9, W8BEN, W8BENE)
- Tax form upload date
- Country
The threshold is hardcoded at $600 (per IRS rule). Reminder emails to affiliates fire automatically when they cross $400, prompting them to upload a form before they hit the threshold.
W-9 vs W-8BEN vs W-8BEN-E
- W-9: U.S. persons and U.S. business entities. Provides the affiliate's TIN (SSN or EIN).
- W-8BEN: non-U.S. individuals. Certifies foreign status.
- W-8BEN-E: non-U.S. business entities. Same purpose as W-8BEN for legal entities.
For Stripe-rail affiliates, Stripe collects the form during Express onboarding. For PayPal-rail affiliates (rolling out), Rekomi prompts the affiliate to pick the right W-8 on /a/settings, where they upload a signed PDF plus a canvas e-signature.
Where tax forms are stored
Forms uploaded to Rekomi (the PayPal rail) live in private storage on DigitalOcean Spaces. (Stripe-rail forms are held by Stripe, not Rekomi.) The persisted URL is an opaque marker (spaces-private://{key}), never a directly-servable public URL. When you or an authorized admin requests a tax form via GET /api/me/tax-form (affiliate-side) or the appropriate brand-side endpoint, the server mints a short-lived pre-signed URL (5-minute TTL) and returns that. The SSN or ITIN on the form never travels through a public CDN path.
For the security audit reasoning, see the SECURITY_AUDIT.md entry on "Tax-form private storage".
CSV export for 1099 generation
From /dashboard/payouts/tax, click "Export CSV" with a year filter. The CSV contains one row per affiliate who crossed $600, with the fields a 1099-NEC needs:
- Recipient name
- Recipient TIN (from their uploaded W-9)
- Recipient address (from their Stripe Connect account, or their uploaded form for PayPal-rail affiliates)
- Total earnings in the tax year
- Your payer info
Rekomi does not file 1099-NECs with the IRS on your behalf today. You take the CSV to your accountant or to a service like Track1099 or Tax1099. They submit the actual filings.
Filing on your behalf is on the roadmap.
CSV formula injection guard
The CSV export prefixes any field that starts with =, +, -, or @ with a single quote, so spreadsheet apps do not interpret them as formulas. This is a standard defense against CSV injection attacks where a malicious affiliate could embed a formula in their "Recipient name" that runs when you open the file. Safe by default.
Retention
Tax forms are retained for seven years per IRS requirements (26 CFR 1.6001-1). A scheduled retention job deletes forms past the seven-year window automatically, removing the stored file first and then the record.
Affiliate-side tax form upload
The affiliate's view is at /a/settings. See Affiliates: Tax forms for what they see, how the canvas signature works, and what they can re-upload.