Canada Crypto Audits: How the CRA Tracks Crypto, What Letters They Send, and What Happens Next

Yes, the CRA can track your cryptocurrency. If you are still operating on the assumption that crypto is invisible to Canadian tax authorities, that assumption is years out of date and increasingly expensive to hold onto.

I am Chris Herbst, founder of CountDeFi and a registered Tax Professional (GTP, CIBA). We work with Canadian crypto investors across the country, and the question I get more than almost any other is some version of: "How would the CRA even know?" The honest answer, in 2026, is: through more channels than most investors realise, and the number of those channels is growing. This guide explains exactly how the CRA finds unreported crypto activity, what letters they send when they do, and what the audit process actually looks like from the moment you receive that first letter to the moment the file closes.

Can the CRA Track Cryptocurrency in Canada?

Yes. The CRA has multiple practical pathways to connect your identity to your crypto activity, and each pathway has become more reliable and better resourced over the past several years.

The CRA has a dedicated cryptoasset audit program. Canadian Press reporting from December 2025 describes a team of CRA crypto auditors working through hundreds of active files, generating significant tax recovery from crypto-related audits over three years. The same reporting cites a CRA estimate that a substantial proportion of taxpayers using crypto platforms are either evading taxes or at high risk of non-compliance. Those figures have not been formally confirmed in CRA primary guidance, but the direction is clear: the CRA considers crypto non-compliance a significant and growing problem, and it is actively resourcing enforcement accordingly.

The CRA cannot yet see everything. But what it can already see is substantial, and the infrastructure to see significantly more is being built right now.

How the CRA Tracks Crypto: Five Data Sources

1. Exchange KYC Data and FINTRAC Registration

Exchanges carrying on business in Canada are generally required to hold the appropriate FINTRAC registration as Money Services Businesses. That registration requires mandatory identity verification for customers. Your government-issued ID is tied to your exchange account. Your exchange account is tied to your deposit and withdrawal wallet addresses. Exchanges must verify customer identities, maintain detailed transaction records, and file Suspicious Transaction Reports when they detect potential issues.

When you sign up for a FINTRAC-registered platform and complete KYC, you are creating a documented link between your legal identity and your on-chain addresses. That link persists in the exchange's records, and those records are subject to CRA access through information requests and court orders.

At CountDeFi, we see clients regularly who are surprised by how much data their exchanges retain about them. Consider an investor who has been trading on a foreign exchange under the assumption that activity there is not visible to Canadian authorities. If that exchange holds KYC records and is subject to a regulatory information request, that assumption may not hold. The link between identity and activity can surface through channels the investor never considered.

2. Court-Ordered Unnamed Persons Requirements

The CRA has the authority to compel exchanges to produce customer data through what is called an Unnamed Persons Requirement, authorised by the Federal Court. The CRA used this power against Canadian exchange Coinsquare, obtaining a court-authorised order for information on certain customer accounts. More recently, the CRA obtained a court order requiring Dapper Labs to provide information on a specific group of platform users as part of an NFT tax investigation.

These orders do not target individuals by name. They identify categories of account, typically by transaction volume or account value thresholds, and everyone within that category gets pulled in. You do not need to be individually suspected of anything to find yourself in scope.

3. Banking and Payment Trails

Most crypto investors still interact with the traditional financial system at some point. You fund your exchange account from a Canadian bank account. You withdraw proceeds to a Canadian bank account. You pay expenses in fiat converted from crypto. Even where the underlying crypto activity is on-chain, most investors create a traditional financial footprint, and that footprint is often where a CRA audit begins.

Large deposits or withdrawals that do not correspond to reported income are a standard audit trigger. At CountDeFi, we have worked with clients whose audit originated not from any crypto-specific flag, but from unexplained bank deposits that the CRA identified through standard income matching. The bank trail was the entry point, not the blockchain.

4. Blockchain Analytics and the J5

Most blockchains are public ledgers. Wallet addresses do not display your name, but they display every transaction ever made, every balance held, and every address ever interacted with. Once a wallet touches a regulated chokepoint, such as a centralised exchange, a crypto ATM, or a bank-funded on-ramp, it becomes possible to associate that on-chain activity with a real identity.

