Employer

Sponsor Licence Update: Key Changes to the Sponsor Management System

Please see below a summary of the key changes to the Sponsor Management System (SMS) announced by the Home Office.

These changes will come into effect from September 2026.

1. Mandatory Multi-Factor Authentication (MFA)

From 3 September 2026, MFA will be introduced for existing Worker and Temporary Worker sponsors on a phased basis.

SMS users will need their usual login details plus a one-time passcode (OTP) sent by email or text message. Sponsors will be contacted two weeks before MFA is enabled on their licence.

2. Level 2 User Role Removed

From 9 September 2026, sponsors will no longer be able to appoint new Level 2 Users.

Existing Level 2 Users must be upgraded to Level 1 Users, where eligible, by 8 March 2027; or deactivated.

3. New Notifications for Authorising Officers

From 9 September 2026, Authorising Officers will receive email notifications about key activity on the sponsor licence, including changes to Level 1 Users and, for most sponsors, CoS/CAS assignments.

4. Inactive SMS Users

The Home Office intends to remove inactive SMS user accounts. Sponsors should log in to their SMS and ensure their user accounts remain up to date and active.

5. Increased Protection Against Cyber Fraud

Sponsors should be particularly vigilant about phishing attempts. The Home Office will not ask sponsors to provide SMS passwords, OTPs or personal information by email or telephone, and sponsors should access the SMS through GOV.UK rather than links contained in emails.

Sponsor Licence Holder Implications

Sponsors should review their SMS users and access arrangements ahead of these changes. Ensure contact details are up to date, Level 2 Users are reviewed, and Authorising Officers are prepared to receive and act on licence activity notifications.

These changes place greater emphasis on secure SMS access and oversight of sponsor licence activity. Sponsors should also ensure relevant staff are aware of the new MFA requirements and the risk of phishing attempts.

Disclaimer

This update is intended as a general guide and does not replace tailored legal advice. If you have questions on any of the topics above, please do not hesitate to contact us.

Frequently asked questions

Straight answers to the questions we hear most about this update.

What is changing in the Sponsor Management System (SMS) in September 2026?

+

The Home Office is introducing several changes to the Sponsor Management System (SMS) from September 2026, including mandatory multi-factor authentication (MFA), the removal of the Level 2 User role, new email notifications for Authorising Officers, and measures to remove inactive user accounts. These updates are intended to improve security and oversight of sponsor licence activity

What should sponsors do if they currently have Level 2 Users?

+

From 9 September 2026, sponsors will no longer be able to appoint new Level 2 Users. Existing Level 2 Users must either be upgraded to Level 1 Users, where eligible, or deactivated by 8 March 2027. Sponsors should review their SMS user structure as soon as possible to ensure continued compliance.

Will sponsors need to use multi-factor authentication to access the SMS?

+

Yes. From 3 September 2026, the Home Office will begin rolling out mandatory multi-factor authentication (MFA) for Worker and Temporary Worker sponsors. Users will need their standard login credentials plus a one-time passcode sent by email or text message. Sponsors will be notified before MFA is activated on their licence.