TaxxaCompany Logo

Menu

Company

About usCareersBlogContact usLinkedInYouTube

Product

FeaturesPricingFAQ

Legal

Cookie PolicyData Processing AgreementPrivacy PolicyTerms and Conditions
© 2026 Taxxa AI Oy. All rights reserved.
  1. News
  2. /United Kingdom
  3. /Tax

United Kingdom·Chartered Institute of Taxation

HMRC will switch remaining agent accounts to MFA from 28 September

Automatic activation runs until 15 October, without an account-specific date; firms should update access-code settings and prepare staff before the window opens.

By Taxxa AI Oy · Published 21 August 2026

Tax

HMRC will automatically enable multi-factor authentication on all remaining agent accountsTAX between 28 September and 15 October 2026TAX. The two voluntary activation phases have ended, with more than 20,000 accounts already using MFA, according to the Chartered Institute of Taxation. Firms should be ready by 28 September to avoid disruption to workflows and client service.

HMRC cannot give agents in the final group an individual activation dateTAX. CIOT says switching will take place between 8am and 9am, Monday to Thursday, during the three-week period. Agents should check their accounts after 9am: if no MFA challenge appears when they sign in, their account will not be switched on that day.

MFA adds a one-time access code to the Government Gateway user ID and passwordGOV. It applies to the Agent Services Account and legacy HMRC online agent accountsTAX. Firms need to decide how staff will receive codes and check settings before activation, including any authentication option previously established when using another HMRC service. Once sign-in MFA is activated, codes go to the contact details already saved for that option.

HMRC’s preparation guidance recommends individual sign-in credentials for each staff member who needs access and more than one administrator where the organisation has multiple staff. This enables internal resets and continuity when an administrator is unavailable. Administrators can remove team members’ MFA options but cannot set up new ones for them. Access for staff who leave or no longer need it should be removed.

HMRC recommends an authenticator app as the primary method and one additional method as a backup. Apps work on a phone, tablet or computer and can provide codes without a mobile signal or internet connection. Text-message and voice-call codes last 15 minutes; voice calls are unsuitable for switchboards. Firms using automated sign-in processes or third-party software should ask their provider whether adjustments are needed.

The “remember me” option allows sign-in without another code for seven days on the same device and browser. Changing the Government Gateway user ID, device or browser still triggers a code request during that period.

The operational requirements and preparation steps are set out in the Online services for agents chapter of HMRC’s Tax Agent’s Handbook.

Before 28 September, update each agent account’s MFA settings, confirm staff access and administrator cover, and check sign-in software with your provider.

Sources

  1. Prepare now for Multi-Factor Authentication (MFA)
  2. Online services for agents
  3. How to get ready for increased security on HMRC agent accounts

Share with your network

More on this

  1. 26 Aug 2026

    October sugar quota licences expire earlier for Albanian imports

  2. 26 Aug 2026

    Pigmeat quota licences run from October 2026 to June 2027

  3. 26 Aug 2026

    October poultry quota licences have two different expiry dates

  4. 26 Aug 2026

    Garlic quota notice sets 2,312 tonnes for October-to-May licences

  5. 25 Aug 2026

    HMRC tightens its overseas R&D raw-materials example

United Kingdom news