HMRC Agent MFA: Multi-Factor Authentication Deadlines and What You Need to Do

Last updated: June 2026

HMRC is rolling out mandatory multi-factor authentication for all agent accounts in the second half of 2026. This follows the same MFA journey already in place for individuals and organisations using Government Gateway, and it closes what has been one of the last remaining gaps in HMRC's digital security posture.

If you are a tax agent, accountant, bookkeeper, or any professional who accesses HMRC services on behalf of clients, this change affects you. The good news: it is straightforward to set up, the timeline offers flexibility, and there are no changes to the underlying APIs or the 18-month application authorisation-granting journey that agents rely on for client access.

This guide covers every detail: the three activation windows with exact dates, how to prepare your authenticator app, what happens if you do nothing, how multiple agent IDs are handled, the impact on software and APIs, and what AccountsOS users specifically need to know.

What is HMRC agent MFA and why is it being introduced?

Multi-factor authentication (MFA) adds a second layer of security to the sign-in process. Instead of relying solely on a Government Gateway user ID and password, agents will also need to enter a one-time access code generated by an authenticator app, sent via SMS, or delivered by voice call.

HMRC has been rolling out MFA across Government Gateway for several years. Individuals and organisations already use it. Agent accounts are the final group to be brought into line.

The rationale is simple. Agent accounts have privileged access to client tax records, submissions, and sensitive financial data. A compromised agent account could expose hundreds or thousands of clients' records. Password-only authentication is no longer considered adequate for that level of access.

HMRC's communication on the change emphasises that this mirrors the existing MFA journey that individuals and organisations already follow. The user experience, the setup process, and the authentication methods are the same. If you have ever set up MFA on a personal Government Gateway account, the agent process will be familiar.

What counts as an "agent" for MFA purposes?

Any person or organisation that uses an agent services account or HMRC online services for agents account to act on behalf of clients. This includes:

• Tax agents and accountants
• Bookkeepers with agent access
• Payroll bureaux
• VAT agents
• Corporation Tax filing agents
• Self Assessment filing agents
• Any professional using agent credentials to access HMRC services

If you sign in with a Government Gateway user ID that is associated with agent services, MFA will apply to you.

The three activation windows: exact dates and deadlines

HMRC is not switching on MFA for all agents at once. Instead, the rollout uses a phased approach with two opt-in windows and one mandatory final sweep.

From 10 June 2026, agents can choose one of two specific dates for MFA activation by completing an online form. The form is available when signing in to your agent services account or HMRC online services for agents account.

Window 1: submit by 30 June, active 15 July

The earliest opt-in window. If you want to get MFA set up and working as soon as possible, complete the online form before midnight on 30 June 2026. Your MFA will be activated on 15 July 2026.

This is the recommended approach for agents who want to:

• Test MFA in a quieter period before the autumn filing rush
• Train staff on the new sign-in process with plenty of time to resolve issues
• Demonstrate security best practice to clients
• Get ahead of the mandatory deadline

Window 2: submit by 31 July, active 19 August

The second opt-in window gives you an additional month. Complete the form by midnight on 31 July 2026 and MFA activates on 19 August 2026.

This window suits agents who:

• Need more time to prepare staff or update internal procedures
• Want to see how Window 1 goes before committing
• Have a heavy July workload (Self Assessment payment deadline is 31 July for some clients)

Final sweep: 28 September to 15 October (mandatory)

If you do not submit the form by either deadline, HMRC will activate MFA on your agent account automatically between 28 September and 15 October 2026. You do not get to choose the exact date within this window.

This is not a penalty or an enforcement action. It is simply the catch-all activation for any accounts not yet covered. However, being activated during this window means you will not have had the opportunity to test MFA on your own terms before it goes live.

How to prepare: step-by-step setup guide

Setting up MFA for an agent account follows the same process as for individuals and organisations. Here is what to do before your chosen activation date.

Step 1: Choose your authentication method

HMRC supports three methods for generating one-time access codes:

The authenticator app is the recommended method. It is the most secure, the fastest to use day-to-day, and does not depend on mobile signal or network availability.

Step 2: Install an authenticator app (if using app-based MFA)

If you do not already have an authenticator app, install one before your activation date. All of the following work with HMRC Government Gateway:

• Google Authenticator (iOS, Android): free, simple, widely used
• Microsoft Authenticator (iOS, Android): free, supports backup and restore
• Authy (iOS, Android, desktop): free, supports multi-device sync and encrypted backups
• 1Password (iOS, Android, desktop, browser): paid password manager with built-in TOTP

Any app that supports TOTP (Time-based One-Time Password) will work. You do not need a specific HMRC app.

