The Home Office has introduced several important changes to the Sponsor Management System (SMS) and sponsor compliance framework. Whilst many of the updates are designed to strengthen security, HR teams should take action now to ensure their sponsor licence remains compliant and that key personnel retain uninterrupted access to the SMS.
Mandatory Multi-Factor Authentication (MFA)
From 3 September 2026, MFA will begin to be introduced for Worker and Temporary Worker sponsors. MFA will require SMS users to enter a one-time passcode in addition to their username and password each time they log in. The passcode can be received via mobile phone or email.
Therefore, HR teams should review their SMS records now and ensure that:
• Email addresses for all key personnel are up to date
• Mobile telephone numbers for Level 1 Users are correct
• Dates of birth recorded for Level 1 Users are accurate
• All Level 1 Users can access the contact details registered on the system
Failure to maintain accurate contact information could result in difficulties accessing the SMS once MFA is activated.
Inactive SMS accounts may be removed
The Home Office has confirmed that it intends to deactivate inactive SMS user accounts. Sponsors are expected to review their user population and ensure details remain current. Organisations should therefore carry out an audit of their SMS users and check that:
• Former employees no longer have access
• Current users still require their existing permissions
• Key personnel details remain accurate
Regular housekeeping has always been good practice, but these changes make it increasingly important from a compliance perspective.
Level 2 Users are being phased out
From 9 September 2026, sponsors will no longer be able to appoint new Level 2 Users. Existing Level 2 Users must either be upgraded to Level 1 User status (where eligible) or removed from the licence by 8 March 2027. Employers should identify all current Level 2 Users and determine:
• Whether they need ongoing SMS access
• Whether they meet the requirements to become a Level 1 User
• Whether alternative internal processes will be required if access is removed
Leaving this exercise until early 2027 may create unnecessary disruption, particularly for organisations with multiple users and complex sponsorship activity.
New Licence activity notifications
The Home Office is also introducing enhanced oversight for Authorising Officers. From 9 September 2026, Authorising Officers will receive email notifications when key changes are made to a sponsor licence. These notifications include:
• Changes to Level 1 User details
• Addition of new Level 1 Users
• Changes to the Authorising Officer's email address
For many sponsors, the Authorising Officer will also receive notifications regarding Certificate of Sponsorship (CoS) assignments.
This is likely to increase accountability and make it easier to identify unauthorised activity on sponsor accounts.
Cyber security remains a priority
The Home Office has emphasised that sponsors should only access SMS through the GOV.UK website and remain alert to phishing attempts. Sponsors should never disclose passwords, one-time passcodes or other login credentials outside the SMS platform.
Key takeaway for HRDs
These changes represent the most significant update to SMS user management and security in recent years. The immediate priority for HR teams should be to review SMS users, verify contact details and plan for the removal of the Level 2 User role. Taking proactive steps now will help ensure uninterrupted access to the system and reduce the risk of compliance issues when the new requirements take effect.
We, of course, can assist with such audit and actions, so please do reach out to our Immigration team if support or advice is needed on this or any other immigration matter.