Stricter access rules for SMS users
Under the new arrangements, SMS users will be required to complete an additional authentication step when logging in to the Sponsorship Management System (SMS). In addition to their existing username and password, users will also need to enter a one-time passcode (OTP).
The new login process will depend on the type of SMS user and the contact details held on the system. Level 1 users with a valid mobile number recorded in SMS will receive their one-time passcode by text message. Where no valid mobile number is recorded, the passcode will be sent by email. Level 2 users will receive their passcode by email.
Level 1 users will need a valid date of birth recorded on the system when they first log in to an MFA-enabled account using a mobile phone. Their date of birth will also be required if they subsequently change their mobile number or email address on the SMS.
The Home Office is rolling the change out in phases rather than switching all sponsors across at once. Each existing sponsor will be notified of its respective activation date, with the rollout expected to apply to all work-route sponsors by November 2026.
What should sponsors do now?
Sponsors should review their existing SMS user arrangements before MFA is activated.
In particular, employers should:
- check that all Level 1 and Level 2 users are still required;
- remove access for individuals who no longer need to use the system;
- ensure each user has their own SMS account and does not share login credentials;
- verify that Level 1 users’ date of birth, mobile number and email address are accurate;
- ensure SMS users read the Home Office MFA guidance provided with the licence activation notice before completing the registration process;
- verify that Level 2 users’ email addresses are current;
- review existing Level 2 users and decide whether each should be converted to a Level 1 user, where eligible, or deactivated by 8 March 2027;
- ensure there are sufficient eligible Level 1 users to provide cover during periods of absence; and
- ensure SMS users access their accounts regularly, noting that the Home Office recommends that a Level 1 user accesses the SMS at least once a month.
Users should continue to access the SMS only through the official GOV.UK service. The Home Office has also reminded sponsors that it will not send email links asking users to log in, view SMS messages or take action, and will not send an OTP unless the user has requested one through the SMS.
An SMS user account is considered inactive where it has not been accessed for 12 months or more. Where the Home Office identifies an inactive Level 1 user, it will contact the Authorising Officer and the inactive user, who will have three months to log in, check their details and update them where necessary. If the required action is not taken, the Home Office will deactivate the inactive account. If that process leaves the sponsor without an active Level 1 user, the licence will be suspended and the sponsor given 28 days from the date of suspension to nominate at least one eligible Level 1 user. Failure to do so will normally result in revocation.
Level 2 users being phased out from 9 September 2026
Separate from the MFA rollout, the Home Office is phasing out the Level 2 user role.
From 9 September 2026, sponsors will no longer be able to appoint new Level 2 users. Existing Level 2 users can continue to access the SMS for a transitional period, but sponsors must decide whether each user should be converted to a Level 1 user or have their account deactivated.
Where an existing Level 2 user remains eligible for SMS access and meets the requirements for a Level 1 user, they can be converted to Level 1 status. Otherwise, their account should be deactivated. Sponsors must complete this exercise by 8 March 2027. After that date, the Home Office will deactivate any remaining Level 2 accounts.
Level 2 users who are staff members supplied by an employment business and are not employed by the sponsor cannot be converted to Level 1 users and their accounts will therefore have to be deactivated by the deadline.
For HR and global mobility teams, the change will affect how responsibility for the sponsor licence is distributed internally and how organisations plan for absence, staff turnover and continuity of access to the SMS.
DavidsonMorris Strategic Insight for Sponsors
MFA will make SMS access more dependent on accurate individual user data and robust internal access arrangements.
Consider a plausible scenario: where SMS access depends on a specific user’s phone, email and identity details, that user becoming unavailable can create an operational problem, not just an IT problem. For example, if a key Level 1 user leaves, is absent, changes their mobile number or has inaccurate details recorded on the SMS, the organisation could encounter access problems when it needs to assign a CoS or make a time-sensitive report.
Since problems with system access can impact business continuity and immigration compliance, MFA will make it even more important for sponsors to maintain accurate user details and sufficient authorised SMS access, while keeping the number of Level 1 users to the minimum necessary for effective licence management.
Employers should therefore approach the MFA rollout as a prompt to review Level 1 and Level 2 users, remove obsolete access, update contact details and ensure there is sufficient resilience if a key user is absent or leaves the business. Sponsors should also plan for the withdrawal of the Level 2 user role by reviewing which existing Level 2 users should be converted to Level 1 status, where eligible, before 8 March 2027.
Need assistance?
If you need help reviewing your SMS access arrangements or preparing for the MFA rollout, or would like more information about our specialist SMS level 1 & 2 user training, contact our business immigration solicitors.