Step 3: Submit the activation form

From 10 June 2026:

1. Sign in to your agent services account or HMRC online services for agents account using your Government Gateway user ID and password
2. You will see an option to complete the MFA activation form
3. Choose your preferred activation date (Window 1: 15 July, or Window 2: 19 August)
4. Submit the form

The form is straightforward. HMRC has confirmed it will be available from within the sign-in journey itself, so you do not need to navigate to a separate service.

Step 4: Set up MFA when prompted

On your activation date, the next time you sign in to Government Gateway with your agent credentials, you will be prompted to set up MFA:

1. Sign in with your Government Gateway user ID and password as normal
2. The system will ask you to set up a second factor
3. If using an authenticator app: scan the QR code displayed on screen, or enter the setup key manually
4. Enter the 6-digit code from your app to confirm
5. If using SMS or voice call: enter and verify your phone number

From that point on, every sign-in will require both your password and a one-time code.

Step 5: Save your recovery codes

After setting up MFA, HMRC will provide recovery codes. These are one-time-use codes that let you sign in if you lose access to your authentication method (for example, if your phone is lost or broken).

Store these recovery codes securely:

• Print them and keep them in a safe or locked drawer
• Save them in a password manager
• Do not store them in an unencrypted document on your computer
• Do not email them to yourself

If you lose your phone and your recovery codes, you will need to contact HMRC to regain access to your account, which could take several working days.

What happens if you do nothing?

If you do not submit the activation form by either of the two opt-in deadlines, your account will be activated for MFA automatically during the final sweep between 28 September and 15 October 2026.

The practical consequence is:

• You will still need to set up MFA. The activation just means MFA is enabled on your account. You will be prompted to complete the setup (choosing your method, scanning the QR code, etc.) the next time you sign in after activation.
• You will not be able to sign in without completing setup. Once MFA is activated, Government Gateway requires the second factor. If you have not prepared (no authenticator app installed, no phone available), you will be locked out until you complete the setup.
• No penalty or fine. HMRC is not penalising agents who wait for the final sweep. But being unprepared when it activates, especially during the busy autumn period, could disrupt your ability to file on behalf of clients.

The risk of waiting is operational, not regulatory. If MFA activates on your account on, say, 2 October 2026, and you need to file a VAT return that day but have not set up an authenticator app, you will be unable to sign in until you do. The setup takes 5 to 10 minutes, but that assumes you have a phone to hand and know what to do.

The recommendation: opt in during Window 1 or Window 2 when you can control the timing.

Handling multiple agent IDs

Many firms have more than one Government Gateway agent ID. This is common when:

• Different teams handle different tax types (VAT, PAYE, Corporation Tax)
• The firm has grown through mergers or acquisitions and inherited legacy IDs
• Separate IDs are used for different client groups or offices
• Individual staff members have their own agent credentials

HMRC has confirmed that agents with multiple IDs can choose which ones to activate for each deadline. You do not have to activate all IDs at once.

This means you could:

• Activate your main filing ID in Window 1 (by 30 June, active 15 July) to test the process
• Activate secondary IDs in Window 2 (by 31 July, active 19 August) once you are confident the process works smoothly
• Let any rarely-used legacy IDs be caught by the final sweep

This phased approach is sensible for larger firms. It lets you test MFA on one ID, train staff, identify any issues, and then roll it out to remaining IDs with confidence.

Each Government Gateway user ID is treated independently. Activating MFA on one ID does not affect others.

Impact on software, APIs, and integrations

HMRC has been clear on this point: the MFA requirement applies to the Government Gateway sign-in journey only. It does not affect:

Transaction Engine API (no change)

The Transaction Engine API, which software providers use to submit VAT returns, Corporation Tax returns, and other filings programmatically, is unaffected. API authentication uses OAuth 2.0 tokens granted through the HMRC Developer Hub, not Government Gateway credentials. MFA is not added to API calls.

If your software submits filings via the API, nothing changes in your integration.

SOAP-based APIs (no change)

Legacy SOAP-based APIs used by some older software products are also unaffected. These APIs have their own authentication mechanisms separate from Government Gateway.

18-month application authorisation journey (no change)

The process by which agents grant software applications access to act on their behalf (the 18-month authorisation cycle) is unchanged. This authorisation is a one-time approval that does not require re-authentication at each filing.

