Home Office Updates Sponsor Guidance: What the New SMS Security Reforms Mean for UK Sponsors
In This Article:
The Home Office has published version 08/26 of both Part 1 (Apply for a Licence) and Part 3 (Sponsor Duties and Compliance) of its Workers and Temporary Workers sponsor guidance. Whilst many of the amendments are administrative, together they introduce the most significant changes to the operation of the Sponsor Management System (SMS) since the sponsorship regime was overhauled in 2020.
The principal changes include the introduction of mandatory multi-factor authentication (MFA), the phased withdrawal of the Level 2 User role, new procedures for managing inactive SMS accounts, and consequential amendments to the Home Office’s approach to licence revocation where an organisation loses its licence solely because of inactive SMS users.
Although none of these amendments alter the substantive sponsorship duties imposed on employers, they demonstrate a clear shift in the Home Office’s approach to sponsor governance. Increasingly, compliance is no longer concerned solely with whether sponsors meet their reporting and record-keeping obligations; it also extends to how sponsors administer access to the Sponsor Management System itself.
1. The Home Office is Treating SMS Governance as Part of Sponsor Compliance
One of the more interesting features of these updates is that the changes are spread across both Parts 1 and 3 of the guidance.
Part 1 now introduces new requirements governing who may access the SMS, how users authenticate themselves and how inactive accounts will be managed. Part 3, meanwhile, contains the corresponding compliance consequences where those administrative requirements are not met. Read together, the two guidance documents reinforce an important point: management of the SMS is an integral part of a sponsor’s compliance obligations.
This reflects a broader trend in Home Office policy. Over recent years, sponsor compliance has expanded beyond ensuring sponsored workers are undertaking genuine employment into examining whether sponsors have appropriate internal governance, HR systems and oversight arrangements. The latest amendments continue that trajectory by focusing on the security and integrity of the systems through which sponsors discharge their duties.
2. Mandatory Multi-Factor Authentication
From 03 September 2026, the Home Office has begun introducing mandatory multi-factor authentication for users of the Sponsor Management System. Once enabled for a licence, users will no longer be able to access the SMS using only their username and password, instead being required to complete an additional authentication step.
At first glance, this appears to be little more than a cyber-security enhancement. However, its practical significance is much greater.
The Sponsor Management System is the mechanism through which sponsors assign Certificates of Sponsorship, report changes to sponsored workers, update key personnel and respond to Home Office requests. If authorised users cannot access the SMS because authentication details are inaccurate, linked devices are unavailable or access is concentrated in a single individual, sponsors may find themselves unable to comply with time-sensitive reporting obligations.
Sponsors should therefore view MFA not as an IT issue but as part of their wider compliance framework. Ensuring that user details are accurate, authentication methods remain accessible and sufficient trained personnel have access to the SMS will now be an essential component of good sponsor governance.
3. The Phased Withdrawal of the Level 2 User Role
Perhaps the most significant structural change is the Home Office’s decision to phase out the Level 2 User role altogether.
From 09 September 2026, sponsors will no longer be able to appoint new Level 2 Users. Existing Level 2 Users will remain during a transitional period but must either be upgraded to Level 1 Users, where eligible, or have their accounts deactivated before the role is ultimately removed.
This represents a subtle but important shift in the way the Home Office expects sponsor licences to be managed.
Historically, many organisations have used Level 2 Users to delegate routine sponsorship functions to HR teams or external advisers whilst reserving broader responsibility for Level 1 Users. The removal of the Level 2 role will inevitably concentrate greater responsibility in a smaller number of authorised users. Sponsors will therefore need to review who currently manages their licence, whether existing governance arrangements remain appropriate and whether additional Level 1 Users should be appointed to ensure resilience.
For larger organisations in particular, this is likely to require more than simply changing user permissions. Internal authorisation processes, segregation of responsibilities and approval procedures may all need to be reconsidered.
4. Inactive SMS Accounts and Active Licence Management
The updated guidance also introduces a structured process for dealing with inactive SMS user accounts. Sponsors are expected to ensure that user accounts remain current and actively managed, with the Home Office now taking a more proactive approach where accounts become dormant.
This development is consistent with the wider emphasis on active sponsor management. The practical message is straightforward. Sponsors should not simply obtain a licence and leave it untouched until a Certificate of Sponsorship needs to be assigned. The Home Office increasingly expects sponsor licences to be actively administered throughout their lifetime.
5. A Welcome Clarification on Revocation
The corresponding amendment to Part 3 provides some welcome reassurance for sponsors.
The guidance now confirms that where a licence is revoked solely because of the inactive SMS account process, the enhanced cooling-off provisions will not apply. In other words, an organisation whose licence is revoked because it has failed to maintain active SMS users will not automatically face the same restrictions on making a fresh application as sponsors whose licences are revoked for substantive compliance breaches.
Although no sponsor will wish to find itself in that position, the distinction is a sensible one. Administrative failures relating to SMS account management do not necessarily indicate that a sponsor has exploited workers, breached immigration law or otherwise undermined the integrity of the sponsorship system. The revised guidance recognises that difference.
6. What Sponsors Should Do Now
Taken together, these changes should prompt sponsors to review not only their SMS users but also their wider governance arrangements.
