{"id":30601,"date":"2026-07-03T10:08:53","date_gmt":"2026-07-03T09:08:53","guid":{"rendered":"https:\/\/www.sage.com\/en-gb\/blog\/?p=30601"},"modified":"2026-07-03T10:21:15","modified_gmt":"2026-07-03T09:21:15","slug":"mfa-multifactor-hmrc-agent-how-to","status":"publish","type":"post","link":"https:\/\/www.sage.com\/en-gb\/blog\/mfa-multifactor-hmrc-agent-how-to\/","title":{"rendered":"HMRC multifactor authentication for agents: What it means for your practice and how to prepare"},"content":{"rendered":"<header class=\"entry-header has-dark-background-color entry-header--standard entry-header--has-illustration entry-header--has-illustration--standard\">\n\t<div class=\"container\">\n\t\t<div class=\"entry-header__row row align-center\">\n\t\t\t<div class=\"col col-lg-7 col-xlg-6 entry-header__content\">\n\t\t\t\t\t\t\t<div class=\"component component-single-header\">\n\t\t\t\t\t\t\t\t\t\t<div class=\"entry-header__misc text--subtitle text--uppercase text--small\">\n\t\t\t\t\t\t\t<a href=\"https:\/\/www.sage.com\/en-gb\/blog\/category\/strategy-legal-operations\/\" class=\"entry-header__link\">Strategy, Legal &amp; Operations<\/a>\t\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t<div class=\"entry-title-wrapper\">\n\t\t\t\t\t<h1 class=\"entry-title\">\n\t\t\t\t\t\tHMRC multifactor authentication for agents: What it means for your practice and how to prepare\t\t\t\t\t<\/h1>\n\t\t\t\t<\/div>\n\n\t\t\t\t\t\t\t\t\t<p class=\"entry-header__description\">\n\t\t\t\t\t\tThe extra security that MFA provides is coming to HMRC&#8217;s ASA and OSA agent accounts. It&#8217;s a huge change\u2014and practices need to get onboard now.\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n\t\t<div class=\"single-post-details container\">\n\t\t<div class=\"col\">\n\t\t\t<span class=\"posted-on \">Published <time class=\"entry-date published\" datetime=\"2026-07-03T10:08:53+01:00\">3 July, 2026<\/time><\/span><span class=\"reading-time\"> min read<\/span>\n\t\t<button\n\t\t\ttype=\"button\"\n\t\t\tclass=\"social-share-button button button--icon button--secondary js-social-share-button\"\n\t\t\tdata-share-title=\"HMRC multifactor authentication for agents: What it means for your practice and how to prepare\"\n\t\t\tdata-share-url=\"https:\/\/www.sage.com\/en-gb\/blog\/mfa-multifactor-hmrc-agent-how-to\/\"\n\t\t\tdata-share-text=\"Please read this interesting article\"\n\t\t>\n\t\t\t<span class=\"social-share-button__share-label\">Share<\/span>\n\t\t\t<span class=\"social-share-button__copy-label\" hidden>Copy Link<\/span>\n\t\t\t<span class=\"social-share-button__copy-tooltip\" aria-hidden=\"true\" hidden>Copied<\/span>\n\t\t<\/button>\n\n\t\t\t\t<\/div>\n\t<\/div>\n\t<\/header>\n\n\n\n<div class=\"wp-block-post-author has-dark-background-color alignfull\">\n\t<div class=\"container\">\n\t\t<div class=\"col\">\n\t\t\t\t\t\t\t<div class=\"co-authors\">\n\t\t\t\t\t\n\t\t<div class=\"entry-author-wrapper\">\n\t\t\t<a class=\"entry-author\" href=\"https:\/\/www.sage.com\/en-gb\/blog\/author\/keirthomasbryant\/\">\n\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"40\" height=\"40\" src=\"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2025\/06\/keir-short-hair-350x350.jpg\" class=\"entry-author__image\" alt=\"\" srcset=\"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2025\/06\/keir-short-hair-350x350.jpg 350w, https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2025\/06\/keir-short-hair.jpg 760w\" sizes=\"auto, (max-width: 40px) 100vw, 40px\" \/>\t\t\t\t<span class=\"entry-author__name\">Keir Thomas-Bryant<\/span>\n\t\t\t<\/a>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n<\/div>\n\n\n<section id=\"key-takeaways\" class=\"wp-block-sage-key-takeaways\"><div class=\"sage-key-takeaways__inner\"><h2 class=\"wp-block-heading has-h-3-font-size\">Key takeaways<\/h2>\n<ul class=\"wp-block-list\">\n<li><strong>Multifactor authentication (MFA) <\/strong>is being added to all HMRC agent accounts during 2026.