As explained in an earlier article, HMRC is due to complete the roll out of multi factor authentication (MFA) to the OSA and the agents services account (ASA) by 15 October 2026. In its guidance on MFA, HMRC recommends that each member of staff who requires access to the firm’s ASA or OSA has their own individual sign-in credentials, as this is believed to be the most secure approach. 

However, having separate credentials for staff members can present a significant challenge for some firms. This is particularly the case for the OSA, where the firm must allocate clients to staff members one at a time. This can be time-consuming on initial set-up and difficult to manage going forward as allocations change, staff members leave and new staff join. Therefore, some firms have decided to continue using shared credentials.  

To help firms to use separate sign-in credentials for staff, HMRC is developing an enhancement in the OSA that will allow firms to assign multiple clients to a staff member. HMRC says that this will reduce the administrative burden on firms and deliver “stronger security, clearer accountability and improved auditability”.  

HMRC expects to begin testing the new service with agents before the end of 2026, which will include exploring the volume of clients that can be allocated at one time. ICAEW will publish further details on the enhancement once they become available.

Access groups in the ASA 

The functionality within the Agent Services Account (ASA) differs to the OSA. It is possible for firms to create access groups in the ASA to allow them to control which clients staff members can view and manage. HMRC has published a recorded webinar on creating and managing access groups in the ASA.