Quick Hits
- The Home Office is introducing mandatory Multi-Factor Authentication for all Sponsor Management System users beginning 3 September 2026, requiring a one-time passcode in addition to existing login credentials to protect against unauthorised access.
- The Level 2 user role will be discontinued from 9 September 2026, and sponsors must upgrade eligible Level 2 users to Level 1 status or deactivate their accounts by 8 March 2027.
- Because sponsors can expect an immediate audit of their SMS users, they may want to verify key personnel details and prepare internal teams for the changes to avoid disruption to licence management and compliance obligations.
These measures are designed to strengthen security, improve oversight of sponsor activity, and modernise SMS user management. The changes include the introduction of mandatory Multi-Factor Authentication (MFA), the removal of Level 2 users, deactivation of inactive user accounts, and the rollout of new licence activity notifications.
Sponsors may want to plan early for the implementation of the SMS changes and review existing SMS governance arrangements to avoid disruption to licence management and sponsored worker activities.
What Is Changing?
Mandatory Multi-Factor Authentication (MFA)
From 3 September 2026, the Home Office is introducing mandatory MFA for SMS users. MFA will require users to verify their identity using a one-time passcode (OTP) in addition to their username and password whenever they log into the SMS. The OTP will be delivered either by email or text message.
The Home Office intends this change to provide greater protection against unauthorised access and cybersecurity threats, even where passwords have been compromised.
Removal of inactive SMS users
The Home Office has confirmed its intention to remove inactive SMS user accounts from sponsor licences. Sponsors are therefore expected to regularly review their SMS users and ensure account details remain current. Failure to maintain active and accurate user records could create operational issues and, in some circumstances, place licence compliance at risk.
Removal of the Level 2 User role
From 9 September 2026, sponsors will no longer be able to appoint new Level 2 users. Existing Level 2 users must either:
- be upgraded to Level 1 users (where eligible), or
- have their accounts deactivated.
Sponsors have until 8 March 2027 to complete this process. The Home Office has encouraged sponsors to act as early as possible to ensure continued access for affected users.
New licence activity notifications
From 9 September 2026, Authorising Officers (AOs) will begin receiving automated email notifications relating to key licence activities, including:
- changes to Level 1 user details,
- addition of new Level 1 users, and
- changes to the AO’s email address.
For sponsors that assigned fewer than 1,000 Certificates of Sponsorship (CoS) or Confirmations of Acceptance for Studies (CAS) during 2025, AOs will also receive notifications regarding CoS and CAS assignments.
The Home Office has indicated that larger sponsors will receive enhanced notification functionality later in 2026.
Implementation Timeline
3 September 2026
- Mandatory MFA rollout begins for Worker and Temporary Worker sponsor licence holders.
9 September 2026
- MFA automatically enabled for all newly granted sponsor licences.
- Sponsors can no longer appoint new Level 2 users.
- New AO licence activity notifications begin.
Early November 2026
- MFA rollout expected for student sponsors, including organisations holding multi-route licences.
- Home Office expects MFA onboarding to be complete.
8 March 2027
- Deadline for sponsors to upgrade eligible Level 2 users to Level 1 status or deactivate those accounts.
MFA Onboarding: What Sponsors Should Expect
The Home Office will onboard existing sponsors in phases. Approximately two weeks before MFA is enabled on a licence, the Home Office will contact the Authorising Officer, Key Contact, and Level 1 users with details of the implementation date and any actions required.
To support the rollout, the Home Office has also published a dedicated MFA User Guide containing step-by-step instructions for users.
Tips for Sponsors
Given the scale of these changes, sponsors may want to review their SMS arrangements as soon as possible, including the following actions and their associated steps:
Conducting an SMS user audit
- Identifying all current Level 1 and Level 2 users
- Removing users who no longer require access
- Confirming that all key personnel remain appropriate and active
Verifying key personnel details
- Checking email addresses for the Authorising Officer, Key Contact, and all SMS users
- Confirming that Level 1 users have accurate mobile phone numbers and email addresses recorded
- Ensuring dates of birth for Level 1 users are correct
Reviewing Level 2 user arrangements
- Identifying individuals who will require ongoing SMS access after March 2027
- Assessing eligibility for Level 1 status and, if necessary, request a Level 1 user account for the Level 2 user
Preparing users for MFA
- Communicating the upcoming changes internally
- Ensuring users understand how OTP verification will operate
- Updating internal SMS access procedures and guidance documents
Establishing regular SMS governance reviews
- Scheduling periodic audits of user access rights
- Reviewing licence activity notifications received by the AO
- Monitoring user activity and account accuracy as part of broader sponsor compliance processes
Key Takeaway
The introduction of MFA represents the most significant operational change to the Sponsor Management System in recent years. While the security enhancements will be welcomed by many sponsors, the administrative work required to prepare for implementation is significant. Early review of SMS user populations, key personnel information, and Level 2 user arrangements will help minimise disruption and ensure continued compliance with sponsor licence duties.
Ogletree Deakins’ London office will continue to monitor developments and will post updates on the Cross-Border, Cybersecurity and Privacy, Immigration, and United Kingdom blogs as additional information becomes available.
Ruhul K. Ayazi is a partner in the London office of Ogletree Deakins.
Carrie-Ann Hosker is an immigration manager for Ogletree Deakins, and is based in the firm’s London office.
Follow and Subscribe
LinkedIn | Instagram | Webinars | Podcasts