ARRIVECAN: COSTS, CONTRACTS AND GOVERNMENT ACCOUNTABILITY

Overview

ArriveCAN was introduced by the Canada Border Services Agency (CBSA) in April 2020 during the COVID-19 pandemic. It was initially used to collect traveller contact and public-health information required at the border. The application was expanded and updated as border measures changed. It later incorporated an optional Advance Declaration feature for customs and immigration information.

The controversy surrounding ArriveCAN is not simply that a government application was expensive. Audits and reviews identified serious weaknesses in financial records, procurement decisions, contract administration, documentation and oversight. Those weaknesses made it difficult to establish a precise project cost or determine whether taxpayers received value for money.

WHAT DID ARRIVECAN COST?

There is no single uncontested figure that captures every activity associated with ArriveCAN. The figures published by the CBSA and the Auditor General use different scopes and time periods.

• Approximately $59.5 million: The Auditor General's February 2024 estimate of the overall cost, based on the information that could be assembled. The Auditor General stated that poor financial records and controls meant the precise cost could not be determined.

• Approximately $55 million: The CBSA's reported actual expenditures from April 1, 2020 to March 31, 2023 for ArriveCAN as a border public-health measure. The CBSA said this was against a forecast of approximately $54 million.

• Approximately $6.2 million: The CBSA's reported vendor costs for development and enhancements from April 2023 to January 2024, when ArriveCAN continued as an optional tool for customs declarations.

The difference between the $55-million and $59.5-million figures is not necessarily a simple accounting error. The Auditor General included certain related work performed alongside the public-health application and after its use as a border health measure, while the CBSA's $55-million figure covered the public-health measure over a defined period. The CBSA's own comparison presented additional categories of related work, including Mobile Border and other operational costs.

The Auditor General's estimate should therefore be described as an approximate project-related total, not as a precise audited invoice total. The available records did not allow the Auditor General to calculate an exact cost.

WHAT WAS DELIVERED?

ArriveCAN was launched on April 29, 2020. It was used to collect traveller contact and health information and support the administration of quarantine and other border public-health measures. The CBSA reported that the application was downloaded more than 18 million times and used by more than 60 million travellers.

The application was updated repeatedly as public-health rules changed. The CBSA told Parliament that more than 70 releases were made over approximately two and a half years. In October 2022, ArriveCAN stopped being used to collect travellers' contact and health information.

The application was subsequently retained as an optional digital service for customs and immigration declarations, including an Advance Declaration feature at participating airports. The Auditor General noted that this continuing customs and immigration function was an enduring benefit of the application.

The existence of a functioning application does not, by itself, resolve the value-for-money concerns. The Auditor General found that contract documentation often lacked clear deliverables and that invoices and timesheets frequently did not contain enough detail to establish what work had been performed.

CONTRACTING AND PROCUREMENT

The CBSA relied extensively on external contractors because it determined that it did not have sufficient internal resources to develop the application. The Auditor General found that the agency's contracting practices did not consistently meet required standards for documentation, transparency and oversight.

Among the findings in the February 2024 audit:

• The Auditor General found little documentation explaining how and why GC Strategies received the initial ArriveCAN contract through a non-competitive process.

• Evidence indicated that GC Strategies was involved in developing requirements later used by the CBSA in a competitive procurement process.

• The Auditor General found that essential information, including clear deliverables and required qualifications, was missing from some contracts and task authorizations.

• Invoices and supporting timesheets often lacked sufficient detail about the work performed and the individuals who performed it.

• In the sample of invoices tested by the Auditor General, 18% did not provide enough information to determine whether the expenses related to ArriveCAN or another information-technology project.

The Office of the Procurement Ombudsman separately reviewed procurement practices associated with ArriveCAN. It found that mandatory criteria in a solicitation leading to a $25-million contract awarded to GC Strategies were overly restrictive and favoured the existing supplier. GC Strategies was the only bidder for that contract.

The Procurement Ombudsman's review also identified a recurring practice in which individuals named in winning bids were replaced by other resources when work was assigned. Across the applicable contracts reviewed, approximately 76% had some or all of the resources proposed in the successful bid not perform work on the contract. This finding should not be interpreted to mean that 76% of the work was not done or that contractors were necessarily paid for work not performed. The concern was that substitutions occurred frequently and that supporting documentation explaining them was often absent.

CONTRACTORS AND GOVERNMENT ACTION

GC Strategies was a prominent contractor in the ArriveCAN procurement record. The Auditor General attributed approximately $19.1 million in ArriveCAN-related costs to GC Strategies in its analysis. The CBSA and other witnesses have discussed different figures based on different contract scopes and accounting approaches. These figures should not be treated as interchangeable measures of money retained by GC Strategies: contractor totals can include payments passed on to subcontractors and other resources.

In June 2025, Public Services and Procurement Canada determined that GC Strategies was ineligible under the federal government's Ineligibility and Suspension Policy. The decision took effect June 6, 2025 and made the company ineligible to enter into federal government contracts or real-property agreements for seven years. This was an administrative supplier-integrity decision, not a criminal conviction.

