Mandatory MFA for SMS users: What UK sponsors need to do now

The Home Office is introducing mandatory multi-factor authentication (MFA) for Sponsorship Management System (SMS) users to improve sponsor licence security and reduce the risk of unauthorised access.

For anyone holding a UK sponsor licence, the changes are also a timely opportunity to review SMS user access, key personnel arrangements and sponsor licence records. Taking action now can help prevent access issues and support ongoing sponsor licence compliance.

When will MFA for SMS users be introduced?

The Home Office is rolling out MFA in stages:

• 3 September 2026: MFA rollout begins for Worker and Temporary Worker sponsors
• 9 September 2026: Sponsors can no longer appoint new Level 2 Users
• Early November 2026: MFA expected to be introduced for Student sponsors, including organisations holding both Worker and Student licences

What is changing?

MFA adds a layer of security when users access the SMS. Users will need to complete an additional authentication step using a one-time passcode sent to their registered email address or mobile number.

This makes it particularly important that user information is accurate and accessible. Outdated details could prevent users from accessing the SMS and affect activities such as assigning Certificates of Sponsorship (CoS) and meeting reporting obligations.

Check your Authorising Officer details

Make sure your Authorising Officer (AO) is still the appropriate person and that their email address is current, accessible and regularly monitored.

The Home Office uses SMS contact details to send important notifications. If emails sent to your AO are returned undelivered, this may indicate that your sponsor licence records are out of date and could prompt UKVI to review your contact information.

If your AO has left your organisation, changed roles or is no longer appropriate for the position, you should update your sponsor licence records.

Review your SMS users

Sponsors should review all individuals with access to their SMS account, checking their details and removing anyone who no longer requires access.

For Level 1 Users, check that their:

• Email address is correct and accessible
• Mobile number is accurate
• Date of birth is correctly recorded

For Level 2 Users, check that their registered email address is current and accessible.

You should also ensure that at least one active Level 1 User remains available to manage the sponsor licence.

Review your Level 2 User arrangements

From 9 September 2026, sponsors will no longer be able to appoint new Level 2 Users.

If your organisation relies on Level 2 Users, now is the time to review your arrangements. Consider whether eligible users should become Level 1 Users, whether any users should be removed, and whether your current allocation of sponsorship responsibilities remains appropriate.

This is particularly relevant for larger employers, schools and universities where sponsorship responsibilities may be shared across HR, recruitment and international student teams.

Follow SMS security best practice

MFA does not remove the need for good account security. SMS users should:

• Access the SMS directly through GOV.UK rather than via links in emails
• Never share their password or user ID
• Never disclose personal information such as their date of birth
• Use their own individual SMS account
• Be alert to phishing emails claiming to be from the Home Office

Sponsors should be particularly cautious of messages that use urgent compliance warnings or the introduction of MFA to encourage users to click a link or provide their login details.

What should sponsors do now?

Before MFA is introduced, we recommend that sponsors:

• Check your AO: Confirm that they are still the appropriate individual and that their contact details are accurate and monitored.
• Review SMS users: Check all Level 1 and Level 2 User details and remove anyone who no longer requires access.
• Check contact details: Make sure users can access their registered email address and mobile number.
• Review Level 2 Users: Consider whether existing arrangements remain appropriate before new appointments are restricted.
• Prepare for MFA: Make sure users are ready to complete the MFA process when prompted.

Need help reviewing your sponsor licence?

Keeping your sponsor licence compliant requires ongoing management, not just preparation for a Home Office compliance visit.

Our immigration specialists can help you review your AO, SMS user access, key personnel and sponsorship processes, helping you identify potential gaps before they become compliance issues.

We can help you make sure your sponsor licence is ready for the changes and that your sponsorship processes remain compliant. Email us at [email protected] or call +44 20 7759 5316.