When CRA opens an audit or begins investigating a taxpayer, the agency rarely limits its inquiries to information held by that taxpayer alone. Under sections 231.2 and 231.6 of the Income Tax Act, CRA has broad authority to demand information from third parties — banks, accountants, lawyers (subject to privilege), suppliers, customers, and even foreign institutions — often without the affected taxpayer even knowing a request has been made.
Understanding how third-party information requests work, what protections apply, and how to respond if you receive one is important for every Canadian business owner and professional.
CRA issues formal Requirement to Provide Information (RPI) notices to third parties under section 231.2 of the ITA. These are legally binding demands — the recipient must comply or face penalties. RPI notices are routinely sent to:
CRA can issue RPI notices for both named taxpayers (a specific individual or business under review) and unnamed or undisclosed persons. Unnamed requests — sometimes called "fishing expeditions" — require prior judicial authorization from a Federal Court judge. This authorization must be obtained by CRA before it can demand information about unnamed persons from third parties like banks.
Courts have generally upheld the constitutionality of these provisions, but they have also required CRA to demonstrate relevance and proportionality before authorizing sweeping unnamed requests.
| Request Type | Target | Judicial Authorization? |
|---|---|---|
| Named individual RPI | Specific taxpayer's records at a third party | Not required |
| Named third-party RPI | Named person's own records | Not required |
| Unnamed person request | Records of unknown persons at third party | Required — Federal Court order |
| Foreign information request | Records held outside Canada | Foreign treaty process |
Yes — recipients of RPI notices have the right to seek a compliance order hearing through the Federal Court, arguing that the demand is overbroad, irrelevant, or violates Charter protections. This is not a process to take lightly; it involves legal proceedings and costs. However, in cases where CRA's request goes far beyond what is reasonably related to the audit, a challenge may be appropriate.
Practically speaking, most banks and institutional third parties comply with RPI notices as a matter of course, since non-compliance exposes them to penalties. The more realistic strategy for taxpayers is to engage proactively with their tax professional once they know an audit is underway, ensuring records are complete and organized before CRA requests them through third-party channels.
While CRA does not have to notify you when it sends an RPI to a third party about you, you do have rights once you are aware:
If CRA sends you an RPI requesting information about someone else — a customer, employee, or business contact — you have legal obligations but also procedural rights. You must comply within the deadline stated on the notice, but you should:
By the time a taxpayer learns that CRA has been gathering third-party information about them, an audit is likely already well underway. Having a tax professional engaged from the moment you receive any CRA communication — audit selection notice, proposed adjustments, or a reassessment citing unexpected information — puts you in a much stronger position to respond accurately and completely. Our tax professionals manage CRA audits and information gathering processes for clients across all industries.