<\/li>\n\n\n\n<li><strong>Early opt-in activation is possible<\/strong>, or you can wait until it&#8217;s switched on for all accounts in later 2026. <\/li>\n\n\n\n<li><strong>Web sign-in for your agent services account (ASA) and online services account (OSA<\/strong>) are affected, but not things like sign-in for MTD for Income Tax and VAT submissions made through software.<\/li>\n<\/ul>\n<\/div><\/section>\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.sage.com\/en-gb\/blog\/cyber-security-in-2026-what-your-business-should-be-thinking-about\/\" target=\"_blank\" rel=\"noreferrer noopener\">Security<\/a> is never far from the mind of accountants and bookkeepers, and HMRC has recently announced some interesting news: it&#8217;s adding multifactor authentication (MFA) to all agent accounts before the end of 2026.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">MFA is a simple, well-established way to keep your practice and your clients\u2019 information safer, and it\u2019s the same kind of protection you almost certainly already rely on across plenty of other online services.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here\u2019s everything you need to know: the dates, the decisions, and a short checklist to get your practice ready:<\/p>\n\n\n<?xml encoding=\"utf-8\" ?><div class=\"wp-block-yoast-seo-table-of-contents yoast-table-of-contents\"><ul><li><a href=\"#h-what-is-multifactor-authentication-for-agents\" data-level=\"2\">What is multifactor authentication for agents?<\/a><\/li><li><a href=\"#h-when-is-mfa-being-switched-on-and-how-do-i-get-it\" data-level=\"2\">When is MFA being switched on and how do I get it?<\/a><\/li><li><a href=\"#h-a-quick-checklist-to-get-your-practice-ready-for-mfa\" data-level=\"2\">A quick checklist to get your practice ready for MFA<\/a><\/li><li><a href=\"#h-frequently-asked-questions\" data-level=\"2\">Frequently asked questions<\/a><\/li><\/ul><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-what-is-multifactor-authentication-for-agents\">What is multifactor authentication for agents?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you already use <a href=\"https:\/\/www.sage.com\/en-gb\/blog\/ai-cyber-security\/\" target=\"_blank\" rel=\"noreferrer noopener\">multifactor authentication<\/a> every day, feel free to skip ahead\u2014but here\u2019s a quick recap in case it\u2019s handy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Multifactor authentication, or MFA, simply adds an additional step to prove who you are when you log in. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As well as your username and password, you confirm it\u2019s really you with a one-time access code\u2014usually generated by an app on your phone, or sent to you by text message or voice call. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It\u2019s the same extra layer you\u2019ll recognise from online banking, and it\u2019s already in place on the personal and business tax accounts that individuals and businesses use to access HMRC services, like the HMRC app.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Considering accessing agent service account (ASA) and online service account (OSA) records effectively open the door to your clients\u2019 tax records, they\u2019re a natural target for fraud\u2014and the addition of MFA could be said to be overdue. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nonetheless, adding this second step ASAP makes it much harder for anyone else to get in, keeping both your practice and your clients\u2019 data better protected. In short: a small change at the login screen, and a big gain in security.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-when-is-mfa-being-switched-on-and-how-do-i-get-it\">When is MFA being switched on and how do I get it?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is the interesting part. MFA is arriving in three stages during 2026, and you can choose the timing that suits your practice best. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are two early \u201copt-in\u201d dates over the summer, plus a final stage where MFA is switched on automatically:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Apply by midnight on 30 June 2026 to have MFA activated on <strong>15 July 2026<\/strong>.