RC59: How to Authorize Your Tax Accountant with the CRA

The RC59 form no longer exists: the CRA retired it in February 2020 and replaced it with Form AUT-01, which grants offline access only. Full online access now runs through an electronic request your accountant submits in Represent a Client and you confirm inside your own CRA portal. Here is how the whole system works today.

For years, RC59 — the "Business Consent" form — was how a company told the CRA that its accountant was allowed to speak for it. Individuals had a parallel form, the T1013, and non-residents had the NR95. In February 2020 the CRA merged all three into a single form, AUT-01, Authorize a Representative for Offline Access, and redrew the map at the same time: the paper form now grants offline access only — your representative can phone and write to the CRA, but cannot see your account online — while full online access moved to an electronic process built around the CRA's own portals.

The old name still circulates because thousands of engagement letters, checklists and blog posts were written in the RC59 era, and because the CRA kept a cancellation cousin (the AUT-01X) whose lineage traces straight back to the RC59X. If a template or an adviser asks you to "sign an RC59" today, what they actually mean is one of the two current routes below — and nine times out of ten the one you want is the online one, because a representative who cannot see your account online is working with one hand tied behind their back.

What you are actually trying to do — let your accountant deal with the CRA on your behalf, for your business or your personal taxes — is still very much a thing, and getting it right is the difference between a representative who can fix problems for you and one who gets stonewalled on every call. The rest of this guide covers the system end to end: the online route that grants full access, the paper route that grants phone-and-mail access only, the access levels and what each one really permits, the security checks that protect you, and the setup mistakes that leave business owners personally on hold with the CRA in the middle of filing season.

Everything in the current system reduces to three routes, and picking the right one first saves weeks:

1. The online route. Your accountant submits an authorization request through the CRA's Represent a Client service, and you confirm it inside your own CRA portal — My Account for individuals, My Business Account for companies. This is the standard for any ongoing engagement, because it is the only route that gives online access.
2. The paper route: Form AUT-01. Signed and mailed (or submitted by the representative), it grants phone-and-mail access only. It exists for people who genuinely do not use the CRA's portals — but if you ever plan to register for My Account or My Business Account, the online route is strictly better.
3. Through certified tax software. When an accountant files your return electronically, the authorization request can travel with the filing workflow — mechanically it is the same online request, initiated from the preparer's side, and it still lands in your portal for confirmation.

Four facts anchor the whole system:

The modern flow is a two-sided handshake, and understanding both sides prevents the single most common stall.

Your representative's side. Every professional who deals with the CRA is registered in Represent a Client, the CRA's portal for representatives, where they hold an identifier — a RepID for an individual, a GroupID for a team, or the firm's business number for a company-level registration. From there they submit an authorization request against your social insurance number (personal taxes) or business number (corporate accounts), specifying the access level and, for businesses, which program accounts it covers — corporate income tax, payroll, GST/HST, and so on.

Your side. The request does not take effect on its own. The CRA notifies you, and you confirm or deny the pending request inside your own CRA portal — My Account for individuals, My Business Account for a corporation's owner or delegated authority. Requests that sit unconfirmed expire, and the CRA cancels them; the representative then has to start again. This confirmation step is the security spine of the whole system: nobody gets access to your tax account without an action taken inside your login.

After you confirm. Once the confirmation is done, access follows quickly — your representative sees the account through Represent a Client and the engagement can actually start: pulling the assessment history, checking balances and carry-forwards, and dealing with any letters already in flight. Compare that with the paper route's processing queue and the case for doing this electronically makes itself.

Form AUT-01 is the direct descendant of the RC59 (and the T1013), and it does exactly one job: it authorizes a representative for offline access — telephone calls, letters, faxes, and in-person dealings. The representative named on an AUT-01 cannot see your account in Represent a Client, cannot pull your slips or statements of account online, and cannot use the online adjustment tools on your behalf.

The form itself is short: who you are (name and SIN, or business name and BN), who the representative is (their name or firm and their identifier), the level of access, which accounts or program accounts it covers, an expiry date if you want one, and a signature from someone entitled to sign — for a corporation that means a director or an officer with authority, not the bookkeeper, not the accountant themselves, and the CRA does check. Once signed it goes to the CRA (representatives typically submit it), and processing takes longer than the online route — weeks in busy season rather than days.

When is paper the right call? Honestly: rarely. It suits an owner who genuinely will not use online services, an estate or non-resident situation where portal registration is impractical, or a one-off matter where phone access is all the engagement needs. For everything else — a corporate year-end with T2 filing, ongoing bookkeeping with GST/HST filings, payroll — your representative needs to see the account, and only the online route provides that.

Authorization is not all-or-nothing. You choose how much your representative can do, and the levels mean different things than most owners assume:

The practical guidance is simple: give your working accountant Level 2 — a Level 1 representative has to phone you every time something needs fixing, which defeats the point — and treat Level 3 as an internal role, not something an external firm needs. On the personal side there are two levels only (view, and view-plus-act), and the same logic applies.

The machinery is parallel but not identical, and engagements that cover both — an incorporated owner with personal and corporate filings, which is most of our small business accounting clients — need two authorizations, one against the SIN and one against the BN.

Individuals. Authorization attaches to your SIN and covers your personal income tax account. You confirm requests in My Account. One representative authorization covers the account as a whole — there is no per-program split.

Businesses. Authorization attaches to the business number, and here the per-program split matters: corporate income tax (the RC program), payroll deductions (RP), GST/HST (RT) and others are separate program accounts, and a representative can be authorized on all of them or only some. A firm doing your payroll but not your corporate tax can be scoped to exactly that. Confirmation happens in My Business Account, and only the owner or a delegated authority can do it — which is why the owner's own portal registration is not optional, however much they would like it to be.

