The Home Office is introducing a significant security change to the Sponsor Management System (SMS). From 3 September 2026, the Home Office will begin a phased rollout of mandatory Multi-Factor Authentication (MFA) for SMS users. The rollout is expected to extend to all work-route sponsors by November 2026.
Sponsors should take action now to ensure that their SMS users can continue to access the system and that there is no disruption to their sponsorship activities.
What is changing?
The SMS is the online system through which licensed sponsors manage their sponsor licence and undertake key sponsorship functions. This includes assigning Certificates of Sponsorship (CoS), reporting changes in sponsored workers’ circumstances, reporting changes to the organisation and managing the sponsor licence.
At present, SMS users primarily access the system using their user ID and password. The Home Office is introducing MFA as an additional security measure designed to reduce the risk of unauthorised access, particularly following an increase in phishing attacks targeting sponsor licence holders.
Once MFA is enabled for a sponsor, users will need to complete an additional verification step when logging in. This will involve a one-time passcode (OTP) in addition to the existing login requirements.
The Home Office’s rollout will be phased. Sponsors should therefore pay close attention to communications from UKVI confirming when MFA will be activated for their particular licence.
For work-route sponsors, the first scheduled implementation is expected to take place after business hours on 3 September 2026, meaning MFA-enabled logins may be required from 4 September 2026.
Why does this matter to sponsors?
Although MFA is primarily a security enhancement, it has important practical implications for sponsor compliance.
Access to the SMS is essential to the day-to-day management of a sponsor licence. For example, a sponsor may need to access the system to:
- assign a CoS to a sponsored worker;
- request or manage CoS allocations;
- report a sponsored worker’s change of circumstances;
- report the departure of a sponsored worker;
- report changes to the sponsor’s organisation or key personnel;
- manage the sponsor licence; and
- respond to Home Office requests or other sponsorship-related matters.
The Home Office’s sponsor guidance makes clear that SMS users are responsible for carrying out important sponsorship functions through the system.
A sponsor that loses access to its SMS account could therefore face practical difficulties in complying with its reporting and sponsorship obligations. This is particularly important where a sponsor has imminent CoS requirements, sponsored workers approaching visa expiry or reporting deadlines.
From 3 September 2026, the Home Office will begin a phased rollout of mandatory Multi-Factor Authentication (MFA) for SMS users.
Sponsors should check their SMS records now
The most important immediate action is to ensure that the information held on the SMS for users is accurate and up to date.
Sponsors should review, in particular:
-
Level 1 User details
Level 1 Users have responsibility for the day-to-day management of the sponsor licence and have significant access to the SMS. Sponsors should check that the relevant user’s:
full name;
date of birth;
email address; and
mobile telephone number
are accurate.
This is particularly important because the MFA verification process relies on the contact information recorded against the SMS user.
-
Level 2 Users
Sponsors should also review their Level 2 Users and consider whether each person still requires access.
The Home Office has indicated that, once the new MFA functionality is implemented, sponsors will no longer be able to add new Level 2 Users, although Level 1 Users can continue to be added where appropriate.
Sponsors who currently rely on Level 2 Users should therefore consider whether any individuals should instead be appointed as Level 1 Users before MFA is introduced, subject to the relevant eligibility requirements.
-
Former employees and inactive users
Sponsors should review who currently has access to the SMS and remove users who no longer require access.
This is particularly important where there has been:
- staff turnover;
- restructuring;
- a change in the HR or immigration team;
- a change of Authorising Officer or Key Contact; or
- a change in the external advisers managing the sponsor licence.
The Home Office’s best-practice guidance emphasises the importance of regularly reviewing SMS users and deactivating users who no longer require access.
Do not share SMS login details
The introduction of MFA does not change the fundamental requirement that SMS credentials must be kept secure.
Sponsors should continue to follow the Home Office’s security guidance, including the principle of one user, one SMS account. SMS passwords and user IDs should not be shared.
