If your business holds a UK sponsor licence, there is an important change you need to know about.
The Home Office has introduced new rules affecting how sponsors access and manage the Sponsor Management System (SMS). These changes are contained in version 08/26 of the Workers and Temporary Workers sponsor guidance, published in August 2026. The new rules cover mandatory multi-factor authentication, the phasing out of Level 2 Users and a new process for inactive SMS User accounts.
And there is one point that sponsors should pay particular attention to:
If your SMS users do not access and manage the account properly, your sponsor licence could be put at risk.
So, if you are an employer with sponsored workers, this is not something to leave until your next Certificate of Sponsorship application.
What is changing for UK sponsor licence holders?
The Sponsor Management System is an important part of running a sponsor licence. It is where authorised users carry out key sponsorship activities, including assigning Certificates of Sponsorship, reporting changes and managing certain licence details.
The latest Home Office guidance introduces three major changes:
- Mandatory multi-factor authentication for SMS Users
- The removal of the Level 2 User role
- A new process for inactive SMS User accounts
The Home Office has also made clear that sponsors should access their SMS account regularly, keep user details up to date and actively manage their authorised users.
Let’s look at what this means for your business.
1. Mandatory MFA for SMS Users
From 3 September 2026, the Home Office began rolling out mandatory multi-factor authentication (MFA) for SMS Users. The rollout is expected to cover all sponsors by November 2026.
In simple terms, your username and password will no longer be the only step involved in accessing an MFA-enabled SMS account.
A user will also need to enter a one-time passcode.
For Level 1 Users, the passcode can be sent to their registered mobile phone by text message. Where a Level 1 User does not have a valid mobile number, or for a Level 2 User, the code can be sent to the registered email address.
Why should you care about this?
Imagine that your company’s only SMS User is your HR manager.
That person leaves the business.
Or their phone number changes.
Or they lose access to the device they use for authentication.
You could suddenly have a practical problem accessing the system.
That matters because SMS access is used for important sponsorship functions, including assigning Certificates of Sponsorship and reporting worker activity.
The solution is not simply to give more people access.
You need to make sure the right people have appropriate access, their details are accurate and there is a sensible continuity plan if a key person leaves.
2. The Level 2 User role is being phased out
If your business has relied on Level 2 Users for years, this is another change you need to understand.
From 9 September 2026, sponsors can no longer appoint new Level 2 Users. Existing Level 2 Users can remain temporarily, but sponsors must either convert them to Level 1 Users where they meet the requirements or deactivate their accounts.
There is also an important deadline.
Existing Level 2 Users must be dealt with by 8 March 2027.
After that date, the Home Office will deactivate any remaining Level 2 User accounts.
What does this mean for your HR team?
If you currently have several Level 2 Users, don’t wait until March 2027.
Start reviewing your user structure now.
Ask yourself:
- Who currently has Level 1 access?
- Who currently has Level 2 access?
- Which Level 2 Users still need SMS access?
- Who is eligible to become a Level 1 User?
- Which users have left the business?
- Does your business have enough trained people to manage the licence?
This is particularly important for businesses that have outsourced some HR functions or use external representatives.
The Home Office guidance also makes clear that sponsors remain responsible for activities carried out by their SMS Users, including relevant users from outside the organisation.
3. Your SMS account should not simply sit unused
This is perhaps the biggest practical change for sponsors.
The Home Office now specifically requires SMS Users to access their accounts regularly and keep their details up to date.
The guidance recommends that a Level 1 User accesses the SMS account at least once a month. It also warns that users may be deactivated and the sponsor licence could be at risk if SMS Users fail to access their account regularly.
So, think about how your business currently manages its sponsor licence.
Do you only log into the SMS when you need to assign a CoS?
If so, it may be time to change that approach.
The SMS should be treated as an active part of your sponsor compliance system rather than a portal you visit only when something needs to be submitted.
Can an inactive SMS account lead to sponsor licence revocation?
Yes, the new guidance introduces a process under which inactive SMS User accounts can be deactivated, and a sponsor licence can be at risk if the sponsor does not take the required action to maintain active users.
However, there is an important distinction.
The Home Office has specifically updated its guidance to state that where a sponsor licence is revoked solely because of the inactive SMS User account process, the cooling-off period will not apply.
That is significant because it distinguishes this particular situation from other forms of sponsor non-compliance.
It does not, however, mean that sponsors can ignore their SMS accounts.
The safest approach is to make sure your user structure and access arrangements are actively managed before the issue arises.
Your SMS access is now part of your compliance strategy
For many employers, SMS management has traditionally been seen as an administrative responsibility.
But consider what happens through the system.
Your authorised users may be responsible for:
- Assigning Certificates of Sponsorship
- Reporting sponsored worker activity
- Managing SMS users
- Updating licence information
- Requesting changes to the licence
- Accessing Home Office messages
- Managing other sponsorship functions
The Home Office guidance confirms that Level 1 Users undertake these day-to-day sponsorship activities through the SMS.
That means your internal controls around SMS access can have a direct impact on your ability to manage your sponsor licence.
What should your business do now?
You don’t need to wait for a problem.
A practical SMS compliance review should start with five simple checks.
1. Review all SMS Users
Look at everyone currently listed on your licence.
Do they still work for your organisation?
Do they still need access?
Are they still suitable for their role?
2. Check contact details
Make sure the registered email addresses, telephone numbers and other relevant details are accurate.
This is particularly important now that MFA is being introduced.
3. Review your Level 2 Users
If you have existing Level 2 Users, decide whether they should be converted to Level 1 Users or have their accounts deactivated.
Remember the 8 March 2027 deadline.
4. Don’t rely on one person
Consider what would happen if your only SMS User left tomorrow.
Could another trained person manage the sponsor licence?
Would your business still be able to carry out important sponsorship functions?
Good succession planning can help prevent an avoidable operational problem.
5. Make regular SMS checks part of your compliance routine
The Home Office recommends that a Level 1 User accesses the SMS at least once a month.
Use those regular checks to review messages, user details and licence information.
A small administrative issue can create a much bigger problem
Imagine you have a sponsored worker whose circumstances have changed and you need to make a report.
Your HR manager is the only person who can access the SMS.
They have left the company.
Nobody else knows the login details or has completed the necessary MFA setup.
What started as an internal staffing change could quickly become a sponsorship management problem.
That is why access, responsibility and succession planning should be considered when reviewing your sponsor licence compliance arrangements.
What does this mean for employers with sponsored workers?
The message from the latest guidance is fairly straightforward:
Having a sponsor licence is not a one-time approval. It comes with ongoing responsibilities.
You need to maintain appropriate Key Personnel, manage your SMS Users and ensure that your organisation can continue carrying out its sponsorship duties.
The latest SMS changes make this even more important.
If you haven’t reviewed your SMS users recently, now is a sensible time to do it.
How CSR Law can help?
If you hold a UK sponsor licence and are unsure whether your current SMS structure is ready for these changes, CSR Law can review your arrangements and help you identify potential compliance issues.
This can include reviewing:
- SMS User structure
- Level 1 and Level 2 User arrangements
- MFA readiness
- User contact details
- Former employee access
- Internal responsibility for sponsor management
- Succession and continuity arrangements
- Wider sponsor licence compliance procedures
The aim is simple: make sure your sponsor licence management does not depend on assumptions or one person’s access.
If you need help reviewing your sponsor licence and SMS arrangements, contact CSR Law.
Phone: +44 7586 980156
Email: info@csrlaw.co.uk
Website: csrlaw.co.uk
*General information only. This article is not legal advice.