<\/li>\n\n\n\n<li>Apply by midnight on 31 July 2026 to have MFA activated on <strong>19 August 2026<\/strong>.<\/li>\n\n\n\n<li>If you don\u2019t pick an early date, MFA will be switched on automatically between <strong>28 September and 15 October 2026<\/strong>.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">To choose an early date, you complete a short form that appears when you sign in to your agent services account (ASA) or online services account (OSA) from 10 June 2026. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It works best when handled centrally by whoever manages your firm\u2019s agent accounts, so it\u2019s worth letting colleagues know to leave the form to them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The opt-in is based on your Government Gateway identifier. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your firm has more than one\u2014for example, if you\u2019ve grown through mergers and picked up additional agent accounts along the way\u2014you can choose which ones to activate and when, and even stagger them across the two summer dates.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Should you opt in early or wait?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Opting in early gives you certainty. You\u2019ll know exactly when MFA is coming, so you can prepare your team and pick a date that works around your busy periods.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It also means the right person is in the driving seat. The first time anyone signs in after MFA is switched on, they\u2019ll set up the extra step\u2014so it makes sense for that to be the person who looks after your agent accounts, on a day you\u2019ve planned for, rather than a quiet morning when someone else happens to log in first.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Preferring to wait for the automatic stage is completely fine too. You\u2019ll just want to make sure everyone who uses the accounts is ready before late September, since the exact day within the final window isn\u2019t fixed. Either way, a short window of preparation is the key to a smooth switch.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Deciding how your team will log in<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You have two options here, and both work seamlessly with MFA. But care needs to be taken.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The first is individual logins for each member of staff. This is HMRC\u2019s recommended approach and it\u2019s especially tidy for managing access: everyone has their own credentials, and you can simply remove a person\u2019s access when they leave. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Individual accounts are challenging in the case of OSAs, however, because individual clients need to be assigned to each account. This requirement isn&#8217;t present with ASA accounts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, a second option might seem better as a short-term option\u2014to keep shared logins and use an authenticator app, especially where OSA client allocation makes individual access difficult. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But there can be little doubt that firms should consider individual access the cleaner, long-term model where it is practical.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Choosing how you receive your access codes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Once MFA is on, you\u2019ll enter a one-time access code alongside your usual Government Gateway details. You can receive that code in one of three ways: by text message, by voice call, or through an authenticator app.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HMRC recommends using an authenticator app as your main method, with at least one backup set up as well. You can have a primary method plus up to two backups. