UK Introduces Mandatory Multi-Factor Authentication for Sponsor Licence Users

The UK government has announced that mandatory multi-factor authentication will be introduced for sponsor management system (SMS) users from 3 September 2026. A phased rollout is expected to conclude by November 2026, at which time the new requirement will apply to all work and student sponsors. Changes will also be made to who can act as key personnel on a sponsor licence, namely the elimination of the Level 2 User role, as the government takes steps to increase security.

To protect user accounts from being compromised, in addition to their username and password SMS users will be required to enter a one-time passcode each time they access their SMS account.

The passcode will be sent to either the user’s registered

• mobile number (via text message) if they are a Level 1 User with a valid mobile phone number; or
• email address if they are a Level 1 User without a valid mobile phone number or a Level 2 User.

When logging in for the first time with MFA, Level 1 Users will have to provide their date of birth as additional verification.

SMS users are advised to check that the email address, phone number, and date of birth associated with their account are correct to ensure continued access to the SMS.

LEVEL 2 USERS

Level 2 Users are individuals with access to a sponsor licence, but with fewer permissions than Level 1 Users. From 9 September, it will no longer be possible to appoint additional Level 2 users to a licence (it will still be possible to appoint additional Level 1 users).

As the Level 2 User role is set to be eliminated, the following actions must be taken in relation to existing Level 2 Users no later than 8 March 2027:

• They must be converted to a Level 1 User if they meet the requirements for Level 1 and still need licence access; or
• The account must be deactivated.

If no action is taken, the Home Office will deactivate any remaining Level 2 User accounts.

It should be noted that temporary members of staff supplied by employment agencies will also no longer be able to be appointed as Level 2 Users from 9 September, and any existing accounts of such staff must be deactivated by 8 March 2027. It is not possible to convert such workers into Level 1 Users.

INACTIVE USERS AND SPONSOR LICENCES

SMS users are already advised to log in and check their accounts regularly, but the Home Office will now take steps to deactivate accounts that are deemed inactive (i.e., if the user has not accessed the SMS for 12 months or more).

Updated guidance states that where an account is identified as inactive the Home Office will write to both the Authorising Officer and the inactive Level 1 User with instructions on how to log into their account and check their details. If the inactive user does not take this action within three months of the date they are contacted, the account will be deactivated.

If the deactivation of accounts in this way leads to there being no active Level 1 Users, the sponsor licence will be suspended for 28 days to allow an opportunity to appoint a new Level 1 User. Should no new user be appointed, the licence will normally be revoked.

At this time, this automatic deactivation applies only to SMS users and not the licence itself, but the Home Office has indicated that it will in the future publish guidance on how it intends to manage inactive licences, which may include automatic revocation.

ACTIONS FOR USERS

For most SMS users, the introduction of MFA is likely to add an additional administrative step when they access the SMS. However, in instances where the user’s details are not up to date, it is possible that accounts could become blocked.

Users are advised to review the details associated with their accounts, log into the SMS regularly to ensure accounts are kept current, and seek assistance should they become locked out of their account.