Authorise your accountant through the official HMRC process for the work they will do. Keep your Government Gateway password and security codes private. For MTD, confirm whether the accountant needs a main or supporting-agent role, especially if another firm remains involved.
Check the firm and the permission requested
Use HMRC’s official agent-authorisation process for the service concerned. Read the request and confirm the accountant’s identity through a contact method you already trust. An urgent message is not a reason to approve unexpected access.
Main and supporting agents have different roles
For MTD, the main-agent role includes finalising the overall tax position and annual return. Supporting agents can undertake the work their permissions allow, but cannot submit that annual return. If a bookkeeper and tax accountant are both involved, agree their roles before changing access.
Keep passwords and one-time codes private
Complete your own part of the official process. Do not send your Government Gateway password, security code or recovery details through email or chat. If you cannot complete the suggested route, ask about an approved alternative.
An engagement letter is a different step
The engagement records the work and terms you agree. HMRC authorisation gives permission to act through the relevant service. Signing one is not proof that the other has been completed.
You remain responsible for the information supplied for tax. Review the return before submission and keep the authorisation and engagement records. When an arrangement ends, check both outstanding filings and removal or replacement of access.
Complete the permission step and check the result
- Confirm whether the firm is asking to act as a main or supporting agent.
- For a new digital request, read the HMRC consent statement and complete your part yourself through the official journey.
- Ask the firm to confirm authorisation is in place for the relevant work. Then check separately that MTD signup and software access are ready.
Some existing Self Assessment permissions can be added to the agent’s services account instead of a new digital request. The firm should identify the route that applies. HMRC authorisation does not itself prove the next update has been filed.
An urgent authorisation message: what to verify
Illustrative example.
A client receives an unexpected message asking for a one-time login code to “finish accountant setup”. Instead of replying with the code, they contact the firm through the number already in their engagement records and confirm the proper authorisation route.
The same check applies to a genuine-looking request from a different firm name. Verify the organisation and the requested service before approving access. The goal is to establish the agreed authority, not to transfer control of the client’s personal sign-in credentials.
| Check | Practical action |
|---|---|
| Known firm, expected request | Check that the tax service and requested role match the engagement. |
| Unexpected sender or role | Confirm through a previously known contact channel. |
| Password or one-time-code request | Keep credentials private; use the official authorisation process. |
Does signing a client-care letter grant HMRC access?
It records the engagement. Check the separate HMRC authorisation step rather than assuming it happened automatically.
Can a supporting agent file the annual return?
That is a main-agent responsibility under the MTD agent-role guidance. Agree who will perform it.
Download a checklist for this guide
- Firm identity and known contact route
- Tax service being authorised
- Main or supporting role agreed
- Authorisation status
- Outstanding work and permission-removal arrangements