HMRC: Mandatory Agent MFA Activation 2026 Rollout Begins

• HMRC is making multi-factor authentication (MFA) mandatory for all agent online service accounts to enhance security.
• Automatic activation for remaining agent accounts will occur between September 28 and October 15, 2026.
• Agents must proactively prepare their accounts by checking existing MFA settings and updating contact details before September 2026 to avoid service disruption.
• MFA adds an extra layer of security, requiring a one-time access code in addition to a user ID and password for all linked Government Gateway services.
• HMRC advises firms to ensure each staff member has individual credentials and to promptly remove access for departing personnel to maintain security and compliance.

To prevent any disruption to essential tax services, agents, particularly lawyers and compliance officers, must prepare their HMRC online service accounts well in advance of the September 2026 activation period.

HM Revenue & Customs (HMRC) is implementing a mandatory multi-factor authentication (MFA) system for all agent online service accounts, a critical enhancement designed to bolster security against evolving online threats. This initiative, known as the HMRC agent MFA activation 2026, aims to safeguard sensitive client data and ensure the integrity of tax services accessed by agents.

While some agents voluntarily adopted MFA through early activation periods in July and August 2026, the remaining agent accounts will undergo automatic activation. This compulsory rollout is scheduled to occur between September 28, 2026, and October 15, 2026. HMRC has indicated that it cannot provide specific activation dates for individual accounts within this window, underscoring the need for proactive preparation by all tax agents.

Multi-factor authentication introduces an additional layer of security beyond traditional username and password credentials. When an agent signs into their Government Gateway account, they will be prompted to enter a unique, one-time access code after providing their standard login details. This system is already in place for individuals and organizations utilizing Government Gateway services, and its extension to agent accounts is a direct response to the increasing sophistication of cyber threats.

Once activated, this enhanced security measure will apply across all online services linked to that specific Government Gateway account. This includes crucial platforms such as the Agent Services Account and the HMRC online services for agents account, which facilitate access to a range of client services. These services encompass PAYE for Agents, allowing management of client responsibilities, and Self Assessment for Agents, covering individuals, businesses, trusts, partnerships, National Insurance, and requests related to the High Income Child Benefit charge. The specific tax services an agent uses will determine the type of account required, all of which will eventually be protected by the Government Gateway agent MFA rollout.

To prevent any disruption to essential tax services, agents, particularly lawyers and compliance officers, must prepare their HMRC online service accounts well in advance of the September 2026 activation period. It is crucial to verify whether an MFA option has already been configured for an account, as this may have occurred if a firm member enabled it while using another HMRC service, such as Making Tax Digital for VAT. The one-time access codes generated by MFA are sent to the contact details recorded when the option was initially set up, making it imperative to ensure these details are current and accurate.

Administrators within an agent's firm possess the capability to remove existing MFA options for team members; however, they cannot establish new ones on behalf of others. Detailed guidance for updating settings is available for both Agent Services Accounts and HMRC agent accounts, providing clear instructions for managing these security configurations. Proactive engagement with these preparation steps is vital for a seamless transition to mandatory HMRC agent account preparation MFA.

HMRC strongly advises that each member of staff requiring access to an agent's online services, including the HMRC agent services account MFA, possesses their own individual sign-in credentials. This practice enhances accountability and security within the firm. For organizations with multiple staff members, HMRC recommends designating more than one administrator for their accounts. This redundancy ensures continuity of access management and provides an additional layer of oversight.

Maintaining robust security also necessitates promptly removing access for any staff members who depart the organization or no longer require access to HMRC online services. This measure significantly reduces the risk of unauthorized access and helps to safeguard sensitive client information. Comprehensive guidance on how to manage staff access, including adding standard users, administrators, and removing personnel, is readily available from HMRC, supporting firms in maintaining compliance and operational security.

Lawyers and compliance officers acting as tax agents must prepare their HMRC online service accounts for mandatory multi-factor authentication (MFA) activation between September and October 2026 to avoid disruption to critical tax services. They should ensure staff access is managed securely and MFA contact details are up to date before the activation dates.

Source: Original reporting via HMRC guidance