HMRC's New MFA Deadline: What Sole Traders and Small Businesses Must Do Before 31 July

If you or your accountant logs into HMRC's online services to manage your tax, a security deadline is approaching that's easy to miss but expensive to ignore.

What's happening

HMRC is completing the roll-out of multi-factor authentication (MFA) across all agent accounts between 28 September and 15 October 2026. Agents — accountants and bookkeepers acting on behalf of clients — have the option to request MFA be switched on earlier, on 19 August 2026, by completing an online form in their agent services account or online services account by 31 July 2026. Miss the window and MFA will simply be applied automatically during the main roll-out later in the year.

If you're a sole trader, freelancer or small business owner who manages your own tax affairs directly (rather than through an agent), this is also a good moment to check MFA is properly set up on your own Government Gateway account, given how central it now is to filing VAT, PAYE and Self Assessment.

Why HMRC is doing this

Tax accounts are a high-value target for fraud — a compromised login can be used to redirect refunds, file false claims, or access sensitive financial data. MFA, which requires a second proof of identity (typically a text message or authenticator app code) alongside your password, dramatically cuts the risk of an account being accessed by someone who has only stolen your password.

Checklist: getting ready

• Check whether you use an agent. If your accountant files on your behalf, ask them directly whether they've opted into the 19 August date or are waiting for the default fifteen-week roll-out window.
• If you self-file, log into your Government Gateway account now and confirm MFA is already active, rather than waiting to be forced into it.
• Make sure your registered mobile number and email are current — MFA typically relies on being able to reach you.
• Have a backup method ready, such as an authenticator app, in case you change your phone or lose signal at a critical filing deadline.
• Don't leave it to the week of a filing deadline. Getting locked out while setting up MFA for the first time is far less stressful in July than in the days before a VAT or Self Assessment deadline.
• Beware phishing. Scammers often exploit rollouts like this by sending fake "verify your account" links — always go directly to gov.uk rather than clicking emailed links.

International comparison

The US has already gone further and made this mandatory rather than optional. Since 2024, the IRS has required multi-factor authentication for all tax professionals accessing systems containing taxpayer information as a federal requirement under IRS Publication 4557, regardless of firm size — from solo preparers to national firms. Non-compliant US preparers risk PTIN suspension and civil penalties of up to $100,000 per violation under FTC safeguards rules. HMRC's approach is comparatively softer for now: a phased, largely automatic roll-out rather than an immediate hard mandate with financial penalties attached, though that gap could narrow in future.

Key Numbers

• 31 July 2026 — deadline for agents to opt into the earlier MFA date
• 19 August 2026 — earliest date MFA can be added if requested in time
• $100,000 — maximum US civil penalty per MFA violation for tax preparers, for comparison

Sources

• HMRC's 31 July deadline approaches in roll-out of multi-factor authentication — ICAEW
• Log in to HMRC online services — GOV.UK
• Tax pros: Multifactor authentication is key to protecting client data — IRS.gov

Educational content only — not financial advice.