Introduction – What is Represent a Client?
The Canada Revenue Agency's (CRA) Represent a Client (RAC) service allows individuals and businesses to access to tax information and services on behalf of another individual and/or business. In addition, CRA's Represent a Client service permits the CRA to deal with taxpayer's representative on their behalf.
Who Can Use Represent a Client?
Individuals and businesses can use CRA's Represent a Client service, whereby they can represent their taxpayer client with the CRA and gain access to the client's individual and business tax information. Representatives may include, but are not limited to:
- An owner, partner, director or officer of a business that provides tax or payroll services for clients, such as accounting and payroll services.
- An employee of a business that provides tax or payroll services. For examples, a Payroll specialist of a Payroll company.
- An individual acting on behalf of the taxpayer with respect to his or her tax affairs. This may include, but is not limited to: a bookkeeper, a Canadian tax lawyer, a CPA or other accountant, a financial planner, a trustee, an executor, a power of attorney, a legal guardian, and friend or family member.
- A non-resident representative living in the United States of America can also use CRA's Represent a Client service to access information and services on behalf of another individual or business.
How to Register for CRA's Represent a Client?
Individuals or businesses who would like to access information and services on behalf of another individual or business must complete the following:
- Go to Represent a Client – representative must go to CRA's Represent a Client webpage
- Create a CRA user ID and password or login within a Sign-in Partner – A "Sign-in Partner" is a financial institution that is registered with the CRA as a Sign-in Partner. CRA's Represent a Client webpage provides a list of the financial institutions that are registered with the CRA as a Sign-in Partner. If a representative's financial institution is a Sign-in Partner, he or she can access the Represent a Client service, provided they have online banking set up with their financial institution. However, if a representative's financial institution is not a listed Sign-in Partner, the representative can only access CRA's Represent a Client service using a CRA user ID and password. A CRA user ID and password can be obtained by contacting CRA's General Enquires line and the CRA will process and issue the user ID and password to the representative's mailing address within 10 business days.
- Register with CRA's Represent a Client service – businesses that would like to access information and services on behalf of another individual or business must register their Business Number (BN). Individuals who would like to access information and services on behalf of another individual or business must register themselves with the services and receive a representative identifier (Rep ID). Groups that would like to access information and services on behalf of another individual or business must register their group and receive a group identifier (Group ID).
- Obtain authorization – individuals, businesses or groups must provide their Business Number (BN), Rep ID or Group ID to the individual, business or group authorizing access so they can be granted access accordingly.
- Access individual or business information and services – once authorization is granted, the individual, business or group can access information and services on behalf of the taxpayer who granted the authorization.
Individuals, businesses or groups may also grant different roles and accesses to different representatives. The two types of access that can be granted are:
- Allow view only access – whereby the CRA can disclosure information about the individual, business or group authorizing access to the representative. The representative may also make payment arrangements with the CRA on the individual, business or group's behalf.
- Allow update and view access – whereby the CRA can disclosure information about the individual, business or group authorizing access to the representative. The representative can also request to make changes to the individual, business or group's My CRA Account or My CRA Business Account.
However, regardless of the level of access granted, a representative will not be allowed to update any of the following information on behalf of the taxpayer:
- For individuals and trusts:
-
- address
- marital status
- direct deposit information
- other representatives
- pre-authorized debit agreement
- For businesses and non-residents:
-
- direct deposit information
- other representatives
Obtaining Authorized Access to a Client's My CRA Account or My Business CRA Account
As previously discussed, representatives may obtain authorized access to information and services on behalf of another individual or business. However, the process for obtaining authorized access for business clients and individual clients is different.
CRA Account Authorization for Business Clients
Representatives can submit business authorization requests electronically. Representatives with an active Rep ID can log into CRA's Represent a Client webpage and submit an authorization request, electronically. Individuals without an active Rep ID must follow the above-noted steps before submitting an authorization request, electronically. For a request to be completed, representatives must submit their completed request by providing all the required information including CRA's certification form, signed and dated by their client authorizing access. Additional supporting documents may also be submitted, including, but not limited to, a Will or a Power of Attorney. Once the CRA receives the electronic authorization request and signed certification form, the information will be reviewed, validated and processed within five business days.
In addition, business owners can also log into their My CRA Business Account and enter the Rep ID of an individual to authorize him or her access, a Group ID to authorize a group of representatives with access or the Busines Number of a business to authorize access to all of its employees.
Further, business owners can also authorize representatives with access by completing the Form AUT-01 Authorize a Representative for Access by Phone and Mail and sending this form to their local tax centre by surface mail. It should be noted that the Form AUT-01 Authorize a Representative for Access by Phone and Mail will only grant representatives access by telephone and mail and it will not grant online access to a client's My CRA Account or My CRA Business Account.
CRA Account Authorization for Individual Clients
Individual clients can log into their My CRA Account and enter the Rep ID of an individual to authorize him or her access, a Group ID to authorize a group of representatives with access or the Busines Number of a business to authorize access to all of its employees.
In addition, individual clients can also authorize representatives with access by completing the Form AUT-01 Authorize a Representative for Access by Phone and Mail and sending this form to their local tax centre by surface mail. It should be noted that the Form AUT-01 Authorize a Representative for Access by Phone and Mail will only grant representatives access by telephone and mail and it will not grant online access to a client's My CRA Account or My CRA Business Account.
