HMRC MFA Activation: Mandatory Deadline 28 September to 15 October 2026
HMRC will activate multi-factor authentication (MFA) on all remaining agent accounts between 28 September 2026 and 15 October 2026. This is a security measure to protect tax agent access and your business data. If your accountant or tax adviser has an agent services account (ASA) with HMRC, they must be ready.
What is Happening:
Any agent account that does not already have MFA enabled will have it activated automatically during this window. This means users will need an additional security code (typically from an authenticator app or text message) each time they access HMRC services on behalf of clients.
What SME Owners Need to Know:
If you have appointed a tax adviser or accountant to handle your HMRC affairs (Self Assessment, Corporation Tax, PAYE, VAT), this change affects their access. You do not need to take direct action, but you should:
- Confirm with your accountant or tax adviser that they are aware of the MFA deadline
- Ensure they have set up MFA before the activation window to avoid disruption
- Understand that temporarily they may need to re-authenticate with additional codes when submitting your returns
What Tax Advisers and Accountants Must Do:
If you are a tax professional, set up MFA on your agent services account now. Use an authenticator app (recommended) or text message option. Test your MFA setup before the 28 September deadline to avoid last-minute issues. HMRC will force activation if MFA is not already in place, which could cause temporary service disruption.
This aligns with HMRC's broader security agenda, including the Modernising and Mandating Tax Adviser Registration (MMTAR) requirement introduced earlier this year. Together, these changes aim to strengthen the security of the UK tax system.
Source: HMRC Agent Update (Issue 144)