National Security and Intelligence Review Agency report

Description

• The National Security and Intelligence Review Agency (NSIRA) is an independent and external body that reviews and investigates Canada’s national security and intelligence activities to ensure that they are lawful, reasonable, and necessary.
• NSIRA initiated a review of the CRA’s Review and Analysis Division (RAD) in March 2023, focused on its national security activities and decision-making relating to charities.
• [Redacted]
• The final report will be shared with the Minister of Finance and National Revenue, and the CRA will have an opportunity to prepare a response that will be published with the final report on NSIRA’s website.

Key Messages

• The CRA contributes to a whole-of-government approach to combatting terrorism by protecting charities from terrorism abuse through administrative enforcement of the Income Tax Act. This directly contributes to Canada’s international commitments for combatting terrorist financing.
• The CRA has fully supported and cooperated with NSIRA in its review. The report was presented to NSIRA’s members for approval on March 27, 2025.
• The CRA acknowledges there is room for improvement in how it documents its risk assessment and decision making based on some of the findings and conclusions noted in the draft report.
• The CRA takes racism and discrimination seriously and does not select registered charities for audit, nor does it apply policies or procedures differently, based on any particular faith or denomination.

Context

• In 2021, two external reports were published raising concerns with the government’s risk-based approach to terrorist financing and addressing terrorism abuse in the Non-Profit Organization sector.
• The NSIRA review was announced shortly after the Office of the Taxpayers’ Ombudsperson concluded that its review could not assess bias in the CRA’s audit of charities due to legislative restrictions that prevented it from accessing taxpayer information.
• When NSIRA completes a review, the resulting classified document is sent by the NSIRA Members to the appropriate Minister or Ministers. NSIRA is mandated to prepare a public annual report to the Prime Minister containing summaries of its reviews, including findings and recommendations, completed during the previous calendar year.
• Departments and agencies have a chance to respond to NSIRA recommendations, and these responses are included in this report, which is ultimately tabled in Parliament by the Prime Minister and published on NSIRA’s website.
• [Redacted]
• [Redacted]
• [Redacted]
• [Redacted]
• An internal review of the Charities Directorate’s audit program (including RAD) was also conducted by the CRA’s Audit, Evaluation and Risk Branch (AERB). The AERB had full access to the Charities Directorate information systems. The review recommended measures to help the CRA ensure controls are in place to protect itself against the negative impact bias could have on its audit activities.

Filing season

Description

• Every year, the tax filing season runs from late February to April 30 for most individuals. This is the period where the majority of CRA’s tax processing activity occurs.

Key Messages

• Filing season officially opened February 24, 2025 for both T1 (individual) and T3 (trust) filers.
• The filing deadline for 2024 returns is April 30, 2025 and June 16, 2025 for individuals with self-employment income, however all payments are due by April 30, 2025.
• Last year over 33 million individual income tax and benefit returns were filed as well as over 420,000 trust returns.
• The CRA is aware that some taxpayers are not yet seeing certain 2024 tax information slips on My Account or through the Auto-fill my Return service as early as in previous years. This issue is linked to recent changes in how the CRA processes these slips. The CRA is actively working to address any outstanding issues, including consulting with issuers, to ensure tax slips are made available in the portal.

Considerations

Information returns processing

• The CRA is responsible for processing nearly 3 million information returns per year, containing up to 290 million tax slips such as the T4 (Statement of Remuneration Paid), T4A (Statement of Pension, Retirement, Annuity, and Other Income), and T5 (Statement of Investment Income). These slips are used by individual taxpayers to support the filing of their T1 and T3 tax returns.
• A major system update was completed in January 2025 for the main system, InfoDec, which is responsible for the processing of these information returns. This update introduced upfront validations, which advises tax slip issuers (e.g., financial institutions and employers) of errors with their submission in real-time and prevents the submission of invalid information returns. This will improve the quality of the data the CRA receives, and allows for errors to be corrected faster, which means tax slips will be available earlier for individual filers in My Account and Auto-fill my return, and also for downstream CRA programs throughout the service and compliance continuum, such as audit, collections, and appeals.
• The update to the InfoDec system also introduced a greater number of validations, including flags for high-risk filings. These flags will allow the CRA to better understand the types and volumes of potentially fraudulent information returns, and develop business rules aiming to prevent the processing of such returns.
• The introduction of upfront validations represents a significant departure from prior years. The information filer community might perceive this change negatively in this first year, as they interact with the new system and adapt to new processes. Given ongoing challenges faced by some filers, the CRA announced that it will grant relief in respect of late-filing penalties for information returns filed on or before March 7, 2025, which are normally due on February 28, 2025.
• Changes to the T619 (Business or Professional Income Statement) transmittal record, which must be included with each electronic submission, will also allow the CRA to better understand filing behaviour. For instance, for the first time, the CRA will be able to determine which organizations are filing information returns on behalf of others. As this information will be recorded for each return filed, it will also support efforts to combat fraud when credentials have been determined to be compromised.