AUDITS, INVESTIGATIONS AND FORMAL FINDINGS

Auditor General of Canada — February 2024

The Auditor General concluded that the CBSA, the Public Health Agency of Canada and Public Services and Procurement Canada repeatedly failed to follow good management practices in the contracting, development and implementation of ArriveCAN. The audit concluded that weaknesses in project design, oversight and accountability meant the application did not deliver the best value for taxpayer dollars. It made eight recommendations addressing financial records, procurement documentation, contract review, qualifications, deliverables, security clearances, evidence of work and testing before releases.

Office of the Procurement Ombudsman — 2024

The Procurement Ombudsman's review identified concerns with restrictive procurement criteria, contract disclosure and the frequent replacement of resources proposed in successful bids. Its findings raised concerns about fairness, transparency and whether procurement practices achieved best value.

Office of the Privacy Commissioner of Canada — March 2026

The Privacy Commissioner reported that the investigation did not find a contravention of the Privacy Act or evidence that personal information collected through ArriveCAN had been used or disclosed in violation of that Act. The investigation did, however, identify shortcomings in the CBSA's contracting and security-assessment practices, including weaknesses in the accuracy and timing of certain security assessments. The CBSA accepted the Commissioner's recommendations.

Office of the Information Commissioner of Canada — May/June 2026

The Information Commissioner found that the CBSA failed to conduct reasonable searches for records in response to six ArriveCAN-related access-to-information requests because the agency did not search a Slack workspace used by the ArriveCAN project team. The workspace had been permanently deleted in May 2023 without consultation with the CBSA's access-to-information unit or a documented review of its contents.

The Commissioner found no evidence to substantiate the public allegation that a senior CBSA official deliberately destroyed emails or other records to obstruct access requests. The findings instead identified serious shortcomings in record identification, preservation and retrieval. The CBSA accepted the Commissioner's recommendations for corrective measures.

BOTLER ALLEGATIONS AND COURT PROCEEDINGS

Separate allegations of misconduct involving CBSA officials were raised by Botler AI and referred to the CBSA's Professional Integrity Division and the RCMP. These allegations are distinct from the Auditor General's findings about procurement and project management. Allegations should not be presented as proven misconduct unless and until an authorized investigation or court establishes the facts.

In December 2025, the CBSA told the House of Commons Standing Committee on Public Accounts that its professional-standards investigations had been completed, but that the investigation reports were the subject of litigation before the Federal Court. The CBSA said an interim court order issued in July 2025 prevented it from disseminating the reports while the case remained unresolved. A restriction on distributing investigation reports is not a final finding that the allegations are true or false.

A February 2026 Public Safety briefing also described the CBSA's administrative investigation into the Botler allegations as continuing. The public record should therefore be checked for further court decisions or official updates before describing this matter as concluded.

WHAT HAS CHANGED?

The CBSA has reported implementing procurement reforms and responding to the Auditor General's recommendations. A February 2026 Public Safety briefing stated that the CBSA had implemented seven of the eight applicable recommendations, with the remaining recommendation still being implemented at that time.

ArriveCAN also continued to require maintenance as an optional customs and immigration tool. In December 2025, the CBSA told a parliamentary committee that its annual funding for ArriveCAN maintenance was $2.9 million and that it was working to reduce the amount to $1.4 million through efficiencies and spending reviews. The agency identified ongoing costs such as app-store updates, accessibility and software updates, cloud hosting, licensing and user support. These were figures reported by the CBSA at that time, not an independently verified final cost.

WHAT THE PUBLIC RECORD ESTABLISHES — AND WHAT IT DOES NOT

Established by official audits and investigations:
• The Auditor General estimated ArriveCAN-related costs at approximately $59.5 million but could not determine the precise total because of inadequate records.
• The CBSA reported approximately $55 million in expenditures for the public-health measure from April 2020 to March 2023.
• Auditors identified significant deficiencies in procurement, contract documentation, financial records and oversight of deliverables.
• GC Strategies was made ineligible for federal contracts for seven years, effective June 6, 2025.
• The Privacy Commissioner found no contravention of the Privacy Act in the investigation, while identifying weaknesses in contracting-related privacy and security practices.
• The Information Commissioner found serious access-to-information search and record-management failures, including the failure to search a deleted Slack workspace.

Not established by those findings:
• An exact, fully reconciled total cost for every activity associated with ArriveCAN.
• That the entire $59.5 million was paid to one contractor or retained by intermediaries.
• That every proposed contractor who was replaced was paid for work they did not perform.
• That the Botler allegations constitute proven misconduct or that a final court judgment has resolved them.

ACCOUNTABILITY QUESTIONS THAT REMAIN

• Will the government publish a complete, reconciled accounting of ArriveCAN-related spending, including related projects and ongoing maintenance?
• Have all eight applicable Auditor General recommendations been fully implemented and independently verified?
• What final findings, if any, will be made public from the CBSA's internal investigations and the related Federal Court proceedings?
• What further steps have been taken to ensure that procurement records, deliverables, invoices and digital communications are properly documented and preserved?

This record will be updated when new official reports, court decisions, parliamentary evidence or government disclosures materially change the public record.

EDITORIAL NOTE

This account distinguishes audit findings, government-reported figures, administrative decisions, allegations and unresolved proceedings. It does not treat allegations as findings of guilt. Where official bodies used different scopes or accounting periods, the figures are identified separately rather than combined into a misleading single total.