In June 2026, HMRC announced that it would complete the roll-out of MFA on all agent accounts between 28 September and 15 October 2026. HMRC is unable to give agents a specific date within this window for when MFA will be activated on their accounts.

However, HMRC has given agents the option of asking for MFA to be added on their accounts on 19 August 2026. To do this, agents must complete an online form in their agents services account (ASA) or online services account (OSA) by 31 July 2026. A previous opportunity to have MFA added on a specific date (15 July 2026) has now closed.  

Therefore, agents have the choice between: 

• opting for MFA to be added to some or all of their accounts on 19 August 2026, in which case they must complete the online form by 31 July 2026; and
• waiting for MFA to be added at some point between 28 September and 15 October 2026.  

In both cases, the agent should ensure they are prepared for the addition of MFA on their HMRC accounts. We have set out below the steps that agents may wish to take, drawing on HMRC’s guidance in its Tax Agent’s Handbook. 

Actions to take:      

Step one: Consider having multiple administrators  

The person who creates the firm’s agent online account will automatically be set up as an administrator. Administrators can perform additional tasks compared to standard users, for example, they can add or remove users. HMRC has published guidance for firms on how to set up administrators and users for agent accounts.  

HMRC recommends that firms with multiple staff members have at least two administrators. Potential benefits from this include allowing the firm to maintain continuity if an administrator is unavailable.   

Step two: Create accounts for staff members  

HMRC recommends that each member of staff who requires access to the firm’s ASA or OSA has their own individual sign-in credentials. Administrators can add new users by following HMRC’s guidance (see above).   

The process for creating new users differs between the ASA and the OSA. ICAEW understands that, in the OSA, the administrator must go into each client record and allocate that client to a user or users. This could be a significant task for firms that do not currently use individual accounts for staff members.   

HMRC has recently published a recorded webinar on creating and managing access groups in the ASA (currently in private beta). Creating access groups allows firms to control which clients staff members can view and manage in the ASA.   

Given the administrative challenges described, creating individual sign-in credentials is only a recommended step. But if firms do set up individual users, HMRC also recommends that firms remove access where it is no longer required, for example, where a staff member leaves the firm.   

Step three: Investigate how access codes will be received 

Access codes can be obtained through an authenticator app, a text message or a voice call. HMRC recommends that firms use an authenticator app as the primary method and set up an additional method as a back-up. ICAEW has published a TAXguide to help ICAEW member firms understand the options available to them.  

Step four: Review existing MFA options  

An existing MFA option may already be set up on the account. If this is the case, when MFA is rolled out, access codes will be sent to the contact details that were saved at the time the option was set up. If these details are out of date, then it will lead to agents being unable to access their account until they have been reset. HMRC advises that firms ensure that any existing MFA options are correct before MFA is activated.   

Although administrators can remove MFA options for users, they cannot set up new MFA options on behalf of users. The user can set up their MFA options:  

• in advance of MFA being activated; or
• on being prompted to do so when they first access the account after MFA has been activated.   

ICAEW understands that users have the opportunity to re-set up their MFA options if an administrator removes their security preferences.  

Step five: Contact software providers  

HMRC recommends that agents using automated processes or third-party software to manage their sign-in journey contact their software provider to check whether any adjustments are needed. HMRC says that software developers have been notified of the roll-out of MFA to allow time for necessary updates.