Capital Dispositions

• The government’s January 31, 2025 announcement on the capital gains inclusion rate change with a new effective date of January 1, 2026, has required the CRA to quickly revert to administering the currently enacted capital gains inclusion rate of one half. This involved changes to forms, internal systems and also requires software developers to make similar adjustments.
• Recognizing the delays this will cause for some individuals and trusts that have capital disposition reporting requirements, the CRA announced that it will grant relief in respect of late-filing penalties and arrears interest until June 2, 2025, for impacted T1 Individual filers, and until May 1, 2025, for impacted T3 Trust filers.
• The CRA has taken a proactive approach in communicating the expectation of delays with Canadians and representatives.

SimpleFile by Phone and Digital services

• Individuals who have lower income and simple tax situations may have received a letter inviting them to file their tax returns using these free, secure, and simplified automated services, which will help them access the government payments designed to support them.
• SimpleFile opened February 24, 2025, with 2 million invitation letters for the phone service mailed at the start of the 2025 Filing Season, in line with a prior public commitment, and close to 100,000 invitation letters for a pilot offering SimpleFile Digital, mailed out in mid-March 2025.

Fuel charge and Canada Carbon Rebate

Description

• The Canada Revenue Agency (CRA) administers Part 1 of the Greenhouse Gas Pollution Pricing Act (GGPPA) known as the fuel charge program (i.e., carbon tax).
• On March 14, 2025, the elimination of the fuel charge was announced, effective April 1, 2025, by setting all fuel charge rates to zero. Regulations implementing these changes were passed on March 15, 2025. This also eliminates the Canada Carbon Rebate (CCR) for individuals and small businesses.
• [Redacted]
• Part 2 of the GGPPA, known as the output-based pricing system, has continued to be administered by Environment and Climate Change Canada.

Key Messages

• As the administrator of the fuel charge, the CRA is responsible for administering the changes in accordance with the regulations.
• While the fuel charge ceased as of April 1, 2025, considerable work remains to be done to ensure compliance activities are completed.
• As the CRA develops plans to wind down the fuel charge program, including adjusting workforce requirements over time, it will do so in a transparent manner that considers taxpayer interests, and in consultation with the unions.
• The final CCR payment for individuals was issued starting April 22, 2025, for those who filed their 2024 income tax and benefit return electronically by April 2, 2025.
• Since the CCR cannot be issued without information from an individual’s income tax and benefit return, eligible individuals who filed their returns after April 2, 2025, will receive their final CCR quarterly payment after their 2024 return is assessed.

Context

Fuel charge

• Under Part 1 of the GGPPA, the CRA is responsible for the collection/administration of the federal fuel charge in Alberta, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Nunavut, Ontario, Prince Edward Island, Saskatchewan, and Yukon (known as listed provinces).
• Fuel producers, distributors, importers, and certain users (commercial carriers) that have business activities in listed provinces have to register with the CRA and file a monthly fuel charge return. Interjurisdictional road carriers also have to register and file quarterly returns. Currently, there are approximately 14,000 registrants in the program.
  • Effective April 1, 2025, fuel charge filing requirements for registrants ceased. Registrants must still file any outstanding fuel charge returns and pay any amounts owing for reporting periods prior to April 1, 2025.
• While the fuel charge ceased as of April 1, 2025, the fuel charge program will continue compliance efforts, including wind-down activities needed to ensure proper fuel charge amounts are reported and paid. Resources are required to promote electronic reporting, to update and maintain information technology systems, to perform revenue collection activities, to process objections and appeals, to deliver training and provide guidance to CRA employees, to perform outreach with stakeholders, and to publish and update technical notices informing those subject to the GGPPA of their responsibilities and how to fulfill them.
• [Redacted]

