- with Senior Company Executives, HR and Finance and Tax Executives
- with readers working within the Accounting & Consultancy, Business & Consumer Services and Property industries
If you have held or traded cryptocurrency or NFTs through a Canadian platform in the past several years, the Canada Revenue Agency may already have your account details, and you may not know it yet. In September 2025, the Federal Court granted the CRA's second-ever unnamed persons requirement (UPR) against a Canadian crypto business, this time targeting Dapper Labs Inc., the Vancouver-based creator of the NBA Top Shot NFT platform.
The order forces Dapper Labs to identify thousands of its Canadian users so the CRA can check whether they have properly reported their crypto and NFT income.
This is not an isolated event. It is the latest step in a five-year CRA enforcement campaign that began with an unnamed persons requirement against Coinsquare Ltd. in 2020, and it comes as the CRA reports collecting more than $100 million from crypto tax audits over the past three years, while, notably, laying zero criminal charges related to digital assets since 2020. For Canadian taxpayers who have not reported crypto or NFT gains, the Dapper Labs order is a signal that the CRA's civil enforcement machinery is active and expanding, even where its criminal enforcement has stalled. An experienced Canadian tax lawyer can help you understand where you stand and what options, including the Voluntary Disclosures Program, may still be available before the CRA identifies you.
Background: How the CRA Uses Unnamed Persons Requirements Against Crypto Platforms
An unnamed persons requirement is a tool under subsection 231.2(2) of the Income Tax Act (and the parallel provision in the Excise Tax Act) that lets the CRA ask the Federal Court for permission to compel a business to hand over information about a group of customers it cannot otherwise identify. The CRA does not need to know who the customers are. It only needs to satisfy the Court that the group is “ascertainable” and that the information is sought to verify the group's compliance with Canadian crypto tax law, under subsection 231.2(3).
Because a UPR authorizes the CRA to reach into records the CRA does not otherwise have access to, without naming a specific target in advance, courts have historically limited its scope.
Canada (National Revenue) v. Hydro-Québec, 2018 FC 622, and the Federal Court of Appeal's later decision in Canada (National Revenue) v. Roofmart Ontario Inc., 2020 FCA 85, together establish the boundaries of the tool:
- In Hydro-Québec, the Federal Court refused to authorize a UPR because Hydro-Québec's general commercial ratepayers were too broad and generic a group to be “ascertainable,”
- In Roofmart, the Federal Court of Appeal upheld a UPR targeting a large roofing supplier's higher-volume commercial customers, confirming that the CRA can use the tool for sector-wide compliance sweeps as long as the targeted group is defined with enough precision.
The CRA first tested this tool against a Canadian cryptocurrency exchange in 2020, when it applied to the Federal Court for an order against Coinsquare Ltd., Canada's largest exchange at the time. On March 19, 2021, the Federal Court granted that order (Minister of National Revenue v. Coinsquare Ltd., Federal Court file T-1114-20), though negotiation trimmed the CRA's original request for records on Coinsquare's entire customer base down to a defined group: users with account values or cumulative deposits of $20,000 or more, and its 16,500 largest accounts by trading volume.
Nearly five years later, the CRA returned to the Federal Court for a second crypto-sector UPR, this time against Dapper Labs Inc. According to court filings reported by The Canadian Press, the CRA's application described a Minister of National Revenue concerned that taxpayers are using the “anonymous underground economy” of crypto and NFTs to evade tax.
An affidavit from Predrag Mizdrak, a project leader in the CRA's digital compliance and audit support division, stated that CRA data show approximately 15% of Canadian taxpayers who use cryptoasset platforms have not filed their taxes on time or at all, and that roughly 30% of those who do file have been flagged as high risk for non-compliance. The Federal Court granted the CRA's application in September 2025.
Key Issues and Findings: From 18,000 Users to 2,500, and Zero Criminal Charges
Two details from the Dapper Labs matter stand out for taxpayers trying to gauge their own exposure.
The scope-negotiation story. The CRA's initial application sought information on Dapper Labs' top 18,000 users. Through negotiation between the CRA and Dapper Labs' lawyers, that number was reduced to approximately 2,500 users before the Court granted the order, and the company did not oppose the application outright.
This mirrors the pattern seen in the Coinsquare matter, where the CRA's original request covering the platform's full customer base was ultimately narrowed to roughly 5 to 10% of Coinsquare's 400,000 users. In both cases, the businesses subject to the UPR were not accused of any wrongdoing themselves; the requirement exists to identify unnamed customers, not to penalize the platform. The pattern suggests the CRA treats its opening ask as a bargaining position, and that a business facing a UPR application has real room to narrow the scope of what it must disclose, provided it engages counsel early.
