The Home Office has begun the phased rollout of mandatory multi-factor authentication (MFA) for users of the Sponsorship Management System (SMS).
For sponsor licence holders, the immediate change is an additional step at login. The more important question is whether the organisation’s SMS arrangements are resilient enough to withstand an access problem when a time-sensitive sponsorship action is required.
Employers should therefore treat MFA as more than a cyber-security update. It is a useful trigger to review who controls the SMS, whether user details are accurate, whether inactive accounts have been removed, and whether the organisation is overly dependent on one Level 1 User.
When is MFA being introduced for sponsor licence holders?
The Home Office started introducing mandatory MFA for SMS users from 3 September 2026 and has said it expects the rollout to reach all sponsors by November 2026.
Sponsors will be contacted before MFA is enabled for their licence, so the Authorising Officer, Key Contact and Level 1 Users should ensure that the email addresses recorded on the licence are current and regularly monitored.
Once MFA is active, SMS Users will continue to log in using their existing User ID and password, but must also enter a one-time passcode.
The Home Office’s SMS Guide 13 confirms that the passcode is six digits, is valid for 10 minutes and is required each time the user logs in.
For Level 1 Users, the login journey can also require the date of birth recorded on the sponsor licence and a mobile telephone number used to receive the passcode. Level 1 Users without a mobile number can use an email route. Level 2 Users receive their passcode by email.
Why this is more than a login change
The SMS is the principal system through which sponsors manage their licence, assign Certificates of Sponsorship and report relevant worker or organisational changes.
The stronger compliance question is therefore not simply: “Can our Level 1 User receive a passcode?”
It is: "Could our organisation continue to meet its sponsor duties if that person could not access the SMS today?”
Is your sponsor licence dependent on one person?
For some employers, MFA may expose a broader weakness, too much operational knowledge and too much system access concentrated in one individual.
The Authorising Officer is responsible for the actions of staff and representatives who use the SMS, while Level 1 Users are responsible for the day-to-day management of the licence.
The Home Office requires sponsors to maintain at least one eligible Level 1 User throughout the life of the licence.
Where an organisation has only one active Level 1 User, an unexpected absence, departure from the business or access problem can create a single point of failure.
That risk becomes more significant where international recruitment is commercially important or where the business regularly needs to make time-sensitive reports.
Sponsors should consider whether they have sufficient eligible and properly trained Level 1 Users to provide continuity, and whether responsibilities are documented rather than held informally by one member of HR or the mobility team.
Level 2 Users are being phased out
MFA is being introduced alongside a significant change to SMS user roles.
From 9 September 2026, sponsors will no longer be able to appoint new Level 2 Users.
Existing Level 2 Users must be converted to Level 1 Users, where they meet the relevant requirements, or deactivated by 8 March 2027. The Home Office will deactivate any remaining Level 2 accounts after that date.
This creates a practical planning issue for sponsors that have historically used Level 2 Users to provide operational support.
Waiting until March 2027 to address the change could leave organisations with fewer active users than they expect.
A sensible review now should identify every existing Level 2 User, what they currently do, whether they genuinely require continued SMS access and whether they are eligible and suitable to become a Level 1 User.
Inactive SMS accounts are now a governance issue
Sponsors should also review accounts that are no longer used.
Home Office sponsor guidance treats an SMS User account as inactive where it has not been accessed for 12 months or more.
Where inactive users are identified, the Home Office can contact the Authorising Officer and affected Level 1 Users and require action. If the sponsor does not respond within the period specified by the guidance, inactive accounts can be deactivated.
The consequences are more serious if the sponsor is left without an active Level 1 User.
The current sponsor guidance provides for suspension where no active Level 1 User remains, followed by a period in which the sponsor must nominate an eligible Level 1 User. Failure to rectify the position can ultimately place the licence at risk.
The Home Office recommends that a Level 1 User accesses the SMS at least once a month.
For employers, that is a useful reminder that sponsor licence administration should be an active governance process rather than something revisited only when a new hire requires sponsorship.
Do not wait for an urgent Certificate of Sponsorship to test access
One of the more practical details in the new MFA process is the way identity information is checked.
Where a Level 1 User is required to enter their date of birth, it must match the information held on the sponsor licence.
The Home Office guidance states that a Level 1 User has three attempts to enter their date of birth correctly. If all three attempts fail, the account is locked for 24 hours.
Incorrect one-time passcodes and repeated requests can also trigger temporary lockouts.
A 24-hour delay may be manageable on an ordinary day. It could be much more disruptive where the organisation is working to a recruitment deadline or needs to make a time-sensitive sponsorship report.
Sponsors should therefore verify the relevant user information before MFA goes live and understand how access can be recovered.
Once MFA is activated, it is also sensible for Level 1 Users to test the new login process rather than waiting until urgent action is required.
Protect credentials and watch for MFA phishing attempts
The new process reinforces an existing principle of the sponsorship system: SMS access is personal.
User IDs, passwords and one-time passcodes should not be shared.
The Home Office warns users never to provide an OTP to another person. An unexpected passcode, or a request to disclose authentication information, should be treated with caution and reported.
HR and mobility teams should make sure everyone with SMS access understands the new login process and knows what legitimate Home Office communications should look like during the phased rollout.
For sponsors, the practical point is to know exactly who has access, why they have it and whether their permissions remain appropriate.
What should sponsor licence holders do now?
Employers should use the MFA rollout to carry out a focused SMS governance check.
- Audit all SMS Users: Confirm every Level 1 and Level 2 User, remove anyone who has left the organisation or no longer needs access, and identify accounts that have become inactive.
- Check user information: Make sure email addresses are current and secure. Level 1 Users should check that their mobile number and date of birth are correctly recorded for the MFA process.
- Assess resilience: Consider whether the business is reliant on one Level 1 User and who would provide cover during holidays, sickness, departure or an unexpected access problem.
- Plan for the end of Level 2 access: Decide which existing Level 2 Users should be converted to Level 1 status, if eligible, and which should be deactivated before 8 March 2027.
- Test access early: Once MFA is enabled, Level 1 Users should try the new login and familiarise with the process.
- Protect credentials: User IDs, passwords and one-time passcodes should never be shared, and unexpected OTPs should be treated as a warning sign.
- Monitor Home Office communications: The Authorising Officer, Key Contact and Level 1 Users should monitor the email addresses recorded on the licence so activation notices and account-management messages are not missed.
Use MFA to test wider sponsor licence governance
The immediate objective is to make sure the right people can log in when MFA is activated, and the wider value is in testing the governance behind the licence.
Senior HR, mobility and compliance teams should be clear on:
- Who owns sponsor compliance internally;
- Who performs day-to-day SMS activity;
- Who provides cover;
- Whether the Authorising Officer has appropriate oversight; and
- Whether user access reflects the organisation’s current structure.
For organisations that rely on international talent, the question is no longer simply whether MFA is technically enabled. It is whether the sponsor licence is managed in a way that allows the business to continue meeting its obligations when people, systems or circumstances change.
How our Sponsor Licence lawyers can help
Our Business Immigration team advises employers on sponsor licence management, compliance and the practical operation of the Sponsorship Management System.
We can help organisations review their SMS user structure, assess Level 1 and Level 2 arrangements, identify weaknesses before MFA is activated and strengthen the wider governance of their sponsor licence.
If your business or organisation is preparing for the MFA rollout or you are concerned about the resilience of your current SMS access arrangements, contact our Business Immigration team.
Need to Talk to Someone?
Use the form to send us some details about your matter and one of our experts will get in touch, or you can call us using the number below.