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Adding a backup is a small step that\u2019s well worth taking, so you always have a way to sign in even if your main device isn\u2019t to hand. But bear in mind that any MFA attached to a phone number increases risk, because it&#8217;s possible for hackers to socially engineer mobile companies into transferring phone numbers and therefore get access to the MFA codes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-a-quick-checklist-to-get-your-practice-ready-for-mfa\">A quick checklist to get your practice ready for MFA<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A few minutes of preparation now is all it takes. Here\u2019s a simple checklist to work through:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Check your contact details. <\/strong>Make sure the phone numbers and details on your accounts are current, so your access codes always reach the right place. It\u2019s also worth checking whether an MFA option was set up on an account some time ago.<\/li>\n\n\n\n<li><strong>Confirm who\u2019s in charge. <\/strong>Decide who manages your firm\u2019s agent account access, and make sure they\u2019re the one to complete the opt-in form.<\/li>\n\n\n\n<li><strong>List your Government Gateway identifiers. <\/strong>If your firm has more than one agent account, gather your identifiers in one place before you opt in.<\/li>\n\n\n\n<li><strong>Choose your login approach and code method. <\/strong>Decide between individual or shared logins, and pick how you\u2019ll receive your access codes.<\/li>\n\n\n\n<li><strong>Brief your team. <\/strong>Let everyone know what\u2019s changing and when, so the switch is no surprise.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Final thoughts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Multifactor authentication is a welcome, straightforward upgrade to the security around your clients\u2019 data\u2014and getting ready for it really is quick. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Decide whether you\u2019d like an early date or prefer to wait, get your contact details and logins in order, and let your team know what to expect.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do that, and switch-on day will pass without a hitch, leaving your practice better protected than ever. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-frequently-asked-questions\">Frequently asked questions<\/h2>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1782403010407\"><strong class=\"schema-faq-question\"><strong>When is HMRC introducing multifactor authentication for agents?<\/strong><\/strong> <p class=\"schema-faq-answer\">MFA is being rolled out to all HMRC agent accounts during 2026. You can opt in for an early activation date of 15 July (by applying by 30 June) or 19 August (by applying by 31 July). If you don\u2019t choose an early date, MFA will be switched on automatically between 28 September and 15 October 2026.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1782403023433\"><strong class=\"schema-faq-question\"><strong>What happens if I don\u2019t opt in for MFA for agents?<\/strong><\/strong> <p class=\"schema-faq-answer\">Nothing to worry about\u2014MFA will simply be switched on for your accounts automatically at some point between 28 September and 15 October 2026. The only difference is that you won\u2019t have a fixed date in advance, so it\u2019s a good idea to make sure everyone who uses the accounts is ready to set up the extra step before late September.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1782403046026\"><strong class=\"schema-faq-question\"><strong>Can I keep using shared logins for my HMRC agent account?<\/strong><\/strong> <p class=\"schema-faq-answer\">Yes, but it&#8217;s not the best approach. Individual logins for each staff member are HMRC\u2019s recommended approach, although there&#8217;s no prohibition on keeping shared logins and using an authenticator app if that&#8217;s best for your practice at the moment. It still gives you the full benefit of MFA, and you can move to individual logins later when the timing is correct for you.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1782403058366\"><strong class=\"schema-faq-question\"><strong>Will MFA affect my Making Tax Digital for Income Tax or VAT submissions?