Detecting Forged Vendor Compliance Certificates in Canada

A doctored GST/HST registration screenshot, a stale Certificate of Compliance from a provincial registry, or a workers' compensation clearance number copied from another firm can all pass a five-second glance during vendor onboarding. Catching them means checking every reference against the issuing authority's own system — CRA's GST/HST Registry, a provincial corporate registry, or the applicable workers' compensation board's clearance lookup — rather than trusting the PDF a supplier hands over. Under subsection 227.1(1) of the Income Tax Act, directors can already be held personally liable for a corporation's unremitted payroll deductions, and provincial boards can assess a general contractor directly for a subcontractor's unpaid premiums, making certificate verification a financial exposure issue, not a compliance nicety.

This article is deliberately narrow: it is not a guide to registering for GST/HST, incorporating a business, or obtaining workers' compensation coverage — those are covered in our guides on construction subcontractor compliance documents and vendor compliance certificate verification. This piece covers the opposite problem: how these documents get faked, and what a procurement team should do the moment one looks wrong.

Why Forged Compliance Certificates Are Appearing in Supplier Onboarding

Forged certificates surface most where margins are thin and onboarding is fast, because fabrication is cheaper for a non-compliant subcontractor than fixing the underlying tax, insurance, or registration problem. Construction, facilities management, and labour-supply sectors see this disproportionately, combining tight tender pricing with multi-tier subcontracting chains that dilute oversight — and Canada adds a wrinkle, since tax obligations are federal but workers' compensation clearance is administered separately by each province and territory.

Construction businesses that derive more than half their income from construction activities must file a T5018 slip reporting payments over $500 a year to each subcontractor, with penalties applied per missing or late slip and criminal prosecution possible for deliberate concealment (CRA, T5018 Statement of Contract Payments). A subcontractor who resists this reporting, or whose paperwork does not match the general contractor's own T5018 filings, is often signalling a registration problem rather than an administrative oversight.

How Forgers Fabricate CRA, Corporate Registry and Workers' Comp Documents

A genuine "CRA compliance certificate" barely exists in the form fraudsters fabricate it, because outside Quebec, the CRA does not issue a downloadable certificate confirming a supplier's tax standing. Businesses can confirm a supplier's GST/HST number is valid and matches the registered legal name using CRA's free online GST/HST Registry, without needing anything from the supplier beyond the number itself (CRA, Confirming a GST/HST account number). A supplier presenting a polished "CRA Tax Compliance Certificate" PDF is already showing a document type CRA generally does not issue federally — forgers copy the layout of a genuine CRA letter, edit a PDF text layer, and invent a Business Number that returns nothing on the registry. Quebec is the exception: public-body contracts of $25,000 or more genuinely require an Attestation de Revenu Québec, a real downloadable document Revenu Québec does issue, which is precisely why it is a more common forgery target there — editing an existing PDF's dates or amounts is faster than inventing a document from nothing.

Corporate registry documents are forged differently, because the underlying filings at Corporations Canada and most provincial registries are genuinely public and free to search. Fraudsters typically alter a real filing's screenshot or PDF export — registered office, director list, or "active" status — since editing an existing image is faster than fabricating one from scratch. A federal Certificate of Compliance is a common target because few reviewers realize it is a point-in-time snapshot: Corporations Canada issues a Certificate of Compliance confirming a corporation has filed its required annual returns as of the issuance date, and does not extend that confirmation once new filings fall due (Corporations Canada, Certificate of Compliance or Certificate of Existence). A certificate reused months later, or one claiming compliance for a company with an overdue annual return, is a contradiction any reviewer can catch on the free registry search.

Workers' compensation clearance certificates follow the same pattern: forgers reuse or invent a clearance reference rather than fabricate a convincing certificate design, since the goal is passing an onboarding checklist. A number copied from a genuinely compliant firm and attached to a different subcontractor fails the moment it is checked against the issuing board's own lookup.

Red Flags in Forged CRA Tax Compliance Documents

The strongest red flag is the document format itself: outside Quebec, CRA confirms GST/HST status through its own registry lookup, not a certificate document, so a "certificate" with letterhead and a signature block is presenting something CRA's process does not generate. A genuine Business Number is nine digits, with the GST/HST account adding an "RT0001"-style suffix; anything that does not match, or returns no result on the registry, should stop onboarding immediately.

Directors of a corporation can be held personally and jointly liable under subsection 227.1(1) of the Income Tax Act for unremitted source deductions — CPP, EI, and income tax — and CRA applies escalating late-remittance penalties starting at 3% and rising to 10%, doubling to 20% for a repeat failure within the same calendar year (Justice Canada, Income Tax Act s.227.1; CRA, Director's liability). A subcontractor whose GST/HST number fails the registry check presents exactly the gap this penalty regime exists to catch — and a contracting business's own director liability turns on whether it exercised due diligence before relying on the document.

Spotting a Forged Certificate of Status or Corporate Registry Filing

The cross-check for any corporate registry document is free and takes only minutes, which is why an unchecked forged filing is inexcusable in an onboarding file. Search the company name or number on Corporations Canada's federal registry or the applicable provincial registry — Ontario Business Registry, BC Registry Services, or the equivalent elsewhere — and compare every field on the supplier's document against the registry: corporate number, registered office, director names, and filing status.

Since January 2024, corporations governed by the Canada Business Corporations Act must file information on individuals with significant control — generally those holding 25% or more of shares or voting rights — searchable through the same federal registry tool (ISED, Individuals with significant control). A freshly incorporated supplier with no ISC filing on record is worth extra scrutiny — the registry's record, not the PDF sent, is the source of truth.

