A man sits waiting to log into his laptop, with icons in front of him showing a password box, then the MFA box and then a tick for logged in. Intended to show the process of logging in.

Multi-factor authentication is coming to HMRC Agent Accounts

19 March, 2026

Further to HMRC's Agent Update 141, published 19 March 2026, all members will need to be aware of changes to the login processes for agent accounts due to be introduced this year.

Currently Personal Tax Accounts (PTA) and Business Tax Accounts (BTA) are accessed using both login credentials (password and username) and a security code. This code can be sent to a mobile phone or landline, or generated by a connected authenticator app. This is called multi-factor authentication (MFA), as the user needs to use multiple pieces of information to access their account. 

Over the course of this year - exact timescale to be confirmed but with the initial aim of the end of June - HMRC will be bringing MFA to their agent online services. This will mean adding a second step of asking for a security code when logging into your agent online account(s). This will include both the Agent Services Account (ASA) and legacy online accounts used to access services including self-assessment and corporation tax.  

Some details of the change have been added to the Tax Agent Handbook. However, this is only basic guidance and we have asked HMRC to provide more detail to allow members to prepare. 

Agents will start to receive warning notices about the change when logging into their accounts from 7 April 2026. Firms should ensure that the whoever is responsible for managing their HMRC online accounts is aware of HMRC's plans to introduce this additional security step, and consider how they will manage these codes within their firm. How firms approach this change will depend on how the firm manages their login credentials and how staff receive security codes for other software.  

Message from HMRC shared with us: 

HMRC Multi-Factor Authentication (MFA) – Change to the agent sign in journey 

HMRC are working closely with tax advisors and professional bodies to introduce Multi-Factor Authentication (MFA) to strengthen security on agent accounts. MFA will provide greater protection as agents sign in to HMRC’s services, helping to keep accounts and client data secure.  

From Tuesday 7 April, to raise awareness of the upcoming introduction of MFA, agents will see a new page when signing in to their HMRC account on GOV.UK, linking to further guidance in the Tax Agent’s Handbook. 

A small group of agent volunteers are currently participating in a period of MFA test and learn, with testing then due to expand in April. HMRC will be contacting agents who they recognise would benefit from early adoption of the additional security MFA offers. This may be agents who have previously contacted HMRC due to account suspension or to raise security concerns.  

Members using automated processes or third-party software for their sign-in journey should check whether any software updates are needed and allow time for those adjustments. These changes only apply to web sign in on GOV.UK and will not affect services such as PAYE or Making Tax Digital for VAT. We urge agents to prepare and depending on their circumstances, identify the best approach for them to manage MFA’s introduction. 

To give agents time to prepare, HMRC will confirm the MFA go-live date for the wider agent community as early as possible, currently scheduled for delivery by the end of June 2026, but subject to successful testing.

If members have concerns or feedback, please email [email protected].