HMRC will activate multi-factor authentication (MFA) on agents' accounts between 28 September and 15 October 2026, unless agents opt for earlier activation. This critical security requirement directly impacts how accountants and tax advisers access HMRC systems.
HMRC will activate multi factor authentication (MFA) on agents' accounts between 28 September and 15 October 2026, unless the agent opts for one of two earlier dates by completing an online form. MFA adds an additional step to the sign-in process for the agent services account (ASA) and the online services account (OSA).
The phased activation represents the regulator's latest effort to counter cyber-threats and unauthorised access to sensitive tax data.
HMRC says it is activating MFA for all agent accounts to "add an extra layer of security", and that it is taking action now "in response to ongoing and evolving online security threats". For practising accountants and tax agents, this is a critical development: failure to implement MFA by the deadline could disrupt client services and lock firms out of essential HMRC digital channels during the 2026/27 tax year.
What Is MFA and Why Does It Matter?
Multi-factor authentication requires users to verify their identity through multiple methods—typically a password combined with a one-time code sent to a registered mobile phone or email, or generated by an authenticator app. This significantly reduces the risk of credential theft or phishing attacks that could otherwise grant cyber-criminals access to client records, tax filings, and Real Time Information (RTI) submissions.
For firms managing dozens of clients' tax affairs, the security risk is material. A compromised agent account could enable fraudsters to file false tax returns, redirect client refunds, or alter VAT liabilities.
HMRC emphasises that it is taking action now "in response to ongoing and evolving online security threats".
Timeline: Three Options for Implementation
HMRC is giving agents the option of asking for MFA to be added on their accounts at an earlier, defined date. To do this, the agent must complete an online form by either:
- 30 June 2026, in which case MFA will be activated on 15 July 2026; or
- 31 July 2026, in which case MFA will be activated on 19 August 2026.
However, those deadlines have now passed. The default roll-out window is 28 September to 15 October 2026. HMRC is unable to give agents a specific date within this window for when MFA will be activated on their accounts.
For agents who have not yet registered for early activation, preparation should begin immediately.
MFA will be activated for all accounts held under the agent ID(s) provided. This means that if your firm operates multiple agent IDs, each will require separate setup of the authentication method.
Practical Next Steps
Firms should identify the authentication method they prefer—authenticator app (such as Microsoft Authenticator or Google Authenticator) or SMS-based codes—and ensure their registered contact details with HMRC are current. Staff who access the ASA or OSA should be briefed on the new sign-in process to avoid confusion during the migration. Test logins in advance, where possible, to identify and resolve any technical issues before the mandatory roll-out date.
The activation of MFA across all agent accounts also signals HMRC's broader shift towards digital security and data protection. Future interactions with HMRC may require similarly enhanced verification steps, particularly for sensitive transactions such as claim amendments, penalty appeals, or large payment deferrals.
The Wider Picture
This move aligns with broader government and FCA pushes to strengthen cyber hygiene across financial services and tax administration. As firms embed remote working, cloud-based accounting software, and digital client portals, the reliance on agent credentials means that any breach carries outsized risk. MFA is now the standard protective measure across banking, email, and government services; its application to HMRC systems was overdue.
Accountants should also remind clients—particularly those with online access to their own HMRC services—to enable MFA on their personal tax accounts.
HMRC has announced that the following services will be unavailable from 5pm on Friday, 11 September 2026 to 1pm on Tuesday, 15 September 2026: Sign up for Making Tax Digital for Income Tax and Sign up your client for Making Tax Digital for Income Tax. These windows suggest that system maintenance and security updates are ongoing; planning around such outages is prudent.
Further reading
- UK tax & accounting resource library — the Acts, regulations and standards referenced in our coverage.
- Accountancy, tax & regulatory bodies — HMRC, Companies House, ICAEW, ACCA and the rest, with what each one does.
- Find an accountant — AOPA member firms across the UK, searchable by town and service.
- How to find a good accountant — what to check before you appoint one.