UK Sponsor Licence SMS Changes: What Employers Need to Know

Mandatory Multi-Factor Authentication for SMS Users

Multi-factor authentication for Sponsor Management System users will be introduced on a phased basis from 3 September 2026, with the Home Office expecting this to be in place for all sponsors by November 2026.

‍

Existing sponsors will be contacted by email approximately two weeks before MFA is enabled on their licence, with the notification sent to the Authorising Officer, Key Contact and Level 1 User(s).

‍

Organisations granted a new sponsor licence on or after 9 September 2026 will automatically have MFA enabled.

‍

Level 2 Users Are Being Phased Out

From 9 September 2026, sponsors will no longer be able to appoint new Level 2 Users.

‍

Existing Level 2 Users must be converted to Level 1 Users where eligible or have their accounts deactivated by 8 March 2027.

‍

Restrictions on Agency Staff

Certain Level 2 Users, including individuals supplied by an employment business who are not employed by the sponsor, will not be eligible to be converted to Level 1 Users.

‍

Any remaining Level 2 accounts will be deactivated by the Home Office after 8 March 2027.

‍

Inactive SMS Accounts

User accounts that have not been accessed for 12 months or more may be deactivated following a process initiated by the Home Office.

‍

Where the Home Office identifies an inactive Level 1 User, the user will be given three months from the date of contact to log in and check or update their details.

‍

If the required action is not taken, the account will be deactivated.

‍

Sponsors Must Maintain an Active Level 1 User

Sponsors must maintain at least one active and eligible Level 1 User.

‍

If a sponsor is left without one, the Home Office may suspend the licence and, if an eligible Level 1 User is not nominated within the required timeframe, the licence would normally be revoked.

‍

SMS User Details Must Be Kept Up to Date

Sponsors should ensure current contact details are recorded for SMS users, including the information required for MFA.

‍

This includes checking that email addresses for all Key Personnel are correct and that Level 1 Users have an up-to-date mobile telephone number and date of birth recorded on the SMS.

‍

Incorrect or incomplete information could cause difficulties accessing the SMS once MFA is enabled.

‍

New Authorising Officer Notifications

From 9 September 2026, Authorising Officers will receive email notifications about key activity on the sponsor licence, including:

• changes to Level 1 User details
• the addition of a new Level 1 User
• changes to the Authorising Officer's email address

For sponsors that assigned fewer than 1,000 CoS or CAS in 2025, Authorising Officers will also receive notifications when CoS or CAS are assigned.

‍

The Home Office intends to introduce daily summary functionality later this year for sponsors above this threshold.

‍

What Should Sponsor Licence Holders Do Now?

Sponsors should:

• Review who currently has access to the SMS account
• Identify any Level 2 Users who will need to be converted or removed
• Check whether any SMS accounts have become inactive
• Make sure user contact details are accurate and up to date
• Ensure the Level 1 User accesses the SMS regularly. The Home Office recommends at least monthly
• Make sure the Authorising Officer understands the new activity notifications they will begin receiving from 9 September 2026 and has appropriate internal processes for reviewing them
• Review internal sponsor licence governance and responsibilities

With the Home Office continuing to focus on sponsor compliance, ensuring SMS access, Key Personnel and internal processes are properly managed is an important part of maintaining a UK Sponsor Licence.

‍

If you would like to discuss the changes or review your SMS governance arrangements, contact Hudson McKenzie.