As explained in an earlier article, HMRC intends to apply MFA to all agent accounts. Although HMRC has not yet confirmed a date for the full roll-out, this could be as soon as the end of June 2026.  

MFA adds an additional step to the sign-in process for agents to help protect agent accounts. Currently, agents are asked to enter their government gateway ID and password to access their agent services account (ASA) or online services account (OSA). Once MFA is introduced, the agent will also need to enter a one-time access code. 

HMRC has updated the guidance on MFA in its tax agents handbook to explain how agents can prepare for the roll-out of MFA. HMRC’s recommendations are summarised below.   

Step one: Consider having multiple administrators 

The person who creates the firm’s agent online account will automatically be set up as an administrator. Administrators can perform additional tasks compared to standard users, for example, they can add or remove users. HMRC has published guidance for firms on how to set up administrators and users for agent accounts. 

HMRC recommends that firms with multiple staff members have at least two administrators. Potential benefits from this include allowing the firm to maintain continuity if an administrator is unavailable.  

Step two: Create accounts for staff members 

HMRC recommends that each member of staff who requires access to the firm’s ASA or OSA has their own individual sign-in credentials. Administrators can add new users by following HMRC’s guidance (see above).  

The process for creating new users differs between the ASA and the OSA. ICAEW understands that, in the OSA, the administrator must go into each client record and allocate that client to a user or users. This could be a significant task for firms that do not currently use individual accounts for staff members. 

HMRC has recently published a recorded webinar on creating and managing access groups in the ASA (currently in private beta). Creating access groups allows firms to control which clients staff members can view and manage in the ASA.  

HMRC also recommends that firms remove access where it is no longer required, for example, where a staff member leaves the firm.  

Step three: Investigate how access codes will be received

Access codes can be obtained through an authenticator app, a text message or a voice call. HMRC recommends that firms use an authenticator app as the primary method and set up an additional method as a back-up.  

The ‘Remember me’ function can be used to sign in to an account from the same device, using the same browser, without the need to input an access code for seven days. 

Step four: Review existing MFA options 

An existing MFA option may already be set up on the account. If this is the case, when MFA is rolled out, access codes will be sent to the contact details that were saved at the time the option was set up. HMRC recommends that firms ensure that any existing MFA options are correct.  

Although administrators can remove MFA options for users, they cannot set up new MFA options on behalf of users. The user can set up their MFA options: 

• in advance of MFA being activated; or
• on being prompted to do so when they first access the account after MFA has been activated.  

ICAEW understands that users have the opportunity to re-set up their MFA options if an administrator removes their security preferences. 

Step five: Contact software providers 

HMRC recommends that agents using automated processes or third-party software to manage their sign-in journey contact their software provider to check whether any adjustments are needed. HMRC says that software developers have been notified of the roll-out of MFA to allow time for necessary updates.