What does change

The only thing that changes is the human sign-in process. When an agent (a person) signs in to Government Gateway through a web browser to:

• View client records
• Manage agent authorisations
• Access HMRC online services for agents
• Use any Government Gateway service that requires agent credentials

They will need to enter their password plus a one-time code. That is the full scope of the change.

Impact on accounting software

For cloud accounting software that connects to HMRC via the MTD API (such as AccountsOS, Xero, FreeAgent, QuickBooks, and Sage), the impact is zero. These products authenticate via OAuth tokens, not Government Gateway credentials. Your clients' MTD submissions will continue to work exactly as before.

The only scenario where accounting software users might encounter MFA is if they sign in to Government Gateway directly through a web browser, for example to manage their agent services account, check client records manually, or handle authorisation requests.

What AccountsOS users need to know

If you use AccountsOS for your accounting, here is the short version: the HMRC agent MFA change does not affect your AccountsOS experience.

MTD VAT filing is unaffected

AccountsOS connects to HMRC's MTD API using OAuth 2.0 tokens. When you file a VAT return through AccountsOS, the submission goes directly from AccountsOS to HMRC via the API. At no point does your Government Gateway password or an MFA code enter the process.

Your VAT filing workflow remains:

1. AccountsOS calculates your VAT from your books
2. You review the 9-box summary
3. You confirm and submit
4. HMRC receives and acknowledges the submission

No MFA step is involved because the API handles authentication separately.

Deadline tracking covers MFA preparation

AccountsOS tracks all your HMRC deadlines automatically. If you are an agent or accountant who also uses AccountsOS, the MFA activation deadlines (30 June and 31 July 2026) are the kind of compliance dates that Finn, your AI accountant, can remind you about.

Ask Finn: "When do I need to set up HMRC MFA?" and get a direct answer with the relevant dates.

If you are both an agent and a business owner

Many AccountsOS users are company directors who also act as their own agent for HMRC filings. If you have an agent services account alongside your personal and business Government Gateway accounts, MFA applies to all of them. Your personal and business accounts may already have MFA enabled. Your agent account will be added to MFA between July and October 2026 under this rollout.

Frequently asked questions about HMRC agent MFA

Does MFA apply to every sign-in or just the first time?

MFA applies every time you sign in to Government Gateway with your agent credentials. Each sign-in requires your user ID, password, and a one-time access code. The code changes every 30 seconds (for authenticator apps) or is sent fresh each time (for SMS and voice call). There is no "remember this device" option currently available for agent accounts.

Can I use the same authenticator app for multiple Government Gateway IDs?

Yes. Authenticator apps like Google Authenticator, Microsoft Authenticator, and Authy support multiple accounts. Each Government Gateway ID gets its own entry in the app, generating its own separate code. You can have your personal, business, and multiple agent IDs all in the same app.

What if I lose my phone or change my phone number?

If you lose access to your authentication method, use the recovery codes provided during MFA setup. Each recovery code can be used once. If you have no recovery codes remaining, you will need to contact the HMRC helpline to reset your MFA. This process can take several working days, during which you will not be able to sign in.

To avoid this: transfer your authenticator app entries to a new phone before disposing of the old one, and keep your recovery codes in a secure separate location.

Does this affect my clients' ability to authorise me as their agent?

No. The 18-month application authorisation-granting journey is unchanged. Your clients can still authorise you as their agent using the existing process. MFA is added to your sign-in, not to the client authorisation flow.

Will HMRC require hardware security keys (FIDO2/WebAuthn)?

HMRC has not announced any requirement for hardware security keys. The three supported methods are authenticator app, SMS, and voice call. Hardware keys may be supported in the future, but there is no current timeline.

Is there a cost to setting up MFA?

No. MFA setup is free. Authenticator apps are free to download and use. SMS codes are sent by HMRC at no charge to the agent. Voice calls are made by HMRC to your registered number at no charge.

What if I use a shared agent ID across my practice?

HMRC does not recommend sharing Government Gateway credentials, but it is aware that some practices do. When MFA is activated on a shared ID, every person who signs in with that ID will need access to the same authenticator app, SMS phone number, or voice call number. This is one reason HMRC recommends that each staff member has their own agent credentials.

If you currently share credentials, consider setting up individual agent IDs before MFA activation. This improves security and audit trails, and avoids the practical difficulty of sharing one-time codes across a team.

Can I opt out of MFA?

No. MFA is mandatory for all agent accounts. There is no opt-out mechanism. The only choice is when MFA is activated: you can choose Window 1 (15 July) or Window 2 (19 August), or wait for the final sweep (28 September to 15 October).

