HMRC have confirmed that they will introduce Multi-factor Authentication (MFA) for agent accounts as part of its efforts to combat the continued and evolving threat to online security.
From 7 April 2026, agents signing in to HMRC’s online services will begin to see a new page explaining that Multi-factor Authentication (MFA) is coming.
Testing in progress
HMRC is currently testing MFA with a small group of agents and, if successful, intends to complete a full rollout by the end of June 2026.
- Beginning in April, HMRC will expand the testing programme by contacting agents they feel could benefit from early adoption of MFA. This is likely to include agents who have previously contacted HMRC about account suspension or security concerns.
What is MFA and how will it work?
MFA is a security measure requiring users to verify their identity using two or more independent credentials. It is already in place for HMRC’s personal and business tax accounts used by individuals and organisations.
- Once MFA is introduced, agents will need to enter both their password and a one-time access code to log in.
- HMRC has not specifically confirmed how one-time access codes will be provided to agents, but such codes are typically sent by text or email, or generated through an authenticator app.
- MFA will only apply to web sign-in on GOV.UK. PAYE and Making Tax Digital for VAT will not be affected.
Preparing for the change
If you are affected, HMRC are advising that you consider how you will receive access codes and ensure access code settings and administration roles are ready.
- Firms that share agent account access among employees will need to consider how codes can be made available to users.
- It currently appears that HMRC will permit multiple uses of the same code.
- Some password managers have shared credential functionality that may assist.
- It may also be necessary to review internal policies if staff do not have work mobile phones or are not permitted to receive codes on their personal phone.
If you use automated processes or third-party software to sign in, it may be worth contacting your software provider to check whether any adjustments are needed.
- HMRC have confirmed that they have notified software developers of the change.
Useful guides on this topic
Mandatory tax adviser registration with HMRC
From May 2026, all tax advisers who interact with HMRC on behalf of clients will be required to register with them. Who will be required to register? What conditions must be met? What are the consequences of non-compliance with ‘mandatory tax adviser registration’?
Setting up as a tax agent
What do you need to consider when setting up as a tax agent? What are the steps? How do you register with HMRC?
External link
HMRC: The Tax Agent’s Handbook: Multi-factor authentication
