MFA is live – please sign in to all your agent accounts

Multi-factor authentication (MFA) is now live on all agent accounts following the completion of the roll out this month. This brings HMRC agent accounts in line with the protection already in place for individual and organisation Government Gateway accounts.

MFA is an important security measure, and it is essential that agents sign in to all their accounts to confirm or create their access code settings for it to have full effect. 

If you have not already done so, please ensure that you sign in to all your agent accounts and create or confirm your access settings. 

Failure to set up your MFA options leaves your account less protected against unauthorised access. If someone obtains your sign-in credentials, they could potentially access sensitive client information, view account data and make changes within the services available to that account.

MFA applies to both the Agent Services Account (ASA) and HMRC Online Services for Agents. Signing in now also lets you confirm your access code method is working, so there are no surprises when you need to access your accounts for client work.

MFA for new agent accounts 

Any agents setting up new agent accounts should find that MFA is a standard part of the registration process for new agent accounts. Any agent setting up a new account from now on will have MFA in place from the outset. 

Guidance and support 

The joint ATT and CIOT guide Multi-Factor Authentication on agent accounts has been updated to reflect the completion of the roll out - and to highlight the work HMRC is doing to improve the process of allocating clients to staff on their legacy services. 

HMRC guidance is available in the Tax Agent's Handbook: Online services for agents’ guidance on GOV.UK. 

A recorded webinar covering practical guidance on MFA and what to expect is also still available via HMRC's email updates, videos and webinars for tax agents and advisers on GOV.UK.