The CRA participates in the Joint Chiefs of Global Tax Enforcement (J5), a coalition of tax administrators from Canada, the United States, Australia, the United Kingdom, and the Netherlands. J5 materials describe investigators, cryptocurrency experts, and data scientists working to generate leads using data from open and investigative sources, with noted involvement from blockchain analytics firms. The J5 focuses specifically on information sharing and joint investigations targeting crypto-related tax evasion across jurisdictions.

If you have activity connecting to addresses in multiple countries, more than one tax authority may have visibility into it.

5. CARF: International Data Sharing

This is the pipeline that changes the enforcement landscape most significantly for the medium term. Canada is implementing the OECD's Crypto-Asset Reporting Framework through proposed amendments to the Income Tax Act, with first reporting intended for 2027 covering the 2026 calendar year, subject to the legislative process. Under the proposed framework, Canadian crypto-asset service providers would be required to report user information including full name, address, date of birth, jurisdiction of residence, and taxpayer identification number, as well as details of exchanges between crypto and fiat, exchanges between different crypto-assets, and certain transfers.

More than 40 countries are implementing CARF or equivalent frameworks, with information to be shared automatically between participating tax authorities. If you are trading on foreign platforms, this applies to you. A Canadian investor using a platform registered in the EU, the UK, or Australia may have their activity reported to those jurisdictions and shared back to the CRA under reciprocal exchange agreements.

What Triggers a CRA Crypto Audit

The CRA uses a risk-based system to select files for audit. Crypto-specific triggers we see come up repeatedly in our work at CountDeFi include:

Unreported income identified through third-party data. If exchange data obtained through FINTRAC, court orders, or information-sharing shows proceeds that do not appear on a return, that mismatch is a direct audit trigger. This is the most common scenario we see.

Large or unusual bank deposits. Proceeds from crypto sales deposited into Canadian bank accounts without corresponding reported income flag in standard CRA income matching.

Frequent trading without corresponding income declaration. High-volume traders who report nothing, or who may have misclassified business income as capital gains, are a targeted category. The CRA has publicly stated that crypto is an active area of audit focus.

Missing T1135 filings. Whether crypto held on foreign exchanges constitutes specified foreign property for T1135 purposes is not straightforward, and CRA guidance in this area is not fully settled. However, if you hold significant crypto assets on foreign platforms and have not considered your T1135 obligations, this is worth reviewing with a qualified Canadian tax professional. Failure to file when required carries significant penalties.

Discrepancies between lifestyle and reported income. The CRA can conduct net worth assessments in cases where reported income does not appear to support an investor's apparent lifestyle or financial activity. This is less common but does happen in crypto cases.

Random selection. Some audits are genuinely random. Being selected does not always mean something went wrong.

CRA Letters and Notices: What Each One Means

Not every letter from the CRA is an audit. Understanding the escalation ladder matters because the appropriate response differs significantly depending on where in the process you are.

Notice of Assessment (NOA). The standard letter confirming how your return was processed. It establishes the official record of what the CRA believes you owe or will be refunded. Always review it carefully. You have 90 days from the date of the NOA to file a Notice of Objection if you disagree with anything on it.

Pre-Assessment Review Letter. Sent before your return is fully processed, asking for supporting documentation. For crypto investors, this often means the CRA wants to see ACB calculations and transaction records before it finalises the assessment. Respond promptly with the requested documentation.

Post-Assessment Review Letter. Similar to a pre-assessment review but sent after your return has been processed. The CRA is asking you to substantiate claims already made. Respond with documentation. This is not yet an audit but failure to respond adequately can escalate it to one.

Request for Information (RFI). A formal demand for specific documents, records, or clarification. This is more targeted than a review letter and signals the CRA has identified something specific it wants to examine. In crypto cases, this often accompanies data the CRA has already obtained from a third party. Respond completely and on time, and do not volunteer information beyond what is specifically requested.

Audit Notification Letter. This formally opens an audit. It specifies the tax years under review, lists the documents being requested, and typically provides a deadline for initial response. Read it carefully. The scope it defines gives you a good indication of what the CRA already knows and what it is trying to establish.

