CRA requests for personal banking info: Out of line?

Many practitioners are surprised when tax auditors ask for banking records from business owners and their families. Find out the reasons behind these requests and how you can make small business audits proceed more efficiently.

Asking taxpayers for their personal banking information is invasive – a fact that the Canada Revenue Agency (CRA) recognizes. Many small business owners and their advisers believe these requests are out of line.

But, the CRA does not make these requests lightly. In fact, the CRA says its processes aim to ensure tax auditors only ask for complete bank records after a CRA assessment suggests that a business might be at risk for unreported income.

After discussing this topic with CPA Canada’s Small and Medium Practitioners Tax Committee, CRA officials shared information about the CRA’s Indirect Verification of Income (IVI) procedures at CPA Canada’s The ONE conference in September 2018.

The CRA’s audit results show that small businesses have significant non compliance. In the CRA’s audits of over 9,500 small businesses last year, the CRA found unreported income in 26 per cent of these audits, resulting in $239 million in recovered taxes. In view of this heightened risk, the CRA conducts thorough audits in the sector to protect the integrity of the tax system and level the playing field for all businesses.


The CRA only requires complete banking records when a business is considered at risk for unreported income. The CRA performs IVI testing early in small business audits to quantify the risk of unreported income. These tests include analyzing bank deposits, rough net worth, source and application of funds, and ratio analysis. The CRA’s concerns include:

  • the presence of personal bank deposits related to taxable sources of income that have not been reported
  • the presence of personal assets that are not supported by taxable earnings and business income
  • a lack of documented personal spending (e.g., cheques and credit card charges) that may indicate that unreported cash earnings are being used to pay personal expenses.

CRA auditors cannot identify and deal with these concerns if they focus only on the corporation.

If these IVI tests confirm there is a high risk of unreported income, only then would the CRA move forward with an IVI assessment. This involves assessing net worth, unidentified bank deposits and projections.

Last year, the CRA says IVI testing was conducted in 36 per cent of small business audits, and IVI assessments were considered warranted in only 20 per cent of these cases.

How do auditors decide to conduct IVI testing? When a business is chosen for audit because of a specific risk factor, CRA policy mandates IVI testing. For example, the business owner may have wealth indicators, like a speed boat, that they could not afford with their reported income.

In other cases, the auditor may determine during the audit that the business owner’s books and records are unreliable. For example, the business’s internal controls may be insufficient or the books and records themselves may be inadequate.

The CRA’s instructions to auditors on IVI audits are set out in the CRA’s Income Tax Audit Manual (Please contact us for more information on how to find the CRA’s audit manual.)


These IVI methods are personal in nature. Many small business owners use business and personal accounts interchangeably. The CRA therefore argues it needs to see business and personal banking records alike.

And, because family members often share personal funds, assets and liabilities, and expenses, the CRA also requests the records of the other contributing members of the household.

In some cases, the information obtained from the personal records of other family members may be helpful to the business under audit and the owner-manager. For example, a business owner may be reporting income that is too low to sustain their lifestyle. However, their spouse and adult children may contribute funds toward living expenses, or the taxpayer’s spouse may have received a large inheritance or won a lottery. This information would help the CRA understand the discrepancy between the owner’s reported income and their wealth indicators.

The CRA emphasizes that IVI helps tax auditors detect unreported income that they would not find by reviewing the business’s books and records. So, even though these techniques may seem invasive, the CRA argues that they are needed to show a complete picture of a taxpayer’s financial situation and they are effective in identifying gaps in taxpayer compliance. 

Smaller businesses and their owners can help ease the audit process by keeping all financial records on hand, including all personal bank account statements and documentation to support material sources of non-taxable income (e.g., gifts, inheritances, gambling winnings). Being ready to supply these records early in the audit process will make the audit much more efficient.

Finally, CPA Canada will continue to discuss these issues with the CRA in order to make the process as simple as possible.


What are your thoughts on the CRA’s requests for personal banking information? Post a comment below.


CPA Canada’s Tax Blog is designed to create an exchange of ideas on tax policy and practice issues, and their impact on those who practice tax. Your comments can provide helpful input into the public interest advocacy positions developed by CPA Canada.

About the Author

Bruce Ball, FCPA, FCA, CFP

Vice-president, Taxation, CPA Canada