If you deal with an accountant or tax agent, this update is about the systems we use to access your records, and it's worth knowing about, because it affects how smoothly your affairs get handled over the next few months.

HMRC is rolling out multi-factor authentication (MFA) to every agent account this year, the same extra security step you likely already have on your own online banking: a password, plus a one-time code sent to a phone or generated by an app. Individuals and businesses have had this on their Personal Tax Accounts and Business Tax Accounts for a while. Agent accounts, the accounts firms like ours use to manage client tax affairs, have not, until now.

Why this is happening

Agent accounts are an attractive target for fraud, because a single login can potentially touch many clients' records at once. HMRC is introducing MFA specifically to close that gap and better protect client data across the profession.

The rollout timetable

HMRC is switching MFA on in three phases:

15 July 2026 — for agents who opted in by 30 June (this window has now passed)
19 August 2026 — for agents who opt in by 31 July 2026
28 September to 15 October 2026 — mandatory activation for everyone who hasn't opted in early, on a date HMRC will not specify in advance

That last point is the one worth sitting with. If a firm doesn't act by 31 July, HMRC will switch MFA on for them at some unannounced point within a three-week window in the autumn, with no specific warning of the exact day.

Why this matters to you, as a client

A well-prepared firm sails through this. A firm that isn't ready risks being locked out of its own agent account exactly when it needs it, mid-way through preparing a return, responding to an HMRC query, or handling a deadline on your behalf. If access details on file are out of date, whoever manages that account could genuinely lose access until it's sorted out.

This is exactly why we're getting ahead of it now, checking our own account settings, making sure our security details are current, and choosing a controlled activation date rather than waiting to be caught by the automatic switch-on in the autumn.

What we're doing about it

At Zara Accountants, we're opting in ahead of the 31 July deadline, so MFA activates on our terms, on a known date, with everything tested and ready beforehand. It's a small operational change on our end, but it means zero disruption to the work we do for you.

If you're a fellow practitioner reading this

If your firm hasn't opted in yet, the window closes 31 July 2026. The form is available directly within your Agent Services Account or Online Services Account. Worth checking now whether your account already has an MFA method set up from years ago; if the contact details on file are stale, that's a lockout waiting to happen the moment MFA goes live.

We're here to help

If you have any questions about how we manage the security of your financial information, or anything else about how we operate, we're always happy to talk it through.

This article is for general information only. Please contact Zara Accountants if you have any questions about your account with us.