cra-assistent

← Curriculum /Foundations /Level 1

Authorising a representative

Draft — unverified

Confidentiality is the default: a taxpayer's information is disclosed to the taxpayer, and to nobody else without authority. Authorisation is how that changes. It matters constantly, because a large share of contact comes from accountants, family members, and people holding legal authority for someone who cannot act for themselves — and those three groups are established in entirely different ways. This tutorial covers who may act for a taxpayer, how a representative is authorised and how that authority is limited, why a legal representative is a different thing altogether, and what must be confirmed before anything is disclosed.

How to work through this tutorial

The order here is the order the checks happen on a real contact: 1. Start from the default — information goes to the taxpayer and to nobody else. 2. Establish which kind of authority the caller claims: representative, or legal representative. 3. For a representative, confirm the authorisation exists and what level it grants. 4. For a legal representative, confirm the legal documents are on file. 5. Confirm identity before disclosing anything. 6. Know how authority is limited, expires and is cancelled. 7. Check your work against the common failures — which run in both directions. 8. Verify every specific against CRA's published guidance before relying on it.

The default, and the two kinds of authority

Taxpayer information is confidential by statute. Absent authority, it goes to the taxpayer and to nobody else — not their spouse, not their parent, not their adult child, not their employer, not their bank. There are two quite different ways a third party acquires authority, and conflating them causes real problems. A **representative** is someone the taxpayer has authorised to deal with CRA on their behalf — typically an accountant, a tax preparer, a family member helping out, or a firm. The taxpayer grants this and the taxpayer can revoke it. A **legal representative** holds authority by operation of law rather than by the taxpayer's authorisation to CRA — an executor or estate administrator, an attorney under a power of attorney, a court-appointed guardian or trustee. Their authority comes from the legal instrument, and CRA needs to see it. The practical distinction: a representative's authority is something the taxpayer gave and could take away; a legal representative's is something a document or a court conferred, often precisely because the taxpayer cannot give or take away anything. A caller saying "I have power of attorney" is not describing a representative authorisation, and treating it as one will send them down the wrong path.

Authorising a representative

A taxpayer can authorise a representative through CRA's online services, or on a prescribed paper form where online is not suitable. The online route is generally faster and the paper form exists for those who need it. Authorisation is granted at a level, and the level determines what the representative may do. A lower level permits disclosure — the representative can be told about the account. A higher level permits changes — the representative can act on the account as well as ask about it. Confirm the current levels and exactly what each permits, since a representative asking to make a change may hold authority only to be told things. Authorisation can be limited to particular tax years and can be given an expiry date. A representative authorised for one year has no authority for another, which is a distinction that gets lost when a long-standing accountant calls about something older than their authorisation covers. Business authorisations work differently from individual ones and use their own process. Do not assume an individual authorisation extends to a business the individual owns, or the reverse. A taxpayer can cancel an authorisation at any time, and authorisations may also expire on their own terms. "They were my accountant last year" is not authority now.

Legal representatives

A legal representative acts because the taxpayer cannot, or is deceased. The authority comes from a document — a will naming an executor, a grant from a court, a power of attorney, a guardianship order — and CRA must have that document before it will act on the authority. This is a document review rather than a form submission, and it takes time. A caller who has just been bereaved and wants to sort out their parent's tax affairs today is going to be told that the paperwork has to be reviewed first, and how that is explained matters. It is not obstruction; it is the protection that keeps a stranger from doing the same thing. A power of attorney is not automatically effective for tax purposes simply because it exists. Its scope matters, and CRA needs to see it to determine what it authorises. On death, the estate's representative deals with the deceased's returns, including the final return, and with the estate's own tax obligations. Those are separate filings and a common source of confusion. Where no legal representative has been established, there may be nobody CRA can lawfully deal with, however sympathetic the circumstances. That is a genuinely difficult conversation and it is better handled by explaining what would establish authority than by leaving the caller thinking they were simply refused.

