Important Changes for Sponsor Management System (SMS) Users

These changes are designed to strengthen the security of sponsor licence accounts, improve oversight of licence activity and ensure sponsor records remain accurate and up to date.

Mandatory Multi-Factor Authentication (MFA)

The Home Office will begin introducing MFA for SMS users on a phased basis from 3 September 2026. Once MFA has been enabled on a sponsor licence, users will be required to enter a one-time passcode (OTP), sent by text message or email, in addition to their username and password each time they log into SMS.

Existing Worker and Temporary Worker sponsors will be onboarded in phases from 3 September 2026, with MFA expected to apply to all such sponsors by November 2026. Existing Student sponsors, including multi-route licence holders, are expected to be onboarded in early November 2026. New sponsor licences granted on or after 9 September 2026 will have MFA enabled automatically. Existing sponsors will normally be notified approximately two weeks before MFA is activated on their licence.

Level 1 users should ensure that their date of birth, email address and mobile telephone number are accurately recorded on SMS, as this information may be required when first accessing an MFA-enabled account and when updating contact details. Sponsors should review these details now to minimise the risk of disruption to SMS access.

Sponsors and Level 1 users can refer to the new SMS Manual 13 – MFA User Guide for detailed guidance on registering for and using MFA.

Level 2 Users

The Home Office is also phasing out the Level 2 user role.

From 9 September 2026, sponsors will no longer be able to appoint new Level 2 users. Existing Level 2 users must either be upgraded to Level 1 users, where eligible, or have their access deactivated by 8 March 2027.

Sponsors should review their existing Level 2 user population and determine which users require continued access to SMS so that appropriate action can be taken well before the deadline.

Deactivation of Inactive SMS User Accounts

The Home Office also intends to remove inactive SMS user accounts from sponsor licences.

A user account will generally be considered inactive if it has not been accessed for a period of 12 months or longer. Sponsors should therefore ensure that Level 1 users access SMS regularly and review any messages or updates published on the SMS homepage.

Where inactive Level 1 users are identified, the Home Office will contact both the Authorising Officer and the relevant inactive Level 1 user. To retain access to SMS, the user must log in, review their details and update them where necessary.

Consequences of Failing to Take Action

If no action is taken within three months of the Home Office making contact, the inactive account will be deactivated and access to SMS will be lost.

If the deactivation of inactive accounts results in a sponsor no longer having an active Level 1 user, the Home Office will normally suspend the sponsor licence. The sponsor will then have 28 days to nominate an eligible replacement Level 1 user. If this is not done, the Home Office will normally revoke the licence.

The Home Office will not contact inactive Level 2 users directly. Sponsors are responsible for identifying any inactive Level 2 users and determining whether their access should be removed or, where appropriate, whether they should be upgraded to Level 1 users before the Level 2 role is withdrawn.

Additional Oversight for Authorising Officers

As part of these wider changes, the Home Office is also introducing additional notifications for Authorising Officers relating to certain activity on the sponsor licence. This is intended to provide greater visibility of licence management activities and help sponsors maintain effective oversight of their immigration compliance arrangements.

Conclusion

These changes represent the most significant update to SMS user management in several years. Sponsors should take proactive steps now to review their SMS users, confirm that all contact details are accurate and ensure they have sufficient Level 1 user coverage in place ahead of the MFA rollout and the removal of Level 2 users.

We recommend that sponsors carry out an immediate review of their SMS accounts to ensure that:

• all Level 1 user details are accurate and up to date;
• any inactive user accounts are identified;
• unnecessary user accounts are removed; and
• suitable arrangements are in place to replace or upgrade existing Level 2 users before March 2027.

If you have concerns about SMS access, Level 1 user duties, compliance or sponsor licence updates, please contact us or visit our immigration website here.