One morning this month, around 9am, your accountant will sign in to HMRC and be asked for a code. HMRC is switching multi-factor authentication on for every remaining tax agent account by 15 October 2026, and it will not say in advance which morning yours lands on. Most firms will barely notice. The ones that will are the ones still sharing a single login across the office.
TL;DR: HMRC is adding multi-factor authentication to every remaining tax agent account between 28 September and 15 October 2026, with no advance notice. Your own HMRC login already has it, and routine filing through software carries on. The real exposure is a practice with shared credentials or stale contact details losing access during deadline season.
What Changes on 15 October 2026?
Signing in stops being a username and password. From the morning it activates, your accountant also needs a six-digit access code, delivered by authenticator app, text message or automated phone call. It applies to both the Agent Services Account and the older HMRC online services for agents account (ATT, 2026).
The final window runs from 28 September to 15 October 2026, and accounts are switched on around 9am, Monday to Thursday. HMRC has said it cannot tell individual firms which day they are on (Agent Update 147, GOV.UK, 2026).
The rollout is moving quickly. HMRC switched multi-factor authentication on for roughly 13,000 agent accounts in the first four days alone, between 28 September and 1 October (ICAEW, 2026). More than 20,000 accounts had already been switched on during the two voluntary phases in July and August (ATT, 2026).
Does This Affect Your Own HMRC Account?
No. If you sign in to a Personal Tax Account or a Business Tax Account, you already use an access code, and nothing about this change touches you. HMRC's own wording is that the agent rollout brings those accounts in line with the protection already in place for individual and organisation Government Gateway accounts (Agent Update 147, GOV.UK, 2026).
So there is no form to complete, no setting to update and no deadline you personally need to diarise. The change sits entirely on the adviser side of the relationship.
What we see most often is clients reading a headline about an HMRC deadline and assuming it is theirs. This one genuinely is not. The useful thing you can do is check that your accountant has handled it, which we come back to below.
Will Your Accountant's Filings Stop Working?
Day to day, no. Routine submissions do not pass through the browser sign-in screen, and the process for filing returns through commercial software does not change (TaxCalc, 2026).
There is one caveat worth knowing, because plenty of coverage has missed it. HMRC treats the access-code step as part of granting a software token rather than something sitting outside it, so a user has to complete it when their token expires after 18 months, or when they authorise a new scope (HMRC Developer Hub, 2026). A firm whose token happens to lapse in a bad week still needs a working access code.
The timing matters. The next Making Tax Digital for Income Tax quarterly update is due on 7 November 2026 (Agent Update 147, GOV.UK, 2026), with Self Assessment season behind it. In our experience the disruption lands on tasks that need a human inside the HMRC website, like checking a client's PAYE position or chasing a repayment.
Where Does the Real Risk Sit?
Three situations cause genuine lockouts, and all three are avoidable.
The first is shared credentials. Plenty of smaller practices run one Government Gateway login for the whole team, which breaks the moment a code goes to one person's phone. HMRC's preference is individual credentials per staff member, though a firm can keep a shared login if every user loads the same authenticator app seed.
The second is a stale contact method. If the mobile number on the account belongs to someone who left in 2023, the code goes to them, and a text or voice code expires after 15 minutes either way (ATT, 2026). Nobody is waiting that one out.
The third is administrator cover. An administrator can reset multi-factor authentication for other users but not for themselves (ATT, 2026), which is why we would treat two administrators per account as the sensible minimum.
How an Agent Sets Up Multi-Factor Authentication
The setup happens inside the account itself, not through a separate application. In the Agent Services Account it sits under Manage account, then Manage your own sign in details. In the older online services account, it is Your Account, then Change Details, which opens the Government Gateway settings and the option covering how you get your access codes (ATT, 2026).
From there an agent picks an authenticator app, text message or voice call, and can select all three. An app suits firms without work mobiles, because it generates codes on the device without needing a mobile signal (ATT, 2026). HMRC asks agents to set at least two preferences so there is always a second way in.
If someone does get locked out, the route is HMRC's online services helpdesk, which can reset an access code. Early reporting suggests the helpdesk has taken only a very small number of calls so far (ICAEW, 2026), so the rollout is going better than many firms feared.
What to Ask Your Accountant This Week
Three questions cover it, and none of them need a technical answer.
Ask whether multi-factor authentication is already live on their HMRC agent accounts, or still pending. Ask whether each member of the team has their own credentials and their own way of getting a code, rather than everyone leaning on one phone. Then ask who can reset access if the person holding the code is on leave, which is the question that catches firms out.
One question clients always ask is whether any of this signals a problem at their accountant's end. It does not. HMRC is applying the same change to every agent in the country, and tens of thousands of accounts have already been through it without incident.
For wider context, our guide to checking whether your accountant is HMRC-registered covers the registration rules from earlier in 2026, and our notes on the first MTD quarterly update and HMRC's automatic MTD sign-ups explain the filing calendar this deadline sits inside. Our services page sets out how we handle HMRC correspondence for clients.
Frequently Asked Questions
Does multi-factor authentication delay my tax filings?
It should not. Routine submissions through accounting software do not run through the browser sign-in screen, so the filing process itself is unchanged. The exception is re-authorisation: when a software token expires or a new permission is granted, someone has to complete the access-code step. The tasks most likely to slow down are manual ones, such as an adviser logging in to review a PAYE record or chase a repayment.
My accountant uses one shared HMRC login for the whole team. Is that still allowed?
Yes, but it needs work. HMRC's stated preference is individual credentials for each staff member, which also means access can be removed cleanly when someone leaves. A firm keeping a shared login has to give every user the same authenticator app seed so they can each generate a valid code independently.
What happens if my accountant is locked out of HMRC during a deadline?
They contact HMRC's online services helpdesk, which can reset the access code. A firm with two administrators can often fix it internally instead, because an administrator can reset multi-factor authentication for other users, just not for their own account.
Do I need to do anything to my own HMRC account before 15 October?
No. Multi-factor authentication has applied to Personal Tax Accounts and Business Tax Accounts for some time, and this rollout only brings agent accounts up to that standard. There is no action, form or deadline on the taxpayer side.
If you would rather not spend deadline season wondering whether your adviser can still log in, get in touch. We will walk you through how we hold HMRC access for clients, who covers what when someone is away, and what happens to your filings if HMRC's own services have a bad week.