This guide is educational. It does not create a lawyer–client relationship and is not a substitute for advice from a qualified Canadian lawyer, accountant, or other professional familiar with your organization. If a regulator has contacted you, retain counsel promptly.
If regulators contact you: what to do next, and who to involve
A calm, plain-language playbook for Canadian charities, non-profits, and corporations. Use it alongside — not instead of — advice from your own lawyer and accountant.
- Stay calm and read the letter carefully — don't reply substantively yet.
- Preserve records — no destruction, no routine deletion.
- Contact counsel before making any statement to the regulator.
Step-by-step: Non-profit
Work through these in order. Steps 1–3 should happen the same day the letter arrives.
- 1
Read the letter carefully
Identify the regulator (Corporations Canada, provincial registrar, OPC, or a funder-linked regulator), the statute cited, the deadline, and the exact filings or records requested.
- 2
Log the contact
Record date received, method, corporation number, reference number, named officer, and the reply-by date. Save the original delivery evidence.
- 3
Preserve records — no destruction
Hold minute book, member register, annual returns, bylaws, financial statements, contracts, and related emails. Suspend routine deletion until counsel confirms scope.
- 4
Notify the right internal people
Board chair and treasurer first. Executive director and, if applicable, the privacy officer. Document who was told and when.
- 5
Bring in the right external professionals
Retain corporate counsel familiar with CNCA / ONCA / provincial NFP statutes. Involve your accountant for financial questions and your insurance broker for D&O notification.
- 6
Draft a single-channel response plan
One named contact, one written response reviewed by counsel. No ad-hoc calls with the regulator.
- 7
Ask for a written extension if needed
Most registrars grant a first reasonable extension when asked in writing before the original deadline. Never let the deadline pass silently.
Who to involve — and when
| Role | When to loop in |
|---|---|
| Board chair | Immediately — governance responsibility and director liability sit here. |
| Treasurer / CFO | Immediately for anything touching financials, receipting, tax, or filings. |
| Executive Director / CEO | Immediately — coordinates response and internal communications. |
| Privacy officer | Whenever personal data, a suspected breach, or an OPC contact is involved. |
| External counsel | Same day — before any substantive reply to the regulator. |
| Auditor / accountant | When records, financial statements, or tax positions are in scope. |
| Insurance broker (D&O / cyber) | Early — many policies require prompt notice or coverage is jeopardized. |
| PR / communications | Only if the matter is likely to become public; coordinated with counsel. |
Common types of regulator contact
Recognize what you've received so you can respond proportionately.
This page is general information published by Legal Risk Alert for educational purposes only. It is not legal advice, does not create a lawyer–client relationship, and does not replace advice from a qualified professional retained by your organization. Laws and regulator practices change; always verify current requirements with counsel.
Not sure where you stand today?
Take the free 8-minute compliance assessment to see which risks apply to your organization.
If a regulator has already contacted you, the Audit + Consult tier pairs the full audit with counsel-led response support.