Canada Carbon Rebate

• The CCR is a tax-free amount to help eligible individuals and families offset the cost of the federal pollution pricing. It consists of a basic amount and a supplement for residents of small and rural communities.
• The CCR for Small Businesses is a refundable tax credit announced in Budget 2024 to return a portion of federal fuel charge proceeds directly to eligible Canadian-controlled private corporations (CCPCs), including Indigenous CCPCs.
• On March 15, 2025, the Government of Canada stopped the federal fuel charge, thereby ending the CCR for individuals and small businesses.
• A portion of fuel charge proceeds from 2019-2020 through 2023-2024 has been returned to the majority of eligible CCPC. Proceeds for the 2024-2025 fuel charge year will be returned in a similar manner.

Federal Budget and Fall Economic Statement

Description

• The Federal Budget and Fall Economic Statement (FES) are key government statements outlining the government’s fiscal, social, and economic policies and priorities. These statements are critical to the work of the CRA, as they often include proposed tax measures that result in new or amended legislation that the CRA is mandated to administer. As these statements are Cabinet decisions, and as such are Cabinet confidence, they are not shared with the public until they are in Parliament.

Key Messages

• Before the government makes any public announcements on new tax measures, it is important that the CRA is given sufficient time to provide feedback on administrative impacts, and prepare for the implementation of the new measures, including making any necessary systems and forms changes; and the appropriate legislative authorities, time, and financial resources to administer the new measures.
• Consistent with constitutional and parliamentary conventions, before making a payment or issuing a refund, the CRA will wait for Royal Assent of the legislative appropriation of these public funds.
• In cases other than the payment of a benefit or the issuance of a refund, the CRA will administer a proposed tax measure upon announcement, when two conditions are met: 1) Legislative amendments in final form are in the public domain (we need to know what the rules are); and 2) the proposed legislative amendments reflect the intent of the government. This second condition will be satisfied when legislative amendments have been tabled by a Minister in a Notice of Ways and Means Motion (NWMM), or as a bill at First Reading, if there was no motion.
• By contrast, having draft legislation posted on the Department of Finance Canada’s (FIN) website, for consultation, would not meet this condition (by definition, consultation drafts are not considered to be in final form). CRA precedents include limited exceptions to this condition: in exceptional cases, the CRA started to administer on the basis of a detailed press release having been issued by the Minister of Finance or the Prime Minister, which indicated the government’s intent to proceed with legislation.
• The CRA will cease to administer a proposal if the government indicates that the NWMM no longer reflects the government’s intent.

Context

Budget 2025

• [Redacted]

Fall Economic Statement 2024

• On December 16, 2024, the Leader of the Government in the House of Commons tabled the 2024 FES, announcing 12 tax and benefit measures that would require the CRA’s administration. There is currently no legislation tabled in Parliament for the majority of 2024 FES measures and the CRA is not administering these measures yet.

Budget 2024

• On April 16, 2024, the Minister of Finance tabled the 2024 Federal Budget, with 36 tax and benefit measures that would require the CRA’s administration. Some of these measures were contained in Bill C-69, which received Royal Assent on June 20, 2024. The CRA is currently administering these measures. For most of the remaining measures, draft legislation was released for public consultation on August 12, 2024. The CRA is not administering these measures yet.

Considerations

[Redacted]

External fraud landscape at the CRA

Description

• The CRA has a duty to protect the programs it administers against external fraud to preserve the integrity of Canada’s tax system. Like most public and private sector organizations, the CRA faces potential fraud from a variety of threat actors.
• This is why the CRA has adopted a robust approach to detect, prevent, and address external fraud risks. Fraud risk management is part of the CRA’s priority to strengthen security, identity management, and privacy safeguards, [Redacted]

Key Messages

• The CRA is adapting and keeping pace with the new fraud landscape and continues to detect threats and respond to schemes.
• No organization is immune to fraudulent activity. The CRA continues to adjust and improve its anti-fraud measures in response to an ever-evolving threat environment.

Context

• In recent years, the world has seen a push for greater digitalization of programs and services. Canadians use their personal information online more than ever, which is leveraged by fraudsters. This has led to a rising tide of complex fraud schemes in both the private and public sectors.
• The CRA suffered a credential stuffing attack in August 2020, demonstrating its attractiveness as a target for threat actors.
  • This has led to investigations by the Office of the Privacy Commissioner (OPC), which culminated in the OPC making several recommendations aimed at improving the CRA’s measures to prevent unauthorized access.
  • The CRA has since implemented corrective actions and accepted all additional recommendations made by the OPC.
• In October 2024, the OPC launched another investigation into the CRA related to more than 30,000 privacy breaches dating back to 2020.
  • This investigation was initiated following a complaint from a member of Parliament resulting from increased media attention on fraud at the CRA. This also led to Parliamentary hearings on the topic in December 2024.