Proposal Letter. Issued during or at the conclusion of an audit when the CRA has made preliminary findings and proposes adjustments to your return. This is not final and can be contested via additional submissions. This is your opportunity to push back with documentation, legal arguments, and corrected calculations before anything becomes binding.

Notice of Reassessment. The formal outcome of an audit where the CRA has made adjustments. This triggers your 90-day window to file a Notice of Objection if you disagree. Do not miss this deadline.

A note on scams. CRA scam warnings are clear that the agency will never demand immediate payment via Interac e-transfer, cryptocurrency, prepaid credit cards, or gift cards. Legitimate CRA correspondence arrives by mail or through your CRA My Account portal. If something looks unusual, verify by logging into My Account independently or calling the CRA directly using the number from their official website.

The CRA Crypto Audit Questionnaire

One thing most guides do not mention, and which catches investors completely off guard, is that CRA crypto audits have historically included a detailed crypto-specific questionnaire sent alongside or shortly after the audit notification letter.

Based on published accounts from Canadian tax lawyers who have worked through these audits with clients, the questionnaire is extensive, running to multiple pages and covering a wide range of topics. These include every exchange and platform ever used, every wallet held, DeFi protocols interacted with, mining and staking activity, airdrops received, and NFT transactions. It asks about current and historical activity and is not necessarily limited to the tax year under audit.

We have worked with clients at CountDeFi who received this questionnaire mid-audit and found the reconstruction exercise genuinely overwhelming. Consider an investor who has been active in crypto since 2017, used multiple exchanges, held assets across several wallets, and participated in DeFi protocols. Reconstructing that complete history under audit pressure, within a tight response deadline, while ensuring accuracy, is a significant undertaking.

The questionnaire rewards investors who have maintained complete records from the beginning. For everyone else, it requires a reconstruction project at the worst possible time. Get your records organised before you need them.

The CRA Crypto Audit Process: Step by Step

Step 1: Initial Contact Letter

The audit formally begins with the audit notification letter. This outlines the tax years under review, the documents being requested, and the deadline for your initial response. Read it in full as soon as it arrives, note every deadline, and do not ignore it. Ignoring a CRA audit notification does not make the audit go away. It typically results in the CRA making assumptions in the absence of your input, which is almost always worse than engaging.

At this stage, consider engaging a qualified tax professional immediately. CRA audit requests cast a wide net by design, and not everything requested needs to be provided in the way the request implies. A professional with experience in crypto audits can help you respond appropriately without inadvertently creating new exposure.

Step 2: The Crypto Questionnaire

Shortly after the initial letter, crypto audits typically include the detailed questionnaire described above. Answer carefully, accurately, and completely within the scope of what is asked. Do not guess. If you are uncertain about a platform you may have used, investigate before responding rather than leaving it blank or answering incorrectly. An inaccurate answer is a larger problem than an incomplete one you flag for follow-up.

Crypto audits often come down to one central question: show us the complete story of your crypto activity, where it came from, where it went, and how you calculated what you reported. Everything you provide in the questionnaire shapes how the auditor frames that story.

Step 3: Document Submission

The CRA will request your transaction records, ACB calculations, exchange statements, wallet records, and documentation relevant to your reported or unreported activity. The CRA expects records sufficient to establish the CAD value of each transaction at the time it occurred.

This is the stage where incomplete records become expensive. At CountDeFi, we have helped clients work through document submissions for audits covering multiple years and multiple chains. In one case, a client came to us part-way through an active audit with minimal records for the first two years of a four-year trading history. We reconstructed that history from on-chain data, archived exchange statements, and bank records. That reconstruction happened under deadline pressure and at significant cost. Maintained from the start, those records would have made the audit straightforward.

Step 4: CRA Review and Potential Proposal Letter

The CRA reviews your submissions. If the auditor identifies discrepancies between what was reported and what the evidence shows, they will typically issue a Proposal Letter outlining proposed adjustments. You can respond with further documentation and legal arguments. Engage actively at this stage. A well-prepared counter-submission addressing each proposed adjustment is substantially more effective than a general objection.