If you completed the Form AUT-01 Authorize a Representative for Access by Phone and Mail in French or if you live in Québec, send the form to: Jonquière tax centre 2251 René-Lévesque Boulevard, Jonquière QC G7S 5J2.
If you live in Ontario or outside Canada, send your completed the Form AUT-01 Authorize a Representative for Access by Phone and Mail to: Sudbury tax centre Post Office Box 20000, Station A, Sudbury ON P3A 5C1.
If you live anywhere else in Canada, send your completed Form AUT-01 Authorize a Representative for Access by Phone and Mail to: Winnipeg tax centre Post Office Box 14000, Station Main, Winnipeg MB R3C 3M2.
CRA's Authorization Validation Process
Pursuant to the Privacy Act and the Access to Information Act, the CRA has a legal obligation to protect taxpayers' confidential information. The CRA can provide confidential information and services only to individuals, businesses and groups that the taxpayer has authorized. As such, when an authorized representative contacts the CRA to obtain information and services on behalf of another individual or business, the CRA will need to validate the representative and their authorized access to the taxpayer's account.
As of January 1, 2021, representatives associated with a firm, business or a group, must have their own Rep ID when calling into CRA's General Enquires line to represent a client. This new security measure aims to enhance the security of confidential taxpayer information by permitting CRA Agents to verify representatives and their authorization to the taxpayer's information. This new security measure does not require the taxpayer to sign and submit a new authorization request form. Existing representatives can associate their employees' personal Rep ID to the Business Number or Group ID. However, non-existing representatives must follow the above-mentioned registration process before they can associate their employees' personal Rep ID to the Business Number or Group ID.
The Benefits and Challenges Associated with CRA's Rep ID Requirement
As previously mentioned, the CRA has a legal obligation to protect taxpayers' confidential information. On the one hand, CRA's efforts to validate authorized representatives over the telephone aims to enhance the security of confidential taxpayer information and protects against unauthorized access to taxpayers' My CRA Account or My CRA Business Account. On the other hand, this new security measure fails to consider the possibility of Rep ID sharing among employees in the same business or group. For instance, an employee of a business could contact the CRA General Inquires line, provide another employee's name and Rep ID and gain access a confidential taxpayer information. As such, it is unclear whether CRA's new security measure will enhance the security of confidential taxpayer information or whether it will allow CRA Agents to accurately verify the representatives' authorized access to the taxpayer's account. Even more problematic is that this new security measure only applies to representing a client by telephone. It does not apply to a representative's access to taxpayer's information electronically or by mail. Moreover, there are ongoing concerns regarding the recent cyberattacks that compromised a total of 5,500 taxpayer accounts and 9,000 GC Key accounts and resulted in over 900 social insurance numbers and fragments of data being removed from CRA's system.
Under the Privacy Act and the Access to Information Act, the CRA has an obligation to detect and prevent unauthorized access (by mail, telephone or electronically) and the misuse of any information that is in its control and possession. Unauthorized access to confidential taxpayer information can create harmful consequences for taxpayers, the CRA, our economy and national security. Despite ongoing efforts of the CRA, unauthorized access to confidential taxpayer information and cyberattacks against government institutions and their systems are evolving, and they can have devastating effects on taxpayers including, but not limited to, financial hardships and identity theft. My Account, My Business Account and Represent a Client are used by millions of taxpayers who reasonably assume that the CRA will deal with their information with the utmost security and respect of privacy. The CRA must be held accountable for protecting taxpayers from threats against its online services and unauthorized access to confidential taxpayer information by telephone and by mail and it must implement effective safety measures focused on the security of taxpayers and respect of their privacy.
Taxpayers' Ability to Sue the CRA
Taxpayers who suffer actual damages as a result of unauthorized access to confidential information or CRA's cyberattacks have the right to commence a lawsuit against the CRA for negligence and damages. Under the provisions of the Crown Liability Act, the federal government can be sued for negligence and damages resulting from the actions of its employees and officers. In order for CRA to be liable, the taxpayer must establish that the CRA owed a duty of care to the taxpayer, breached that duty of care, and caused the loss. In Ontario, the Proceedings Against the Crown Act govern the procedure for suing the CRA for damages. At least 60 days before commencing an action against the CRA, the taxpayer must serve on the Canadian tax lawyer representing the CRA a notice of the claim containing the relevant particulars.
Pro Tax Tips – CRA's Represent a Client Service
CRA's Represent a Client service allows individuals and businesses to access tax information and services on behalf of another individual and/or business. With such authorization, representatives can (1) access the taxpayer's tax information; (2) help deal with the CRA with respect to the taxpayer's tax affairs; (3) obtain information regarding the taxpayer's business account, and/or (4) update some of the taxpayer's tax account information. Yet, taxpayers selecting a representative should give careful consideration to the level of access granted, the representative obtaining the authorized access and the tax years for which access is required. If you suspect that you might be a victim of unauthorized access to confidential taxpayer information or any of the CRA's recent cyberattacks against the CRA accounts or if you have concerns with how the CRA is handling your personal information and or administering the Privacy Act or the Access to Information Act, contact our Certified Specialists In Taxation Canadian tax lawyer for appropriate tax guidance.