<\/strong><\/strong> <p class=\"schema-faq-answer\">No. The change applies to web sign-in for your agent services account and online services account on GOV.UK. It doesn\u2019t affect Making Tax Digital for Income Tax or VAT submissions you make through software, so your day-to-day filing workflow carries on as normal.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1782403073132\"><strong class=\"schema-faq-question\"><strong>What is the Government Gateway identifier and where do I find it?<\/strong><\/strong> <p class=\"schema-faq-answer\">It\u2019s the reference linked to your agent account, and it\u2019s what the opt-in form uses to switch MFA on. It\u2019s different from the agent codes you might use on authorisation forms. The opt-in form includes instructions for finding it, and if your firm has more than one agent account it\u2019s worth gathering all your identifiers in one place before you apply.<\/p> <\/div> <\/div>\n\n\n\n<div class=\"single-cta\">\n\t<div class=\"single-cta__positioner on-scroll-highlight__target\">\n\t\t<div class=\"single-cta__wrapper has-dark-background-color\">\n\t\t\t<div class=\"single-cta__content\">\n\t\t\t\t\t\t\t\t<h2 class=\"single-cta__title h3\">Explore Sage trust and security<\/h2>\n\n\t\t\t\t\t\t\t\t\t<div class=\"single-cta__description\">\n\t\t\t\t\t\t<p><!-- wp:paragraph --><\/p>\n<p>Trust is the foundation of good security and our customer relations. Learn how we safeguard your security, value your privacy, and uphold the highest standards of data ethics.<\/p>\n<p><!-- \/wp:paragraph --><\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a\n\t\t\t\t\t\thref=\"https:\/\/www.sage.com\/en-gb\/trust-security\/\"\n\t\t\t\t\t\tclass=\"single-cta__button button button--primary\"\n\t\t\t\t\t\t\t\t\t\t\t\t\tid=\"cta-id-24055\"\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tdata-button-location=\"cta_box\"\n\t\t\t\t\t\t\t\t\t\t\t>Learn more<\/a>\n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<img decoding=\"async\" width=\"800\" height=\"450\" src=\"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2025\/08\/tandshubcta.jpg\" class=\"single-cta__image\" alt=\"A man in an office exploring the Sage trust and security hub\" loading=\"lazy\" srcset=\"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2025\/08\/tandshubcta.jpg 800w\" sizes=\"auto, (min-width: 48em) 33vw, 100vw\" \/>\t\t\t<\/div>\n<\/div>\n\n\n<section class=\"more-topics alignfull has-grey-light-background-color wp-block-sage-post-topics\">\n\t<div class=\"container\">\n\t\t<div class=\"row\">\n\t\t\t<div class=\"col col-12 col-lg-4\">\n\t\t\t\t<h3 class=\"more-topics__title h2\">Browse more topics from this article<\/h3>\n\t\t\t<\/div>\n\t\t\t<div class=\"col col-12 col-lg-8\">\n\t\t\t\t<ul class=\"post-tags__list\">\n\t\t\t\t\t\t\t\t\t\t\t<li class=\"post-tags__item\">\n\t\t\t\t\t\t\t<a href=\"https:\/\/www.sage.com\/en-gb\/blog\/tag\/security-fraud\/\" class=\"post-tags__link button button--secondary\">\n\t\t\t\t\t\t\t\tSecurity and fraud\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t\t<\/ul>\n\t\t\t<\/div>\n\t\t<\/div>\n\t<\/div>\n<\/section>\n\n\n<div class=\"alignfull wp-block-sage-related-posts\">\n\t<section class=\"related-posts card-grid has-dark-background-color\">\n\t<div class=\"container\">\n\t\t\t\t\t<div class=\"row\">\n\t\t\t\t<div class=\"col\">\n\t\t\t\t\t<h2 class=\"related-posts__heading related-posts__heading--featured h1\">Explore more wisdom<\/h2>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\n\t\t\t<div class=\"row related-posts__featured\">\n\t\t\t\t<div class=\"col card-grid__item\">\n\t\t\t\t\t<article\n\t\tclass=\"card-post related-post related-post-0 post-30540 post type-post status-publish format-standard has-post-thumbnail hentry category-strategy-legal-operations category-technology-innovation category-trends-insights tag-gdpr tag-security-fraud business_type-small-business business_type-medium-sized-business business_type-accountants industry-professional-services card-post--is-clickable\"\n>\n\t<div class=\"card-post__media-wrapper\">\n\t\t<figure class=\"card-post__media\">\n\t\t\t\t\t\t\t<img