HMRC Agent MFA: Prepare Now for the Autumn Automatic Window

HMRC’s Tax Agent Handbook is clear for practices that did not take the July or August early multi-factor authentication (MFA) dates: remaining agent accounts activate automatically between 28 September and 15 October 2026. HMRC cannot tell you which day inside that window your agent ID will switch on.

That uncertainty is the operational risk. Waiting until you see the new access-code screen is too late if phone numbers are stale, leavers still have logins, or only one administrator can reset MFA. Use August to finish the handbook checklist while 19 August early-activation firms are still a useful reminder next door.

Who sits in the autumn cohort

Thousands of agents already opted into early activation for July or 19 August 2026. Any agent IDs not activated on those voluntary dates fall into the final automatic window. Multi-office firms often hold several Online Services for Agents or Agent Services Account identifiers — map which IDs already have MFA and which will activate in autumn.

MFA protects web sign-in to agent portals. It does not replace API credentials used by compatible software for Making Tax Digital submissions, but locked-out portal access still disrupts authorisations, client management, and any manual HMRC work.

Handbook prep before September

Check and update existing MFA settings now. Someone may already have enabled an MFA option for Making Tax Digital for VAT — access codes will go to whatever contact details were saved then. Update outdated numbers and add a backup method.

Give each staff member their own sign-in credentials, keep at least two administrators so MFA resets stay in-house, and remove leavers promptly. HMRC recommends an authenticator app as the primary method, with text or voice call as backup. Authenticator apps work offline and do not need mobile signal.

If third-party tools automate the sign-in journey, confirm with your software vendor before late September. The “Remember me” option can reduce re-prompts for seven days on the same device and browser, but you are still challenged after changing user ID, device, or browser.

Do not confuse MFA with MMTAR

Tax adviser registration under MMTAR and agent MFA are separate programmes. An ASA application does not enrol MFA for you, and MFA enrolment does not satisfy registration. Tranche-one firms still face 18 August for ASA applications; tranche-two firms start their three-month clock the same day.

Split ownership: partnership or compliance lead owns ASA packs; IT or portal administrators own MFA. Document recovery paths so autumn client filings do not stall because one phone left the office on an unknown activation morning.

How FinnAccountings helps while portals harden

Organised client packs still have to move while practices finish MFA readiness. FinnAccountings helps Ireland and UK accountants and business owners prepare bookkeeping and tax packs with Chartered Accountant insight before qualified sign-off. Start a free trial for review-ready drafts — we prepare packs; we do not manage your HMRC agent MFA settings or file client returns on your behalf.

Start a free trial →

Related reading

If you opted into 19 August early activation, use that briefing for switch-on day. For firms still finishing tranche-one registration this week, start with the final-week MMTAR checklist.

HMRC agent MFA: prepare for 19 August →

Seven days remain until the first MMTAR window closes for tranche-one advisers without an ASA, Self Assessment, or Corporation Tax agent account.

MMTAR final week: register by 18 August →

For client-side Income Tax estimates only — not MFA setup — use the dual-market tax calculator.

Open free tax calculator (Ireland & UK) →