UK Sponsor Licence Holders Face New Sponsorship Management System Security Requirements

UK employers wishing to sponsor overseas workers must first obtain Home Office authorisation in the form of a sponsor licence. Once granted, all licence administration — adding users, issuing Certificates of Sponsorship, updating key personnel — is carried out through the Sponsorship Management System (SMS), the online portal that underpins the entire sponsorship framework.

On 28 August 2026, the Home Office published updated sponsor guidance introducing a set of security and governance requirements for SMS. The changes do not alter who a business is entitled to sponsor. What they alter is who may access the SMS account, how that access is authenticated, and who is alerted when the account is changed. The requirements currently apply to Worker and Temporary Worker sponsors; separate guidance for student sponsors is expected to follow.

Mandatory Multi-factor authentication

From 3 September 2026, logging into SMS will require more than a username and password. Users will also need to enter a one-time passcode sent to their registered email address or mobile phone — the same second-step verification already familiar from online banking.

The rollout is staged rather than immediate:

• 3 September 2026 — MFA rollout begins for Worker and Temporary Worker sponsors.

• 9 September 2026 — MFA is switched on automatically for any organisation newly granted a sponsor licence from this date.

• Early November 2026 — MFA rollout is expected to extend to student sponsors, including multi-route licence holders.

Authorising Officers, Key Contacts and Level 1 Users are meant to receive email notice two weeks ahead of MFA being switched on for their account.

Removal of Level 2 access and more visibility for Authorising Officers

Two separate changes take effect on 9 September 2026.

Removal of the Level 2 user role. SMS accounts typically distinguish between Level 1 Users, who hold full administrative rights, and Level 2 Users, a more limited access tier often assigned to staff managing day-to-day administrative tasks without needing full control. From 9 September 2026, sponsors can no longer create new Level 2 accounts.

This does not switch off existing Level 2 users immediately, but it does require every sponsor to make a decision about each one: upgrade the individual to Level 1 access, or deactivate the account. That decision must be finalised by 8 March 2027 — after which no account can remain at the Level 2 tier.

New activity alerts for Authorising Officers. The Authorising Officer — the individual who carries ultimate personal responsibility for the licence — will begin receiving automatic email notifications when certain events occur on the account:

• A Level 1 User's login details are changed

• A new Level 1 User is added

• The Authorising Officer's own registered email address is changed

Sponsors that issued fewer than 1,000 Certificates of Sponsorship (CoS or CAS) in 2025 will also be notified each time a new one is assigned to a worker.

Taken together, this is the point at which the Home Office moves from assuming licences are managed responsibly to actively surfacing account activity to the person accountable for it.

8 March 2027: The deadline for resolving legacy Level 2 accounts

Every existing Level 2 account must be either upgraded or deactivated by this date. Six months may feel like ample time, which is precisely why it is worth addressing now rather than leaving it until the final weeks before the deadline.

Why the Home Office is making these changes

None of these measures change immigration policy in the conventional sense — there is no new visa route and no revised salary threshold involved. Instead, they tighten the operational security of a system that governs a legally significant power: the ability to bring an individual into the UK to work. The Home Office has also indicated that inactive SMS user accounts will be removed, and has reminded sponsors to access the system only through GOV.UK, given the risk of phishing and other credential-based scams. The clear message is that enforcement is becoming less forgiving, and that poor account security or unclear ownership of a licence can now count against a sponsor in much the same way as an error in a visa application.

One consequence of the inactive-account removal process deserves particular attention. The guidance has been updated to confirm that where a licence is revoked for the sole reason that it falls foul of the inactive SMS User account process set out in section L4 of Part 1 of the guidance, the standard cooling-off period that would normally apply before a sponsor can reapply for a licence will not apply. In practical terms, this narrows — but does not eliminate — the downside of losing a licence purely through account inactivity, and it underscores why sponsors should not treat the inactive-account rule as a low-priority housekeeping item.

A related change: right to work checks extend to new categories of engagement

Separately from the SMS changes, but taking effect in the same period, the Home Office has confirmed that from 1 October 2026 the obligation to carry out right to work checks will extend beyond the conventional employer-employee relationship. The duty will also apply to:

• Organisations that engage individuals under a worker's contract

• Organisations that engage individual sub-contractors

• Organisations that operate an online matching service which provides a potential client or customer with the details of an individual service provider

This is a meaningful expansion in scope, particularly for businesses that rely on flexible labour models, gig-economy style engagements, or platform-based matching services and have not historically treated those arrangements as falling within right to work obligations. The Home Office has published a draft "Employer's guide to right to work checks" setting out how these checks are expected to be carried out in this wider range of engagements, and organisations operating any of the above models should review it well ahead of the 1 October start date.

What sponsors should do before 3 September

Before MFA begins rolling out, sponsors should review their SMS user list in full: confirm who currently has access and at what level, and verify that the phone numbers, email addresses and (for Level 1 Users) dates of birth on file are accurate and current — these are the details the one-time passcodes and account alerts will rely on. It is also worth confirming that the Authorising Officer's registered contact details are correct, since that individual is about to become the account's primary point of visibility for licence activity.

Organisations that engage contractors, sub-contractors, or individuals through a matching platform should additionally begin preparing for the 1 October right to work changes now, rather than treating the two reforms as unrelated compliance items landing in the same month.

This article is based on information procured from official sources and public portals. It is provided for general informational purposes and does not constitute legal or immigration advice. Kindly consult the relevant public authority or an immigration advisor at the Legit Migrant for guidance specific to your circumstances.