decoding=\"async\" width=\"1440\" height=\"810\" src=\"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2026\/06\/AdobeStock_2064057245-1440x810.jpg\" class=\"card-post__image\" alt=\"A man entering data in an office environment\" loading=\"lazy\" srcset=\"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2026\/06\/AdobeStock_2064057245-684x384.jpg 684w, https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2026\/06\/AdobeStock_2064057245-768x432.jpg 768w, https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2026\/06\/AdobeStock_2064057245-1440x810.jpg 1440w\" sizes=\"auto, (min-width: 48em) 250px, (min-width: 30em) 100vw, 100vw\" \/>\t\t\t\n\t\t\t\n\t\t\t\t\t<\/figure>\n\t<\/div>\n\n\t<div class=\"card-post__content\">\n\t\t\t\t\t<div class=\"card-post__label\">Recommended<\/div>\n\t\t\n\t\t\t\t\t<div class=\"card-post__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"card-post__meta-text\"><span class=\"posted-on \"><time class=\"entry-date published\" datetime=\"2026-06-25T10:41:04+01:00\">25 June, 2026<\/time><\/span><\/span>\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"card-post__meta-text\"><span class=\"reading-time\">10 min read<\/span><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\n\t\t<p class=\"card-post__title h3\">\n\t\t\t\t\t\t\t<a\n\t\t\t\t\tclass=\"card-post__title-link\"\n\t\t\t\t\thref=\"https:\/\/www.sage.com\/en-gb\/blog\/data-use-and-access-act-2025-need-to-know\/\"\n\t\t\t\t>\n\t\t\t\n\t\t\tUK data protection changes in 2026: What businesses must do now\n\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/p>\n\n\t\t\n\t\t\t\t\t<p class=\"card-post__description\">\n\t\t\t\tThanks to the DUAA, the UK&#8217;s data protection rules have undergone a post-Brexit and post-GDPR refresh, with big changes as of June 2026. Here&#8217;s your crash course.\t\t\t<\/p>\n\t\t\n\t\t\t<\/div>\n\n\t<\/article>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\n\t\t\t\t\t<div class=\"row related-posts__non-featured\">\n\t\t\t\t<div class=\"col col-12\">\n\t\t\t\t\t<h2 class=\"related-posts__heading related-posts__heading--more h4\">More on this Topic<\/h2>\n\t\t\t\t<\/div>\n\n\t\t\t\t\n\t\t\t\t\t<div class=\"col col-6 col-lg-3 card-grid__item\">\n\t\t\t\t\t\t<article\n\t\tclass=\"card-post related-post related-post-1 post-29356 post type-post status-publish format-standard has-post-thumbnail hentry category-technology-innovation category-trends-insights tag-ai tag-security-fraud business_type-small-business business_type-medium-sized-business business_type-accountants\"\n>\n\t\t\t<a\n\t\t\tclass=\"card-post__link\"\n\t\t\thref=\"https:\/\/www.sage.com\/en-gb\/blog\/ai-cyber-security\/\"\n\t\t\t\t\t>\n\t\t\t<figure class=\"card-post__media\">\n\t\t\t\t\t\t\t<img decoding=\"async\" width=\"684\" height=\"384\" src=\"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2022\/04\/GettyImages-1325899588-684x384.jpg\" class=\"card-post__image\" alt=\"\" loading=\"lazy\" srcset=\"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2022\/04\/GettyImages-1325899588-684x384.jpg 684w, https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2022\/04\/GettyImages-1325899588-768x432.jpg 768w, https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2022\/04\/GettyImages-1325899588-1440x810.jpg 1440w\" sizes=\"auto, (min-width: 48em) 250px, (min-width: 30em) 100vw, 100vw\" \/>\t\t\t\n\t\t\t\n\t\t\t\t\t<\/figure>\n\n\t\t\n\t\t\t\t\t<div class=\"card-post__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"card-post__meta-text\"><span class=\"posted-on \"><time class=\"entry-date published\" datetime=\"2026-03-31T12:09:13+01:00\">31 March, 2026<\/time><\/span><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"card-post__meta-text\"><span class=\"reading-time\">1 min read<\/span><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\n\t\t<p class=\"card-post__title h5\">\n\t\t\tAI is accelerating familiar attacks: What\u2019s changing, and how leaders should respond\t\t<\/p>\n\n\t\t\t<\/a>\n\t\n\t\n\t\t\n\t\n\t<\/article>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t<div class=\"col col-6 col-lg-3 card-grid__item\">\n\t\t\t\t\t\t<article\n\t\tclass=\"card-post related-post related-post-2 post-24797 post