The Home Office is introducing mandatory multi-factor authentication (MFA) for users of the Sponsorship Management System (SMS), with the phased rollout beginning on 3 September 2026.
For employers with a sponsor licence, this means SMS users will need an additional verification step when logging in. Sponsors should check their account details now to reduce the risk of access problems once MFA is enabled.
What's changed?
The Home Office has published a new SMS Manual 13 explaining how MFA will work.
Once MFA is enabled, SMS users will enter a one-time passcode alongside their usual username and password. The additional security measure is intended to protect sponsor accounts from unauthorised access if login details are compromised.
Existing sponsors are being moved to MFA in phases from September 2026. Organisations granted a new sponsor licence on or after 9 September 2026 will have MFA enabled automatically.
The Home Office will contact an organisation’s Authorising Officer, Key Contact and Level 1 users before MFA is activated on their licence.
What do sponsors need to check?
Sponsors should make sure the details held on the SMS are accurate before MFA is enabled. They should check:
- email addresses for key personnel
- mobile telephone numbers for Level 1 users
- dates of birth for Level 1 users
Incorrect or incomplete information could make it difficult for users to complete MFA registration or access the SMS.
Sponsors should also review who currently has access to their account and remove users who no longer need it.
What's happening to Level 2 users?
From 9 September 2026, sponsors will no longer be able to appoint new Level 2 users.
Existing Level 2 users will need to be upgraded to Level 1, where eligible, or have their accounts deactivated by 8 March 2027.
The Home Office has also said it intends to remove inactive SMS user accounts, making it particularly important for sponsors to keep their user information under review.
What should employers do now?
Sponsors should:
- make sure the details held for the Authorising Officer, Key Contact and SMS users are current
- check Level 1 users’ mobile numbers, email addresses and dates of birth
- review whether everyone with SMS access still needs it
- identify any Level 2 users who will need to be upgraded or removed
- make sure relevant staff understand the new MFA login process
- read SMS Manual 13 before MFA is enabled
- remind SMS users how to recognise phishing attempts.
The Home Office has specifically warned sponsors to access the SMS through GOV.UK rather than links received by email. It will not ask users to provide their password, user ID or OTP outside the SMS or send an unsolicited OTP.
Taking these steps now should help avoid access issues and ensure responsibility for the sponsor licence remains clear within the business.
If you’d like reassurance that your sponsor licence arrangements are up to date, our business immigration solicitors can review your SMS users and compliance processes and help identify any areas that may need attention.
Related articles
How can we help?
To access legal support from just £159 per hour arrange your no-obligation consultation today. We aim to respond to all messages received within 24 hours.
