For several years, cryptocurrency holders operated on the assumption that the blockchain was anonymous and the CRA had no practical way to find them. That assumption is now wrong. The CRA has built dedicated cryptocurrency audit teams, invested in blockchain-analysis software, obtained transaction records directly from Canadian exchanges, and plugged into international information-sharing networks. The result is that a great deal of cryptocurrency activity the CRA could once only guess at is now sitting in its files. This guide explains what triggers a crypto audit, how the CRA gets exchange data through unnamed-persons requirements, what records you need to keep, and how the Voluntary Disclosures Program works for unreported cryptocurrency.

How the CRA's enforcement capability changed

The CRA's cryptocurrency enforcement focus expanded substantially after 2018, and the tools now in use are real:

Exchange data requests. The CRA has obtained records from Canadian cryptocurrency exchanges, putting customer transaction histories directly in its hands.
International information exchange. The Common Reporting Standard, FATCA, and bilateral exchange-of-information arrangements give the CRA data on foreign-held assets of Canadian residents — including crypto held abroad.
On-chain analysis. The CRA uses blockchain-analysis tools that can trace cryptocurrency as it moves between wallets and on and off exchanges.
Dedicated audit programs. Specialized teams now focus on cryptocurrency non-compliance rather than treating it as a side issue in a general audit.

The combined effect is that the CRA can often reconstruct a taxpayer's crypto activity from the outside — from exchange records and on-chain data — and then compare it to what the taxpayer actually reported. A mismatch is a powerful audit lead.

It is worth being clear about what this does and does not mean. The CRA cannot see inside a self-custody wallet by name; the blockchain identifies addresses, not people. What it can do is connect an address to a person once that address interacts with a regulated, identity-verified exchange — and most holders eventually move funds on or off an exchange to convert to or from dollars. From that anchor point, on-chain analysis can follow the trail outward to associated addresses. The anonymity many holders assumed they had was, in practice, pseudonymity that collapses the moment a known exchange account enters the picture.

What triggers a crypto audit

Cryptocurrency audits arise through both the ordinary audit-selection channels and crypto-specific ones. The general audit triggers we describe in our overview of what triggers a CRA audit all apply, and several have a particular crypto flavour:

Data mismatches. Exchange records the CRA holds show dispositions you did not report.
Unexplained lifestyle and net worth. Significant assets — a home, vehicles, investments — that are not supported by reported income invite a net-worth or indirect-income assessment. Crypto gains that were never reported are a classic source of the gap.
Large or sudden bank deposits traceable to crypto exchange cash-outs.
Foreign-property gaps. A taxpayer who should have filed a T1135 for foreign-held crypto but did not.
Industry participation. Mining operations, exchange operators, and high-volume DeFi users draw attention because of the scale and complexity of their activity.

Once selected, a crypto audit can be document-intensive. The CRA will typically ask for complete records of every wallet and every exchange account, and it will not accept a vague summary in place of transaction-level detail.

Unnamed-persons requirements: how the CRA gets exchange data

The single most important development for crypto holders is the CRA's use of the unnamed-persons requirement. Under section 231.2 of the Income Tax Act, the CRA can compel a third party — such as a cryptocurrency exchange — to hand over information about a group of unidentified taxpayers, provided the CRA first obtains authorization from a judge of the Federal Court. The group is described by criteria (for example, "all Canadian customers of this exchange") rather than by name.

This is the mechanism behind the headlines about the CRA obtaining customer lists from crypto platforms. The same tool has long been used against banks and other intermediaries; we discuss its general operation in our article on the unnamed-persons search. The practical takeaway for crypto holders is stark: if you transacted on a Canadian exchange, the CRA may already have your records, even though it has never contacted you and never named you in any request.

That has a direct consequence for voluntary disclosure, discussed below. The voluntariness of a disclosure can be compromised once the CRA has obtained the data that would reveal the non-compliance, even before any audit letter arrives. Timing, therefore, matters a great deal.

The unnamed-persons mechanism is not unlimited. The Federal Court must be satisfied that the group is ascertainable and that the requirement is made to verify compliance with the Act, and the third party who receives the requirement has standing to contest it. Some exchanges have negotiated the scope of what they hand over. But these are limits on the breadth of a request, not a shield for the individual taxpayer: if your records fall within an authorized requirement, the negotiation over scope happened between the CRA and the exchange, not on your behalf. By the time most holders learn that their exchange produced records, the production is already complete.

What records to keep

Because cryptocurrency tax depends on transaction-level detail and Canadian-dollar valuations at the time of each event, the records you keep — or fail to keep — often determine the outcome of an audit. The CRA expects you to maintain, for every transaction:

The date of the transaction.
The type of transaction (purchase, sale, exchange, transfer, mining or staking receipt, payment, gift).
The cryptocurrency and quantity involved.
The value in Canadian dollars at the time of the transaction, with a record of the exchange-rate source used.
The wallet addresses and the exchange involved.
The counterparty where relevant.
Any transaction fees paid.
Supporting documents — exchange statements, transaction receipts, and records of how value was determined.

