The short version
- CRA asks for information in two ways: an ordinary request during a review or audit, and a formal "requirement" under section 231.2 of the Income Tax Act, which is a legal demand with penalties for ignoring it.
- For audits, CRA's standard timelines give up to 30 days for the first request for records, then 15, 30 or up to 60 days for follow-ups depending on how available the information is.
- Ignore a formal requirement and CRA can ask a court for a compliance order. Failing to comply is also an offence with fines.
- Send what's asked for, organized, with the reference number, and keep copies. You don't have to hand over documents protected by solicitor-client privilege.
- Before you send anything, make sure the request is real: check My Account or call CRA at the number on canada.ca, not the one in a text or email.
CRA Request for Information: How to Respond
CRA asking for information is routine. CRA asking for information the second time, in a letter with a section number in it, is less routine. The difference between those two letters is usually one missed deadline. Here's how to tell what kind of request you have, what you're obliged to send, and how to send it so the file closes instead of growing.
What Kind of Request Is It?
| Request | What it looks like | How serious |
|---|---|---|
| Review letter | "Please send receipts for your medical expenses by…" | Routine; ignoring it means the claim is denied. See CRA review letter |
| Audit request | An auditor's list of books and records, often after a phone call | Routine within an audit; follow-ups get stricter. See CRA audit |
| Follow-up request | A second letter warning that a compliance order may be sought | Take it seriously and answer by the date |
| Requirement (section 231.2) | A formal letter citing the Income Tax Act or Excise Tax Act and a deadline | A legal obligation; penalties and court orders can follow |
| Third-party requirement | Sent to your bank, a client or a platform about you | CRA can get records about you without asking you first |
Which kind of letter is this?
Upload it. The Document Analyzer tells you whether it's a review, an audit request or a formal requirement, what exactly CRA asked for, and the deadline.
Deadlines
The letter's date governs. For audits, CRA's own standard timelines are:
| Request | Time given (up to) |
|---|---|
| First request for books and records | 30 days |
| Additional information that's readily available | 15 days |
| Information that isn't readily available | 30 days |
| Not readily available, with extenuating circumstances | 60 days |
| Response to a proposal letter | 30 days |
Need more time? Ask before the deadline, in writing if you can, with a reason and a realistic date. CRA commits to getting back to you within 30 days of receiving what it asked for.
How to Respond
- List each item requested, in CRA's order and numbering.
- Match each item to a document, or a short explanation of why it doesn't exist.
- Send only what's asked. Extra documents create extra questions.
- Organize and label: one PDF per item, named by item number, rather than 400 photos of receipts.
- Submit with the reference number, through My Account, My Business Account, Represent a Client, or to the auditor as instructed.
- Keep a copy of the whole package and the confirmation.
For bank deposits, auditors usually want an explanation of every non-business deposit: transfers between your own accounts, loans, gifts, sale of personal items. A short spreadsheet of these saves a lot of back and forth; see cash income for why deposits matter.
What You Don't Have to Give
- Privileged documents: communications with your lawyer for legal advice are protected by solicitor-client privilege. Accountant communications generally aren't, unless the accountant was working for your lawyer.
- Information outside the request. Answer the question asked.
- Documents that don't exist. CRA can ask for records you're required to keep; it can't make you create history. But missing records you were required to keep are their own problem; see recordkeeping requirements.
If You Don't Comply
- The claim or expense is denied and you're reassessed.
- CRA estimates your income, sometimes with a net worth assessment.
- Compliance order: CRA can ask a court to order you to provide the information. Ignoring a court order is contempt.
- Offence: failing to comply with a requirement can lead to fines and, in serious cases, imprisonment.
- Proposed: a "notice of non-compliance" carrying $50 a day, up to $25,000, and pausing the reassessment deadline. It was still draft legislation when we checked.
Is It Really CRA?
Scammers love this topic. Real CRA requests show up in your CRA account (My Account or My Business Account) or by mail, reference your file, and never ask for payment by gift card or crypto, threaten arrest, or send a link to "verify your identity" by text. If in doubt, log in yourself or call CRA at the number listed on canada.ca. More on CRA and its letters is on the CRA guide.
Rules of Thumb
- Write down the deadline the day the letter arrives.
- Ask for time before you need it, not after.
- One clean package beats five partial ones.
- Get help when the request is formal, covers several years, or asks about income you're worried about.
Records you should have kept, and for how long, are on how long to keep tax records. If the request ends in a reassessment you disagree with, see CRA objection.
Request for Information Questions
Do I have to give CRA the information it asks for?
For records you are required to keep and information related to your tax obligations, generally yes. A formal requirement under section 231.2 is a legal obligation, and CRA can seek a court compliance order if you do not respond.
How long do I have to respond to a CRA request?
The deadline in the letter governs. In audits, CRA’s standard timelines allow up to 30 days for a first request for records and 15 to 60 days for follow-up requests.
Can I get more time to respond to CRA?
Usually yes, if you ask before the deadline and explain why. Contact the person or number on the letter.
Can CRA get my bank records without asking me?
Yes. CRA can send a requirement for information to third parties such as banks about a specific taxpayer.
Do I have to give CRA letters from my lawyer?
No. Communications with your lawyer for the purpose of legal advice are protected by solicitor-client privilege.
Sources: CRA, Standard timelines for information requests (AD-20-01); RC4188 What you should know about audits; Miller Thomson, The new notice of non-compliance (February 2026). Checked October 2026. Requirement, compliance order and offence rules are summarized from sections 231.2, 231.7 and 238 of the Income Tax Act as we understand them; specific fine amounts are not given because they depend on the court. The notice of non-compliance was draft legislation when checked.
Last reviewed October 5, 2026 against CRA and Government of Canada sources. How we check our facts.