Can the CRA Get Your Bank Records? Third-Party Audit Powers Explained

A common question during a CRA audit is whether the agency can simply go around you and ask your bank directly. The short answer is yes, in the right circumstances — the CRA has statutory authority under the Income Tax Act to demand information and documents not only from the taxpayer under audit, but from third parties, including banks and other financial institutions.

Understanding how this power works, and what rights you retain, helps you respond appropriately if you learn your bank has been contacted about your account.

Yes, the CRA Can Demand Bank Records — Here's How

The CRA doesn't need your permission to request your banking information from your bank. It can issue a formal demand — sometimes called a Requirement for Information — directly to a financial institution, compelling production of records like account statements, deposit histories, and related documentation.

This is a different power from a criminal search warrant. A civil audit demand for bank records doesn't require the CRA to go before a judge for every individual taxpayer whose records it seeks — though there are additional safeguards when the CRA wants to demand information about a group of unidentified people (for example, all customers of a particular business) rather than a specific named taxpayer, which generally does require independent court authorization first.

Why the CRA Seeks Bank Records

Bank records are often the most reliable source of information in an audit, because they're maintained by an independent third party rather than by the taxpayer. Common reasons the CRA requests them:

• Verifying that reported income matches actual deposits
• Investigating unexplained increases in wealth, particularly in a net worth audit, which reconstructs income from assets, debts, and spending rather than from your own books
• Confirming that business and personal funds haven't been commingled in a way that hides income
• Tracing the destination of funds in cases involving multiple related parties or businesses

What Rights Do You Retain?

Even though the CRA can compel your bank to produce records, you're not without protections:

• Notice. In many cases you're entitled to know that your records are being sought, though the specific notice mechanics depend on the type of demand and whether it targets you by name or targets an unnamed group.
• Privilege. Communications and documents genuinely protected by solicitor-client privilege are not fair game, though asserting privilege against a third-party demand involves its own procedural steps.
• Scope limits. A demand for information must relate to the administration or enforcement of the Income Tax Act — it can't be a fishing expedition entirely disconnected from any tax purpose, though in practice the CRA is given considerable latitude in what it considers relevant.
• The right to legal advice. Nothing prevents you from involving a lawyer once you learn a third-party demand has been made about your affairs, even though the demand itself is directed at your bank rather than you.

What Happens After the Bank Complies

Once your bank produces the requested records, the CRA reviews them against what you reported. Discrepancies — deposits that don't match reported income, patterns suggesting unreported cash income, or transfers that raise questions — typically generate follow-up questions directed at you. This is your opportunity to explain: not every unexplained deposit is unreported income. Loans, gifts, inheritances, and transfers between your own accounts are common, legitimate explanations, but you'll need to be able to document them.

Bank Records vs. Other Third-Party Sources

The CRA's third-party information-gathering power isn't limited to banks. Depending on the audit, similar demands can reach:

Frequently asked questions