United Kingdom Home Office Announces Sponsor Management System Security and Compliance Changes

• The U.K. Home Office has updated sponsor guidance to introduce mandatory MFA for Sponsor Management System users, remove Level 2 user roles and implement new sponsor licence security measures beginning in September 2026. 

Sponsor Management System Security and Compliance Changes 

The United Kingdom (U.K.) Home Office has published updates to its sponsor guidance for Worker and Temporary Worker licence holders, introducing new security and compliance requirements for Sponsor Management System (SMS) users.  

The changes include mandatory multi-factor authentication (MFA), the removal of inactive SMS user accounts, the phase-out of Level 2 user roles and new licence activity notifications for Authorising Officers. 

While the changes currently apply to Worker and Temporary Worker sponsors, the Home Office has indicated that guidance for student sponsors will be updated separately.

Mandatory MFA Coming to SMS 

Beginning September 3, 2026, the Home Office will begin rolling out mandatory MFA for SMS users accessing sponsor licence accounts. 

Key dates include: 

• September 3, 2026: MFA rollout begins for Worker and Temporary Worker sponsors. 
• September 9, 2026: MFA automatically enabled for organizations granted a new sponsor licence. 
• Early November 2026: MFA rollout expected for Student sponsors, including multi-route licence holders. 

The Home Office will notify Authorising Officers, Key Contacts and Level 1 Users two weeks before MFA is enabled on their licence. 

Removal of Inactive SMS Accounts 

The Home Office has announced plans to remove inactive SMS user accounts from sponsor licences. 

Sponsors are encouraged to review and update user details within SMS to ensure key personnel maintain access and licence records remain accurate. 

Level 2 User Role Removal

Starting September 9, 2026, sponsors can no longer appoint new Level 2 users.

Sponsors must:

• Upgrade eligible existing Level 2 users to Level 1 users, or
  Deactivate those accounts.

Sponsors must complete these actions by March 8, 2027.

New Licence Activity Notifications 

From September 9, 2026, Authorising Officers will receive email notifications for certain activities on their sponsor licence, including: 

• Changes to Level 1 User details 
• Addition of a new Level 1 User 
• Changes to the Authorising Officer email address 

Sponsors that assigned fewer than 1,000 CoS or CAS in 2025 will also receive notifications when CoS or CAS are assigned. 

Sponsor Action Items 

To prepare for MFA implementation and other system changes, sponsors should review their SMS records and ensure the following information is up to date: 

• Email addresses for key personnel 
• Mobile telephone numbers for Level 1 Users 
• Dates of birth for Level 1 Users 

The Home Office has also reminded sponsors to access SMS only through GOV.UK and remain vigilant against phishing attempts and other cyber scams. 

Insights from Antonio Lam 

Antonio Lam, Managing Director of Advisory and Strategic Services, notes:

The changes outlined form part of a broader effort by the Home Office to ensure that sponsors take personal responsibility for their sponsor licence, particularly in relation to governance, security and user management. This reduces the ability for sponsors to take a “back-seat” approach. While these principles have always existed, they have not previously been enforced as rigorously. Collectively, these changes achieve most, if not all, of the Home Office’s objectives in this area. 

Sponsors should be aware that, while compliance remains at the forefront of UKVI’s policy agenda, enforcement is becoming increasingly robust. Failures in governance, security or compliance may now lead to a more heavy-handed approach by the Home Office, including the revocation of sponsor licences. 

From a practical and operational perspective, sponsors have often allowed Level 2 users, who have limited access rights, to manage certain aspects of their workforce within the SMS. This will now change. Sponsors should review their current list of Level 1 and Level 2 users, reassess access rights and consider whether responsibilities should be centralised among key personnel with full access or authorised representatives acting on their behalf. 

One positive outcome of these changes is the increased visibility provided to Authorising Officers (AOs) through enhanced notifications and alerts regarding activity on their sponsor licence. However, for larger organisations, this may result in AOs spending more time reviewing licence-related activities. Businesses may therefore wish to consider whether their current AO remains the most appropriate senior individual to fulfil these responsibilities going forward. 

Don’t Miss an Update

At Envoy Global, we combine smart, friendly legal teams with smart, friendly technology to facilitate immigration for companies and the global talent they depend on. Our holistic, proactive immigration services are built for accuracy and efficiency, always putting people first.

Reach out today to learn how we can support your company’s immigration needs.