MFA, which adds an additional step to the sign-in process for the agent services account (ASA) and the online services account (OSA), has been rolled out in stages. In the final stage – which began on 28 September 2026 and is due to end on 15 October 2026 – HMRC will add MFA to all accounts that have not yet had MFA activated.  

HMRC has informed ICAEW that it activated MFA on approximately 13,000 agent accounts between 28 September 2026 and 1 October 2026. Early indications suggest that the final roll-out is proceeding well, with HMRC reporting that only a “very small number” of calls were made to its online support helpline (OSH).

With two more weeks of the roll-out to come, ICAEW is encouraging agents yet to have MFA added to their accounts to take action now to avoid any disruption to their work. In particular, it is important that firms check whether there are any existing MFA options already set up on the account. Out of date access code settings should be removed to avoid potentially being locked out. Administrators can also do this on behalf of users.   

Key points to note include that: 

• MFA will be switched on between 8am and 9am, from  Monday to Thursday. This means that, if MFA has not been switched on by 9am that day, it will not be switched on later that day; 
• accounts with the same government gateway identifier will have MFA added at the same time. Where agents have more than one account with different government gateway identifiers, MFA could be added to those accounts on different days. For guidance on the government gateway identifier, see ICAEW’s TAXguide 01/26; 
• agents who recently received an ASA as a result of the phased introduction of mandatory registration with HMRC will have MFA activated during this final phase of the roll out; and
• agents should contact HMRC’s OSH should they encounter any issues.  

Further information 

• How agents can prepare for multi-factor authentication | ICAEW