HMRC has confirmed that multi-factor authentication (MFA) is being switched on for tax agent accounts during 2026, and from 10 June 2026 agents can choose when it happens to them. If you sign in to an agent services account or to HMRC online services for agents, this change affects how you and your team log in — so it pays to plan ahead rather than be caught out mid‑deadline.
Here is what is changing, the dates that matter, and the short checklist we recommend every practice works through before the switch reaches their accounts.
What is actually changing
Once MFA is active on an agent account, signing in will no longer be just a Government Gateway user ID and password. You will also need to enter a one‑time access code, generated one of three ways:
- through an authenticator app on your phone (the most reliable option),
- by SMS text message, or
- by an automated voice call.
This is the same sign‑in journey HMRC already uses for individuals and organisations, so for many people it will feel familiar. Importantly, once MFA is activated it applies to every account held under the agent ID(s) you provide — not just the one you happened to log in with.
You can now choose your activation date
The headline news is flexibility. Rather than waiting for HMRC to flip the switch at a time of its choosing, agents who are ready can opt in to one of two specific dates and move on their own schedule. From 10 June 2026, an online opt‑in form appears when you sign in to either agent account type. (The form will not appear on any account where MFA is already active.)
| If you want MFA active on… | Submit the online form by… |
|---|---|
| 15 July 2026 | midnight on 30 June 2026 |
| 19 August 2026 | midnight on 31 July 2026 |
| Any remaining accounts | activated automatically between 28 September and 15 October 2026 |
If you do nothing, your accounts will simply be switched on during that final window. HMRC has said it cannot give a specific date to anyone in this last group, so the trade‑off is clear: opt in early and you control the timing; wait, and you get a date you can’t predict.
Managing multiple agent IDs
Larger practices often hold several agent IDs. You can choose which IDs to activate at each deadline — there is no requirement to do them all at once. Any ID you don’t activate by the earlier deadlines is automatically rolled into the final 28 September–15 October window. That makes it practical to pilot MFA on one ID first, confirm your team’s process works, then bring the rest across with confidence.
What this does not affect
If you connect to HMRC through software, there is some welcome reassurance here. There are no changes to the Transaction Engine API or the SOAP‑based APIs, and the 18‑month application authorisation‑granting journey is unchanged. HMRC has confirmed it will not issue technical specifications for this rollout, because the change is to the interactive agent sign‑in journey, not to the underlying machine‑to‑machine connections. In short: your filing integrations keep working; it is the human login that gains a second step.
Your pre‑activation checklist
- Pick your date. Decide whether 15 July, 19 August, or the automatic autumn window suits your workload best, and diarise the matching form deadline.
- Set up an authenticator app on each team member’s phone before activation day, so nobody is locked out at a busy moment.
- Confirm your contact details are current if you intend to rely on SMS or voice codes.
- Map your agent IDs and decide the order you’ll activate them, especially across multiple offices.
- Brief your team and clients so the extra sign‑in step is expected, not a surprise that generates support calls.
- Read the detail. Full guidance is in the updated Tax Agent Handbook on GOV.UK.
The bottom line
MFA is a genuine security upgrade — it protects you and your clients from account takeover, which is exactly the kind of risk that keeps practice owners awake at night. The change is coming either way, so the only real decision is whether you take the controlled route and choose your date, or let HMRC choose it for you in the autumn. A few minutes setting up an authenticator app now will save a scramble later.
At invoice4you, we’ll keep tracking HMRC’s agent changes and flag anything that affects how you and your clients work. If you have questions about preparing your practice, our support team is here to help.