United Kingdom Home Office Announces Sponsor Management System Security and Compliance Changes

• The U.K. Home Office has updated sponsor guidance to introduce mandatory MFA for Sponsor Management System users, remove Level 2 user roles and implement new sponsor licence security measures beginning in September 2026. 

Sponsor Management System Security and Compliance Changes 

The United Kingdom (U.K.) Home Office has published updates to its sponsor guidance for Worker and Temporary Worker licence holders, introducing new security and compliance requirements for Sponsor Management System (SMS) users.  

The changes include mandatory multi-factor authentication (MFA), the removal of inactive SMS user accounts, the phase-out of Level 2 user roles and new licence activity notifications for Authorising Officers. 

While the changes currently apply to Worker and Temporary Worker sponsors, the Home Office has indicated that guidance for student sponsors will be updated separately.

Mandatory MFA Coming to SMS 

Beginning September 3, 2026, the Home Office will begin rolling out mandatory MFA for SMS users accessing sponsor licence accounts. 

Key dates include: 

• September 3, 2026: MFA rollout begins for Worker and Temporary Worker sponsors. 
• September 9, 2026: MFA automatically enabled for organizations granted a new sponsor licence. 
• Early November 2026: MFA rollout expected for Student sponsors, including multi-route licence holders. 

The Home Office will notify Authorising Officers (AOs), Key Contacts and Level 1 Users two weeks before MFA is enabled on their licence. 

MFA Rollout Now Being Conducted Through Activation Cohorts 

The Home Office has begun issuing MFA activation notices to sponsors as part of its phased onboarding process. Organizations are being assigned to activation cohorts and notified of the specific date on which MFA will be enabled for their licence. 

The Home Office advises sponsors to monitor SMS message board communications for any updates or changes to their activation schedule. MFA activation is generally scheduled outside business hours, with users required to complete MFA registration and authentication the next time they access SMS. 

Required Actions Before MFA Activation 

To ensure uninterrupted access to SMS, sponsors should review and update user details before MFA is enabled on their licence. 

Sponsors should confirm that the following information is accurate: 

• Email addresses for SMS users 
• Mobile telephone numbers for Level 1 users 
• Dates of birth for Level 1 users 

The Home Office has warned that incorrect or incomplete information could prevent users from successfully completing MFA setup or accessing SMS once MFA becomes mandatory. 

Sponsors should also review the MFA user guidance before activation and keep the instructions available when completing first-time registration and login.

Removal of Inactive SMS Accounts 

The Home Office has announced plans to remove inactive SMS user accounts from sponsor licences. 

Sponsors are encouraged to review and update user details within SMS to ensure key personnel maintain access and licence records remain accurate. 

Level 2 User Role Removal

Starting September 9, 2026, sponsors can no longer appoint new Level 2 users. Existing Level 2 users must either be upgraded to Level 1 status, where appropriate, or deactivated. These actions must be completed by March 8, 2027.

Sponsors should review current SMS user access rights and determine whether responsibilities should be reassigned to Level 1 users or other authorized personnel.

New Licence Activity Notifications

From September 9, 2026, Authorising Officers will receive email notifications for certain activities on their sponsor licence, including: 

• Changes to Level 1 User details 
• Addition of a new Level 1 User 
• Changes to the Authorising Officer email address 

Sponsors that assigned fewer than 1,000 CoS or CAS in 2025 will also receive notifications when CoS or CAS are assigned. 

Sponsor Action Items 

To prepare for MFA implementation and other system changes, sponsors should review their SMS records and ensure the following information is up to date: 

• Email addresses for key personnel 
• Mobile telephone numbers for Level 1 Users 
• Dates of birth for Level 1 Users 

The Home Office has also reminded sponsors to access SMS only through GOV.UK and remain vigilant against phishing attempts and other cyber scams. 

Insights from Antonio Lam 

Antonio Lam, Managing Director of Advisory and Strategic Services, notes:

The changes outlined form part of a broader effort by the Home Office to provide sponsors with tools to take ownership for their sponsor licence, particularly in relation to governance, security and user management.

It’s important that sponsors keep up to date with the latest changes, as compliance remains at the forefront of UKVI’s policy agenda and enforcement is becoming increasingly robust, and in some instances may lead to the revocation of sponsor licences.

With the removal of Level 2 users, sponsors should review their current list of Level 1 and Level 2 users, reassess access rights and consider whether responsibilities should be centralised among key personnel with full access or authorised representatives acting on their behalf.

One positive outcome of these changes is the increased visibility they provide to Authorising Officers (AOs), through enhanced notifications and alerts about activity on their sponsor licence. Larger organisations may need to consider the time commitment required for AOs to effectively monitor and review licence-related activity. As a result, this may be an appropriate opportunity to assess whether the current AO remains the most suitable senior individual to oversee these responsibilities going forward.

Sponsors should look out for emails from the Home Office confirming their cohort allocation, which will also include the date that MFA will be enabled on the Sponsor Management System (SMS).

Don’t Miss an Update

At Envoy Global, we combine smart, friendly legal teams with smart, friendly technology to facilitate immigration for companies and the global talent they depend on. Our holistic, proactive immigration services are built for accuracy and efficiency, always putting people first.

Reach out today to learn how we can support your company’s immigration needs.

IAA registration number F202000157