MFA further update – what is my agent identifier and why is it important?

Further to our article on 8 June 2026, we wanted to provide a short practical update on the ‘agent identifier’ that is required to voluntarily opt in any account to the summer switch on of multi-factor authentication (MFA). 

The ATT and CIOT have recently updated their guide ‘Multi Factor Authentication – how can agents prepare?’ following confirmation of the implementation plan from HMRC. 

Timelines 

To recap, there will be three phases – two voluntary phases where agents can choose to have MFA activated on two dates over the summer and a final mandatory implementation phase, where HMRC will switch MFA on for all remaining agent accounts.

Agents wishing to voluntarily opt in, will need to notify HMRC by completing a form which will be available in the Agent Services Account and the Online Services Account from 10 June 2026.

To have MFA activated on 15 July 2026, agents must submit a form to HMRC by midnight on 30 June 2026.

To have MFA activated on 19 August 2026, agents must submit a form to HMRC by midnight on 31 July 2026. 

The agent will need to include their Government Gateway Identifier on the form, please see below for further explanation. 

Between 28 September and 15 October 2026, MFA will be activated on all remaining agent accounts that do not already have it. HMRC is unable to give a specific date within this period to agents who are part of this final group for activation. 

What is the Government Gateway Identifier? 

The Government Gateway Identifier is not the agent code nor the Government Gateway credentials that most agents will be familiar with. 

The Government Gateway Identifier can be accessed after logging into your HMRC Online Services Accounts (OSAs) or Agent Services Accounts (ASAs). Our guide includes the steps that an agent needs to take to access this identifier. 

Generally, each Government Gateway account for the firm should have its own unique Government Gateway Identifier. HMRC will use this Government Gateway Identifier to turn on MFA. All services within a single Government Gateway account (e.g. SA, CT, PAYE etc) and all individual credentials for administrators or users linked to that Government Gateway account will have MFA activated when HMRC switch on MFA for the agent.  

Many firms will have multiple accounts (for example, separate accounts for different offices), each with their own Government Gateway Identifier. This means that agents can voluntarily opt in for the summer switch on dates on an account by account basis. This could be useful for agents wishing to try MFA switch on in a more controlled way over the summer, before wider rollout. 

A word of warning however, it is possible that some accounts may share a Government Gateway Identifier depending on how the accounts were originally set up. Our understanding from HMRC is that this should be a relatively small population of accounts. 

It is advisable for agents to allocate and compile a centralised list of their Government Gateway Identifiers so that they can identify if any accounts are linked,  before opting in to the voluntary MFA switch on over the summer. 

Summary and key steps

The Government Gateway Identifier is the reference that HMRC need to switch MFA on during the voluntary phases. The Government Gateway Identifier is not the agent code nor the Government Gateway credentials. 

The Government Gateway Identifier can be found within each OSA and ASA and instructions on how to locate this can be found in our guide. 

Generally, each Government Gateway account should have a unique Government Gateway Identifier. This means agents could opt in to the voluntary switch on over the summer on an account by account basis. 

However, care should be taken. There could be linked accounts depending on how the accounts were set up. If agents wish to voluntarily opt in, they should locate and compare identifiers to check if any accounts share an identifier. If accounts share an identifier, they will be switched on at the same time.