Considerations

• External fraud can lead to several harmful consequences for the CRA and for Canadians, including privacy breaches, impacts to CRA’s data integrity, financial loss to the CRA, such as through unwarranted benefits or refunds, loss of trust in the CRA, and potential media coverage.
• The CRA is working with partners across the Government of Canada, the provinces and territories, international counterparts, and the private sector to understand and respond to today’s fraud landscape.
• In response to increasing fraud risks, the CRA has:
  • Leveraged open-source intelligence to identify fraud;
  • Enhanced cyber and information security protocols;
  • Launched a proactive external fraud risk management function to analyze and safeguard CRA programs against potential methods of fraud;
  • Expanded on a dedicated Identity Protection Services program to protect, restore, and monitor Canadians’ CRA accounts in cases of identity theft;
  • Increased awareness of fraud through external communication campaigns as well as through internal initiatives to enable employees to detect, prevent, and address it;
  • Leveraged business intelligence and analytics capabilities to detect fraud;
  • Emphasized fraud mitigation in the design of new programs and services;
  • Reinforced governance and oversight by CRA senior management;
  • Implemented the CRA’s Management Action Plan in response to the OPC investigation into the summer 2020 cyber attacks.

Next Steps

• The CRA will continue to meet the challenges of the evolving fraud landscape by:
  • Supplementing protection of CRA and taxpayer information with artificial intelligence solutions and manual safeguards;
  • Strengthening identity management and protection services;
  • Ensuring synergy between service and security;
  • Applying an external fraud risk and account security lens in the design and delivery of programs and services;
  • Continuing to improve our interventions when something deviates from established trends and patterns;
  • Working with external partners and industry experts to identify gaps, assess vulnerabilities, and share best practices;
  • Continuing to fulfil our privacy policy obligations around the reporting of material privacy breaches to the OPC and Treasury Board of Canada Secretariat, and cooperate fully with the OPC on their current investigation into CRA privacy breaches resulting from fraud.

Mortgage fraud/income verification

Description

• In the fall of 2024, the CRA consulted mortgage industry professionals on developing a tool to verify borrowers’ income. The CRA hosted roundtables for representatives of mortgage industry associations to discuss challenges verifying income and opportunities to support the industry and reduce risks of mortgage fraud.
• While combating mortgage fraud falls outside the scope of the CRA’s core mandate, the CRA holds many of the documents and information sought by lenders as proof of income. Therefore, industry stakeholders have expressed interest in verifying borrowers’ information with the CRA directly.

Key messages

• At the CRA, we are committed to continually assessing and improving our services to meet the diverse needs of clients. By seeking their feedback, we strive to make our programs and services more streamlined and client-centric, while safeguarding the privacy and security of personal information.
• Throughout the fall 2024, the CRA consulted with stakeholders in the mortgage industry to seek input on the mortgage fraud environment and gather requirements for the potential development of a tool that could allow financial institutions to independently verify borrower income, while helping detect and deter mortgage fraud.
• The CRA aimed to engage a broad range of stakeholders and industry professionals, ensuring that the tool meets the needs of various groups within the mortgage industry. The CRA will publish a “What we learned” report externally in Spring 2025.

Context

• Budget 2024 announced the government’s intention to “consult with the mortgage industry on making a tool available through the Canada Revenue Agency to complement the existing strategies of financial institutions to verify borrower income for mortgages”.
• The 2024 Fall Economic Statement (FES) announced that the CRA was consulting the mortgage industry on how to best design and implement a new tool to combat mortgage fraud and that CRA aimed to begin implementation in early 2025. The tool would enable mortgage lenders to interact with CRA directly and securely to validate borrower income.
• Following consultations held in fall 2024, the CRA will publish a “What we learned” report externally in Spring 2025.

Considerations

• [Redacted]
• [Redacted]
• [Redacted]
• The mortgage industry has expressed a clear desire to have a tool implemented as soon as possible, and CRA has seen a substantial increase in stakeholder inquiries since the FES 2024 announcement.