There is no cite at this point in time other than the IRS page I've linked to below, but I think the key word in this discussion is "verification" of the EFIN. Those of us that have efiled and have never changed software vendors already submitted the EFIN letter long ago to our software providers, but at some point soon and before the next season begins that will change, and in order to efile we will all have to log in to e-services, go through an identity verification, register a mobile phone and receive a text to it, etc. We will then be able to print out a pdf (must be a pdf from e-services) where the EFIN was assigned as part of the application process. All of the software vendors will be required to do this by the IRS. This is just one part of the security measures that were developed as a result of the security summit from this past summer that was held between the IRS, software vendors, and other key stakeholders. Another change will be required usernames and strong passwords to access the 2016 software, and with those passwords expiring and needing to be changed every 90 days.
At this point the e-services/EFIN requirement was to be implemented by 10/24/16 and has been temporarily delayed according to this IRS page (safe link for those that worry): https://www.irs.gov/individuals/important-update-about-your-eservices-account Also, note that at this point it may be possible to proceed through this authentication process by telephone and waiting for something via U.S. mail that may take 5-10 days and additional steps to complete the process.
This will be a requirement for all of us that do not already have the verified EFIN document as a pdf document from e-services on file with our software vendors. It does not count that the EFIN itself was already on file with the software vendor if that information was provided to them from the original letter sent to us from the IRS. It must come from e-services now because there were some fake EFIN letters submitted and relied on in the past.
I have seen this on the Drake site, Drake's forum, in an email from Thomson Reuters for their CS fixed assets and tax products (Ultra Tax) as well as a warning right on their main page in large bold lettering, in a direct email I subscribe to from the IRS stakeholders' liason out of the Philly office, and now here.