Should you share your CROS PIN or password with a registration consultant?

Know what your CRA identity represents

A Companies Registry Account is linked to the person whose information has been verified. The associated unique Identity PIN is used to identify that person in CROS transactions, to establish associations and for supported electronic-signature functions. The Registry describes the PIN as a sensitive identifier, which is why it expressly tells users not to share it.

Consider the difference between a helper reviewing a form and someone entering a secure account as though they were the owner. The first involves administrative support. The second can affect the traceability and authority of actions taken on behalf of a director, partner, sole trader or incorporator. Keep a record of who prepared each document and who submitted it.

Passwords, one-time codes and PINs

CROS access involves a personal email address and password. Initial account access may also involve a one-time password sent to the applicant. These details should remain controlled by the account holder. The Registry's account page warns against sharing login credentials, and its FAQs separately advise against sharing the CRA PIN.

If an adviser needs to understand an error message, provide the wording after hiding account numbers and private identifiers. A screen recording or screenshot may contain other sensitive information such as personal addresses or company records. Review what is visible before sending it and use a secure channel where an official document must be transferred.

Use approvals and roles correctly

CROS allows a person to consent to being included in a filing through an approval workflow. For example, an intended director may need to approve being added to an incorporation application. A company secretary may have a separate role in subsequent filings. The Registry's approval guidance explains which party grants consent and when that consent is used.

This is important when someone else prepares the paperwork. The person whose name is being added should understand the transaction and confirm the correct legal role. Company directors, partners and agents should not assume that a text message saying 'go ahead' automatically completes the approval required by the system. Follow the current CROS steps for the specific transaction.

Questions to ask any service provider

Ask how documents will be prepared, who will use their own account, how you will review the content before filing and what evidence of submission you will receive. Request a clear explanation of service fees and the government's filing charges. If a consultant offers to provide hands-on assistance, the process should still preserve your ability to control your own account and respond to Registry notices.

For a company incorporation, ask separately about directors, incorporators, shareholders, beneficial owners and any agent involved. Those are different functions and may generate different account, identity and consent requirements. A reliable administrative workflow documents authorisation and includes a way to verify the final registered result.

Protect the business after incorporation

Account security remains important after the certificate is issued. Directors and secretaries may use CROS to file annual returns, changes of officers and address updates. A compromised account can cause confusion about who initiated those filings. Use a strong unique password, maintain a secure email account and update your individual CRA profile when personal details change.

When a staff member or professional adviser stops working for the business, review any agent access or authorisations that have been given through applicable systems. Keep copies of company filings, stamped records and approvals in the business's controlled records. Speak with the Registry if you suspect your electronic identity or account access was used improperly.

A secure assistance workflow for an actual filing

A sensible client journey begins with a checklist of the intended transaction: whether the owner needs a new business name, company incorporation or an amendment to existing records. The person providing assistance can explain the application fields, prepare a document list and confirm what government fee is associated with the filing. The client reviews the information and retains control of their individual account and credentials when submitting or approving the transaction.

For a company, confirm who is authorised to submit forms and whether the role of incorporator, director, secretary or properly appointed agent is being used. The Registry has an approvals mechanism for naming other people in documents, and its electronic-signature rules depend on whether a person files on their own behalf. That difference can affect whether documents register electronically or require further signatures. An adviser should describe the proper route before asking for payment.

After completion, the client should receive a clear record of what was filed, relevant receipts and confirmation of the registered result. If a person leaves the company or stops acting as an agent, review any authorisations and account arrangements. The safest approach is a traceable process where the owner knows what was approved and no one needs to impersonate the CRA account holder.

Action checklist

• Keep your individual CRA password, one-time code and Identity PIN private.
• Verify the exact purpose of any requested CROS role or agent appointment.
• Review proposed forms before giving approvals through your own account.
• Ask for submission receipts, registered forms and confirmation of completed transactions.
• Keep company and business records in a controlled location rather than a consultant's personal messaging history.

Questions people ask

Can someone help me register without logging into my CRA?

Administrative support, document preparation and authorised account workflows can be arranged while your personal credentials remain under your control.

Is sharing a CRA PIN necessary for a director's approval?

The Registry's public guidance emphasises that the CRA PIN must not be shared. Use current approved workflow instructions and seek clarification from the Registry where a process seems inconsistent.

What if I already shared my password?

Change the password through the official CRA account process and review recent account activity and authorisations. Contact the Registry if there is any reason to suspect misuse.

Official references

Check the responsible authority for instructions that apply when you file. These sources informed this guide:

1. Companies Registry – FAQ on Account PIN and Login
2. Companies Registry – Account Security and Roles
3. Companies Registry – Approval Process

Related BizReg guides

• How do CROS approvals and electronic signatures work in Trinidad and Tobago?
• What do you need to create a CRA for CROS in Trinidad and Tobago?
• What is CROS in Trinidad and Tobago and how is it used for business registration?