HMRC has confirmed a July 31, 2026 deadline for tax agents to opt out of having multi-factor authentication (MFA) added to their HMRC accounts. The mandatory rollout of MFA on all agent accounts will occur between September 28 and October 15, 2026.
Opt-Out and Early Activation Options
Agents can request MFA to be added earlier, on August 19, 2026, by completing an online form in their agents services account (ASA) or online services account (OSA) by July 31, 2026. This extra security step requires users to enter a one-time access code after signing in with their Government Gateway user ID and password, protecting accounts even if credentials are compromised.
Setting Up MFA
Once activated, each user must set up their own MFA method if not already done. Agents may choose to set this up in advance and agree on a consistent approach across their team, according to the Labour Party government's website. The ICAEW warned that existing MFA options may be out of date, leading to access issues. They advise firms to ensure existing MFA details are correct before activation.
ICAEW explained: "An existing MFA option may already be set up on the account. If this is the case, when MFA is rolled out, access codes will be sent to the contact details that were saved at the time the option was set up. If these details are out of date, then it will lead to agents being unable to access their account until they have been reset."
Administrator and User Responsibilities
Administrators can remove MFA options for users but cannot set up new ones on their behalf. Users can set up their MFA options in advance of activation or when prompted upon first access after activation. ICAEW understands that users can re-set up their MFA options if an administrator removes their security preferences.
