Client list management and the final countdown to MFA

HMRC have confirmed today that they are looking to make changes which will improve how clients are allocated to staff in their legacy online accounts. These changes won’t be in place before the final implementation of Multi-Factor Authentication (MFA) is completed on 15 October, but agents will benefit from the enhancements in future.

The final phase of MFA 

From 28 September 2026, HMRC will be automatically enabling MFA on all agent accounts that do not already have it.  

The switch on will happen between 8am and 9am, Monday to Thursday, over the three-week period from 28 September to 15 October 2026. Firms will not know what day MFA will be switched on for their accounts, so it is vital that all firms are prepared by Monday 28 September to ensure that they can continue to access HMRC’s online services without disruption. 

Shared or individual credentials? 

As part of their planning, firms need to decide if they wish to continue to share login credentials between staff, or set up individual credentials for each member of staff who need access to HMRC’s online services.

We understand that some people have assumed that the introduction of MFA means agents must move to individual staff credentials now. This is not the case. 

In the long-term, HMRC’s would like to see agents to move to individual login credentials for all staff as this is generally considered more secure. However, agents do not have to transition now, just because of MFA. Agents can continue to share login credentials between staff even after MFA is switched on, provided that they set up an authenticator app to generate the necessary MFA access codes. 

Client allocation challenges

HMRC’s legacy services are used for services including self-assessment, corporation tax and PAYE. 

Creating individual logins on HMRC’s legacy services creates a lot of additional work to ensure all staff have access to all the clients they need. This is one of the reasons that many agents share credentials between staff. 

Once additional accounts are added to the agent’s main account, clients will not automatically appear on any user’s client list. Each staff member needs to have the clients they want access to individually assigned to them. For example, to allocate 200 clients to two members of staff requires 2 x 200 = 400 allocations. This is a lot of work for all but the smallest client lists. 

Individual logins are set up differently on the newer Agent Services Account (ASA) used for MTD and the issues of client allocation are not as challenging. For the ASA, it is possible to manage staff access via Access Groups. 

Improvement plans – bulk allocation 

In September’s Agent Update, HMRC confirmed that they are developing an enhancement that will allow agent firms to assign multiple clients at time to a staff member. 

We are not expecting a simple ‘allocate all’ option, but we are hoping to see agents able to allocate a reasonable number of clients to a staff member in one go. This should cut down on the amount of work needed to allocate clients and make moving to individual credentials more practical. 

HMRC tell us that they expect to begin testing the new service with agents before the end of 2026, which will include exploring the volume of clients that can be allocated at one time. If you would be interested in taking part in testing, please let us know on [email protected]. 

The impact for MFA planning 

We are pleased to see that HMRC have taken onboard our concerns about the challenges of client allocation on the legacy online services accounts and are looking to develop an improved client allocation service.

However, any improvements will not be made until after MFA has been completely rolled out to all agent accounts. So agents who have already moved to individual logins - or are planning to – will not benefit from the enhancement at this stage. We understand that some agents will be disappointed by this. However, these agents will benefit in future when staff join or change roles. 

Summary 

The key message is that agents need to prepare urgently for MFA if they have not already. There are only days to go now before HMRC start the final roll-out. 

Agents who are still considering the merits of single or shared credentials may want to bear in mind that an enhanced service for allocating clients is being developed. An agent could continue to use shared credentials with an authenticator app now, and transition to separate staff logins in future. 

Further guidance on preparing for the introduction of MFA can be found in the joint ATT and CIOT MFA guide.