Sponsor Licence Compliance: The New SMS Rules

The Home Office’s 24 September 2026 update to the Workers and Temporary Workers sponsor guidance introduces the most significant changes to the Sponsor Management System (SMS) since 2020.

Version 08/26 of Part 1, Apply for a Licence, and Part 3, Sponsor Duties and Compliance, changes how sponsor licence holders access and manage the SMS. The reforms affect multi-factor authentication (MFA), Level 2 Users and inactive accounts.

For small and medium-sized businesses, the message is clear: SMS governance is no longer an IT afterthought. It is now an important part of sponsor licence compliance.

What is changing?

The main changes are:

• Mandatory MFA for SMS users, being rolled out from 3 September 2026.
• No new Level 2 Users can be appointed from 9 September 2026.
• Existing Level 2 Users must be upgraded to Level 1, where eligible, or deactivated by 8 March 2027.
• The Home Office can proactively identify and deactivate inactive SMS accounts.
• A licence may be suspended or revoked if the process leaves the sponsor without an active Level 1 User.
• A revocation solely resulting from the inactive SMS account process does not trigger the usual enhanced cooling-off provisions.

These changes sit alongside existing obligations to report worker and organisational changes, assign Certificates of Sponsorship (CoS) correctly and maintain accurate HR and right-to-work records.

Mandatory MFA: why operational planning matters

MFA means that SMS users can no longer log in with a username and password alone. Once MFA is enabled for a sponsor’s licence, each login will also require a one-time passcode.

The passcode will generally be sent:

• By text message to a valid mobile number for a Level 1 User; or
• By email for a Level 2 User or a Level 1 User without a valid mobile number.

Level 1 Users may also need to enter their date of birth, which must match the information recorded on the SMS.

The Home Office expects MFA to be in place for all sponsors by November 2026. It is mandatory for organisations granted a new sponsor licence from 9 September 2026.

For businesses, this is not simply a cybersecurity upgrade. If a user’s mobile number, email address or date of birth is incorrect, they may be unable to access the SMS. If the only person with access is absent, has left the business or has lost access to their device, important deadlines may be missed.

Those deadlines can include:

• Reporting changes to a sponsored worker within the required timeframe.
• Reporting a change of work location, salary or duties.
• Assigning a CoS to a prospective Skilled Worker.
• Applying for a Defined CoS.
• Responding to a Home Office request for documents or information.
• Reading important messages posted on the SMS.

SMS credentials and MFA passcodes must not be shared. Sponsors should therefore ensure that each authorised user has individual, secure access and that the business has a contingency plan if a key person is unavailable.

Level 2 Users are being phased out

From 9 September 2026, sponsors can no longer appoint new Level 2 Users.

Existing Level 2 Users can continue during the transition period, but each account must be dealt with by 8 March 2027. The sponsor must either:

1. Convert the individual to a Level 1 User, if they meet the eligibility requirements and still need access; or
2. Deactivate the account.

After 8 March 2027, the Home Office will deactivate any remaining Level 2 accounts.

This may have a significant effect on HR teams and external advisers. Level 2 Users have traditionally provided limited access for people who create or manage certain CoS records. They may include HR staff, employees of outsourced HR providers or UK-based representatives.

Once the role disappears, more users may need Level 1 access. That brings greater responsibility and requires stronger internal controls. The Authorising Officer remains responsible for the activities of SMS users, so businesses should not simply upgrade every existing Level 2 User without considering suitability, training and the scope of their role.

The change also creates a resilience issue. Some small businesses have concentrated SMS responsibility in one owner, director or HR manager. If that person is unavailable, the company may be unable to make time-sensitive reports or assign a CoS.

A better approach is to appoint enough eligible Level 1 Users to provide operational cover, while retaining clear approval processes and oversight.

Inactive SMS accounts: active management is now essential

Under the updated guidance, an SMS user account is generally considered inactive if it has not been accessed for 12 months or more.

Where the Home Office identifies an inactive Level 1 User, it will contact the Authorising Officer and the user. The Level 1 User must log in and check or update their details within three months of the Home Office’s contact.

If they do not, the account may be deactivated.

The Home Office will not contact inactive Level 2 Users directly. The sponsor is responsible for identifying those accounts and deciding whether they should be retained during the transition, upgraded or removed.

This makes regular access and account reviews important. Part 1 recommends that Level 1 Users access the SMS regularly, and the guidance recommends monthly access as best practice. This enables sponsors to:

• Check licence and user details.
• Read Home Office messages.
• Monitor CoS allocations.
• Confirm that contact details remain accurate.
• Identify obsolete or inappropriate access.
• Demonstrate that the SMS is actively managed.

