HM Revenue and Customs (HMRC) is set to implement Multi-factor Authentication (MFA) for agent accounts. This move aims to enhance online security amid ongoing threats. Effective from April 7, 2026, agents will notice a new login page detailing the MFA process.
Testing Phase for MFA
In preparation for the rollout, HMRC is currently testing MFA with a select group of agents. If this testing proves successful, a full implementation is expected by the end of June 2026. Starting in April, HMRC will expand its testing program, reaching out to agents who may benefit from early MFA adoption. Those with previous concerns about account suspensions or security are likely to be included in this initial phase.
Understanding Multi-Factor Authentication
MFA is a crucial security protocol that requires users to confirm their identity using two or more separate credentials. This measure is already active for personal and business tax accounts. Once MFA is fully implemented, agents will be required to enter both their password and a one-time access code to access their accounts.
Access Code Delivery
HMRC has yet to disclose the precise method for delivering one-time access codes to agents. Typically, these codes are sent via text message, email, or through an authenticator application. It’s important to note that MFA will primarily apply to web sign-ins on the GOV.UK platform. Other services, such as PAYE and Making Tax Digital for VAT, will remain unaffected.
Preparation for the Transition
Agents should take proactive steps to prepare for this transition. HMRC recommends considering how access codes will be received. Businesses that grant shared account access among employees need to find methods to provide codes to all relevant users. Initial information suggests that HMRC may allow multiple uses of the same code, which could facilitate easier access.
Reviewing Internal Policies
- Assess how staff will receive access codes, particularly if they lack work mobile phones.
- Consider potential adjustments to internal policies regarding code reception on personal devices.
- Consult with software providers if automated processes or third-party applications are utilized for sign-ins.
HMRC has communicated these changes to software developers to ensure compatibility and support during the transition.
Upcoming Changes in Tax Adviser Registration
In addition to MFA, HMRC will require all tax advisers interacting with them on behalf of clients to register. This mandatory registration will commence in May 2026. Tax advisers should familiarize themselves with the requirements and consequences of non-compliance.
- This registration is essential for maintaining compliance with HMRC regulations.
- Tax advisers need to ensure they meet all conditions set forth by HMRC.
For detailed guidance and the latest updates, agents are encouraged to refer to the HMRC Tax Agent’s Handbook, particularly the section on Multi-factor Authentication.
