IMMICASEThe College of Immigration and Citizenship Consultants updated its regulatory framework in 2026. Two elements of it matter more than the rest for how you run your practice day to day: penalty ceilings reported at up to $50,000, and a client file retention expectation of six years. Underneath both sits something less headline-worthy but more consequential — explicit attention to the technology consultants use to hold client information.
The timing is not a coincidence. As IRCC digitizes, the regulator is raising the floor on what a defensible practice record looks like. The two changes point the same direction: your file has to be complete, attributable, retrievable, and kept.
Six-year retention is an operations problem, not a filing problem
Most practices assume they meet a retention requirement because they have never thrown anything away. That is not the same thing. Retention means you can produce the file — the whole file — on request, six years after the matter closed. Ask yourself, for a matter that closed in 2021:
- Do you have the retainer agreement and every amendment to it?
- Do you have the documents the client provided, in the version you actually submitted?
- Do you have the correspondence — including the email thread that lived in a departed employee's inbox?
- Do you have a record of the advice given and the decisions made, with dates?
- Could you produce all of it without depending on a person's memory or a laptop that has since been replaced?
A practice running on shared drives and individual inboxes will usually fail on the correspondence question, and often on the version question. Neither gap is visible until someone asks.
What an examination actually looks for
| Expectation | What satisfies it |
|---|---|
| Complete client file | Retainer, documents, correspondence, and advice in one retrievable record |
| Attribution | Every action tied to a named individual with a timestamp |
| Retention | Six years post-closure, searchable, not dependent on one device |
| Confidentiality | Access limited to those who need it, with the limits enforced by the system |
| Trust accounting | A ledger that reconciles, with an audit trail behind each entry |
| Client communication | A record of what was sent, when, and to whom |
The technology expectation, plainly
A regulator does not prescribe a product. What it does expect is that the tools you chose let you meet your obligations, and that you can explain the choice. In practice that means being able to answer four questions without hesitating:
- Where is client data stored? Naming a country is the minimum. Canadian hosting is not legally mandatory for every practice, but it removes an entire category of questions about foreign access.
- Who can see what? Role-based access enforced by the software beats a policy document that says people should not look.
- Can you show what happened to a file? An immutable audit trail is the difference between demonstrating and asserting.
- What happens if a client exercises their privacy rights? You should be able to export their data in a portable form and erase it when the retention obligation permits.
A short readiness exercise
Do this in an afternoon. Pick three closed matters — one from last year, one from three years ago, one from five. For each, set a timer and produce the complete file. Note where you had to go, who you had to ask, and what you could not find.
The result is your actual compliance posture, as distinct from your intended one. Most firms who do this find the same three things: correspondence is scattered across inboxes, document versions are ambiguous, and there is no record of who did what. All three are fixable, and all three are structural rather than a matter of trying harder.
How Immicase maps to the obligations
Client and case records hold the retainer, documents, correspondence, invoices, and timeline in one place, so “produce the complete file” is a search rather than a reconstruction. Inbound client email is captured to the case timeline automatically, which closes the most common retention gap. Data is hosted in Canada, sensitive identifiers are encrypted in the browser before they reach the server, access is role-based across five roles, and every action is written to an immutable audit trail. PIPEDA export and erasure are built in.
Be audit-ready without the fire drill
Complete client files, immutable audit trail, Canadian hosting, and six-year retention that does not depend on anyone's inbox.