Practical advice that saves clients real money later: record every transaction at the time it happens, use a dedicated cryptocurrency tax tool, reconcile annually against your exchange statements, and keep the underlying data — not just the summary report. Exchanges close, accounts get locked, and on-chain history is hard to reconstruct years after the fact. The records you cannot produce in an audit are the positions you cannot defend.

The reconstruction problem

Many of the files we see involve incomplete records — a defunct exchange whose statements are gone, a lost private key, a hardware wallet with partial logs, or a tangle of DeFi transactions across protocols. This does not make compliance impossible, but it makes it harder. The reconstruction process generally runs:

Inventory every wallet and every exchange account, current and closed.
Pull all available historical transaction data.
Reconstruct on-chain history for self-custody wallets.
Characterize each transaction (capital or business; income event or disposition).
Determine the Canadian-dollar fair market value at each transaction.
Calculate gain or loss on each disposition using the average-cost method.
Address T1135 reporting for any foreign-held holdings.

Where records are genuinely incomplete, reasonable estimation supported by a documented methodology is the available path. The CRA generally accepts good-faith reconstruction backed by evidence. What it does not accept is a position with no support behind it. Documenting how you estimated is often as important as the estimate itself.

Voluntary disclosure for unreported crypto

If you have unreported cryptocurrency income or unfiled foreign-property forms, the Voluntary Disclosures Program (VDP) is the principal route to correcting the record on better terms than waiting to be caught. A successful disclosure can relieve penalties and, in some cases, partial interest, and it removes the spectre of prosecution for the disclosed conduct. The general mechanics — eligibility, the application, and the conditions — are set out step by step in our guide on VDP eligibility.

A few crypto-specific considerations deserve emphasis:

Voluntariness is fragile. A disclosure must be made before the CRA initiates enforcement action related to the information. Where your exchange has already provided your records to the CRA under an unnamed-persons requirement, your disclosure may no longer be considered voluntary — even though you have not personally received any audit letter. This is the single most important reason not to wait.
Disclosure must be complete. All exchanges, all wallets, all years, all transactions. Cryptocurrency reconstruction is voluminous, and a selective disclosure that leaves something out is not a valid disclosure.
Penalty exposure is the point. The relief is from penalties — including the gross-negligence penalty under subsection 163(2) that can otherwise reach 50% of the understated tax. The underlying tax and some interest remain payable.
Coordinate the U.S. side. Where crypto sits on a U.S. exchange and the taxpayer has any U.S. nexus, U.S. reporting (FBAR, Form 8938) may apply and should be addressed in the same project.

If you are weighing disclosure against simply waiting, our comparison of voluntary disclosure versus a CRA audit lays out the trade-offs.

One distinction matters more in crypto files than almost anywhere else: the difference between a "general" disclosure and a "limited" one. The VDP separates applications into tracks, and the more serious the conduct — large amounts, repeated years, active efforts to conceal — the less generous the relief. Crypto non-compliance can drift toward the more serious track when the facts show a holder who understood the obligations and chose not to report, or who moved funds specifically to stay out of sight. This is one reason the narrative accompanying a crypto disclosure deserves care: it frames the conduct, and the framing influences both the track and the penalty relief. A disclosure assembled in haste, with gaps the CRA later fills from its own exchange data, can undermine the very relief it was meant to secure.

The reporting that a crypto disclosure usually has to repair is not limited to unreported gains. Many files also require back-filed T1135 foreign-property statements, which carry their own penalties when missed, and amended returns to recharacterize income that was reported as capital when it should have been business income, or the reverse. Pulling all of these threads together — income, character, and foreign reporting — into a single coherent submission is the work, and it is why the reconstruction described above is the foundation on which a credible disclosure is built.

Defending a crypto audit

When an audit is already under way, the issues that recur are predictable. Active traders who reported capital gains must defend that characterization with contemporaneous evidence of investment intent and holding periods — see the capital-versus-business analysis in our cryptocurrency tax guide. ACB reconstruction disputes turn on methodology when the CRA's reconstruction differs from yours. Source-of-funds questions arise where crypto value shows up in your net worth without documented purchases. And mining or DeFi participants face characterization questions on income recognition. Each of these is a contestable position, not an automatic loss, and how the file is handled at the audit stage shapes everything that comes after at audit representation and, if necessary, on objection or appeal.

How Barrett Tax Law approaches crypto enforcement files

For taxpayers who have not yet been contacted but know they have a problem, the priority is assessing voluntary-disclosure eligibility quickly, before exchange data closes the window, and then building a complete and defensible reconstruction. For taxpayers already under audit, the work is characterization arguments, ACB reconstruction, foreign-reporting analysis, and a defence to any proposed gross-negligence penalty. Where there is a cross-border dimension, we coordinate with U.S. counsel. The earlier we see a file, the more options remain on the table — which is the practical reason to seek advice before, not after, the CRA's letter arrives.

Crypto and the CRA: Audit Risks, Exchange Data Requests, and Record-Keeping