The Home Office has begun rolling out mandatory multi-factor authentication (MFA) across the Sponsor Management System (SMS), and it forms part of a wider set of changes to how sponsor licences are administered day to day. Here, we look at what MFA involves, what else has changed alongside it, and what sponsors should be doing now to stay ahead of the changes.
What is changing and when
The Home Office has been trialling MFA on a voluntary basis with a limited number of sponsors since November 2025 and began switching it on more widely from early September 2026, with a rolling programme expected to bring every sponsor onto the new system within a few months. Any licence granted from 9 September 2026 onwards has MFA built in from day one.
In practice, MFA adds a second step to the login process. A one-time passcode must also be entered before access is granted, and this will be sent to the user’s registered mobile number or email address.
Where that passcode is sent depends on the type of user: Level 1 Users with a registered mobile number receive it by text message, while Level 2 Users, and any Level 1 User without a mobile number on file, receive it by email instead. Level 1 Users have the added step of confirming a date of birth the first time they log in with a mobile number, and again if they later change their registered phone number or email address.
If the mobile number or email address on file is out of date, or if access is concentrated in a single individual who happens to be unavailable, the organisation can find itself locked out of the very system it needs to meet time-sensitive reporting obligations or urgently sponsor a worker. It is therefore important to ensure that personal and contact details on the SMS are up to date.
Further guidance can be found here: https://www.gov.uk/government/publications/multi-factor-authentication-for-uk-visa-sponsors-sms-manual-13/sms-guide-13-multi-factor-authentification-mfa-accessible
The Level 2 User role is being phased out
The Home Office is withdrawing the Level 2 User role entirely. New Level 2 Users can no longer be appointed, and organisations currently relying on Level 2 access have until 8 March 2027 either to upgrade those users to Level 1 status—where they meet the eligibility criteria—or to have the accounts deactivated. Once that window closes, any Level 2 accounts still in place will be deactivated.
Inactive accounts to be removed
The Home Office has also introduced a formal process for dealing with SMS accounts that fall out of use, and it works differently depending on the type of account.
An account is treated as inactive if it has not been accessed for 12 months or more.
For a Level 1 User, the Home Office will contact the Authorising Officer and the inactive user directly, giving them a three-month window to log in, check their details and update anything that is out of date. If they miss that window, the account will be deactivated.
Level 2 Users are handled differently, and responsibility sits entirely with the sponsor. The Home Office will not contact an inactive Level 2 User directly.
Sponsors should also regularly review their SMS users and proactively deactivate any Level 1 or Level 2 accounts that are no longer needed, rather than waiting for the Home Office’s process to catch up with them.
The stakes get higher if this process runs its course unchecked. If deactivating inactive accounts leaves a sponsor with no active Level 1 User at all, the licence is suspended, and the sponsor has 28 days from the date of suspension to nominate at least one eligible replacement. If the sponsor fails to do that, the licence may be revoked.
Where a licence is lost solely because of this inactive-account process, the more severe restrictions on reapplying that normally follow a revocation do not apply in the same way. The sponsor will not be subject to a cooling-off period—though it would still need to meet the requirements in force at the time of any fresh application. That is a helpful distinction, although it is far better avoided altogether than relied upon after the fact.
What sponsors should do
The theme running through all of this is the same one that the Home Office has been building towards for several years—sponsor governance is judged not only by how an organisation manages its sponsored workers, but also by how it maintains its licence. Here are a few practical steps for sponsors:
- Check that every current SMS user’s mobile number, email address and (for Level 1 Users) date of birth is accurate and up to date.
- Identify any Level 2 Users on your licence and decide, well ahead of the March 2027 deadline, whether each one is eligible for conversion to Level 1 status or needs to be removed.
- Have more than one SMS user—a second authorised user reduces the risk of the organisation being unable to access its own SMS account when it matters.
- Build regular SMS logins into someone’s routine, rather than leaving the account untouched between Certificate of Sponsorship assignments or until a report is required.
- Do not share login credentials.
The above does not change the substantive duties with which a sponsor already needs to comply—but getting the administrative side wrong or having inadequate systems can just as easily put a licence at risk or cause business disruption.
If you would like our help reviewing your current SMS user setup or preparing for these changes, please contact Irfan Ali or Nick Gore.
