# Online agent authorisation or form 64-8? How a practice gets authority to act for a new client, tax by tax

> Which route gets a practice authority for Self Assessment, Corporation Tax, PAYE and VAT, the 7 working day letter, the 30-day code and a worked timeline.

- Page to cite: https://aeolookup.com/accountants/online-agent-authorisation-or-form-64-8-accountants/
- Publisher: AEO Lookup (https://aeolookup.com/)
- Section: Accountancy practices, Onboarding and AML
- Published 5 October 2026
- Key fact: We counted the authorisation timeline from GOV.UK's Online Agent Authorisation page. A request made on Monday 2 November 2026 gets its letter by Wednesday 11 November 2026 at the latest (7 working days), and the client's code has to reach the practice within 30 days of the letter, so by Friday 11 December 2026 if the letter is dated 11 November. A client who needs both Self Assessment and Corporation Tax gets two letters and two codes, so two separate 30-day clocks.
- Sources: GOV.UK "How to get authorised to act as a tax agent on behalf of your clients" (updated 17 March 2026), "How to use the Online Agent Authorisation to get authorised as a tax agent" (updated 18 January 2024), "Agent authorisation: apply using HMRC paper forms" (updated 12 May 2025) and "Authorise a tax agent (64-8)" (updated 24 July 2026); all read 2026-10-05.

An engagement letter does not give a practice any standing with HMRC. Until HMRC records the practice as the client's agent, the practice cannot see the client's record, file for them or speak to HMRC about them. This guide sets out the two routes for the older taxes, the time limits on each, and a worked timeline for a start date.

## Two routes, and which tax each one covers

GOV.UK's guidance on getting authorised as a tax agent (updated 17 March 2026) lists the routes service by service. The two that matter for most small practices are these.

| Tax | Online Agent Authorisation | Paper form 64-8 |
|---|---|---|
| Self Assessment | Yes | Yes |
| Corporation Tax | Yes | Yes |
| PAYE for employers and individuals | Yes | Yes |
| VAT | No: the digital handshake in the agent services account | The page lists 64-8 only for older "legacy" VAT cases |
| Construction Industry Scheme | Yes, or through the client's business tax account | The paper-forms page lists CIS for contractors |

The online service needs the practice's Government Gateway user ID. GOV.UK's Online Agent Authorisation page says that from 16 February 2024 the service is no longer available for VAT, which is why VAT goes through the digital handshake instead. Making Tax Digital for Income Tax has its own sign-up, covered in our [MTD agent sign-up guide](https://aeolookup.com/accountants/mtd-income-tax-agent-sign-up-client-authorisation/).

## The online route: the clock starts when the letter is issued

The practice requests authority online. HMRC then posts a letter with an authorisation code to the client. GOV.UK says the letter comes "within 7 working days". The client has to give the code to the practice within 30 days: "usually within 30 days of the letter being issued but the exact date will be in the letter". Read the date in the letter, not the date the client says it arrived.

Three more points from the same page:

- Enter the code wrongly 3 times and the practice has to start the request again.
- If the code expires, the practice has to start again too.
- The process is done once for each tax service. A client who needs two taxes gets one code in the post for each.

The 3-attempt limit is why the code should be copied from the letter, not retyped from a phone photo.

## The paper route: form 64-8

Form 64-8 is the paper route for the same taxes. GOV.UK's page on the form (updated 24 July 2026) says it must be signed and dated, filled in clearly, and posted without a covering letter unless one is essential. The client has to put the practice's agent code or reference on it. The paper-forms page says to send it to the Central Agent Authorisation Team, with these exceptions:

1. a Corporation Tax only form goes to the HMRC office that handles the client's Corporation Tax;
2. a charity goes to the Charities Correspondence Team;
3. trust tax affairs go to the Trusts and Estates Team;
4. an R40 repayment claim goes in with the R40 form.

GOV.UK does not give a processing time for 64-8 on any of the pages above, so this guide gives none. Anyone quoting a number for it is quoting something other than HMRC's own guidance.

## One timeline, counted out

A practice is engaged for a new limited company client on Monday 2 November 2026. The director also files a personal return, so it needs Corporation Tax and Self Assessment authority. It requests both online that day.

| Step | Date | Count |
|---|---|---|
| Both requests made | Monday 2 November 2026 | Day 0 |
| Latest date for both letters to be posted | Wednesday 11 November 2026 | 7 working days: 3, 4, 5, 6, 9, 10 and 11 November |
| Last day for the code, if the letter is dated 11 November | Friday 11 December 2026 | 30 days after the letter |
| Last day for a code, if the letter is dated 5 November | Saturday 5 December 2026 | 30 days after the letter |

HMRC sends the letters when it sends them, so the two taxes can carry different dates and each code has its own deadline. The practice cannot assume the second letter expires with the first. A diary entry per code, copied from the letter, is the safe form.

The counting also shows why the request belongs at the start of the engagement. If the practice asks on the day the client's records arrive, the earliest it can have authority is about a fortnight later, when the client has to find the post, open it and pass the code on in time.

## What the practice does

1. **Request authority in the first week**, in the same sitting as the engagement letter. Our [new client onboarding checklist](https://aeolookup.com/accountants/new-client-onboarding-checklist-accountants/) has the order.
2. **Choose the route per tax.** Online for Self Assessment, Corporation Tax and PAYE if the practice has the agent services account; 64-8 where the online route cannot be used; the digital handshake for VAT.
3. **Diary the code deadline from the letter.** Not from the request, and not from the day the client mentions it.
4. **Chase the client for the code at day 10 and day 20.** A client who has not opened the post is the usual cause of an expired code.
5. **Do not file or discuss the client's affairs with HMRC until the authority shows.** The professional clearance step with the previous accountant is separate: see the [clearance letter template](https://aeolookup.com/accountants/professional-clearance-letter-template-accountants/).
6. **Keep the identity and anti-money-laundering checks apart from this.** HMRC authority is not a client check. The [AML checklist](https://aeolookup.com/accountants/aml-checklist-accountants-bookkeepers/) says what is needed before work starts.

Overlyft ![](https://aeolookup.com/img/d/ours-badge.png) can set up an AI assistant that holds each client's authorisation request date, works out the code deadline from the letter date and tells the partner each morning which codes have not arrived. Sending the request and entering the code stay with the accountant.

This is general information, not professional advice.

---
![](https://aeolookup.com/img/d/owner-line.png)

General information for UK small firms, not legal, tax or financial advice.