Accessing EDOF in 2026: mandatory 3-representative declaration and email security code

One morning in 2026, you log into your EDOF space as usual — and nothing happens as usual. A screen asks you to declare three people you have never had to identify before, with no way to skip the step. This is not a bug: it is the new access process now imposed on CPF-listed training providers, rolled out in two stages between April and September 2026.

EFP Connect, the single gateway into EDOF

EDOF (Espace Des Organismes de Formation) remains the Caisse des Dépôts platform where you publish the course offers visible on Mon Compte Formation — see our full guide to CPF and EDOF listing if you’re just starting that process. But since November 14, 2024, you no longer access it directly: you must go through EFP Connect, the Ministry of Labour’s single sign-on portal that replaced the old « Mes Démarches Emploi et Formation ». One EFP Connect account now covers all of a training provider’s digital procedures — EDOF, but also the activity declaration or the filing of the annual pedagogical and financial report (BPF).

It is on this shared foundation that the Caisse des Dépôts and the Ministry of Labour added, in 2026, two extra layers of security — a direct response to the fraud that has hit the CPF in recent years, which had already justified tighter listing requirements and the €100 co-payment introduced for account holders.

Since April 18, 2026: mandatory declaration of three representatives

The first lock: every training provider already listed on EDOF must now declare three identified contacts, on the first login following the rollout of the measure. Without this entry, the rest of the professional space stays inaccessible.

Who are these three contacts

• The legal representative: the person who legally commits the organisation — chair, manager or director depending on your legal form, the same person already named on your activity declaration and bylaws.
• The pedagogical manager, designated as the “catalogue contact”: the point of contact for the Caisse des Dépôts on anything related to your CPF-eligible course offer.
• The financial manager, designated as the “payments contact”: the point of contact for billing and bank-detail matters.

Nothing stops one person from holding all three roles, which will be the case for most micro-organisations and sole-trader providers: you simply enter the same identity three times.

A one-shot entry, with no going back

The point to plan for: this declaration must be completed in full in a single session, with no partial save. If you need to track down the full identity and contact details (professional email, phone number) of your pedagogical or financial manager mid-way through, you don’t want to discover that while stuck in the form — gather everything before you log in. In a structure with several partners or employees, give the designated people a heads-up in advance: they may need to confirm their details.

From September 3, 2026: an email security code

A second lock, more conventional in principle but just as capable of shutting you out in practice: starting September 3, 2026, logging into the training-provider space will require entering a security code sent by email, in addition to the usual username and password. It’s the same principle as the two-factor authentication already widespread on banking sites and sensitive administrative platforms.

In practice, this means the email address attached to your EFP Connect account needs to be a professional address, not shared, and checked regularly — not a generic mailbox opened once a week. If several people in your organisation log into EDOF, each should have their own EFP Connect account with their own address, rather than sharing a single login where receiving the security code becomes a bottleneck.

A 2026 study by Eden Kamar, C. Jordan Howell, David Maimon and Isabelle Fraser published in Crime & Delinquency (“Evaluating the Effectiveness of Two-Factor Authentication in Mitigating Account Takeover Fraud”, see on Google Scholar), conducted on Canadian banks, found that mandatory two-factor authentication significantly reduced fraudulent account takeovers, while optional activation had almost no measurable effect. That helps explain why the Caisse des Dépôts chose to make this code mandatory for everyone rather than optional, unlike the France Connect+ two-factor login already available on the account-holder side of the CPF.

Why this tightening, and what it doesn’t change

Both measures follow the same logic as the stricter catalogue checks and the ongoing verification of listing conditions: securing a system that channels several billion euros of public funds every year. They change neither your Qualiopi obligations nor the substance of your regulatory watch under indicator 23 — but they do add to the list of things worth tracking, alongside the URSSAF certificate of good standing or tightened subcontracting thresholds. An EDOF account blocked for lack of a declaration or a missed security code is also not the same as a suspension of your NDA: it’s an access hurdle to clear, not a sanction — but it can still delay your CPF payments if it stops you from declaring a course start on time.

Checklist so you’re not caught off guard

1. Before your next EDOF login, gather the full identity and contact details (professional email, phone number) of your legal representative, pedagogical manager and financial manager — even if it’s the same person for all three.
2. Check that the email address on your EFP Connect account is up to date, professional, and checked daily, ahead of the security code required from September 3, 2026.
3. Set up an individual EFP Connect account for each person in your organisation who logs into EDOF, rather than a shared login.
4. Don’t leave this until the last minute before a filing or invoicing deadline: the full entry can take longer than expected if the contact details aren’t ready in advance.
5. Document the completed declaration (date, people entered) in your quality file, as proof of compliance and continuity if a director or manager later changes.

Take action

These new access requirements join the long list of digital formalities a training-provider founder needs to anticipate from the very start of the project. The Complete Kit Certif (€297) equips you to structure your procedures and your regulatory watch well beyond the certification standard itself, and the Ebook “Set up your training organisation in 30 days” (€67) guides you step by step through these administrative tasks from day one — or choose the Kit + Ebook Pack (€347) to cover both at once.