Midnight Sunday: HMRC's MFA Opt-In Deadline Arrives as Penalty Notices Prepare to Restart

30 June 2026, midnight. That is the deadline by which tax agents must submit an online form to HMRC if they want to voluntarily activate multi-factor authentication on their agent services accounts by 15 July. The form has been available since 10 June via either an agent services account or an HMRC online services for agents account. If your firm has already activated MFA, the form will not appear; HMRC has at least spared you the existential dread of wondering whether you have forgotten something.

This is not a fire drill.

The Three Windows, and Why the First One Closes This Sunday

HMRC has confirmed a three-phase rollout. The first window closes at midnight on 30 June, with MFA activated on 15 July for those who opt in. A second voluntary window runs to 31 July, with activation on 19 August for participants. The third phase is mandatory and considerably less agreeable: all remaining agent accounts will have MFA compulsorily activated sometime between 28 September and 15 October. HMRC has stated plainly that it cannot give a specific date within that final window to agents in the last group. You will simply wake up one morning to find it done.

The practical implication is that a firm with twenty fee-earners all relying on a shared agent account (a common enough arrangement in smaller practices) needs to have its authentication infrastructure in order before activation day, not after. Scrambling to set up authenticator apps at 7:45am on a client filing deadline is a pastime best avoided.

Agents with multiple agent identifiers can choose which ones to activate for each deadline. Any IDs not opted into an earlier window will be swept into the mandatory October activation automatically.

What This Means for Your Monday Morning

Check whether the opt-in form appears in your account. If it does, you have until midnight Sunday 29 June (tonight, if you are reading this on publication day) to submit it. Miss that window and the 31 July deadline still gives you a 19 August activation date, which is arguably more comfortable; the summer holiday filing lull makes it a reasonable moment to bed in new authentication procedures. The October mandatory window offers no such scheduling courtesy.

Brief your team. Every person who accesses HMRC's agent portal needs to know that MFA is coming, what it requires from them personally, and, critically, that HMRC sends no reminders about this. The same silence HMRC maintains about employment-related securities returns (more on which below) applies here.

Update your business continuity notes. If a key contact is on annual leave when MFA activates in October, you do not want the first indication of a problem to be a failed VAT return submission.

The Corporation Tax Penalty Restart: July Is Not a Grace Period

Buried alongside the MFA news in HMRC's recent communications is a point that deserves a prominent underline. From 1 April 2026, late-filing penalties for Corporation Tax increased. HMRC has spent the intervening months updating its systems to ensure the new penalty amounts are applied correctly, and automatic penalty notices have been paused in the interim. That pause ends in July 2026, when the penalty notice process recommences.

The pause was an administrative necessity, not a holiday from compliance. Companies that submitted their Corporation Tax returns after the deadline during this period remain liable for the late-filing penalties. The notices simply have not arrived yet; they are, in effect, queued. July is the month they start landing.

Additional penalties may also be imposed where a return has not been submitted promptly after the initial deadline. Practices with clients in arrears on CT returns should treat the next fortnight as a final clearing window, not an extension of the reprieve.

6 July: The ERS and P11D Cluster

For completeness, and because the professional calendar rarely offers tidy spacing between crises, 6 July brings its own obligations. Companies that award shares, options, or other securities to UK employees, directors, or officeholders must submit employment-related securities annual returns to HMRC by that date. The requirement covers restricted and unrestricted shares, growth shares, share options, and all other forms of share awards. There are separate returns for tax-advantaged schemes (EMI, CSOP, SAYE, SIP) and a catch-all for everything else.

HMRC sends no reminders. A company that has not yet registered an ERS scheme should do so immediately, as activation in HMRC's portal can take up to two weeks. An automatic £100 penalty applies for a late return, escalating to £300 after three months, a further £300 after six months, and £10 per day after nine months. Inaccurate returns carry a separate penalty of up to £5,000 per return.

Any EMI option granted between 6 April 2025 and 5 April 2026 must also be notified to HMRC by 6 July 2026 to preserve its EMI-qualifying status. This is not a technicality. An EMI option that loses its qualifying status because of a missed notification deadline has lost a significant part of its commercial value, something both the company and the option holder will notice sharply at exercise.

P11D forms for benefits in kind for 2025-26 share the same 6 July deadline.

The Register of Overseas Entities: A Brief Reminder

On 18 June, Companies House's Integrity and Enforcement Team published a blog post noting that the Register of Overseas Entities, which came into force in August 2022, continues to be a live enforcement priority, with the register improving transparency of property ownership and its role in tackling economic crime. For any practice with overseas-owned property-holding clients, ROE update filings remain a standing obligation and Companies House has made clear it does not treat them as an afterthought.

Next on the Horizon

Beyond Sunday's MFA midnight deadline and 6 July's ERS and P11D cluster, the next material date is 28 September 2026: the opening of HMRC's mandatory MFA activation window. Practices that have not opted into an earlier phase by then have left their activation date entirely to HMRC's discretion. Given that HMRC has confirmed it will not provide advance notice of the specific date within the window, the sensible course is to treat the 31 July voluntary deadline as the last responsible opportunity to maintain control of your own timetable.