The civil-recovery-versus-criminal-charges tension. The CRA disclosed that it has 35 auditors dedicated to its cryptoasset compliance program, working across more than 230 files, and that this program has recovered more than $100 million in the past three years through CRA tax audits and reassessments. At the same time, the CRA confirmed that five criminal investigations with a digital-asset component were opened between 2020 and the first quarter of 2025, four of which remained ongoing as of March 2025, and that no criminal charges have been laid in that period. The CRA has attributed this to the length and complexity of criminal investigations, including the number of individuals involved and the need for international cooperation.
For taxpayers, the practical takeaway is that the CRA's civil tax audit and reassessment machinery, backed by tools like the UPR, is moving faster and producing tangible financial results than its criminal enforcement track. A taxpayer identified through a UPR is far more likely to face a civil reassessment, with tax, interest, and possibly gross negligence penalties, than a criminal charge, but that does not mean the risk of a criminal referral disappears, particularly where non-compliance appears deliberate or the dollar amounts are large.
The CRA doesn't need criminal charges to make a UPR effective. Every name it obtains from Dapper Labs becomes a civil tax audit file, and civil reassessments carry no burden of proof beyond a balance of probabilities. That is a much easier bar for the CRA to clear than a criminal prosecution, which is exactly why taxpayers should treat a UPR as seriously as they would a criminal investigation.
— David J. Rotfleisch, Certified Specialist in Taxation Law (Law Society of Ontario)
Practical Implications for Canadian Taxpayers
If you held an account with Dapper Labs, or with any platform that may become subject to a future UPR, several practical consequences follow from this order.
First, being among the roughly 2,500 identified users does not mean you did anything wrong, but it does mean the CRA will have your identifying information and transaction history, and will very likely cross-reference it against your filed tax returns.
This fits a broader pattern of rising crypto tax enforcement across jurisdictions Canadian taxpayers should be aware of; the CRA's UPR strategy runs alongside international information-sharing initiatives such as the Crypto-Asset Reporting Framework (CARF), and HMRC's own recent crackdown on undeclared crypto gains in the UK shows the same enforcement trend playing out abroad.
Second, once the CRA has commenced an enforcement action such as a UPR, the Voluntary Disclosures Program generally becomes unavailable to the specific taxpayers identified through it, because relief under the VDP requires a disclosure to be voluntary and made before the CRA has taken steps to enforce compliance. Taxpayers who have unreported crypto or NFT income and who have not yet been identified in a UPR should treat this as a narrowing window to correct their filings proactively.
Third, the reduced-scope pattern in both the Coinsquare and Dapper Labs matters suggests that platforms served with a UPR application have genuine leverage to narrow its reach, which is relevant both to crypto businesses that may be served with a future UPR and to individual users trying to estimate their own odds of being captured by one.
Takeaway
The Dapper Labs order confirms that the CRA's UPR tool against Canadian crypto platforms is not a one-time event; it is a repeatable enforcement strategy the CRA is prepared to use again as the crypto and NFT sectors grow. The gap between the CRA's civil recovery numbers and its criminal charge count shows where the agency's practical enforcement pressure currently sits: CRA tax audits and reassessments, not prosecutions. Canadian crypto and NFT users who have unreported income should not take comfort in the absence of criminal charges since 2020; a civil reassessment carries its own serious financial consequences and a much lower bar for the CRA to meet.
Pro Tax Tips
- If you think you may be among the users identified in the Dapper Labs order, or you have unreported income from any Canadian or foreign crypto or NFT platform, the most important thing to understand is timing.
- The CRA's ability to offer penalty relief through the Voluntary Disclosures Program depends on your disclosure being made before the CRA has already taken steps to identify you, so taxpayers who wait until they receive a CRA tax audit letter have generally lost access to that relief.
- An experienced crypto tax lawyer can review your trading history, help you determine whether your crypto activity should be characterized as business income or capital gains, and prepare a disclosure application before the CRA's file catches up with you.
Businesses operating a crypto or NFT platform in Canada should also take note of how the Dapper Labs negotiation played out. Engaging tax counsel promptly after being served with a UPR application, rather than after a court date is already set, appears to have meaningfully narrowed the scope of what both Coinsquare and Dapper Labs were ultimately required to disclose. Waiting to respond, or assuming a UPR application is a formality, risks losing the opportunity to negotiate a more limited class of affected users. - Finally, taxpayers should remember that a UPR is not an accusation against them personally, and it is not a criminal investigation. It is a civil information-gathering tool. That said, the information the CRA obtains through a UPR is precisely the information it needs to open a CRA tax audit, and in some cases refer a file for criminal investigation. Treating a UPR notification, or a subsequent CRA tax audit letter, as a low-stakes administrative matter is a mistake; the right response is to seek tax legal advice immediately, before responding to the CRA in writing.
