Home Office Updates Sponsor Guidance: What the New SMS Security Reforms Mean for UK Sponsors

The Home Office has released version 08/26 of the Workers and Temporary Workers sponsor guidance (Parts 1 and 3). While the substantive sponsorship duties remain unchanged, the updates introduce the most significant alterations to the Sponsor Management System (SMS) since the 2020 overhaul, focusing on security, user roles, and active licence management.

Mandatory Multi‑Factor Authentication

• Effective 3 September 2026, MFA is being phased in for all sponsor licences.
• New licences granted on or after 9 September 2026 will have MFA enabled automatically.
• The Home Office expects MFA to be mandatory for every sponsor by November 2026.
• Users must combine their username/password with a one‑time passcode delivered by text or email.
• If a Level 1 user cannot receive a text code, they may use the email option or amend the registered mobile number after identity verification (date of birth, etc.).
• Sharing passwords or MFA codes is prohibited and may lead to licence revocation.

Phased Withdrawal of the Level 2 User Role

• From 9 September 2026 sponsors cannot appoint new Level 2 users.
• Existing Level 2 accounts may remain temporarily but must be dealt with by 8 March 2027:
  • Convert eligible users to Level 1, or
  • Deactivate the account.
• Conversion is only possible when the individual meets Level 1 eligibility (e.g., in‑house staff). Temporary agency staff, outsourced HR providers, or immigration representatives are ineligible.
• The removal concentrates sponsorship responsibilities in fewer, higher‑level users, prompting a review of internal authorisation, segregation of duties, and succession planning.

Inactive SMS Accounts and Active Licence Management

• An SMS user is deemed inactive after 12 months of no login.
• The Home Office will notify the Authorising Officer and the inactive user; the user then has three months to log in and update details before deactivation.
• The Home Office recommends Level 1 users log into the SMS at least once a month to keep information current and to spot Home Office messages promptly.
• Failure to maintain an active Level 1 user triggers licence suspension, with 28 days to nominate a replacement. If no eligible Level 1 user can be appointed, the sponsor may request a new user via the Home Office change‑of‑circumstances form.

Clarification on Licence Revocation

• Revocation that results solely from the inactive‑account process will not invoke the enhanced cooling‑off provisions that apply to substantive compliance breaches.
• Consequently, a sponsor whose licence is revoked for administrative SMS failures does not face the same restrictions on submitting a fresh licence application as a sponsor revoked for immigration‑law violations.

Practical Steps for Sponsors

1. Audit current SMS users – verify contact details, role eligibility, and recent login activity.
2. Upgrade or replace Level 2 users – assess who can meet Level 1 criteria and convert where possible before the 8 March 2027 deadline.
3. Implement MFA – ensure all authorised users have access to a reliable second‑factor method (mobile phone or email) and understand the procedure for changing numbers.
4. Establish regular access routines – schedule monthly logins for Level 1 users to review licence status, certificates of sponsorship, and Home Office communications.
5. Document oversight – the Authorising Officer should maintain records of user activity and periodic checks, reinforcing internal governance.
6. Plan for succession – identify backup Level 1 users and define clear handover processes to avoid gaps in SMS access.

Frequently Asked Questions

• Is MFA already compulsory for every sponsor licence holder?
  No. It is being phased in from 3 September 2026, with full coverage expected by November 2026. New licences after 9 September 2026 will have MFA enabled automatically.

• What if a Level 1 user loses the phone used for SMS authentication?
  The user can switch to email authentication or update the registered mobile number after completing identity checks.

• Can SMS passwords or MFA codes be shared with colleagues?
  No. Each user must keep credentials personal; sharing may lead to licence revocation.

• When does an SMS user account become inactive?
  After 12 months of no login. The user then has three months to react before deactivation.

• How often should a Level 1 user log into the SMS?
  At least once a month is recommended.

• What happens if the inactive‑account process leaves a sponsor with no active Level 1 user?
  The licence is suspended; the sponsor has 28 days to nominate an eligible Level 1 user, otherwise revocation follows.

• When will existing Level 2 accounts stop working?
  All Level 2 accounts must be dealt with by 8 March 2027; after that date any remaining Level 2 accounts will be deactivated.

• Can every existing Level 2 user be converted to Level 1?
  No. Only those who meet Level 1 eligibility can be upgraded; temporary staff supplied by employment agencies are excluded.

• What responsibilities does the Authorising Officer have for SMS security?
  The Officer remains accountable for all SMS user activity and should monitor certificate assignments and other actions at least monthly.

Source article: immigrationbarrister.co.uk