15 September 2026

The Home Office is rolling out mandatory multi-factor authentication for users of the Sponsorship Management System. Sponsors should prepare now to protect access to their accounts and minimise disruption to sponsorship activity.

The change forms part of a phased programme to strengthen the security of sponsor accounts. It affects organisations that use the Sponsorship Management System (SMS) to manage their sponsor licence and sponsored workers.

What is changing?

Once MFA is enabled for a sponsor licence, SMS users will need to complete an additional verification step each time they log in. After entering their usual credentials, the user will receive a one-time passcode (OTP) by mobile phone or email. The user must enter that code in the SMS to confirm their identity.

The Home Office is introducing MFA in phases. Sponsors should receive their allocated onboarding date by email and through notifications on the SMS message board.

Home Office guidance states that users must not share OTPs with anyone, including colleagues. Sharing an OTP may place the sponsor licence at risk of revocation.

When will MFA be introduced?

The rollout began on 3 September 2026 and is being applied to sponsor accounts in phases. We understand that the next cohort is expected to receive MFA functionality from 17 September 2026; sponsors in that cohort should have been contacted directly. The Home Office intends all Level 1 User accounts to have MFA by November 2026.

What should sponsors do now?

Incorrect or incomplete user information may prevent an individual from completing the MFA process or accessing the SMS. Sponsors should therefore check that the details held for every active user are accurate and complete.

Before MFA is enabled for their licence, Level 1 Users should take the following steps. For some sponsors in the next cohort, the relevant deadline will be 18 September 2026:

• log in to the SMS and check that each Level 1 User’s email address, mobile telephone number and date of birth are accurate and up to date;
• identify inactive users and consider whether additional Level 1 Users should be appointed;
• make sure key personnel understand the MFA registration and login process;
• monitor SMS message board notifications for further information about rollout dates and implementation; and
• ask Level 1 Users to access the SMS regularly so that they remain familiar with the system and reduce the risk of account deactivation.

Inactive Level 1 User accounts

The Home Office has also said that Level 1 User accounts that remain inactive for 12 months should be deactivated. It should notify both the Authorising Officer recorded on the licence and the inactive Level 1 User. The user will then have three months to log in and check or update their details before the account is deactivated.

If deactivation leaves a sponsor with no active Level 1 Users, the sponsor licence will be suspended. The sponsor will have 28 days to nominate an eligible replacement. If no replacement is added, the licence is likely to be revoked.

Sponsors with only one Level 1 User, or a small number of users, should pay particular attention to this risk. Authorised users should log in regularly and keep their account details current.

What has happened to Level 2 Users?

From 9 September 2026, the Home Office has phased out the Level 2 User role, which offered fewer permissions and less SMS functionality than the Level 1 User role. Sponsors should review former Level 2 Users, decide whether they still require access and, where appropriate, appoint them as Level 1 Users.

Cybersecurity reminder

Sponsors should remain alert to phishing attempts and cyber scams. The SMS should be accessed only through GOV.UK. Users should treat with caution any email or message asking for SMS login credentials, OTPs or other personal information.

How we can help

Laura Devine Immigration can assist sponsors with reviewing their SMS user arrangements, updating key personnel and assessing how the MFA changes may affect their licence. For advice, please contact your assigned LDI lawyer or email our Enquiries team at enquiries@lauradevine.com.