Sponsor management system (SMS) changes 2026: MFA, Level 2 users and inactive accounts

The sponsor management system (SMS) is the one Home Office system every sponsor relies on. You use it to assign certificates of sponsorship, report changes and keep your licence details current. In 2026, the way you get into it is changing.

Since 3 September 2026, the Home Office has been rolling out multi-factor authentication (MFA) to every SMS account. It has stopped new Level 2 users from being appointed, and it is now switching off accounts that nobody uses. If those changes leave your organisation with no working Level 1 user, your licence is suspended.

This guide explains each change, how the new SMS login works, what to do if you are locked out, and a short checklist to finish before 8 March 2027.

In short:

• Every SMS login now needs a one-time passcode as well as a password. The rollout is due to reach all sponsors by November 2026.

• No new Level 2 users can be appointed. Existing ones must be converted to Level 1 or deactivated by 8 March 2027.

• Accounts unused for 12 months can be deactivated. If that leaves no active Level 1 user, the licence is suspended.

What is changing in the sponsor management system

The changes come from version 08/26 of the Home Office's sponsor guidance Part 1, published on 28 August 2026. Paragraph numbers are included below so you can check each point against the source.

Alongside these dates, there is a new process for inactive accounts, covered further down. The changes apply to every Worker and Temporary Worker sponsor.

How to log in to the sponsor management system with MFA

You still log in through the SMS landing page on the Home Office points-based system site, linked from the SMS user manuals on GOV.UK. What changes is the extra step after your password.

The Home Office emails Authorising Officers, Key Contacts and SMS users two weeks before MFA is switched on for their account. The first MFA login then works like this for a Level 1 user, according to SMS manual 13:

1. Enter your SMS user ID and password as usual.

2. Enter your mobile number, including the country code.

3. Enter your date of birth. It must match the date held for you on the licence.

4. Check the summary and select “Request OTP”.

5. Enter the six-digit passcode sent by text. It is valid for 10 minutes.

Level 2 users, and Level 1 users without a mobile number, get the passcode by email instead. From then on, every login needs a fresh passcode.

Passwords have not changed. They must be 12 to 256 characters with an uppercase letter, a lowercase letter, a number and a special character, and the SMS logs you out after 20 minutes of inactivity.

Locked out of the SMS? What to do

Most lockouts come from details on the licence that are out of date. Here is how each one works.

For anything else, contact the Business Helpdesk at BusinessHelpdesk@homeoffice.gov.uk with your organisation name and sponsor licence number in the subject line. Add noreply@homeoffice.gov.uk to your safe senders list so SMS notices do not go to spam.

The simplest way to avoid all of this is to check every user's mobile number, email address and date of birth in the SMS before MFA reaches your account. Paragraph L4.84 says you must hold a current email address for every SMS user, and a current mobile number and correct date of birth for Level 1 users.

Level 2 users are being removed

Level 2 users had restricted access. They could create and assign certificates of sponsorship and report on those certificates, but could not see the licence summary or manage defined certificates. Many sponsors gave the role to HR administrators.

From 9 September 2026, you cannot appoint any new Level 2 users (L4.58). For each existing one, you have two options before 8 March 2027:

1. Convert them to a Level 1 user, if they still need access and meet the Level 1 requirements. In practice this means adding them as a new Level 1 user, then deactivating their Level 2 account.

2. Deactivate their account, if they no longer need access.

After 8 March 2027, the Home Office deactivates any Level 2 account that is left (L4.59). A deactivated account cannot be reinstated, so plan the switch rather than waiting for it.

Agency staff need particular care. Workers supplied by an employment business cannot be converted to Level 1 (L4.65), and they can no longer be appointed as key personnel at all (L4.14). If an agency worker currently runs your certificates as a Level 2 user, someone on your own payroll needs to take over before March.

Level 1 user requirements: who can hold the role

A Level 1 user handles day-to-day management of the licence through the sponsor management system. Under the GOV.UK guidance on sponsorship roles:

• At least one Level 1 user must be an employee, partner or director of the sponsor, or a settled worker.

• Level 1 users should normally be based in the UK and be paid members of staff or office holders.

• They cannot be a contractor or consultant hired for a specific project.

• Staff of a third-party HR provider can be additional Level 1 users.

• A qualified UK-based legal representative can become an additional Level 1 user after the licence is granted.

Each person must pass the same suitability checks as other key personnel. Their email address must be “secure, personal to, and only accessible by, the named individual” (L4.81), so a shared HR inbox will not do. For a wider view of these roles, see our page on sponsor licence key personnel management.

Inactive SMS accounts: the route to suspension

This is the change most likely to catch sponsors out, because nothing happens until it is urgent.

1. 12 months without a login. An account is treated as inactive if the user has not accessed it for 12 months or more (L4.72).

2. The Home Office gets in touch. It contacts the Authorising Officer and any inactive Level 1 users (L4.73). It does not contact inactive Level 2 users, so you need to find those yourself (L4.75).

3. Three months to respond. Each Level 1 user must log in, check their details and update them within 3 months (L4.74).

4. Deactivation. If nobody acts, the accounts are deactivated (L4.77).

5. Suspension. If that leaves no active Level 1 user, the licence is suspended, and you have 28 days to nominate an eligible Level 1 user. If you do not, the Home Office will normally revoke the licence (L4.78).

There is one piece of good news. If inactivity is the only reason a licence is revoked, you will not face the usual cooling-off period before reapplying (L4.79). You would still have to apply again, pay the fee and meet the rules in force at the time.

The weak point is the Authorising Officer. They are often a director who rarely touches sponsorship, so a Home Office letter can sit unread for weeks. Make sure whoever manages your licence day to day knows to look out for it.

SMS checklist: what to do before 8 March 2027

• List everyone with SMS access: the Authorising Officer, Key Contact, and every Level 1 and Level 2 user.

• Check each person's email address, mobile number and date of birth in the SMS.

• Replace any shared or generic mailbox with a personal email address.

• Decide, for each Level 2 user, whether to convert them to Level 1 or deactivate them.

• Deactivate any agency staff accounts, and hand their work to an employee.

• Make sure at least two active Level 1 users meet the requirements, so one leaving does not lock you out.

• Ask every Level 1 user to log in at least once a quarter.

• Add noreply@homeoffice.gov.uk to your safe senders list.

• Report key personnel changes in the SMS within 20 working days, and keep a record of each report. Our UKVI reporting deadline calculator can help you count the days.

Keeping track of SMS access with Sponsoro

SMS access often lives in a spreadsheet, or in one person's head. Sponsoro's key personnel view keeps your Authorising Officer, Key Contact and every SMS user in one place. It flags access reviews and pending personnel changes before they turn into a reporting problem, and its reporting deadline tracker counts the working days on each change. Continuous compliance audit checks then help you spot gaps between your records and what the SMS shows.

If you are not sure your licence is in good shape, our free sponsor licence health check takes a few minutes.

Get ahead of the SMS changes

The sponsor management system changes are mostly admin, but getting them wrong means a licence you cannot use. Check every user's details now, plan for each Level 2 user, and keep at least two active Level 1 users who log in regularly. To see how Sponsoro tracks key personnel and SMS access, book a demo or start a 14-day free trial.

This article is general information based on Home Office guidance published up to October 2026. It is not legal advice, so check the current guidance or speak to an immigration adviser about your own licence.