CRA Represent a Client: RepID, GroupID and Business Authorization
the RepID / GroupID / BN authorization workflow every firm runs
Represent a Client is the CRA service through which an accountant accesses a client's tax accounts. An individual representative registers for a RepID; a firm registers a business number and can group representatives under a GroupID. Authorization is then requested per client and must be accepted by the client before access begins.
RepID, GroupID and BN — which do you need?
A RepID identifies an individual representative. A GroupID identifies a group of representatives, which is how a firm gives several staff access under one authorization. A business number identifies the firm itself. Most firms need all three, structured so authorizations survive staff turnover.
How authorization is requested
Authorization is requested electronically per client and per account type, then confirmed by the client. Business authorizations and individual authorizations follow different confirmation paths, and the CRA's process has changed more than once — check the current steps on the Represent a Client page before onboarding a batch of clients.
Access levels and why they matter
Authorization levels range from view-only to the ability to make changes. Granting every staff member the highest level is convenient and wrong; matching level to role is the same discipline as restricting confidential clients inside the firm's own systems.
Where this belongs in onboarding
Immediately after intake and before any work opens. An engagement that starts without authorization stalls the first time the firm needs an account balance or a notice of assessment, and chasing it later is harder than asking at the start.
Removing access when a client leaves
Authorizations persist until cancelled. A firm that never removes departed clients accumulates access it has no business holding — a privacy exposure and, in a review, an awkward one. Make cancellation a step in the offboarding checklist.
Frequently asked questions
What is a RepID?
A RepID is the identifier the CRA assigns to an individual representative registered in Represent a Client. It is personal to the representative, not to the firm, and follows them if they change employers — which is why firms usually authorize a GroupID rather than individual RepIDs.
What is a GroupID used for?
A GroupID lets a firm group representatives so a client authorizes the group rather than each individual. Staff can be added to or removed from the group without re-obtaining client authorization, which makes onboarding and turnover far less painful.
How long does CRA authorization take?
It depends on the authorization path and whether the client confirms promptly. Electronic requests confirmed by the client through their own CRA account are generally faster than alternatives. Because the CRA has changed the process more than once, confirm current timelines on the Represent a Client page.
Do I need separate authorization for business and personal accounts?
Yes. Authorization is granted per account. An owner-managed client typically requires authorization for the individual's personal account and for each of the corporation's program accounts the firm needs to see, such as corporate income tax, GST/HST and payroll.
Should authorizations be removed when a client leaves?
Yes. Authorizations remain in place until cancelled, so a firm that never removes departed clients retains access to tax accounts it has no reason to hold. Cancelling access belongs in the offboarding checklist alongside returning records.
Related guides
How firms run this
Turn these dates into tickets.
SpidNums generates the work from each client's cadence and year-end, then ranks it by proximity.