Stricter access rules for SMS users
Under the new arrangements, SMS users will be required to complete an additional authentication step when logging in to the Sponsorship Management System (SMS). In addition to their existing username and password, users will also need to enter a one-time passcode (OTP).
Based on the Home Office arrangements to date, the new login process will depend on the type of SMS user and the contact details held on the system. Level 1 users with a valid mobile number recorded in SMS will receive their one-time passcode by text message. Where no valid mobile number is recorded, the passcode will be sent by email. Level 2 users will receive their passcode by email.
Level 1 users will need a valid date of birth recorded on the system when they first log in to an MFA-enabled account using a mobile phone. Their date of birth will also be required if they subsequently change their mobile number or email address on the SMS.
The Home Office is rolling the change out in phases rather than switching all sponsors across at once. Each sponsor will be notified of its respective activation date, with the rollout expected to apply to all work-route sponsors by November 2026.
What should sponsors do now?
Sponsors should review their existing SMS user arrangements before MFA is activated.
In particular, organisations should:
- check that all Level 1 and Level 2 users are still required;
- remove access for individuals who no longer need to use the system;
- ensure each user has their own SMS account and does not share login credentials;
- verify that Level 1 users’ date of birth, mobile number and email address are accurate;
- ensure SMS users read the Home Office MFA guidance provided with the licence activation notice before completing the registration process.
- verify that Level 2 users’ email addresses are current; and
- consider whether any additional Level 2 users need to be appointed before the reported restriction on adding new Level 2 users takes effect.
Users should continue to access the SMS only through the official GOV.UK service. The Home Office has also reminded sponsors that it will not send email links asking users to log in, view SMS messages or take action, and will not send an OTP unless the user has requested one through the SMS.
No new Level 2 users once MFA is activated
The MFA rollout also brings a more fundamental change to SMS user management. Once the new functionality is introduced, sponsors will no longer be able to add new Level 2 users.
Existing Level 2 users can continue to use the system, but any new SMS users appointed after the change will need to be Level 1 users. This should prompt sponsors to review the current SMS user structure before the change takes effect, particularly where an organisation relies heavily on Level 2 users for day-to-day sponsor management.
For HR and global mobility teams, this is likely to affect how responsibility for the sponsor licence is distributed internally and how organisations plan for absence, staff turnover and continuity of access to the SMS.
DavidsonMorris Strategic Insight for Sponsors
MFA will make SMS access more dependent on accurate individual user data and robust internal access arrangements.
Consider a plausible scenario: where SMS access depends on a specific user’s phone, email and identity details, that user becoming unavailable can create an operational problem, not just an IT problem. For example, if a key Level 1 user leaves, is absent, changes their mobile number or has inaccurate details recorded on the SMS, the organisation could encounter access problems when it needs to assign a CoS or make a time-sensitive report.
Since problems with system access can impact business continuity and immigration compliance, MFA will make it even more important for sponsors to maintain accurate user details and sufficient authorised SMS access, while keeping the number of Level 1 users to the minimum necessary for effective licence management.
Employers should therefore approach the MFA rollout as a prompt to review Level 1 and Level 2 users, remove obsolete access, update contact details and ensure there is sufficient resilience if a key user is absent or leaves the business.
Need assistance?
If you need help reviewing your SMS access arrangements or preparing for the MFA rollout, or would like more information about our specialist SMS level 1 & 2 user training, contact our business immigration solicitors.
