In this blog, Alex Christen and Seán Davies discuss key recent changes to the Sponsorship Guidance, mainly around use of the Sponsor Management System (SMS) introduced by the Home Office in August 2026, including the introduction of mandatory multi-factor authentication (MFA), the further phasing out of Level 2 Users and new requirements around regular SMS access.
Mandatory multi-factor authentication
Mandatory MFA for access to the SMS began being rolled out on a phased basis from the 3rd of September 2026, following a voluntary trial running since November 2025. The Home Office expects MFA to be in place for all sponsors by November 2026. It will also be automatically enabled for organisations granted a sponsor licence on or after the 9th of September 2026.
Once enabled, SMS Users will need to enter a one-time passcode each time they log in to the SMS, alongside their username and password. For Level 1 Users with a valid mobile number, this will be sent by text message. Level 1 Users without a valid mobile number, and existing Level 2 Users, will receive the passcode by email.
Sponsors should therefore ensure that SMS Users’ contact details are accurate and up to date, including their email address, mobile number and, for Level 1 Users, date of birth recorded on the system.
A new SMS manual (Multi-factor authentication for UK visa sponsors: SMS manual 13) has been added to the SMS User Manual suite and contains helpful information for those using MFA for the first time including how to update stored mobile phone and email addresses and a troubleshooting guide.
Level 2 Users are being phased out
Level 2 Users have long featured in sponsor management, having fewer permissions than Level 1 Users. Their limited functions meant sponsors could delegate certain tasks that required access to the SMS without allowing full access. Likely in line with the Home Office’s tightening of security protocols, this position is being phased out.
The removal of Level 2 Users is not entirely new. The May 2026 guidance confirmed that the Home Office had already begun phasing them out for a limited number of Government Authorised Exchange sponsors in October 2024, but most sponsors did not need to take action at that stage.
That has now changed. From the 9th of September 2026, sponsors can no longer appoint new Level 2 Users to their licence. Existing Level 2 Users must either be converted to Level 1 Users, where they satisfy the relevant eligibility requirements and continued access is required, or have their accounts deactivated. Sponsors have until the 8th of March 2027 to take this action, after which the Home Office will deactivate any remaining Level 2 accounts.
Sponsors should therefore review their Level 2 Users now and decide who genuinely needs continued SMS access.
Particular care should be taken where temporary staff supplied by an employment business currently act as Level 2 Users. Such individuals are not eligible to be converted to Level 1 Users, meaning their accounts will need to be deactivated by the deadline and additional Level 1 Users from within the business sourced, if needed.
Regular SMS access now carries greater weight
The Home Office has long recommended that a Level 1 User log into the SMS at least once a month.
The August guidance goes further by expressly requiring SMS Users, as part of the general Key Personnel requirements and eligibility criteria, to access their account regularly and keep their details up to date.
A new inactive-user process has also been introduced for accounts which have not been accessed for 12 months or more. Inactive accounts may ultimately be deactivated and, if this leaves a sponsor without an active Level 1 User, its licence may be suspended and, if the position is not remedied within 28 days, normally revoked.
Sponsors should therefore build regular SMS checks into their compliance processes rather than treating access as an occasional administrative task.
What should sponsors do now?
Sponsors should ensure their SMS User details are up to date, review their Level 2 Users, maintain adequate Level 1 User coverage and introduce a regular SMS review process.
The overall direction is clear: the Home Office is placing greater emphasis on security, active management of SMS accounts and individual accountability. Sponsors should therefore ensure that SMS management forms part of their ongoing compliance processes.
If you have concerns about how these changes may affect your sponsor licence or compliance obligations, please feel free to contact our Employment & Immigration team today.
Alex Christen
Partner
Business Immigration, Employment, Employment Investigations, Equality & Diversity, International
Alex is a Partner in our Employment and Immigration team. Alex leads the business immigration team, successfully supporting companies and individuals with immigration issues, including understandin... Read More
Seán is a Trainee Solicitor in the Employment & Immigration team. Seán studied both Politics & International Relations and LLB Law at the University of Birmingham, before going on to complete the... Read More
