Setting Up Your CRA Account

What It Actually Is

One sign-in, two sides. My Account is the personal side: your slips, notices of assessment, benefit payments, RRSP and TFSA room, any balance owing, and the controls for direct deposit and address changes. My Business Account is the corporate and sole-proprietor side: GST/HST, payroll, corporate income tax, and program account registration.

Both matter to us for the same practical reason. Once you've authorized us, we can see what the CRA sees. That's how we catch a slip you forgot, confirm your carryforwards against the CRA's own record rather than last year's paperwork, and answer a review letter without a week of back-and-forth collecting documents you already sent once.

What to Have in Front of You

Registration asks you to prove you are who you say you are, so gather these first:

• Your social insurance number
• Your date of birth
• Your current address, matching what the CRA has on file
• An amount from a recent return — usually a specific line from the current or previous tax year, so have your last notice of assessment handy

That last one is where most people stall. If you've never filed, or the CRA's address for you is two moves old, the online path won't complete and you'll need to sort out the mismatch first. Tell us if you hit that — it's a common and fixable problem, not a dead end.

Two Ways In, and One Is Much Faster

You can sign in with a CRA user ID and password, through a Sign-In Partner (your own bank's login, which means one fewer password to keep), or through a provincial partner in British Columbia and Alberta. Whichever you pick, the account is the same underneath.

The step that decides your timeline is identity verification. Verifying with a photo of an accepted identity document can complete the same session, so you're in immediately. The alternative is a security code sent by mail, which can take up to ten business days to arrive and leaves your access limited until you enter it.

So: don't leave this to the week your return is due. If you're going the mail route in April, the code lands after the deadline.

If You Run a Business, This Is No Longer Optional

Two changes closed the alternatives. The CRA stopped taking business number and program account registrations by phone in November 2025. Then, as of July 14, 2026, Business Registration Online sits behind a CRA account sign-in — so registering a BN, a GST/HST account, or a payroll account means having the account first.

Read that alongside the verification timeline above and the order matters: register for the account, verify your identity, then plan to register the business. Someone who needs a payroll account by month-end and starts with a mailed security code is going to miss it.

There's a second business change worth knowing, because it runs on a clock. Business correspondence now arrives as online mail by default. When the CRA posts a notice of assessment or a decision on an objection to your account, the 90-day window to object starts then — whether or not anyone has logged in to read it. A business that never checks the portal can lose an appeal right without ever seeing the letter. You can request paper mail instead using Form RC681, but that has to be renewed every two years.

What Changed in 2026

Three things landed this year that all push the same direction:

• Drop boxes closed permanently on May 29, 2026. All 45 of them. Paper now goes by mail, which is slower, or through the account, which isn't. The CRA cited a 78% fall in use since 2018–19, plus security problems
• Business Registration Online moved behind the sign-in on July 14, 2026. Covered above — plan the ten-day verification window into it
• Disability tax credit submissions changed on July 14, 2026. The account's "submit documents" feature no longer accepts DTC applications unless the CRA has asked you for more information on a file already open. Applications go through the digital DTC form or by mail. And from September 8, 2026, versions of Form T2201 issued before 2023 are no longer accepted at all

None of these are disasters on their own. Together they mean the account has stopped being the convenient option and become the default one.

While You're In There

Two settings are worth thirty seconds each. Direct deposit is the difference between a refund in about eight business days and a cheque in the mail weeks later, and it's the reason a wildfire or a postal disruption doesn't touch clients who've set it up. Email notifications tell you when something new is posted, which is the practical answer to the 90-day problem above.

Multi-factor authentication is required, so have your phone to hand. Keep the recovery options current — losing access to the second factor is a slower problem to fix than forgetting the password.