The U.K. Home Office has begun rolling out mandatory multi-factor authentication (MFA) for Sponsor Management System (SMS) users as of today, 3 September 2026, alongside a phase-out of Level 2 user roles and new licence activity notifications for Authorising Officers. The changes apply to all Worker and Temporary Worker sponsor licence holders, with guidance for student sponsors to follow separately.
What Has Changed
The Home Office's updated sponsor guidance introduces four concrete changes to how licensed sponsors manage their SMS accounts:
- Mandatory MFA from 3 September 2026: SMS users must now enter a one-time passcode sent to their email or mobile alongside their username and password. Organisations granted a new sponsor licence from 9 September 2026 will have MFA automatically enabled.
- Level 2 user roles phased out: From 9 September 2026, sponsors can no longer appoint new Level 2 users. Existing Level 2 users must be upgraded to Level 1 or deactivated, with a compliance deadline of 8 March 2027.
- Inactive account removal: The Home Office will remove inactive SMS user accounts, so sponsors need to review and refresh user records to avoid losing access for key personnel.
- New activity notifications: From 9 September 2026, Authorising Officers will receive email alerts for changes to Level 1 User details, new Level 1 User additions, and changes to the Authorising Officer email address. Sponsors that assigned fewer than 1,000 Certificates of Sponsorship in 2025 will also be notified whenever a CoS or CAS is assigned.
The Home Office will notify Authorising Officers, Key Contacts and Level 1 Users two weeks before MFA is switched on for their licence, and has reminded sponsors to access SMS only through GOV.UK given the phishing risk around credential and OTP-based logins.
What This Means for HR and Mobility Teams
This is part of a broader tightening of sponsor licence governance. The Home Office revoked more than 3,000 sponsor licences in 2025, the highest annual total on record, and enforcement activity has continued to intensify through 2026. Sponsors who have historically delegated day-to-day SMS management to Level 2 users — a common setup in larger organisations — now need to centralise that access among Level 1 Users or authorised representatives before the March 2027 deadline.
The record-keeping burden also shifts upward: outdated contact details, missing mobile numbers, or unverified dates of birth for Level 1 Users will block MFA enrolment and could leave a licence holder locked out of SMS at a critical moment, such as mid-way through assigning a Certificate of Sponsorship for a new hire's start date.
Action Steps
- Audit current SMS user lists now — confirm who holds Level 1 versus Level 2 access, and whether Level 2 users need upgrading or deactivating.
- Update email addresses, mobile numbers and dates of birth for every Level 1 User to avoid MFA enrolment issues.
- Decide before 8 March 2027 who will hold centralised SMS access if Level 2 roles are being retired within your organisation.
- Brief Authorising Officers on the new activity notifications so licence-related alerts are reviewed rather than treated as routine email noise.
- Reconfirm that SMS is only ever accessed via GOV.UK, and flag the increased phishing risk around OTP requests to anyone with SMS access.
At xpath.global, our immigration advisory team tracks UK sponsor licence obligations as they change, including SMS governance requirements like this one, so your Authorising Officers and HR team stay compliant without having to monitor Home Office guidance updates themselves. [Speak to our UK immigration team.](https://xpath.global)
"Sources: Envoy Global — August 31, 2026"
