This guide is educational. It does not create a lawyer–client relationship and is not a substitute for advice from a qualified Canadian lawyer, accountant, or other professional familiar with your organization. If a regulator has contacted you, retain counsel promptly.
If regulators contact you: what to do next, and who to involve
A calm, plain-language playbook for Canadian charities, non-profits, and corporations. Use it alongside — not instead of — advice from your own lawyer and accountant.
- Stay calm and read the letter carefully — don't reply substantively yet.
- Preserve records — no destruction, no routine deletion.
- Contact counsel before making any statement to the regulator.
Step-by-step: Registered charity
Work through these in order. Steps 1–3 should happen the same day the letter arrives.
- 1
Read the letter carefully
Identify the regulator (usually CRA Charities Directorate), the statute cited, the deadline, and the exact records or answers requested. Note whether it is an education letter, T3010 review, audit notice, compliance agreement, or notice of intent to revoke — the response strategy differs.
- 2
Log the contact
Record date received, delivery method, reference or file number, named CRA officer, and the reply-by date. Store the original envelope or email header — proof of receipt matters.
- 3
Preserve records — no destruction
Issue an internal 'litigation / regulatory hold' on donation records, T3010 working papers, board minutes, receipting files, foreign activity agreements, and related emails. Suspend any routine deletion until counsel confirms scope.
- 4
Notify the right internal people
Loop in the board chair and treasurer immediately. Brief the executive director and, if applicable, the privacy officer. Keep the circle small and documented; do not discuss on public channels.
- 5
Bring in the right external professionals
Retain a charity lawyer first — ideally one experienced with CRA audits. Loop in your auditor / accountant for financial-records questions, and notify your D&O insurance broker so coverage is preserved.
- 6
Draft a single-channel response plan
Designate one named contact person (usually counsel). All CRA communication in writing, on letterhead, reviewed before it goes out. No ad-hoc phone calls or side conversations with the CRA officer.
- 7
Ask for a written extension if the deadline is tight
CRA generally grants a first reasonable extension when asked promptly in writing with a specific new date. Do not miss the original date without a granted extension on file.
Who to involve — and when
| Role | When to loop in |
|---|---|
| Board chair | Immediately — governance responsibility and director liability sit here. |
| Treasurer / CFO | Immediately for anything touching financials, receipting, tax, or filings. |
| Executive Director / CEO | Immediately — coordinates response and internal communications. |
| Privacy officer | Whenever personal data, a suspected breach, or an OPC contact is involved. |
| External counsel | Same day — before any substantive reply to the regulator. |
| Auditor / accountant | When records, financial statements, or tax positions are in scope. |
| Insurance broker (D&O / cyber) | Early — many policies require prompt notice or coverage is jeopardized. |
| PR / communications | Only if the matter is likely to become public; coordinated with counsel. |
Common types of regulator contact
Recognize what you've received so you can respond proportionately.
This page is general information published by Legal Risk Alert for educational purposes only. It is not legal advice, does not create a lawyer–client relationship, and does not replace advice from a qualified professional retained by your organization. Laws and regulator practices change; always verify current requirements with counsel.
Not sure where you stand today?
Take the free 8-minute compliance assessment to see which risks apply to your organization.
If a regulator has already contacted you, the Audit + Consult tier pairs the full audit with counsel-led response support.