Home Office Introduces Mandatory MFA for Sponsor Management System Users

What Is Changing?

The most significant development is the introduction of mandatory Multi-Factor Authentication for all SMS users.

Once MFA is activated for a sponsor licence, users will need more than just their username and password to access the system. They will also be required to enter a one-time passcode (OTP) generated during the login process.

The Home Office has confirmed that MFA will be rolled out in phases throughout September and October 2026, with sponsors receiving advance notification before their licence is migrated to the new system.

How MFA Will Work

Level 1 Users

Level 1 Users will usually receive their OTP by text message sent to the mobile telephone number recorded on the sponsor licence.

Where no valid mobile number is available, the OTP will be sent to the email address associated with their account.

In addition, Level 1 Users will be required to verify their date of birth when:

• Logging in using MFA for the first time on a mobile device

• Updating a registered mobile telephone number

• Updating a registered email address

Level 2 Users

Level 2 Users will receive OTPs through the email address associated with their SMS account.

This places increased importance on ensuring all user details within the SMS are accurate and regularly maintained.

End of New Level 2 User Accounts

Alongside the MFA rollout, the Home Office is making a significant change to sponsor user permissions.

From 9 September 2026, sponsors will no longer be able to create new Level 2 User accounts.

While existing Level 2 Users can continue operating temporarily, sponsors should review their current arrangements as soon as possible.

Key points include:

• New Level 2 Users cannot be created from 9 September 2026

• Existing Level 2 Users may continue to operate during the transition period

• Existing Level 2 Users should be reviewed for possible upgrade to Level 1 status

• Eligible Level 2 Users must be upgraded before 8 March 2027 or risk losing access

• Not all existing Level 2 Users may be eligible for upgrade.

This change further emphasises the importance of ensuring sufficient active Level 1 Users are maintained across the business.

Enhanced Notifications for Authorising Officers

The Home Office is also introducing new notification requirements for Authorising Officers.

Authorising Officers will begin receiving email notifications relating to important sponsor licence activity. Examples of activities that may trigger notifications include:

• Creation of new Level 1 Users

• Changes to SMS users

• Certificate of Sponsorship assignments

• Other significant licence management actions

This increased visibility is designed to provide greater oversight and improve sponsor compliance controls.

For many organisations, it will provide an additional layer of oversight and help identify unauthorised or unexpected activity more quickly.

The Risk of Inactive Accounts

Sponsors should also be aware that inactive SMS accounts may be deactivated by the Home Office.

This could create potential compliance risk where:

• Level 1 Users have not logged into the system for extended periods

• Access credentials are no longer available

• A business is left without an active Level 1 User following deactivation.

In some circumstances, losing all active Level 1 Users could create operational difficulties, significantly affect a sponsor's ability to manage its licence and meet its reporting obligations.

Sponsors should therefore ensure that all active Level 1 Users log into the SMS regularly and maintain current access credentials. Regular system access and account reviews should therefore become part of routine sponsor licence governance.

Immediate Actions for Sponsors

The Home Office changes should prompt businesses to conduct a comprehensive review of their SMS arrangements.

Verify Key Personnel Information

Review the details recorded for all key personnel and SMS users, including:

• Full name
• Date of birth
• Business email address
• Mobile telephone number
• Authorising Officer details
• Key Contact details
• Level 1 User status

Audit Existing SMS Users

Sponsors should ensure that:

• All current users remain employed by the organisation
• Former employees no longer have SMS access
• Access permissions remain appropriate
• Existing Level 2 Users have been assessed for upgrade eligibility

Maintain Active SMS Access

All Level 1 Users should:

• Know their login credentials
• Be able to access the SMS successfully
• Log in regularly
• Avoid sharing account information

Security and Fraud Prevention

The Home Office has highlighted several important security reminders.

Sponsors should note that the Home Office will never:

• Ask for SMS passwords

• Request a sponsor's SMS User ID

• Request dates of birth by email or telephone

• Send passwords for SMS access

• Send unsolicited OTP codes

• Provide links requesting login credentials

Any suspicious communications should be treated with caution and escalated internally.

Where sponsors suspect their SMS account has been compromised, they should contact the Home Office Business Helpdesk immediately.

Why These Changes Matter

The introduction of MFA forms part of the Home Office's wider programme to strengthen sponsor licence security and reduce the risk of unauthorised access to sponsorship records.

While the changes are relatively straightforward, employers that fail to update user information or maintain active SMS access could experience:

• Delays assigning Certificates of Sponsorship

• Inability to report sponsored worker changes

• Difficulties accessing licence records

• User lockouts

• Operational disruption to recruitment processes

With sponsor compliance under increasing scrutiny, employers should treat preparation for MFA implementation as a priority rather than a routine technical update.

Our View

The MFA rollout should be seen as more than a technical change. It is another indication of the Home Office's continuing focus on strengthening sponsor governance, improving accountability and enhancing oversight of licence activity.

Organisations should use this opportunity to carry out a broader review of their sponsor licence arrangements, including user permissions, key personnel appointments, reporting processes and wider compliance controls.

Businesses with complex licence structures, multiple Level 1 Users or historic SMS user records should take particular care to ensure their sponsor data is accurate before MFA is activated.

Frequently Asked Questions

When will MFA become mandatory for sponsor licence holders?

The rollout began on 3 September 2026 and is expected to cover all work route sponsors by November 2026.

How will SMS users receive MFA codes?

Level 1 Users will generally receive OTP codes by text message, while Level 2 Users will receive OTP codes by email.

Can sponsors still create Level 2 Users?

No. Sponsors will no longer be able to create new Level 2 Users from 9 September 2026.

What happens to existing Level 2 Users?

Existing Level 2 Users can continue to operate temporarily but eligible users should be upgraded before 8 March 2027 to avoid losing access.

Why are Authorising Officers receiving notifications?

The Home Office is increasing transparency and oversight by notifying Authorising Officers of significant sponsor licence activity.

What happens if a sponsor has no active Level 1 Users?

If all Level 1 Users lose access or their accounts are deactivated, a sponsor may experience significant difficulties accessing the Sponsor Management System and managing its sponsor licence responsibilities. Sponsors should ensure active Level 1 Users can access the system and log in regularly.