Many organisations have accumulated user accounts over several years as staff have changed roles or left the business. Others continue to rely heavily on a single Level 1 User or have delegated operational responsibility to Level 2 Users whose role will shortly disappear. The latest amendments provide an opportunity to review those arrangements before they create operational difficulties.
Sponsors should ensure that all current users have accurate contact details recorded on the SMS, review whether existing Level 2 Users should be upgraded to Level 1 Users, remove obsolete accounts and consider whether responsibility for managing the sponsor licence is appropriately distributed within the organisation.
7. My View
Whilst the headline changes relate to authentication and user management, the broader message is one of increasing regulatory maturity.
The Home Office is steadily moving towards a sponsorship system in which good governance is measured not only by how sponsors recruit and monitor migrant workers, but also by how they control access to the systems through which sponsorship is administered. The Sponsor Management System is no longer simply an administrative portal; it has become a central component of the Home Office’s compliance framework.
For sponsors, the lesson is clear. Robust internal governance, effective succession planning for key personnel and active management of SMS access should now be regarded as fundamental elements of sponsor licence compliance, rather than matters of administrative convenience.
8. Contact our Immigration Barristers
For expert advice and assistance in relation to managing a sponsor licence please contact our immigration barristers in London on 0203 617 9173 or via the enquiry form below.
9. Frequently Asked Questions: Home Office Updates Sponsor Guidance
Is multi-factor authentication already compulsory for every sponsor licence holder?
Not yet for every existing sponsor. The Home Office began phasing in mandatory multi-factor authentication (MFA) on 3 September 2026 and says it expects the system to be enabled for all sponsors by November 2026. For organisations granted a new sponsor licence on or after 9 September 2026, mandatory MFA is enabled as part of the new arrangements. Sponsors will be contacted when MFA is due to be activated on their account.
What happens if a Level 1 User loses the mobile phone they use for SMS authentication?
A Level 1 User who cannot receive a one-time passcode by text can use the email option to authenticate their SMS login. Where a mobile phone has been lost or stolen, the Home Office guidance says the associated number should be removed from the SMS account as soon as possible. The MFA guidance also allows Level 1 Users to amend their registered mobile number during the authentication process, subject to identity checks including their recorded date of birth.
Can SMS passwords or multi-factor authentication codes be shared with colleagues?
No. Each SMS User must keep their login credentials and one-time authentication codes personal to them. Home Office guidance expressly states that SMS Users must not give their password or MFA passcode to anyone else and warns that doing so may result in revocation of the sponsor licence. MFA should therefore not be treated as a mechanism for allowing colleagues to use another person’s SMS account when the authorised user is unavailable.
When does an SMS User account become inactive?
An SMS User account is regarded as inactive where the user has not accessed it for 12 months or more. If the Home Office identifies an inactive Level 1 User, it will contact the Authorising Officer and the inactive user with instructions. The Level 1 User will normally have three months from that notification to log in, check their details and update them where necessary before the account is deactivated.
How often should a Level 1 User log into the Sponsor Management System?
The Home Office recommends that a Level 1 User accesses the SMS at least once a month. This is considerably more frequent than the 12-month period after which an account is formally treated as inactive. Regular access enables sponsors to check licence information, review Home Office messages and identify changes that may require action, as well as reducing the risk that important user accounts become dormant.
What happens if the inactive-account process leaves a sponsor with no active Level 1 User?
If the removal of inactive accounts leaves a sponsor without any active Level 1 Users, the Home Office will suspend the sponsor licence and give the organisation 28 days to nominate at least one eligible Level 1 User. Failure to do so will normally result in revocation. Where nobody within the organisation can access the SMS, the sponsor can use the Home Office change of circumstances form to request the addition of a Level 1 User.
When will existing Level 2 User accounts stop working?
Existing Level 2 Users can remain in place temporarily, but sponsors must deal with those accounts by no later than 8 March 2027. A Level 1 User must either convert the individual to a Level 1 User, provided they meet the relevant eligibility requirements, or deactivate the account. After 8 March 2027, the Home Office will deactivate any remaining Level 2 User accounts.
Can every existing Level 2 User be converted into a Level 1 User?
No. Conversion is possible only where the existing Level 2 User satisfies the requirements for a Level 1 User. For example, temporary staff supplied by an employment business are expressly ineligible to be converted. A UK-based immigration representative or an employee of an outsourced HR provider may, subject to the applicable requirements, act as an additional Level 1 User after the licence has been granted, but cannot replace the requirement for an eligible in-house Level 1 User.
What responsibility does the Authorising Officer have for SMS security and user activity?
The Authorising Officer remains responsible for the activities of the organisation’s SMS Users even if they do not personally use the SMS. Sponsors must therefore have a system for monitoring what authorised users do within the account. The Home Office specifically recommends that the Authorising Officer checks Certificates of Sponsorship assigned to workers at least once a month, reinforcing the expectation that SMS access should be subject to active internal oversight rather than simply delegated without review.
Please note that the information provided in this article is for general guidance only and is based on the immigration rules and policies in force at the date of publication. Immigration law and Home Office policy can change frequently, and requirements may vary depending on individual circumstances. Legal advice should always be sought in relation to your specific situation.