A sponsor may face increased compliance risk if it cannot demonstrate active management of its SMS. In a compliance visit, the Home Office may examine who has access, whether those users understand their responsibilities and whether the organisation can respond quickly to reporting obligations.

What happens if all Level 1 Users become inactive?

Sponsors must have at least one eligible Level 1 User throughout the life of the licence.

If the inactive account process leaves the sponsor without an active Level 1 User, the Home Office will normally suspend the licence and provide 28 days to nominate a new eligible Level 1 User.

If the sponsor does not do so within that period, the licence will normally be revoked.

That could affect the business’s ability to sponsor new workers, assign CoS and retain international employees. It may also disrupt recruitment plans where a business is relying on a Skilled Worker visa application.

There is, however, an important clarification in the updated guidance. If the licence is revoked solely because of the inactive SMS account process, the enhanced cooling-off provisions do not apply. In practical terms, the business is not automatically barred from making a fresh sponsor licence application in the same way it would be after a substantive compliance breach.

This is not a reason to treat the issue lightly. A new application still requires the business to meet all the requirements in force at that time, pay the relevant fee and demonstrate that it has suitable systems and personnel in place.

What to do now: sponsor checklist

Small and medium-sized sponsors should take the following steps:

• Audit every SMS user: Record each user, role, last login date, business function and continuing need for access.
• Update contact details: Check email addresses, mobile numbers and dates of birth for Level 1 Users.
• Prepare for MFA: Confirm that users can access the registered phone or email account and understand the new login process.
• Review Level 2 Users: Decide who should be upgraded to Level 1 and who should be deactivated.
• Complete changes early: Do not wait until the 8 March 2027 deadline.
• Remove obsolete accounts: Deactivate former employees, former advisers and anyone who no longer requires access.
• Add resilience: Consider appointing more than one suitable Level 1 User to cover holidays, sickness, departure or business restructuring.
• Create succession plans: Decide who will take over if the Authorising Officer, HR lead or SMS manager leaves.
• Schedule regular SMS reviews: A monthly review is sensible and should be recorded.
• Check reporting processes: Make sure HR, payroll and line managers know how to escalate changes affecting sponsored workers.
• Protect credentials: Never share SMS passwords or MFA passcodes.
• Keep evidence: Retain records showing user reviews, training, changes made and internal approval decisions.

These steps should sit within a wider sponsor licence self-audit covering right-to-work checks, payroll, absences, work locations, job descriptions, CoS records and employment contracts.

Our earlier guide, Sponsor Licence Compliance: 5 Changes Every Employer Must Know Before the Next Home Office Audit, provides a broader compliance health-check framework.

Frequently asked questions

Is MFA mandatory for all SMS users?

Yes. MFA is being rolled out on a mandatory basis and is expected to be in place for all sponsors by November 2026.

Can we appoint a new Level 2 User?

No. New Level 2 Users cannot be appointed from 9 September 2026. Existing Level 2 Users must be upgraded or deactivated by 8 March 2027.

Can an external immigration adviser be a Level 1 User?

In some circumstances, a UK-based representative may be appointed as an additional Level 1 User, provided they meet the relevant requirements. The sponsor remains responsible for the activities of its SMS users.

How often should Level 1 Users access the SMS?

The updated guidance recommends regular access and specifically recommends that a Level 1 User accesses the SMS at least once a month. Accounts that have not been accessed for 12 months or more may be treated as inactive.

What if our only Level 1 User leaves the business?

You should act immediately. If no Level 1 User has SMS access, certain changes may need to be made using the Home Office change of circumstances process. A sponsor must maintain at least one eligible Level 1 User.

Does an inactive-account revocation always lead to a cooling-off period?

No. Where the sole reason for revocation is the inactive SMS account process, the relevant cooling-off provisions are disapplied. This does not remove the need to make a compliant fresh application.

How Tyndel Solicitors can help

The latest changes show that sponsor licence compliance is now as much about internal governance as it is about genuine employment and immigration paperwork.

Tyndel Solicitors advises small and medium-sized businesses on sponsor licence applications, SMS governance, compliance reviews, Home Office visits and Skilled Worker CoS strategy. Our Immigration service includes support with maintaining a sponsor licence and managing reporting obligations.

If you need advice from experienced immigration lawyers in the UK, or support from Skilled Workers COS Solicitors, contact Tyndel Solicitors on 0208 154 3131.

Review your SMS users now, before a locked account, inactive user or staff departure creates an avoidable compliance problem.