Changes to Level 2 SMS user rules in 2027
Following changes announced by the Home Office in early September 2026, sponsors have been unable to appoint new Level 2 users. Existing Level 2 users can continue to access the Sponsor Management System (SMS) during a fixed transitional period, but the latest Home Office guidance confirms that their access will end after 8 March 2027.
Before then, sponsors will need to decide whether each existing Level 2 user should be upgraded to Level 1 status, provided they meet the relevant eligibility requirements, or whether the account should be deactivated.
Home Office guidance advises sponsors to keep the number of Level 1 users to the minimum needed to manage the licence effectively. The decision should therefore be based on who still needs access and what they actually need to do within the SMS.
Decide who should retain SMS access
The removal of Level 2 access gives sponsors a natural point at which to review how SMS access is structured across the organisation.
Level 2 users currently have a restricted set of permissions. Level 1 users can carry out a much wider range of sponsor management functions, so upgrading an individual changes both the level of access they hold and the actions they are technically able to perform.
Sponsors should therefore consider which employees genuinely need Level 1 access and whether their role, seniority, knowledge and internal authority are appropriate for the functions they will be carrying out.
Conversion should not be automatic, and a sponsor with several Level 2 users may have little jusitification to convert every account; some users may have changed role, stopped administering sponsorship or only ever needed access for a limited operational purpose.
The transition period should therefore be used to determine the future SMS user structure, rather than simply converting existing accounts.
Review Level 1 permissions and approval protocols
Once sponsors have identified who should retain access, the next issue is what those users should be authorised to do.
Having technical access to the SMS does not automatically determine what an individual should be authorised to do within the organisation. A Level 1 user may be technically capable of carrying out a wide range of actions through the system, but sponsors should still decide which actions that person is authorised to take and when further approval is required.
Internal protocols may need to cover matters such as assigning Certificates of Sponsorship, reporting changes affecting sponsored workers, requesting CoS allocations, amending sponsor details and managing other SMS users.
For organisations operating across several sites, business units or HR teams, the removal of Level 2 may also require responsibilities to be redistributed. There should be clarity over who initiates an SMS action, who checks it and who has authority to submit it.
These controls become more important where employees moving from Level 2 to Level 1 will gain access to functions they have not previously used.
Prepare Level 2 users for Level 1 responsibility
Users moving to Level 1 should be trained before or as part of the transition.
Training needs to cover more than how to use the SMS. Level 1 users should know the sponsor duties connected with the actions they perform, the organisation’s internal approval procedures and when a matter needs to be escalated.
Depending on their responsibilities, training may need to cover Certificate of Sponsorship allocation and assignment, worker reporting, changes to sponsor circumstances, management of key personnel, record keeping and the evidence that should support SMS activity.
Sponsors should also make clear that Level 1 access does not give an individual unrestricted authority to make sponsorship decisions on behalf of the organisation.
Check MFA and individual SMS access
The Level 2 transition is taking place alongside the rollout of mandatory multi-factor authentication across the Sponsorship Management System.
The Home Office began introducing mandatory MFA on 3 September 2026 and expects it to apply across sponsor accounts as the rollout continues. Each user must authenticate their own access using the contact information recorded against their account.
For Level 1 users, the SMS can send the one-time passcode by text where a valid mobile number is recorded, or by email where no valid mobile number is held. Level 1 users may also need to provide their date of birth when first accessing an MFA-enabled account or following specified changes to their details.
Sponsors should check that user information is accurate before accounts are converted and make sure their access arrangements work in practice.
Usernames, passwords and MFA passcodes are personal to the individual SMS user and should not be shared. Home Office sponsor guidance expressly states that sharing passwords or MFA passcodes may result in revocation of the sponsor licence.
Build resilience into SMS administration
Once access becomes more individualised, sponsors also need to consider how the licence will continue to be managed when individual users are unavailable.
Sponsors need enough authorised SMS access to meet reporting deadlines and manage the licence when individual users are absent, leave the business or become unexpectedly unavailable.
Access still needs to be controlled. Giving too many people Level 1 access can create its own governance problems.
A workable model is likely to involve a controlled group of appropriately trained Level 1 users, with enough cover to maintain continuity without extending access more widely than necessary.
Contingency arrangements should identify who can take over SMS responsibilities during absence, how urgent reporting is escalated and what happens to access when an SMS user leaves the organisation or changes role.
Review inactive and historic SMS users
The transition also provides an opportunity to review accounts that should no longer remain active.
Recent Home Office changes place greater emphasis on the management of inactive SMS accounts.
Sponsors are expected to keep user information current and ensure their SMS users access the system regularly. Home Office guidance warns that inactive accounts may be removed and that failing to maintain appropriate active users can put the sponsor licence at risk.
The Level 2 transition therefore gives sponsors a sensible opportunity to review the full user list, not just those currently holding Level 2 access.
Former employees, users who have changed role and accounts that are no longer required should be identified and dealt with appropriately. Details recorded for continuing users should also be checked for accuracy.
What should sponsors do before March 2027?
Sponsors do not need to wait until the Level 2 deadline is close. Starting the transition now gives organisations time to identify gaps, make decisions about access, revise internal processes and train replacement or upgraded users where needed.
The review should consider:
- which Level 2 users are still active
- whether each user still requires SMS access
- whether proposed Level 1 users meet the eligibility requirements
- which existing accounts should instead be deactivated
- whether the number of Level 1 users remains proportionate to operational need
- what authority each Level 1 user should have internally
- whether existing SMS procedures and approval protocols need to be revised
- whether personal and contact details are accurate for MFA
- whether there is sufficient cover for absence or staff departure
- what training upgraded and existing Level 1 users require
For larger sponsors, the review may also need to consider how SMS activity is divided between central HR, global mobility, recruitment, local HR teams and other business functions.
DMS Perspective
The end of Level 2 access is likely to expose weaknesses in how some sponsors currently govern the SMS. Organisations that have relied on Level 2 users for operational support will need to decide whether to concentrate more responsibility in a smaller Level 1 population or widen Level 1 access to preserve existing workflows. Neither approach is risk-free.
Concentrating access can create dependency on too few individuals, while widening Level 1 access increases the number of users capable of taking higher-impact actions on the licence. A straightforward, or automatic, conversion of Level 2 to Level 1 may not therefore always be appropriate, necessitating a redesign of the wider SMS control framework: who needs access, which actions require approval, how activity is checked and how continuity is maintained when key users are unavailable.
Taken together with MFA and the Home Office’s increasing focus on active, individually-accountable SMS users, we are continuing on this path towards tighter sponsor-side governance of access and decision-making. Sponsors that treat the March 2027 deadline as an account-conversion exercise may therefore miss the more important compliance issue.
Need Assistance?
DavidsonMorris works with sponsor licence holders preparing for the withdrawal of Level 2 SMS access and reviewing their wider sponsor management arrangements.
We can review existing Level 1 and Level 2 users, assess eligibility for Level 1 appointment, support Level 2 to Level 1 transitions and identify accounts that should be deactivated.
We can also review SMS governance and internal approval procedures, MFA readiness, contingency arrangements and how responsibilities are allocated across HR, recruitment and other sponsorship functions.
For organisations moving existing Level 2 users into Level 1 roles, we provide practical Level 1 user training covering operation of the SMS and the sponsor compliance obligations relevant to the actions those users will be expected to carry out.
Where appropriate, the transition can also form part of a wider sponsor licence compliance review, testing whether SMS administration, reporting practices and internal controls remain aligned with current Home Office requirements.
Speak to our immigration compliance team about preparing your SMS arrangements for the end of Level 2 access in March 2027.
