The most significant development is the introduction of mandatory Multi-Factor Authentication for all SMS users.
Once MFA is activated for a sponsor licence, users will need more than just their username and password to access the system. They will also be required to enter a one-time passcode (OTP) generated during the login process.
The Home Office has confirmed that MFA will be rolled out in phases throughout September and October 2026, with sponsors receiving advance notification before their licence is migrated to the new system.
Level 1 Users will usually receive their OTP by text message sent to the mobile telephone number recorded on the sponsor licence.
Where no valid mobile number is available, the OTP will be sent to the email address associated with their account.
In addition, Level 1 Users will be required to verify their date of birth when:
Logging in using MFA for the first time on a mobile device
Updating a registered mobile telephone number
Updating a registered email address
Level 2 Users will receive OTPs through the email address associated with their SMS account.
This places increased importance on ensuring all user details within the SMS are accurate and regularly maintained.
Alongside the MFA rollout, the Home Office is making a significant change to sponsor user permissions.
From 9 September 2026, sponsors will no longer be able to create new Level 2 User accounts.
While existing Level 2 Users can continue operating temporarily, sponsors should review their current arrangements as soon as possible.
Key points include:
New Level 2 Users cannot be created from 9 September 2026
Existing Level 2 Users may continue to operate during the transition period
Existing Level 2 Users should be reviewed for possible upgrade to Level 1 status
Eligible Level 2 Users must be upgraded before 8 March 2027 or risk losing access
Not all existing Level 2 Users may be eligible for upgrade.
This change further emphasises the importance of ensuring sufficient active Level 1 Users are maintained across the business.
The Home Office is also introducing new notification requirements for Authorising Officers.
Authorising Officers will begin receiving email notifications relating to important sponsor licence activity. Examples of activities that may trigger notifications include:
Creation of new Level 1 Users
Changes to SMS users
Certificate of Sponsorship assignments
Other significant licence management actions
This increased visibility is designed to provide greater oversight and improve sponsor compliance controls.
For many organisations, it will provide an additional layer of oversight and help identify unauthorised or unexpected activity more quickly.
Sponsors should also be aware that inactive SMS accounts may be deactivated by the Home Office.
This could create potential compliance risk where:
Level 1 Users have not logged into the system for extended periods
Access credentials are no longer available
A business is left without an active Level 1 User following deactivation.
In some circumstances, losing all active Level 1 Users could create operational difficulties, significantly affect a sponsor's ability to manage its licence and meet its reporting obligations.
Sponsors should therefore ensure that all active Level 1 Users log into the SMS regularly and maintain current access credentials. Regular system access and account reviews should therefore become part of routine sponsor licence governance.
The Home Office changes should prompt businesses to conduct a comprehensive review of their SMS arrangements.
Review the details recorded for all key personnel and SMS users, including:
Sponsors should ensure that:
All Level 1 Users should:
The Home Office has highlighted several important security reminders.
Sponsors should note that the Home Office will never:
Ask for SMS passwords
Request a sponsor's SMS User ID
Request dates of birth by email or telephone
Send passwords for SMS access
Send unsolicited OTP codes
Provide links requesting login credentials
Any suspicious communications should be treated with caution and escalated internally.
Where sponsors suspect their SMS account has been compromised, they should contact the Home Office Business Helpdesk immediately.
The introduction of MFA forms part of the Home Office's wider programme to strengthen sponsor licence security and reduce the risk of unauthorised access to sponsorship records.
While the changes are relatively straightforward, employers that fail to update user information or maintain active SMS access could experience:
Delays assigning Certificates of Sponsorship
Inability to report sponsored worker changes
Difficulties accessing licence records
User lockouts
Operational disruption to recruitment processes
With sponsor compliance under increasing scrutiny, employers should treat preparation for MFA implementation as a priority rather than a routine technical update.
The MFA rollout should be seen as more than a technical change. It is another indication of the Home Office's continuing focus on strengthening sponsor governance, improving accountability and enhancing oversight of licence activity.
Organisations should use this opportunity to carry out a broader review of their sponsor licence arrangements, including user permissions, key personnel appointments, reporting processes and wider compliance controls.
Businesses with complex licence structures, multiple Level 1 Users or historic SMS user records should take particular care to ensure their sponsor data is accurate before MFA is activated.
The rollout began on 3 September 2026 and is expected to cover all work route sponsors by November 2026.
Level 1 Users will generally receive OTP codes by text message, while Level 2 Users will receive OTP codes by email.
No. Sponsors will no longer be able to create new Level 2 Users from 9 September 2026.
Existing Level 2 Users can continue to operate temporarily but eligible users should be upgraded before 8 March 2027 to avoid losing access.
The Home Office is increasing transparency and oversight by notifying Authorising Officers of significant sponsor licence activity.
If all Level 1 Users lose access or their accounts are deactivated, a sponsor may experience significant difficulties accessing the Sponsor Management System and managing its sponsor licence responsibilities. Sponsors should ensure active Level 1 Users can access the system and log in regularly.