Copy article

HMRC Agent Accounts Move To Two-Step Login On An Unnamed Date

ended 10. August 2026

The login your accountant uses to file for you is about to need a second step, and in a lot of small practices that step points at a single phone. HMRC is extending multi-factor authentication, already in place on Government Gateway accounts for individuals and organisations, to agent accounts. That means both the agent services account and the HMRC online services for agents account that firms reach with their Government Gateway sign-in details. Its guidance now confirms that all remaining agent accounts will be activated automatically between 28 September 2026 and 15 October 2026, and that HMRC “are unable to give a specific activation date for these accounts”. HMRC says thousands of agents took the early activation dates offered in July and August 2026. Everyone else gets a window, not a date.

The catch sits inside HMRC's own preparation advice. It recommends that each member of staff who requires access has their own individual sign in credentials, that organisations with multiple staff members have more than one administrator on the account, and that firms remove access for staff who leave or no longer need it. That is precisely the housekeeping a very small practice has never got round to. HMRC's own guidance says that when MFA is activated, access codes go to the contact details saved when the option was first set up. In our experience that is often a mobile belonging to whoever set it up, sometimes someone who has since left. If a firm loses its access in October, that is not an accountant's inconvenience. It is a small business whose VAT return or payroll sits behind a door nobody in the office can open, in the middle of the VAT and PAYE cycles that run every month regardless and in the run-up to 31 January.

  1. HMRC is closing a real security gap, but it will not tell any individual firm which day its account switches over. Is an 18-day window a reasonable way to run this, or is HMRC pushing its own operational risk onto the smallest practices?
  2. The preparation HMRC recommends, individual credentials and a second administrator, is trivial for a 200-person firm and a genuine project for a two or three-person practice. Who is hit hardest here, and is it fair that the burden falls that way?
  3. What should a small practice do first? Have you seen a firm nearly locked out by a shared login or a code going to someone who had left? If so, please give as much colour and detail as possible.

1 responses from the Newspage community

Copy all

Star Quote
Copy

Editor
Harvey Dhillon
Founder & CEO at Zmartly
Is an 18-day window a reasonable way to run this? Yes. If your firm can only cope because it knew the day, it was never ready. Every remaining agent account will have the second step switched on somewhere from 28 September to 15 October 2026, and HMRC says it cannot tell you which day is yours. The code goes to whichever contact details were saved when the option was set up. So no, HMRC is not pushing its risk onto small firms. The weak point was already there. The work falls on the two or three-person practice, and no, that is not fair. A big firm has someone whose job this is. A small one has an owner doing it at 10pm. No single near miss to offer, but we see the same pattern: one saved phone, and sometimes it belongs to someone who has already left the firm. Start here: sign in and check which MFA options are already saved, if any. Then move to an authenticator app with a backup, and if there is more than one of you, add a second administrator. August is cheap. October is not.