HMRC is introducing Multi-Factor Authentication (MFA) for all tax agent accounts during 2026. The change is designed to improve security and protect sensitive taxpayer information from cybercrime.
Instead of signing in with just a Government Gateway ID and password, users will also need to enter a one-time security code each time they log in. This brings agent accounts into line with the security already used for Personal Tax Accounts and Business Tax Accounts.
Why Is HMRC Making This Change?
HMRC says the move is a response to increasing online security threats and is intended to provide an additional layer of protection for agent accounts and client data. MFA has already been used successfully across other HMRC services and is now being extended to agents.
When Will MFA Be Introduced?
HMRC has confirmed a three-stage rollout:
- 15 July 2026 – First voluntary activation date
- 19 August 2026 – Second voluntary activation date
- 28 September to 15 October 2026 – Mandatory activation for all remaining agent accounts
Agents who wish to activate MFA early must submit an online form through their HMRC account before the relevant deadline.
How Will MFA Work?
After entering a Government Gateway user ID and password, users will be asked to provide a security code. The code can be received through:
- An authenticator app
- A text message (SMS)
- An automated phone call
HMRC recommends setting up more than one method in case the primary option becomes unavailable.
Will I need to do anything in TaxCalc?
No, the process for filing tax returns will not change, despite HMRC implementing multi-factor authorisation for accessing agent accounts online. Currently the existing self-assessment returns can be filed on behalf of taxpayers using the agent's government gateway credentials and a token system is in place for MTD for income tax filing.
For further information on MFA please see the articles below:
Multi-Factor Authentication – how can agents prepare?
Introducing Multi-Factor Authentication
Cookie Settings