Timeline: every key date for HMRC agent MFA

Preparing your practice: a checklist

Whether you are a sole practitioner or manage a team, here is what to do before your chosen activation date.

For sole practitioners

1. Install an authenticator app on your phone (Google Authenticator, Microsoft Authenticator, or Authy recommended)
2. List all your Government Gateway agent IDs and decide which window each should use
3. Submit the activation form from 10 June 2026 onwards
4. When prompted on activation day, scan the QR code and verify your first code
5. Save your recovery codes in a secure location separate from your phone
6. Test the sign-in process immediately after setup to confirm it works

For practices with multiple staff

1. Audit all agent IDs in use across the practice
2. Decide on individual vs shared credentials and migrate to individual IDs where possible
3. Choose activation windows: consider activating one ID in Window 1 as a pilot, then the rest in Window 2
4. Brief all staff who sign in to Government Gateway on the MFA process
5. Ensure every staff member has an authenticator app installed (or confirm their phone can receive SMS)
6. Establish a recovery code policy: where are they stored, who has access, what is the process for lost phones?
7. Update your internal procedures documentation to include the MFA step in the sign-in process
8. Test with one ID first before rolling out to all

For software developers and vendors

If you develop or maintain software that interacts with HMRC APIs:

• No API changes required. The Transaction Engine API and SOAP APIs are unaffected.
• Inform your agent users about the MFA requirement in case they contact your support team
• Update your documentation to clarify that MFA applies to Government Gateway sign-in, not to API calls
• If your software includes a Government Gateway redirect (for example, to initiate OAuth authorisation), be aware that agents will encounter an MFA prompt during that flow

Common concerns and how to address them

"This will slow down our workflow"

MFA adds approximately 10 to 15 seconds to each sign-in. For an authenticator app, you open the app, read the 6-digit code, and type it in. For SMS, you wait a few seconds for the message and then type the code. This is a minor addition to what is already a multi-step sign-in process.

Most agents sign in to Government Gateway a few times per day at most. The cumulative time cost is measured in minutes per week, not hours.

"Our staff are not technically confident"

The MFA setup process is designed for general users, not technical specialists. HMRC has used the same process for millions of individuals and organisations since 2021. The setup involves downloading an app and scanning a QR code, or providing a phone number for SMS.

If staff struggle, have a technically confident colleague walk them through the setup once. After the initial setup, the daily process is simply opening an app and reading a number.

"What if we cannot reach HMRC to reset MFA?"

This is the strongest argument for keeping recovery codes safe. HMRC's helpline wait times can be long, especially during peak filing periods. If a staff member loses their phone and has no recovery codes, they may be unable to sign in for several working days while HMRC processes the reset.

Mitigation: treat recovery codes with the same importance as passwords. Store them in a password manager, a locked safe, or a secure document management system.

"Can we use a company mobile number for SMS?"

Yes, any UK mobile number can receive SMS codes. Some practices use a shared company mobile for this purpose, though this introduces its own security considerations. If the company phone is lost, multiple IDs could be affected. Individual authenticator apps on personal devices are generally more resilient.

The broader context: HMRC's digital security roadmap

HMRC agent MFA is part of a wider programme to strengthen the security of tax services. Recent and upcoming changes include:

• Individual MFA (already live): personal Government Gateway accounts use MFA for Self Assessment and other services
• Organisation MFA (already live): business Government Gateway accounts use MFA for VAT, PAYE, and Corporation Tax services
• Agent MFA (this change): completing the coverage to all Government Gateway user types
• Companies House identity verification (November 2026 deadline): all directors must verify their identity through GOV.UK One Login
• GOV.UK One Login (ongoing rollout): the long-term replacement for Government Gateway, with built-in MFA and identity verification

For agents, the MFA requirement is one piece of a larger shift toward stronger digital identity and access controls across all government services. Getting comfortable with MFA now positions your practice well for the continued evolution of these systems.

How AccountsOS helps agents stay compliant

AccountsOS is built for company directors and the accountants who support them. While the agent MFA change does not directly affect AccountsOS functionality, several features are relevant:

Automatic deadline tracking

AccountsOS syncs deadlines from Companies House and tracks all HMRC compliance dates. The MFA activation deadlines can be added to your deadline calendar so nothing falls through the cracks. Ask Finn to set a reminder for any date that matters to you.

HMRC MTD integration (unaffected by MFA)

AccountsOS connects to HMRC via the MTD API for VAT filing. This integration uses OAuth 2.0 tokens and is completely separate from Government Gateway sign-in. Your VAT submissions, obligation lookups, and liability checks continue to work without any MFA interaction.

