Stricter access rules for SMS users

Under the new arrangements, SMS users will be required to complete an additional authentication step when logging in to the Sponsorship Management System (SMS). In addition to their existing username and password, users will also need to enter a one-time passcode (OTP).

The new login process will depend on the type of SMS user and the contact details held on the system. Level 1 users with a valid mobile number recorded in SMS will receive their one-time passcode by text message. Where no valid mobile number is recorded, the passcode will be sent by email. Level 2 users will receive their passcode by email.

Level 1 users will need a valid date of birth recorded on the system when they first log in to an MFA-enabled account using a mobile phone. Their date of birth will also be required if they subsequently change their mobile number or email address on the SMS.

The Home Office is rolling the change out in phases rather than switching all sponsors across at once. Each sponsor will be notified of its respective activation date, with the rollout expected to apply to all work-route sponsors by November 2026.

What should sponsors do now?

Sponsors should review their existing SMS user arrangements before MFA is activated.

In particular, employers should:

• check that all Level 1 and Level 2 users are still required;
• remove access for individuals who no longer need to use the system;
• ensure each user has their own SMS account and does not share login credentials;
• verify that Level 1 users’ date of birth, mobile number and email address are accurate;
• ensure SMS users read the Home Office MFA guidance provided with the licence activation notice before completing the registration process.
• verify that Level 2 users’ email addresses are current; and
• consider whether any additional Level 2 users need to be appointed before the reported restriction on adding new Level 2 users takes effect.

Users should continue to access the SMS only through the official GOV.UK service. The Home Office has also reminded sponsors that it will not send email links asking users to log in, view SMS messages or take action, and will not send an OTP unless the user has requested one through the SMS.

No new Level 2 users once MFA is activated

The MFA rollout also brings a more fundamental change to SMS user management. Once the new functionality is introduced, sponsors will no longer be able to add new Level 2 users.

Existing Level 2 users can continue to use the system, but any new SMS users appointed after the change will need to be Level 1 users. This should prompt sponsors to review the current SMS user structure before the change takes effect, particularly where an organisation relies heavily on Level 2 users for day-to-day sponsor management.

For HR and global mobility teams, this is likely to affect how responsibility for the sponsor licence is distributed internally and how organisations plan for absence, staff turnover and continuity of access to the SMS.

Need assistance?

If you need help reviewing your SMS access arrangements or preparing for the MFA rollout, or would like more information about our specialist SMS level 1 & 2 user training, contact our business immigration solicitors.