Managing HMRC agent accounts and multi-factor authentication

HMRC has updated guidance on the different types of online accounts required for agents, including the Agent Services Account and the HMRC online services for agents account. The guidance outlines the importance of multi-factor authentication (MFA) for accessing these systems and provides instructions for managing security settings, such as using authenticator apps, text messages, or voice calls for access codes.

What it means for a practice

• Practices must ensure staff use individual sign-in credentials for all HMRC accounts to maintain security and traceability.
• Administrators should be assigned to manage internal MFA resets and routine access issues, which reduces the need to contact HMRC.
• Firms should regularly review and remove access for staff who have left the organisation or no longer require access to HMRC services to prevent unauthorised entry.