Detecting Fake Workers' Compensation Clearance Certificates

Workers' compensation clearance is where Canada diverges most sharply from a single-authority system, since every province and territory runs its own board with its own rules and lookup tools — a clearance genuine in one province verifies nothing about coverage in another. A WSIB clearance certificate in Ontario is generally valid up to 90 days from issue, and Ontario businesses can verify a supplier's status for free through WSIB's Quick Access Clearances tool without creating an account (WSIB, Clearances). WorkSafeBC offers an equivalent Clearance Letter lookup (WorkSafeBC, Get a clearance letter), and in Quebec, CNESST runs its own compliance-verification service alongside the Attestation de Revenu Québec required on qualifying public contracts.

A clearance check is only meaningful against the issuing board's own lookup, repeated during a multi-year contract rather than only at onboarding, since a 90-day certificate collected at signing tells a procurement team nothing eighteen months later. A subcontractor working across provincial lines is a particular trap: coverage registered in one province does not automatically extend to another.

Legal and Liability Exposure for the Hiring Business

Presenting a forged compliance document is a criminal offence in its own right, independent of any underlying tax or coverage breach. Under sections 366 to 368 of the Criminal Code, making or using a forged document with intent that it be relied on as genuine carries a maximum of ten years' imprisonment, and fraud over $5,000 under section 380 carries a maximum of fourteen years (Justice Canada, Criminal Code s.380). A subcontractor who forges a GST/HST number, a registry filing, or a clearance certificate is exposed on both counts at once.

The exposure is not limited to the forger. Director liability under the Income Tax Act attaches to the contracting business's own leadership where remittance obligations tied to an unverified subcontractor go unmet, and provincial boards can assess a general contractor directly for a subcontractor's unpaid premiums. Registries impose no equivalent direct penalty on the hiring organization for accepting a forged filing, but a contractor who onboarded on the strength of one remains exposed to contractual, reputational, and regulatory risk of its own.

What to Do When You Suspect a Forged Certificate

Stop onboarding or payment immediately and do not confront the supplier before the document is independently verified, since an early warning can prompt evidence destruction or a hurried second forgery. Verify directly with the issuing body — CRA's GST/HST Registry, the corporate registry, or the relevant workers' compensation board's clearance lookup — never a contact number printed on the suspect document.

Preserve the original file, including its metadata, since creation and modification history is often the clearest evidence of tampering. Report suspected fraud to the Canadian Anti-Fraud Centre, and notify the relevant authority directly: CRA runs a leads program for reporting suspected tax non-compliance, and each provincial board has its own channel for reporting clearance fraud. One anomaly should trigger verification; two or more is a strong basis to pause the relationship pending confirmation from the issuing authority.

Building Systematic Verification Into Supplier Onboarding

Manual, ad hoc checking does not scale once a procurement team manages more than a handful of subcontractors across multiple provinces, since every renewal and new tier-two supplier creates another document needing verification against a registry. Platforms such as CheckFile apply structural, metadata and cross-document analysis to onboarding files, giving compliance teams high coverage across the document set, while contextual analysis keeps false-positive rates low.

Manual fraud detection methods, including routine document review, catch only around 37% of occupational fraud cases, with a median delay of 87 days before detection (ACFE, 2024 Report to the Nations). CheckFile also deploys an additional AI-generation signal layer, depending on client configuration, as a complement to these checks, not a replacement for them — a forged GST/HST number still has to be checked against CRA's registry, and a copied clearance certificate against the issuing board. For a broader defence against synthetic paperwork, see CheckFile's AI-generated document detection.

Teams comparing platforms can review CheckFile's security architecture and pricing overview, or get in touch to discuss a specific supplier base. For the wider checklist, see our guides on know your supplier due diligence and verifying a company registration certificate against the registry, or the document compliance guide.

Frequently Asked Questions

Does CRA issue a downloadable tax compliance certificate that can be checked for authenticity?

Generally no. Outside Quebec, GST/HST and Business Number status is confirmed through CRA's free online registry lookup, not a downloadable certificate. A supplier presenting a formal "CRA compliance certificate" PDF should be verified against the registry result, not assessed on appearance. Quebec is the exception: public contracts of $25,000 or more genuinely require an Attestation de Revenu Québec.

How long is a WSIB clearance certificate valid?

A WSIB clearance is generally valid up to 90 days from issue. One presented outside that window, or one that cannot be reproduced through WSIB's Quick Access Clearances lookup, should be treated as unreliable until reconfirmed with WSIB. Other provinces, such as British Columbia's WorkSafeBC, run separate lookup tools with their own validity rules.

What penalty applies to a business that accepts a forged compliance certificate without checking it?

The forger faces criminal liability under sections 366 to 368 of the Criminal Code for forgery and potentially section 380 for fraud, the latter carrying up to fourteen years' imprisonment where the value exceeds $5,000. Separately, the contracting business's own directors can face personal liability under subsection 227.1(1) of the Income Tax Act for unremitted payroll deductions tied to a subcontractor it failed to properly verify.

Can a workers' compensation clearance certificate be verified without contacting the subcontractor?

Yes. WSIB's Quick Access Clearances tool and WorkSafeBC's Clearance Letter lookup both allow verification by company name or account number without needing anything further from the subcontractor. Because coverage is provincial, a clearance from one province does not confirm coverage for work performed in another.

---

This article is for informational purposes only and does not constitute legal, tax, or regulatory advice. Consult a lawyer or tax adviser for guidance specific to your organization. Legislation and guidance referenced are current as of 7 July 2026.