Mandatory Multi-Factor Authentication (MFA)
Updated release date: 24 September 2026
Please note: we previously communicated a go-live date of 15 September. This has been updated. Mandatory MFA will now go live on 24 September. No action already taken needs to be repeated, this only affects the enforcement date.
Why this is happening
The IRS, together with its Security Summit partners, has introduced a federal requirement under the Federal Trade Commission's Safeguards Rule for multi-factor authentication to be used across all platforms handling taxpayer and financial data. As a provider handling sensitive financial and tax information on behalf of your institution, Sprintax is rolling out mandatory MFA across all products to meet this requirement and keep accounts secure.
MFA options available
- Authenticator app: generate a time-based code from an app such as Google Authenticator or Authy.
- Passkey: sign in securely using your device's biometrics or PIN, without a code.
- SMS: receive a one-time code by text message.
Note: SMS is not available in all countries or territories. If you'd like to check whether SMS is supported in a specific location, please contact calculus@sprintax.com.
Where to set this up
- Admins: Admin Help Centre
- Users: User Knowledge Base
More materials coming next week
To help everyone get set up ahead of 24 September, we'll be releasing:
- A video for each login flow, showing what to expect with each type of MFA enabled (app, Passkey, SMS).
- A video showing what happens if MFA is not enabled before 24 September (users will be redirected to the Sprintax Identity server and prompted to set up MFA before continuing).
Questions? Please contact calculus@sprintax.com.