Step 5: Outcome

The audit concludes in one of several ways depending on the CRA's findings. If your records support your return, the file may close with no changes. If adjustments are proposed and accepted, the CRA issues a Notice of Reassessment reflecting the changes. If you disagree with a reassessment, you have 90 days to file a Notice of Objection, which triggers a formal review by the CRA's Appeals division. If that process does not resolve the matter, the next step is the Tax Court of Canada.

What Happens If the CRA Finds Unreported Crypto Income

If the audit reveals unreported crypto income, the consequences depend on the nature and scale of the non-compliance.

Reassessment with interest. The CRA will reassess the relevant tax years to include the unreported income. Interest accrues from the original filing deadline at the CRA's prescribed rate. The longer the gap between when the income was earned and when the audit concludes, the larger the interest component.

Gross negligence penalties. Where the CRA determines that omissions were made knowingly or in circumstances amounting to gross negligence, it can apply a penalty of 50% of the additional tax assessed. This is separate from interest and applies on top of the tax owed.

Repeated failure to report income penalty. Under the Income Tax Act, if you fail to report an amount of income in a given year and you also failed to report income in any of the three preceding years, the CRA can apply a federal penalty. The full rule is more nuanced than a simple summary captures, and the penalty structure has changed over time. If you have repeated omissions across multiple years, get specific professional advice on what applies to your situation.

Criminal prosecution. Reserved for the most serious cases involving deliberate and sustained tax evasion. Criminal conviction under the Income Tax Act can result in significant fines and imprisonment. The CRA does publish records of criminal investigations and convictions on its website.

The practical reality we see at CountDeFi is that most crypto tax non-compliance in Canada is not deliberate evasion. It is investors who did not understand what was reportable, did not know how to calculate their ACB correctly, or assumed they had more time. The CRA's enforcement capability means that window is closing, and the cost of being found non-compliant is substantially higher than the cost of filing correctly in the first place.

The Voluntary Disclosures Program: An Option If You Have Unreported History

If you have unreported crypto income from prior years and have not yet been contacted by the CRA, the Voluntary Disclosures Program (VDP) is worth understanding. Under the VDP, you can come forward to correct past returns before the CRA initiates contact. If your application is accepted, you will owe the tax and interest but may avoid gross negligence penalties and criminal prosecution. The key condition is that the disclosure must be genuinely voluntary: the CRA must not already be aware of the non-compliance when you apply.

The VDP application must be submitted before the CRA contacts you about the specific non-compliance you are disclosing. If you are considering a VDP application, do not attempt it without professional guidance. A poorly prepared or incomplete application can be rejected, and once rejected, you lose the protections the program provides.

How to Protect Yourself Before the CRA Comes Knocking

The investors who navigate CRA crypto audits most successfully are not the ones with the smallest tax bills. They are the ones with the best records.

The CRA's own guidance on crypto recordkeeping is specific. For each transaction you should retain the date, the type of transaction, the amount in CAD at the time, the wallet addresses involved, the exchange used, and any receipts or confirmations. These records should be maintained even if a platform closes.

In practice, what we tell every Canadian client at CountDeFi is this: your records need to be complete enough to reconstruct your full ACB for every asset you have ever held, from the first time you acquired it to the present day. A gap anywhere in that chain affects every calculation downstream.

Beyond records, the practical steps that reduce audit risk are:

• Report all taxable events, including activity that did not generate a profit
• Review your T1135 obligations with a qualified professional if you hold significant crypto assets on foreign platforms
• Do not confuse capital gains treatment with business income treatment and get professional guidance if you are unsure which applies
• Document wallet-to-wallet transfers clearly as non-taxable transfers with evidence of ownership of both wallets
• If you have unreported history from prior years, consider the VDP before the CRA finds it first

The CRA's enforcement capability is not yet complete. But the tools it already has are sufficient to identify a significant proportion of non-compliant Canadian crypto investors. The infrastructure being built over the next few years will expand that capability considerably.

Compliance is cheaper than the alternative. If your crypto tax history is complex, incomplete, or uncertain, the time to address it is before the CRA asks you about it. Book a free 15-minute call with CountDeFi today.

‍

‍