Support from Finn

Finn, the AI accountant in AccountsOS, is trained on HMRC compliance requirements. You can ask Finn about MFA deadlines, what authentication methods are available, and how the change affects your specific setup. Finn draws on authoritative sources including GOV.UK guidance to give you accurate, up-to-date answers.

Where to find official HMRC guidance

HMRC publishes detailed guidance for agents in the Tax Agent Handbook on GOV.UK. The key resources are:

• Tax Agent Handbook: gov.uk/guidance/tax-agents-handbook covers agent responsibilities, including the MFA requirement
• Government Gateway help: gov.uk/government-gateway covers sign-in, MFA setup, and recovery
• Agent services account guidance: gov.uk/guidance/get-an-hmrc-agent-services-account covers account setup and management
• HMRC agent forum: the HMRC Agent Forum on GOV.UK provides updates and allows agents to raise questions

If you have specific questions about how MFA affects your agent account, HMRC's Agent Dedicated Line (0300 200 3311) can provide direct assistance.

Summary

HMRC agent MFA is a straightforward security improvement that brings agent accounts into line with the MFA already used by individuals and organisations. The key facts:

• From 10 June 2026: agents can submit the activation form
• Two opt-in windows: 15 July (submit by 30 June) and 19 August (submit by 31 July)
• Final sweep: 28 September to 15 October for all remaining accounts
• Authentication methods: authenticator app, SMS, or voice call
• No API changes: Transaction Engine, SOAP APIs, and OAuth authorisations are unaffected
• No cost: setup is free
• Multiple IDs: each can be activated in a different window
• Mandatory: no opt-out

The recommendation is to opt in during Window 1 or Window 2 to control the timing and avoid disruption during the busy autumn filing period. Install an authenticator app, brief your team, and save your recovery codes.

AccountsOS users can continue filing VAT and managing their accounts exactly as before. The MTD integration is unaffected. Sign up for AccountsOS to track all your HMRC deadlines and let Finn keep you compliant.

Frequently Asked Questions

When does HMRC agent MFA become mandatory?

HMRC agent MFA becomes mandatory for all agent accounts by 15 October 2026. From 10 June 2026, agents can choose to activate MFA on 15 July (by submitting the form before 30 June) or 19 August (by submitting before 31 July). Any accounts not activated by either deadline will have MFA enabled automatically between 28 September and 15 October 2026.

Does HMRC agent MFA affect MTD API submissions?

No. The Transaction Engine API used for Making Tax Digital submissions (VAT, Income Tax, etc.) is completely unaffected. API authentication uses OAuth 2.0 tokens issued through the HMRC Developer Hub, which are separate from Government Gateway credentials. Software that submits filings via the API will continue to work exactly as it does today.

What authentication methods can I use for HMRC agent MFA?

HMRC supports three methods: an authenticator app (such as Google Authenticator, Microsoft Authenticator, or Authy), SMS text message to a registered mobile number, or a voice call to any phone number. The authenticator app is the recommended method because it is the most secure, works offline, and does not depend on mobile signal.

Can I activate MFA on some agent IDs now and others later?

Yes. Agents with multiple Government Gateway IDs can choose which ones to activate for each deadline. You could activate your primary filing ID in Window 1 (15 July) to test the process, activate secondary IDs in Window 2 (19 August), and let any rarely-used IDs be caught by the final sweep. Each ID is treated independently.

What happens if I lose my phone after setting up MFA?

Use the recovery codes provided during MFA setup. Each code can be used once to sign in without your authentication method. If you have no recovery codes remaining, contact HMRC's Agent Dedicated Line (0300 200 3311) to reset your MFA. This process can take several working days. Store recovery codes in a secure location separate from your phone.

Does AccountsOS need any changes because of HMRC agent MFA?

No. AccountsOS connects to HMRC via the MTD API using OAuth 2.0 tokens. The agent MFA requirement applies only to Government Gateway web browser sign-ins, not to API calls. Your VAT filing, deadline tracking, and all other AccountsOS features continue to work without any change.

Is there a charge for setting up HMRC agent MFA?

No. MFA setup is entirely free. Authenticator apps are free to download. SMS codes and voice calls are sent by HMRC at no cost to the agent.

Will HMRC extend the MFA deadline?

HMRC has not indicated any plans to extend the deadline. The phased rollout with two opt-in windows and a final sweep between 28 September and 15 October 2026 gives agents several months to prepare. Given that MFA has been live for individuals and organisations for years without issues, an extension is unlikely.