The sponsor guidance expressly states that SMS users must not give their password to anyone else and that failure to maintain appropriate security can have serious consequences for the sponsor licence.
Businesses should also be particularly cautious about phishing emails.
The Home Office has warned sponsors about fraudulent emails purporting to come from UKVI and directing users to log into the SMS. Sponsors should not click links in emails purporting to provide access to the SMS. Instead, users should access the SMS through the official GOV.UK route.
The Home Office has confirmed that it will not ask users for their SMS password, user ID or date of birth by email, nor send an email containing a link to log into the SMS.
What should sponsors do?
We recommend that all sponsor licence holders undertake an SMS security and access review before MFA is activated.
Sponsor checklist
Before your MFA activation date:
- Log into the SMS and check that your user details are correct.
- Check the date of birth, email address and mobile number recorded for each Level 1 User.
- Check the email addresses recorded for Level 2 Users.
- Review all current SMS users.
- Remove former employees or anyone who no longer requires access.
- Consider whether any Level 2 Users should become Level 1 Users before the new functionality is implemented.
- Ensure there is sufficient internal cover so that the business does not depend on a single individual to manage the sponsor licence.
- Make sure relevant HR, legal and immigration personnel understand the new login requirements.
- Ensure users know how to identify phishing emails and understand that the SMS should be accessed through GOV.UK rather than through links contained in emails.
- Review any sponsorship deadlines or outstanding SMS actions that may need to be completed around the MFA implementation date.
What if the information on the SMS is incorrect?
Sponsors should not wait until MFA is activated to discover that an SMS user’s mobile number or email address is no longer current.
If a key person has left the business or their details have changed, the sponsor should consider whether a formal change of circumstances notification is required.
The sponsor guidance requires sponsors to notify UKVI of relevant changes to key personnel, including replacing or amending details for an Authorising Officer, Key Contact or Level 1 User.
This is therefore an opportunity for sponsors to undertake a wider review of their sponsor licence governance rather than treating MFA as simply an IT issue.
MFA is an important compliance issue, not just an IT change
The introduction of MFA should be welcomed as an additional safeguard against unauthorised access to sponsor accounts. However, sponsors should recognise that security and immigration compliance are closely connected.
The SMS contains information that is central to the sponsor’s immigration operations. Unauthorised access could potentially allow inappropriate sponsorship activity to take place, while legitimate users being unable to access the system could prevent the sponsor from completing time-sensitive actions.
Sponsors should therefore incorporate SMS access into their wider sponsorship compliance procedures.
In particular, businesses should have clear processes for:
- identifying who is responsible for the SMS;
- ensuring that there is appropriate cover during periods of annual leave or absence;
- removing access promptly when an employee leaves;
- recording changes to key personnel;
- monitoring sponsorship reporting deadlines; and
- escalating any suspected compromise of the SMS account.
What happens next?
The Home Office’s MFA rollout will be phased. Sponsors should monitor communications from UKVI and follow the specific instructions provided for their sponsor licence.
The Home Office is also expected to provide further guidance explaining the MFA registration process, troubleshooting and support arrangements as sponsors are brought onto the new system.
If a sponsor experiences a technical problem or believes that its SMS account may have been compromised, the Home Office Business Helpdesk can assist with SMS-related issues, including technical problems and suspected phishing or account compromise.
Key takeaway for sponsors
Sponsors should not wait for MFA to be activated before reviewing their SMS access.
A simple review of users and contact details now can significantly reduce the risk of being locked out of the system when MFA becomes mandatory.
For businesses that regularly sponsor workers, this is also a useful opportunity to review wider SMS governance and ensure that responsibility for the sponsor licence does not rest with a single individual.
Clarkslegal’s Business Immigration team can assist sponsors with reviewing their sponsor licence, SMS users and sponsorship compliance arrangements ahead of the introduction of MFA.