type-post status-publish format-standard has-post-thumbnail hentry category-strategy-legal-operations category-technology-innovation tag-cloud tag-security-fraud business_type-small-business business_type-accountants\"\n>\n\t\t\t<a\n\t\t\tclass=\"card-post__link\"\n\t\t\thref=\"https:\/\/www.sage.com\/en-gb\/blog\/turn-your-employees-into-cyber-security-champions\/\"\n\t\t\t\t\t>\n\t\t\t<figure class=\"card-post__media\">\n\t\t\t\t\t\t\t<img decoding=\"async\" width=\"684\" height=\"384\" src=\"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2022\/09\/Quiet-quitting-684x384.jpg\" class=\"card-post__image\" alt=\"Working on employee performance and goals\" loading=\"lazy\" srcset=\"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2022\/09\/Quiet-quitting-684x384.jpg 684w, https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2022\/09\/Quiet-quitting-768x512.jpg 768w, https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2022\/09\/Quiet-quitting-1215x810.jpg 1215w\" sizes=\"auto, (min-width: 48em) 250px, (min-width: 30em) 100vw, 100vw\" \/>\t\t\t\n\t\t\t\n\t\t\t\t\t<\/figure>\n\n\t\t\n\t\t\t\t\t<div class=\"card-post__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"card-post__meta-text\"><span class=\"posted-on \"><time class=\"entry-date published\" datetime=\"2025-11-14T15:42:22+00:00\">14 November, 2025<\/time><\/span><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"card-post__meta-text\"><span class=\"reading-time\">6 min read<\/span><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\n\t\t<p class=\"card-post__title h5\">\n\t\t\tTurn your employees into cyber security champions\t\t<\/p>\n\n\t\t\t<\/a>\n\t\n\t\n\t\t\n\t\n\t<\/article>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t<div class=\"col col-6 col-lg-3 card-grid__item\">\n\t\t\t\t\t\t<article\n\t\tclass=\"card-post related-post related-post-3 post-24010 post type-post status-publish format-standard has-post-thumbnail hentry category-technology-innovation tag-security-fraud business_type-small-business business_type-medium-sized-business business_type-accountants\"\n>\n\t\t\t<a\n\t\t\tclass=\"card-post__link\"\n\t\t\thref=\"https:\/\/www.sage.com\/en-gb\/blog\/phishing-why-trusting-your-gut-matters\/\"\n\t\t\t\t\t>\n\t\t\t<figure class=\"card-post__media\">\n\t\t\t\t\t\t\t<img decoding=\"async\" width=\"684\" height=\"384\" src=\"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2023\/09\/GettyImages-1488918938-684x384.jpg\" class=\"card-post__image\" alt=\"A man using a computer and protecting himself from phishing\" loading=\"lazy\" srcset=\"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2023\/09\/GettyImages-1488918938-684x384.jpg 684w, https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2023\/09\/GettyImages-1488918938-768x512.jpg 768w, https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2023\/09\/GettyImages-1488918938-1215x810.jpg 1215w\" sizes=\"auto, (min-width: 48em) 250px, (min-width: 30em) 100vw, 100vw\" \/>\t\t\t\n\t\t\t\n\t\t\t\t\t<\/figure>\n\n\t\t\n\t\t\t\t\t<div class=\"card-post__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"card-post__meta-text\"><span class=\"posted-on \"><time class=\"entry-date published\" datetime=\"2025-08-20T09:04:38+01:00\">20 August, 2025<\/time><\/span><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"card-post__meta-text\"><span class=\"reading-time\">7 min read<\/span><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\n\t\t<p class=\"card-post__title h5\">\n\t\t\tPhishing: Why trusting your gut matters\t\t<\/p>\n\n\t\t\t<\/a>\n\t\n\t\n\t\t\n\t\n\t<\/article>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t<div class=\"col col-6 col-lg-3 card-grid__item\">\n\t\t\t\t\t\t<article\n\t\tclass=\"card-post related-post related-post-4 post-16969 post type-post status-publish format-standard has-post-thumbnail hentry category-strategy-legal-operations tag-accountant-accounting tag-security-fraud business_type-accountants\"\n>\n\t\t\t<a\n\t\t\tclass=\"card-post__link\"\n\t\t\thref=\"https:\/\/www.sage.com\/en-gb\/blog\/identity-fraud-combat-framework\/\"\n\t\t\t\t\t>\n\t\t\t<figure class=\"card-post__media\">\n\t\t\t\t\t\t\t<img