The UK Home Office has introduced a mandatory multi-factor authentication (MFA) for all users accessing the Sponsorship Management System (SMS) – the platform used by organisations to manage their sponsor licence and sponsorship activities in respect of their visa holder employees.
MFA adds an extra layer of security by requiring users to verify their identity using a one-time passcode (OTP), sent by text message or email, in addition to their existing username and password, each time they log in. The change is designed to protect accounts from unauthorised access, even where a password has been compromised.
Alongside the introduction of MFA, the Home Office has announced two further changes:
- the planned deactivation of inactive SMS user accounts (meaning no logins for 12 months or more); and
- the removal of the Level 2 user role.
From 9 September 2026, sponsors are no longer able to appoint Level 2 users (who had more limited access to the SMS than Level 1 users), and existing Level 2 users must be upgraded to Level 1 (if eligible) by 8 March 2027, failing which their accounts will be deactivated. Additionally, from 9 September 2026, the Home Office has introduced email notifications to Authorising Officers to alert them to key activities on sponsor licences.
Timeline for the changes
- 3 September 2026 – The phased onboarding of existing sponsors to MFA system began, starting with Worker and Temporary Worker licence holders.
- 9 September 2026 – Organisations granted a new sponsor licence of any type on or after this date will automatically have MFA enabled. This is also the date from which the Level 2 user role was discontinued for new appointments and licence activity notifications are introduced.
- 8 March 2027 – Deadline for all existing Level 2 users to be upgraded to Level 1 users (if eligible) or have their accounts deactivated.
The Home Office will contact each sponsor's Authorising Officer, Key Contact, and Level 1 User(s) by email approximately two weeks before MFA is enabled on their specific licence. That notification will confirm the date on which MFA will take effect for that organisation and set out the actions that must be taken before that date.
It is important to note that the precise date on which MFA is enabled will vary from sponsor to sponsor within the phased rollout. The relevant date notified to each sponsor is specific to that sponsor's onboarding phase and do not apply universally to all sponsors. Each sponsor should act on the dates confirmed in its own notification email from the Home Office.
Steps required by all SMS users now
Regardless of the date on which MFA is enabled on a particular licence, all sponsors and their SMS users should take the following steps as soon as possible:
- Read the MFA user guide – Familiarise yourself with the Home Office user manual regarding the MFA.
- Log into the SMS and check that all user details are correct – In particular, ensure that the following information is up to date for all relevant users:
-
- email addresses for all key personnel;
- mobile telephone numbers for MFA purposes (Level 1 users only); and
- dates of birth (Level 1 users only).
- Correct any inaccurate details promptly – If the above details are incomplete or incorrect, users may experience delays in receiving key information and difficulties logging into SMS once MFA is enabled. Note that Level 2 users cannot amend their own email addresses and a Level 1 user must make these changes on their behalf. If a date of birth is incorrect on SMS, a Sponsor Change of Circumstances form must be completed and submitted to the Home Office.
- Review Level 2 user accounts – Identify any existing Level 2 users and take steps to upgrade them to Level 1 users (if eligible) at the earliest opportunity to ensure they maintain access to SMS. This must be completed by 8 March 2027 at the latest.
- Monitor communications from the Home Office – Look out for notification emails confirming the specific date on which MFA will be enabled for your licence. Once received, ensure all preparatory steps are completed before that date.
- Be vigilant against phishing and cyber scams – Always access SMS through the GOV.UK website, and never via links sent by email. The Home Office will never send you a link to the SMS login page, ask you to provide your user ID, password, OTP, or personal information outside SMS, or send you an OTP that you have not requested. If you receive a suspicious communication or believe your SMS account has been compromised, contact the Business Helpdesk at BusinessHelpdesk@homeoffice.gov.uk.
Macfarlanes is a pre-eminent law firm advising a global client base across Private Capital, Private Wealth, M&A and Disputes.
Visit our website to learn more about our services and how we can assist.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
