409A Safe Harbor: The Legal Shield Every Startup Needs

Safe harbor is the entire point of getting a 409A

Founders sometimes treat the 409A as a checkbox — something the lawyer said they need, so they get it done and move on. That misses the point. The 409A isn't the goal. Safe harbor is the goal. The 409A is the mechanism that gets you there.

Under Treasury Regulations §1.409A-1(b)(5)(iv)↗, if your valuation meets specific requirements, the IRS presumes it reflects fair market value. This is safe harbor. The burden of proof shifts from you to the IRS. They can't simply disagree with your number — they must affirmatively demonstrate that your valuation is "grossly unreasonable." Courts have interpreted that standard as requiring the IRS to show a fundamental methodological flaw or a complete disregard for relevant facts. It is an extraordinarily difficult standard for the IRS to meet.

Without safe harbor, the dynamic reverses. The IRS can challenge your FMV, and you must prove it was reasonable. "We thought it was about right" is not a defense. "Our board picked a number" is not a defense. Even "a CPA looked at it" may not be a defense if the CPA isn't a qualified valuation professional with relevant experience. The only reliable defense is a valuation that satisfies all five safe harbor requirements.

The five requirements — and how each one gets broken

Safe harbor under the Independent Appraisal Presumption (the most common route, and the one Express 409A provides) requires all five of the following:

1. Independent appraiser. The person performing the valuation must have no financial interest in the company being valued. No equity, no options, no board seats, no consulting arrangements beyond the valuation engagement. Treasury Reg §1.409A-1(b)(5)(iv)(C)↗ makes independence a threshold requirement. A board member's estimate, no matter how sophisticated, doesn't qualify. A friend who happens to be a CPA doesn't qualify if they hold shares.

How it breaks: Companies ask an advisor who holds equity to "also handle the 409A." The moment the appraiser has a financial interest in the company, independence is compromised.

2. Qualified professional. The appraiser must have "significant knowledge, experience, education, and training" in performing similar valuations. The IRS generally expects at least five years of relevant experience. This isn't a formal certification requirement — it's a qualifications standard that will be evaluated if the valuation is ever challenged.

How it breaks: A general-practice accountant with no valuation training prepares the report. Their CPA license doesn't substitute for valuation expertise. Or worse — an automated platform generates the report with no qualified human reviewing the specific engagement.

3. Recognized methodology. The valuation must use a recognized approach — Market, Income, or Asset, as defined in the AICPA Valuation Guide↗ and Revenue Ruling 59-60↗. The choice of approach must be appropriate for the company's stage and documented with rationale. The comparable companies must be relevant. The discount rate must be derived, not assumed.

How it breaks: The appraiser uses a "rule of thumb" or a single comparable without justification. The methodology section of the report is thin or generic. Automated platforms may apply the same template methodology regardless of whether the company is a pre-revenue biotech or a SaaS business with $5M ARR.

4. Signed written report. The valuation must be documented in a comprehensive written report, and the report must be signed by the appraiser. In Estate of Hoensheid v. Commissioner (T.C. Memo 2023-34), the Tax Court examined whether reports met this requirement. An unsigned report — or a report generated by a platform without an individual appraiser's signature — creates a vulnerability.

How it breaks: The provider delivers a PDF that isn't signed by a named individual. Or the report is a template with minimal company-specific analysis.

5. Timeliness. The valuation must be performed within 12 months of the option grant date, and no material event can have occurred between the valuation date and the grant date. Material events include funding rounds, significant revenue changes, key personnel changes, M&A activity, and major operational pivots. The 12-month clock runs from the valuation date — not the report date, not the date you received it, not the date the board adopted it. (See Your 409A Expires in 30 Days. Here's What to Do for the expiration scenario.)

How it breaks: The founder forgets the expiration date. Or a material event occurs (like closing a funding round) and the founder continues granting at the old FMV. Both are common, both are preventable.

What "grossly unreasonable" actually means in practice

The IRS doesn't challenge 409A valuations often — and when it does, the "grossly unreasonable" standard gives the company a significant advantage. But "rarely challenged" doesn't mean "never challenged." The challenges that do happen tend to follow a pattern:

The company has a known value-changing event (a fundraise, an acquisition offer) and the 409A doesn't reflect it. Or the methodology is so thin that the report doesn't actually support the conclusion. Or the appraiser isn't independent.

Safe harbor doesn't make you invincible. It makes you defensible. The report still needs to be competent. The assumptions still need to be reasonable. But with safe harbor, the IRS has to prove a fundamental failure — not just a disagreement about comparables or discount rates.

Without safe harbor, any disagreement becomes a fight where you carry the burden of proof. That's a fight you don't want to have when your employees' tax bills are on the line. (See What Happens If You Grant Options Without a 409A for what those penalties look like in practice.)

How to maintain safe harbor continuously

Safe harbor isn't a one-time achievement. It's a continuous state that requires maintenance:

Get a new 409A before the 12-month mark. Not after. Not "when we get around to it." Before. The clock is absolute under Treasury Reg §1.409A-1(b)(5)(iv)(B)↗. There is no grace period.

Get a new 409A after any material event. Funding round closed? New valuation. Major revenue milestone? Assess whether a new valuation is needed. Key executive departure? Same assessment. When in doubt, refresh. An annual plan with as-needed refreshes means you're never caught debating whether to spend the money — the coverage is already in place.

Verify the report is signed. Every time. By a named individual. With disclosed qualifications.

Keep the board resolution on file. For every FMV adoption. For every grant authorization. This is the corporate governance layer that ties the 409A to the actual grants.

Every Express 409A report is signed by a qualified, independent appraiser with investment banking credentials. Every report satisfies all five safe harbor requirements. Every engagement includes lifetime audit support — if the IRS or your auditor ever questions the valuation, we respond directly. Safe harbor isn't optional. It's the foundation of every engagement we deliver.

See how Express 409A works →