Frequently Asked Questions
What is an unnamed persons requirement (UPR) under the Income Tax Act?
A UPR is a court-authorized order that lets the CRA compel a business, such as a crypto exchange or NFT platform, to disclose information about a defined group of customers whose identities the CRA does not already know, so the CRA can verify their tax compliance.
Why did the CRA target Dapper Labs specifically?
Dapper Labs operates the NBA Top Shot NFT platform and its own blockchain and crypto wallet products. The CRA's affidavit evidence describes general concerns about non-compliance across crypto and NFT platforms rather than any specific allegation against Dapper Labs or its users.
Is Dapper Labs, or was Coinsquare, accused of any wrongdoing?
No. A UPR is directed at identifying the platform's unnamed customers, not at penalizing the platform itself. Neither Dapper Labs nor Coinsquare opposed the CRA's application outright; both negotiated the scope of what they would be required to disclose.
How many Dapper Labs users are affected by the order?
The CRA's initial request covered Dapper Labs' top 18,000 users. Following negotiation, the scope was reduced to approximately 2,500 users before the Federal Court granted the order in September 2025.
Was this the first time the CRA has used a UPR against a Canadian crypto company?
No. The CRA first used this tool against Coinsquare Ltd. in 2020-2021. The Dapper Labs order is only the second time a Canadian court has granted a UPR against a crypto platform.
If I am one of the identified Dapper Labs users, will I automatically be audited?
Not necessarily immediately, but the CRA will have your identifying information and platform activity, and CRA statements indicate the agency is actively working through non-compliance identified from its crypto UPRs. You should assume your information will be reviewed and consider your filing position now rather than waiting for contact from the CRA.
Can I still use the Voluntary Disclosures Program if I am identified through the Dapper Labs UPR?
Once the CRA has commenced an enforcement action such as a UPR that specifically identifies you, the CRA will generally treat a subsequent disclosure as no longer voluntary, which can disqualify you from VDP relief. Taxpayers with unreported crypto or NFT income should seek advice before, not after, they are identified.
Why has the CRA collected more than $100 million from crypto tax audits but laid no criminal charges since 2020?
The CRA has stated that its criminal investigations into digital-asset cases are complex, often involve multiple individuals and jurisdictions, and can take years to complete. Civil audits and reassessments, by contrast, only require the CRA to meet a balance-of-probabilities standard, which is a substantially lower bar than the criminal standard of proof beyond a reasonable doubt.
Does a civil crypto tax reassessment carry penalties even without criminal charges?
Yes. A taxpayer reassessed civilly for unreported crypto or NFT income can face tax owing, arrears interest, and in cases the CRA considers to involve a high degree of carelessness or intent, gross negligence penalties, all without any criminal charge being laid.
How is cryptocurrency and NFT income taxed in Canada?
Gains from crypto and NFTs are generally taxed either as business income or as a capital gain, depending on factors such as frequency of transactions, intention at the time of acquisition, and the taxpayer's overall course of conduct. The correct characterization significantly affects the taxpayer's total tax liability, since only a portion of a capital gain is taxable while business income is fully taxable.
What should I do if I think the CRA may already have my information from a platform UPR?
Contact an experienced Canadian tax lawyer before responding to any CRA correspondence or filing amended returns on your own. A lawyer can assess whether a voluntary disclosure is still available to you, and if not, help you prepare the strongest possible response to a CRA tax audit.
What should a crypto or NFT business do if it is served with a UPR application?
Engage a Canadian tax litigation lawyer immediately, before the response deadline set out in the application. Both Coinsquare and Dapper Labs negotiated the scope of their disclosure down substantially from the CRA's opening request, and that negotiation happened before the Federal Court granted the order, not after. A business that waits until a court date is scheduled has already lost most of its leverage to narrow what it must hand over.
How is a UPR different from a regular CRA tax audit?
A CRA tax audit is directed at a specific, already-identified taxpayer whose return the CRA is reviewing. A UPR is a separate tool the CRA uses against a third party, such as an exchange or NFT platform, to identify unnamed customers before any of those customers are subject to an audit. In practice, a UPR is often the step that precedes a CRA tax audit: once the CRA has names, it can open individual audit files against the taxpayers it identifies.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]