decoding=\"async\" width=\"684\" height=\"384\" src=\"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2023\/09\/GettyImages-1369567969-1-684x384.jpg\" class=\"card-post__image\" alt=\"\" loading=\"lazy\" srcset=\"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2023\/09\/GettyImages-1369567969-1-684x384.jpg 684w, https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2023\/09\/GettyImages-1369567969-1-768x512.jpg 768w, https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2023\/09\/GettyImages-1369567969-1-1215x810.jpg 1215w\" sizes=\"auto, (min-width: 48em) 250px, (min-width: 30em) 100vw, 100vw\" \/>\t\t\t\n\t\t\t\n\t\t\t\t\t<\/figure>\n\n\t\t\n\t\t\t\t\t<div class=\"card-post__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"card-post__meta-text\"><span class=\"posted-on \"><time class=\"entry-date published\" datetime=\"2024-06-25T09:00:00+01:00\">25 June, 2024<\/time><\/span><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"card-post__meta-text\"><span class=\"reading-time\">6 min read<\/span><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\n\t\t<p class=\"card-post__title h5\">\n\t\t\tHow the Core Identity Framework can help to combat identity fraud\t\t<\/p>\n\n\t\t\t<\/a>\n\t\n\t\n\t\t\n\t\n\t<\/article>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t<\/div>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The extra security that MFA provides is coming to HMRC&#8217;s ASA and OSA agent accounts. It&#8217;s a huge change\u2014and practices need to get onboard now.<\/p>\n","protected":false},"author":280,"featured_media":30602,"menu_order":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sage_video":false,"post_featured_image_hide":false,"sage_hide_published_date":false,"sage_hide_read_time":false,"sage_hide_share_buttons":false,"_pwl_sage_podcast_buzzsprout_src":"","footnotes":""},"categories":[9,11],"tags":[52],"business_type":[115],"lilypad":[],"context":[],"industry":[],"persona":[67],"imagine_tag":[267],"coauthors":[369],"class_list":["post-30601","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-strategy-legal-operations","category-technology-innovation","tag-security-fraud","business_type-accountants"],"sage_meta":{"region":"en-gb","author_name":"Keir Thomas-Bryant","featured_image":"https:\/\/www.sage.com\/en-gb\/blog\/wp-content\/uploads\/sites\/10\/2026\/06\/MFA.jpg","imagine_tags":{"267":"Security Fraud"}},"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Sage Advice UK","distributor_original_site_url":"https:\/\/www.sage.com\/en-gb\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/posts\/30601","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/users\/280"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/comments?post=30601"}],"version-history":[{"count":5,"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/posts\/30601\/revisions"}],"predecessor-version":[{"id":30705,"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/posts\/30601\/revisions\/30705"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/media\/30602"}],"wp:attachment":[{"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/media?parent=30601"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/categories?post=30601"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/tags?post=30601"},{"taxonomy":"business_type","embeddable":true,"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/business_type?post=30601"},{"taxonomy":"lilypad","embeddable":true,"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/lilypad?post=30601"},{"taxonomy":"context","embeddable":true,"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/context?post=30601"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/industry?post=30601"},{"taxonomy":"persona","embeddable":true,"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/persona?post=30601"},{"taxonomy":"imagine_tag","embeddable":true,"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/imagine_tag?post=30601"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.sage.com\/en-gb\/blog\/api\/wp\/v2\/coauthors?post=30601"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}