HMRC is in the process of adding multi-factor authentication (MFA) to agents' online accounts. MFA adds an additional step to the sign-in process for agents to help protect agent accounts. Currently, agents are asked to enter their government gateway ID and password to access their agent services account (ASA) or online services account (OSA). Once MFA is introduced, the agent will also need to enter a one-time access code.

The roll out of MFA also has implications for the way in which some firms access their online accounts. HMRC's recommends that firms  set up individual accounts for their staff members, as this is believed to be the most secure option. However, having to allocate clients to staff members – initially, and in response to changes in the practice, clients and staff members –  could present a significant challenge, meaning that continuing to use shared credentials to login to agent accounts is a better fit for some firms. Each firm will need to decide which method works best for them.

Agents have the option of having MFA added to their HMRC accounts: 

• on 19 August 2026, by completing an online form in their ASA or OSA by 31 July 2026; or
• at some point between 28 September and 15 October 2026.  

It had been possible for agents to have MFA added to their HMRC accounts on 15 July 2026 by completing an online form by 30 June 2026.  

A second Tax in Practice webinar poll revealed that 13% of agents opted for MFA to be set up on 15 July 2026 and that 18% of agents had opted, or will opt for it to be set up on 19 August 2026. 51% of respondents planned to wait until between 28 September and 15 October 2026, with 14% undecided and 4% having already had MFA added to their accounts.  

ICAEW’s Tax Faculty has published an article to help agents prepare for MFA and a TAXguide (recently updated) explaining the different options for setting up MFA.