The Deadline is Set: MFA Rollout by End of June 2026
HMRC has announced a phased rollout of multi-factor authentication (MFA) for all tax agents, with a forced migration deadline of 30 June 2026. Your team needs to prepare now.
Here’s what’s changing, why it matters, and what you should do about it.
What’s Happening
Starting 7 April 2026, HMRC will add an MFA prompt to the agent sign-in journey. This is the warning phase. All tax agents and their staff will be required to switch to MFA by 30 June 2026. After that date, old-style username-and-password logins won’t work.
HMRC is testing this with a small volunteer group right now. Early adopters will help iron out issues. But make no mistake: this is a hard cutoff, not a suggestion.
Why Now?
Cyber threats to tax professionals are real and rising. More attacks target accountants and bookkeepers than ever before, because they hold the keys to client data and tax systems. MFA—requiring something you know (password) plus something you have (a phone, authenticator app, or security key)—makes attackers’ jobs exponentially harder.
For CFOs and finance teams who rely on agents to manage payroll, VAT, and corporation tax submissions, this is actually good news. It means fewer breaches, less fraud, and more secure handling of your sensitive financial data.
What You Need to Do
1. Alert Your Accountants and Tax Advisors
If you work with external accountants or use a tax service provider, tell them now. Don’t wait until June. Their implementation time matters. Some firms are slower to move than others.
2. Work Out Which Method Suits Your Firm
HMRC supports several MFA approaches:
- Authenticator app (free, works offline, recommended for most)
- Text message (SMS) (easy, but less secure)
- Email codes (reasonable middle ground)
- Physical security keys (most secure, best for high-risk accounts)
Choose based on your team’s tech comfort level and your data sensitivity.
3. Plan for Your Internal Users
If your in-house team accesses MTD systems or submits tax returns directly, they’ll need MFA too. Document who has access and start the rollout early. Rolling out to 15 staff members in one week is chaos. Rolling out over four weeks is manageable.
4. Test Before June
Don’t make 30 June the first time your team tries MFA. Get everyone set up in April. Test submissions. Sort out lost devices and backup codes now, not when the tax deadline is two days away.
The Making Tax Digital Connection
While we’re here: HMRC has also clarified that agents can now resolve Making Tax Digital (MTD) for income tax queries via the dedicated agent line and webchat. If your advisors have been struggling to help clients with MTD exemptions or technical issues, there’s now a direct escalation route.
This is helpful because MTD for income tax is still the source of confusion for many practitioners. More accessible help from HMRC is a net win.
The Bigger Picture
MFA is table stakes in 2026. Every software vendor, every financial platform, every serious service provider now requires it. Tax agents are simply catching up with everyone else. View it as a security investment, not a compliance burden.
If you’re managing multiple teams or outsourced finance functions, this is a good moment to audit who has access to what. Know your users. Know what data they’re touching. MFA is one layer; proper access controls are another.
What’s Next
- 7 April 2026: MFA prompts appear on HMRC agent sign-in
- 30 June 2026: Hard cutoff — old logins stop working
- Action now: Tell your advisors. Plan your rollout. Test in April.
Don’t leave this to the last week of June. Every year, tax professionals scramble with compliance surprises. Not this time.
Get in touch if you need help planning your tax technology roadmap or securing your finance team’s access to HMRC systems. We work with CFOs and finance leaders to make tax compliance actually work. Get in touch
This post reflects HMRC guidance as of March 2026. Check HMRC’s agent guidance for the latest updates.