The Canada Revenue Agency (CRA) took action to enhance security measures due to the recent security breaches. In fact, the 2021 Budget earmarked almost $52 million a year to develop measures to protect taxpayer information against data breaches. This is particularly important in light of the pandemic; because CRA staff is remote, CRA is corresponding with taxpayers by cellphone, and is relying on the use of online platforms.
The result is the CRA’s new unofficial policy on level 3 authorizations. When speaking to the CRA agents on the phone, the agents (e.g., auditors and appeals officers) now require that representatives have a level 3 authorization, despite already having a level 1 or 2 authorization on file. This undoubtedly causes some confusion for representatives.
Currently, the CRA’s webpage provides two levels of authorization for personal and trust tax accounts: level 1 is to obtain information and level 2 is to request limited changes and obtain information. There is no level 3 authorization available for individuals or trusts.
For non-resident and business accounts, there are three levels of authorization: the same two levels as identified above, and level 3 that allows the representative to delegate authority as well as update and obtain information. A level 3 delegated authority may authorize another representative or delegated authority on behalf of the business. Most representatives only have level 1 or 2 as, historically, level 3 delegate authority was typically reserved for employees of the taxpayer itself (e.g., a business’ CFO).
Generally, level 2 access was sufficient for accountants and other representatives to communicate with the CRA and submit information both over the phone and online on a client’s behalf. Recently, the CRA unofficially stated that it introduced a new COVID security rule requiring level 3 authorization before communicating with representatives over the phone. The rationale is that cellphones are not secure and only a level 3 delegate has the authority to accept the risk on the taxpayer’s behalf. However, it does not appear that the CRA has made any formal announcements with respect to this new policy to date.
These new measures could present problems for taxpayers and professional representatives alike, for example:
- Only an individual can apply for level 3 authorization, meaning a firm cannot secure level 3 authorization for a client;
- The CRA website does not currently provide the option for level 3 authorization for individual or trust accounts; and
- The CRA website currently states that level 3 authorization provides delegate authority, meaning it does not accord with the unofficial statements from CRA agents, which can cause further confusion in an already complicated tax compliance season.
To overcome these hurdles, some CRA auditors are accepting a letter from the client authorizing the CRA to speak with its level 2 representative by cell phone, but this seems to be on an ad hoc basis and does not appear to be an official CRA policy. It remains unclear whether the CRA will make a formal announcement or update its online authorization system to facilitate these new procedures.
We will continue to monitor the situation and provide updates as we learn more.
