Time to act on Multi-Factor Authentication for your HMRC agent accounts

HMRC has confirmed the timetable for the rollout of Multi-Factor Authentication (MFA) to all agent accounts. It’s time to get ready and decide whether you want to choose a specific date for activation.

We published six steps HMRC recommends you take to prepare in May, and there's detailed guidance in HMRC’s Tax Agent’s Handbook. Even if you looked at the handbook in May, it may be worth another look because HMRC has added more information to cover issues that arose during testing. 

Two essential actions to take now 

You should check as soon as possible whether an MFA option has already been set on your account – this could have happened several years ago. When MFA is activated, access codes will be sent to the contact details saved at the time. If those details are out of date you could lose access to your account. There are detailed instructions on how to check and update your settings in The Tax Agent’s Handbook.  

HMRC’s detailed guidance on the timetable and activation process appears below. If you want  to choose one of two specific dates for activation, you must complete an HMRC online form by 30 June (for activation on 15 July) or 31 July (for activation on 19 August). The form will be available from 10 June. If you wait for the final activation phase in September and October, you won’t be able to choose a specific date.

HMRC’s detailed guidance: Activation dates for agent accounts 

Why is MFA being introduced? 

The introduction of MFA brings agent accounts in line with the protection already in place for individual and organisation Government Gateway accounts and is part of HMRC's ongoing work to protect agents and their clients from the evolving threat to online security.

Choose a specific date 

From 10 June 2026, agents will be able to choose one of two specific dates for MFA to be activated on their accounts. This means agents who've already made the necessary preparations for MFA can make the switch on a date which most suits their business requirements and benefit from enhanced security, protecting themselves and their clients.

Agents wishing to take advantage of this must notify HMRC by completing an online form. The form will be available from 10 June 2026 when signing in to either an ‘agent services account’ or an ‘HMRC online services for agents account’. The form won't appear on accounts where MFA has already been activated.

• To have MFA activated on 15 July 2026 agents must submit a form to HMRC by midnight 30 June 2026.
• To have MFA activated on 19 August 2026, agents must submit a form to HMRC by midnight 31 July 2026.

Once activated, MFA will be applied to all accounts held under the agent ID(s) provided. Agents with multiple IDs can choose which ones to activate for each deadline. Any IDs not activated by earlier deadlines will automatically be included in the final activation window.

Final activation for remaining accounts

Between 28 September 2026 and 15 October 2026, MFA will be activated on all remaining agent accounts that don't already have it. HMRC is unable to give a specific date within this period to agents who are part of this final group for activation. Agent accounts that don't already have MFA will continue to see a message notifying them of the activation dates when signing in to either their ‘agent services account’ or an ‘HMRC online services for agents account’ until it's activated.

Additional information from HMRC

HMRC has worked closely with tax and software professional bodies to develop this approach, recognising some agents need additional time to prepare while others are ready to adopt the additional security as soon as possible. If agents want to benefit from a defined date at which MFA will be activated, they should opt for one of the two earlier dates specified. 

We strongly encourage all agents to prepare in advance for their chosen activation date by selecting your preferred future settings and checking for any existing MFA settings that may be outdated. This will ensure you're ready to use MFA on the date it is switched on for you. Full guidance on how to prepare is available in the updated Tax Agent Handbook on gov.uk.

Please note that there are no changes to the authentication journey for HMRC’s software channels (Transaction Engine APIs or the SOAP-based APIs) such as Making Tax Digital for VAT or ITSA, and the 18-month application authorisation-granting journey won't change.

Let us know if you have any questions 

We're involved in ongoing discussions with HMRC about the rollout of MFA. If you have any questions that aren't answered by HMRC’s detailed guidance in the Tax Agent’s Handbook, please let us know – we'll raise them with HMRC. 

Contact us