New corporations, one timing note. Authorization can only attach to program accounts that exist. A freshly incorporated company that has a business number but has not yet registered for GST/HST or payroll cannot scope a representative onto those programs until the registrations are done — so onboarding for a brand-new corporation usually runs in two passes: authorize on the corporate income tax account immediately, then extend the grant as each program account is opened. It is a small sequencing point that saves a confusing rejection.

An authorization stays in force until something ends it: you cancel it, your representative removes themselves, an expiry date you set on the grant arrives, or — on the personal side — the taxpayer dies, which ends authorizations automatically (estates then re-authorize through the legal representative). It does not quietly renew or quietly lapse each tax year; representatives you authorized a decade ago are still there unless someone acted.

Cancelling is easy, and you do not need your accountant's cooperation to do it: remove them yourself in My Account or My Business Account in a few clicks, phone the CRA, or file the offline cancellation form (AUT-01X) if you are paper-bound. Do this the day an engagement ends. The annual review habit — open your portal's representatives page once a year and prune it — takes three minutes and is the cheapest security control in tax.

The CRA tightened this system for a reason: representative access is valuable, and fraudsters know it. The current design — requests that only take effect after confirmation inside your own login, and portal pages that list every active representative — puts the controls in your hands. Use them:

• Confirm only what you recognise. When a pending request appears, check the representative's name and identifier against your engagement letter before approving. A request you were not expecting is a deny, every time.
• Scope tightly. Grant the accounts the engagement covers and the level the work needs — Level 2 for the working accountant, view-only for anyone whose job is looking, not acting.
• Review annually. The representatives page in your portal is the whole audit: names, levels, dates. Anyone you no longer work with comes off.
• Never share your own credentials. A legitimate professional will never ask for your CRA user ID and password — the representative system exists precisely so they never need it. Anyone who asks is telling you who they are.

1. Signing a paper AUT-01 when the engagement needs online access. This is the big one, and it happens precisely because people search for "RC59" and land on a form. The paper form goes in, the CRA processes it, everything looks done — and then the accountant starts work and cannot see a single assessment, slip or balance online, because the paper route never grants portal access. The engagement limps along on hold music and mailed printouts until someone diagnoses the problem and restarts through the online route. If your representative will be doing real, ongoing work, the paper form was never the right tool.

2. The wrong person signing for a corporation. The CRA checks the signatory on a business authorization against its own records of who is entitled to act for the corporation. A form signed by the office manager, the bookkeeper, or the accountant being authorized bounces — often weeks after submission, by letter rather than by phone. For a corporation the signature must come from a director or an officer with signing authority, and if the CRA's records of your directors are stale (common after a share sale or a board change), fix that first or the bounce simply repeats.

3. Letting the confirmation request expire. The online request sits as a pending item inside your My Account or My Business Account until you act on it — and if nobody logs in, it eventually expires and the CRA cancels it. From the representative's side this failure is invisible: they submitted correctly, heard nothing, and have to start over. When your accountant says "we have sent the request," treat that as your cue to log in the same week, not a formality that resolves itself.

4. Authorizing a person instead of the firm. An authorization naming an individual RepID breaks the day that individual changes roles, goes on leave or leaves the firm — and nobody notices until a deadline forces the question. A firm-level authorization, made against the practice's business number or GroupID, survives staff changes, which is why it is what a well-run practice asks for. If your grant names a single human being rather than the practice, ask why.

5. Scoping to the wrong program accounts. Business authorizations attach per program account, and a grant that covers corporate income tax does nothing for the GST/HST review letter that arrives in October. The fix is to match the grant to the engagement letter at setup: T2 work needs the corporate program, sales-tax filings need the GST/HST account, payroll needs the payroll account — and nothing needs to be thrown in "just in case."

6. Losing the portal before it is ever needed. Some owners registered for My Business Account once, years ago, and the credentials are long gone — recovery runs through security steps that take time, which is exactly the kind of delay that lands badly against a filing deadline. Portal access is the master key to the whole authorization system. Treat "can I actually log in today?" as a standing item on your year-end checklist, not something to discover in March.

Our onboarding runs the online route as a checklist, and it is worth describing because it is what "done properly" looks like from the client side. Before any tax work starts, we confirm you can log into My Account (and My Business Account for corporations) — and if you cannot, fixing that becomes step zero, because everything else waits on it. We then submit the authorization request from our Represent a Client registration at the firm level, scoped to the program accounts in your engagement letter — tax planning and T1/T2 work does not need us on your payroll account, so we do not ask for it. You confirm the request in your portal, usually the same day, and from that point the CRA conversation is ours to handle: professional-services firms, contractors and incorporated owners all get the same setup, and our published corporate tax filing pricing already includes it — authorization is part of onboarding, never a billable extra. Clients from Mississauga to Vancouver do this without a single piece of paper changing hands.

So when a checklist says "sign the RC59," translate it: make sure you can log into your CRA portal, have your accountant send the authorization request through Represent a Client, confirm it inside your login at the level and scope the engagement needs, and put a yearly reminder in your calendar to prune the representatives list. Ten minutes of setup buys an engagement where the CRA conversation happens without you on hold.

If you would rather have the whole thing walked through with you — portal registration included — that is literally part of our onboarding. Fixed fees agreed before work starts, payment after the service, 100% remote across Canada. Get in touch and we will set it up with you, or call +1 (416) 619-0068.