HMRC Agent MFA Deadline 31 July 2026: Choose 19 August Activation or Wait Until Autumn

HMRC is completing its rollout of multi-factor authentication (MFA) on agent accounts in 2026. Agent Update Issue 144 confirms that agents who want MFA activated on a specific date — rather than during the mandatory autumn window — must submit an online form through their Agent Services Account (ASA) or HMRC online services for agents account.

The next voluntary activation date is 19 August 2026. To choose that date, agents must submit the opt-in form by 11:59pm on 31 July 2026 — ten days from today. Missing this deadline does not block access immediately, but it removes control over timing and pushes activation into the 28 September to 15 October 2026 mandatory window.

HMRC's MFA rollout has three phases. The first voluntary window (15 July activation) closed on 30 June 2026. The second voluntary window targets 19 August activation with a 31 July 2026 form deadline. The final phase activates MFA on all remaining agent accounts between 28 September and 15 October 2026 — HMRC cannot give a specific date within that window.

The Chartered Institute of Taxation and ICAEW both advise firms with multiple Government Gateway agent IDs to decide per ID which deadline to target. Firms that acquired other practices may hold several agent IDs; any ID not opted in by 31 July will be included in the autumn mandatory activation.

MFA applies to web sign-in for ASA and online services accounts. It does not affect MTD for Income Tax or VAT submissions made through compatible software using existing API credentials.

Before MFA goes live, map every team member who signs into each agent ID. CIOT guidance recommends setting up authenticator apps or backup methods in advance and documenting recovery procedures — a locked-out agent account during filing season creates client service disruption.

Firms with outsourced payroll or bookkeeping partners should confirm those suppliers understand which agent IDs they use and whether MFA activation will affect their access patterns. The opt-in form activates MFA for all accounts under the agent ID(s) specified.

If your practice missed the 30 June deadline for 15 July activation, the 31 July form deadline is the last chance to pick a defined summer activation date before the unpredictable autumn window.

Agents who take no action will have MFA activated automatically between 28 September and 15 October 2026. HMRC cannot confirm the exact date, so practices should treat late September as the earliest likely activation and ensure all staff are trained before then.

Waiting for mandatory activation is a valid choice for firms still updating internal security policies or rolling out authenticator apps to remote staff. However, voluntary opt-in on 19 August gives ten weeks of lead time before peak Self Assessment season.

HMRC's Issue 145 Agent Update also reminds agents about the separate 31 July payment on account deadline for Self Assessment clients — MFA preparation should not distract from client payment reminders running in parallel.

Decide whether your practice wants MFA on 19 August or prefers the autumn mandatory window. If choosing 19 August, locate every Government Gateway agent ID and submit the opt-in form before 31 July 2026.

Brief all staff who access HMRC agent accounts on authenticator setup and backup codes. Test sign-in on a non-critical day before activation.

FinnAccountings supports practices managing multiple client entities across Ireland and the UK — start a free trial to streamline compliance workflows while your team adapts to HMRC's enhanced agent security requirements.