HMRC has published a new policy paper clarifying its position on access to its online services. The policy confirms that agents must only access client data through their own authorised account. Firms using automated tools that 'screen scrape' to extract data from their Agent Services Account (ASA) may also be in breach of Government Gateway Terms and Conditions.
The policy paper outlines HMRC's position on the use of HMRC sign-in details, automation and accessing HMRC's web services.
Sign-in details
HMRC prohibit sharing sign-in details used to access any HMRC web services, including:
- Agent Services Account (ASA).
- Business Tax Account.
- Personal Tax Account.
This means that:
- Only the named account user or members of that organisation should access the account.
- Individual members of an organisation can share sign-in details to access their organisation's HMRC web services account.
- Accessing another person's account is not permitted by HMRC.
- Agents need to be authorised by clients via HMRC's approved appointment process.
- Agents must only access client data through their own authorised accounts.
HMRC consider that asking for HMRC sign-in details is a harmful practice. This includes:
- Software that requests or captures HMRC login credentials on its own sign-in page.
- This is in breach of HMRC's Online Services Terms and Conditions.
- A user is, however, free to use a password manager or other tool to save and use sign-in details on their own device or web browser.
- Agents who share HMRC sign-in details breach HMRC's Standard for Agents, and HMRC may take action against agents who do this.
Using automation tools
Using automation tools to enter data or navigate Government Gateway is already prohibited by the existing Government Gateway Terms and Conditions.
- HMRC define automation tools as software designed to simulate human interaction, such as browser automation, screen scraping, scripted sign-in or robotic process automation.
- The restriction applies whether data is being read or written.
Despite this restriction, HMRC have noted that the use of automated tools has increased across the tax profession.
- For instance, many firms rely on automated tools to log into their ASA and extract client data via screen scraping to create consolidated dashboards.
The policy paper acknowledges that some automated tools have emerged because tax agents or software providers have no secure alternative to access the client data they need.
- Application Programming Interfaces (APIs) provided by HMRC do not yet provide access to all the data that firms legitimately need.
- APIs allow secure data access to software tools without directly using HMRC sign-in details.
- HMRC intends to review how automation can be used safely, securely and appropriately in relation to its services. Greater clarity on this has been promised for later in 2026.
How could this affect firms?
Firms currently using automated tools to sign in to their accounts and screen-scraping data may be in breach of the Government Gateway Terms and Conditions.
- HMRC have said that where they detect unsafe access, they will take action to protect data and web services.
- This could include blocking access to an ASA, which would impact being able to file tax returns.
- HMRC have also identified several software products that access HMRC web services by collecting sign-in details on their own sign-in page and then reusing those details to access the account.
- These are being reviewed and HMRC will take action on any unsafe access.
In view of the potential consequences, firms will want to contact their provider to check whether their tax software:
- Collects HMRC sign-in details.
- Uses screen scraping or other automation that conflicts with HMRC's terms and conditions.
Useful guides on this topic
HMRC's Multi-Factor Authentication for agents
HMRC are introducing Multi-Factor Authentication (MFA) for agents using HMRC online accounts. How will this be implemented? How do agents set up MFA? What preparations should agents undertake for MFA?
Tax Agents: HMRC's Standard for Agents
Our guide to HMRC's 'Standard for agents', HMRC's approach to tackling bad agent behaviour, and providing a definition of a tax adviser.
Setting up as a tax agent
What do you need to consider when setting up as a tax agent? What are the steps? How do you register with HMRC?
External link
Policy paper: Use of HMRC sign-in details, automation and accessing HMRC's web services