Confirming identity before disclosing

Authorisation on file is necessary but not sufficient. You also have to know that the person you are speaking to is the person authorised. Identity confirmation follows a defined procedure, and the point of it is not the ritual — it is that anyone can claim to be anyone on a telephone. Follow the procedure as written rather than accepting that someone plainly knows a lot about the account. Knowing a lot about someone's account is what an impersonator would also do. Some specific pressures are worth naming, because they are the ones that produce breaches. A caller who is upset. A caller in an obvious emergency. A caller who has already been transferred several times and is exasperated at being asked again. A caller who supplies most of the identifiers and becomes indignant at the last one. None of these change the requirement. The failure runs the other way too. A properly authorised representative who has confirmed their identity is entitled to the information their authorisation covers, and refusing it out of excessive caution is also a failure — it obstructs someone acting lawfully for a taxpayer who needs help. The reliable habit: establish authority, confirm identity, then disclose fully within the scope. Not less, and not more.

A worked example: three callers, one taxpayer

Teaching example. The figures below are invented to show the method. They are not CRA figures, and no amount here should be used for a real taxpayer.

Assume a taxpayer, Nadia, who has a benefit enquiry outstanding. Three people call about her account on the same day. All names and circumstances here are invented. **Her accountant, Wesley.** He is authorised at a level permitting disclosure, for the current and previous tax year. He asks about her benefit entitlement, and after identity confirmation he can be told. He then asks to change her marital status on the account — and if his authorisation permits disclosure only, he cannot do that. He is not being doubted; his authority simply does not extend that far. The route is for Nadia to change it, or to grant a higher level. **Her adult son, Daniel.** He explains that Nadia is unwell and he handles her affairs. No authorisation is on file. Sympathetic as this is, there is nothing to disclose to him. What helps him is knowing exactly what would establish authority — Nadia authorising him, or, if she is unable to, the power of attorney route with documents CRA can review. **Her former preparer, Sam.** He filed her return three years ago and his authorisation expired. He knows her address, her date of birth and her approximate refund. None of that is authority. Confirming any of it back to him would itself be a disclosure. The shape to carry away: authority first, identity second, scope third. Wesley fails only at the third step, Daniel at the first, Sam at the first as well despite appearing to know the most.

Common failures

Disclosing to a spouse, parent or adult child because the relationship seems obvious. Relationship is not authority. Treating a claim of power of attorney as a representative authorisation. It is a legal representative matter and requires document review. Assuming an authorisation covers all years. It may be limited to specific years and may have an expiry date. Assuming an individual authorisation covers a business, or the reverse. They are separate processes. Letting a representative make a change when their authorisation only permits disclosure. Accepting that a caller is who they say because they already know a lot. That is what an impersonator would also present. Confirming details back to an unauthorised caller. Confirmation is disclosure. Relaxing the identity procedure under emotional pressure, or because the caller has already been transferred repeatedly. Refusing information to a properly authorised and identified representative out of excess caution. That is a failure too. Leaving a caller with no authority thinking they were simply refused, rather than explaining what would establish authority. Forgetting that a deceased taxpayer's affairs and their estate's affairs are separate filings.

What to verify this tutorial against

This was drafted without a source document. Get the form numbers, the authorisation levels and the identity procedure from CRA's own material, since all three change and all three matter. CRA's pages on authorising a representative cover the online process, the paper form, the levels of authorisation and what each permits, and how authorisations are cancelled and expire. CRA's guidance for legal representatives covers executors, powers of attorney and court-appointed representatives, and the documents required for each. The confidentiality provisions of the Income Tax Act are the source of the obligation and should be read directly; the exceptions are specific and should not be reasoned from generally. CRA's guidance on a deceased person's tax affairs covers the final return and the estate's obligations, which are separate filings. Business authorisation uses its own process and forms; confirm those separately rather than assuming the individual process applies. Internal identity-confirmation procedures are operational material this platform does not hold — it is limited to published guidance (DEC-001), so follow the procedure as issued to you rather than anything inferred from this page.

Your progress

This is your own record of what you have worked through. It says nothing about whether the content has been verified.

Quiz not attempted. 7 questions available — marking this complete does not require taking it, but the quiz is the only thing here that distinguishes having read the page from having learned it. Take the quiz

Claims to confirm

These are the checkable specifics from this tutorial — the details most likely to be wrong in a drafted page. Confirm each against CRA guidance. 0 of 12 confirmed.

Verify this tutorial

12 claim(s) still unconfirmed. Confirm them above first — verifying the page while its specifics are outstanding would defeat the purpose of listing them.