United KingdomChartered Institute of Taxation
HMRC will switch remaining agent accounts to MFA from 28 September
Automatic activation runs until 15 October, without an account-specific date; firms should update access-code settings and prepare staff before the window opens.
By Taxxa AI OyPublished 21 August 2026
HMRC will automatically enable multi-factor authentication on all remaining agent accountsTAX between 28 September and 15 October 2026
TAX. The two voluntary activation phases have ended, with more than 20,000 accounts already using MFA, according to the Chartered Institute of Taxation. Firms should be ready by 28 September to avoid disruption to workflows and client service.
HMRC cannot give agents in the final group an individual activation dateTAX. CIOT says switching will take place between 8am and 9am, Monday to Thursday, during the three-week period. Agents should check their accounts after 9am: if no MFA challenge appears when they sign in, their account will not be switched on that day.
MFA adds a one-time access code to the Government Gateway user ID and passwordGOV. It applies to the Agent Services Account and legacy HMRC online agent accounts
TAX. Firms need to decide how staff will receive codes and check settings before activation, including any authentication option previously established when using another HMRC service. Once sign-in MFA is activated, codes go to the contact details already saved for that option.
HMRC’s preparation guidance recommends individual sign-in credentials for each staff member who needs access and more than one administrator where the organisation has multiple staff. This enables internal resets and continuity when an administrator is unavailable. Administrators can remove team members’ MFA options but cannot set up new ones for them. Access for staff who leave or no longer need it should be removed.
HMRC recommends an authenticator app as the primary method and one additional method as a backup. Apps work on a phone, tablet or computer and can provide codes without a mobile signal or internet connection. Text-message and voice-call codes last 15 minutes; voice calls are unsuitable for switchboards. Firms using automated sign-in processes or third-party software should ask their provider whether adjustments are needed.
The “remember me” option allows sign-in without another code for seven days on the same device and browser. Changing the Government Gateway user ID, device or browser still triggers a code request during that period.
The operational requirements and preparation steps are set out in the Online services for agents chapter of HMRC’s Tax Agent’s Handbook.
Before 28 September, update each agent account’s MFA settings, confirm staff access and administrator cover, and check sign-in software with your provider.