Following the publication of Sponsor Guidance version 08/26 by the Home Office on 28 August 2026, the rules concerning security and access management within the Sponsor Management System (SMS) have been significantly strengthened.

The principal changes are the introduction of mandatory multi-factor authentication (MFA), the phased removal of the Level 2 User role, and new procedures for managing inactive accounts. This is regarded as one of the most significant changes to SMS operation since the 2020 reforms to the sponsorship system. How an organisation manages its SMS will no longer be merely an administrative matter; it will be treated as a core component of sponsor compliance.

Why has the Home Office introduced these changes?

In recent years, the Home Office has expanded its approach to sponsor compliance beyond verifying whether there is a genuine employment relationship. It now also considers whether a sponsor has appropriate internal governance arrangements, HR systems and oversight procedures in place.

These changes are intended to strengthen the security and integrity of the SMS, which is the system through which sponsors discharge key sponsorship duties. They are designed to reduce the risk of account compromise, unauthorised use, and failures to report relevant changes or events caused by neglected accounts. In other words, who can access the SMS, how they authenticate themselves, and whether user accounts are kept current will form part of the Home Office’s assessment of compliance and the reliability of the sponsorship system.

What is MFA (Multi-Factor Authentication)?

MFA, or multi-factor authentication, is a security measure requiring an additional stage of verification when logging in, beyond a user ID and password.

For example, when accessing the SMS, a user may be required to enter a password and then input a verification code sent by text message or email. This provides an important safeguard against unauthorised access where a password has been compromised.

However, it also means that a sponsor may be unable to access the system when needed if the relevant mobile telephone number or email address has not been registered or kept up to date, or if only one individual has access to the authentication method. This may result in a sponsor being unable to assign a Certificate of Sponsorship (CoS) or make a required report within the relevant timeframe.

Withdrawal of the Level 2 User role: what is changing?

From 9 September 2026, sponsors will no longer be able to appoint new Level 2 Users. Existing Level 2 Users must, by 8 March 2027, either be converted to Level 1 Users where they meet the relevant eligibility requirements or have their accounts deactivated.

Temporary staff employed by a recruitment agency can no longer be appointed as Level 2 Users. Any existing accounts held by such agency workers must also be deactivated by 8 March 2027, and they cannot be converted to Level 1 User accounts.

As a result, authority and responsibility may become concentrated among a smaller number of Level 1 Users. Sponsors should therefore review and redesign their internal governance arrangements, including approval procedures, segregation of duties and the appointment of suitable back-up users.

Stricter management of inactive accounts: leaving accounts unattended creates a licence risk

Sponsor Guidance 08/26 introduces a new procedure for the systematic management of inactive user accounts, and the Home Office intends to take a more proactive approach in relation to dormant accounts.

Sponsors should therefore avoid obtaining a sponsor licence and leaving the SMS unmanaged until a CoS is needed. User accounts must be kept current, active and appropriately managed throughout the duration of the sponsor licence.

An exception to the ‘cooling-off’ restriction following licence revocation: administrative failings are treated differently

The Guidance confirms that, where a sponsor licence is revoked solely because of inactive SMS accounts, the strengthened cooling-off provisions will not apply. This means that an automatic restriction will not be imposed when the organisation applies again for a sponsor licence.

This may be interpreted as recognising that an administrative failure in account management should not be treated in the same way as substantive compliance breaches, such as worker exploitation or breaches of immigration law.

What sponsors should do now?

Sponsors should first check that the contact details for every current SMS user, including email addresses and mobile telephone numbers, are correct and up to date. They should also confirm that each user has genuine access to their MFA authentication method.

Sponsors should then identify all existing Level 2 Users, determine which individuals may be eligible to become Level 1 Users, and deactivate accounts which are no longer required. A clear plan should be put in place to ensure that all necessary steps are completed before the deadline of 8 March 2027.

Accounts belonging to individuals who have left the organisation or changed roles should be dealt with without delay. Accounts that have not been accessed for an extended period should be reviewed regularly. It is also important to ensure that SMS access is not concentrated in the hands of one individual and that responsibilities are appropriately distributed.

In addition, sponsors should establish back-up arrangements for key SMS tasks, including CoS assignment and sponsor reporting. A written procedure for dealing with MFA access failures should also be prepared in order to reduce operational risk.

How should sponsors prepare for the future?

These changes are not a one-off administrative measure. They represent a longer-term shift towards placing SMS access controls at the centre of sponsor compliance governance.

Sponsors should therefore make MFA registration and authentication-method management, the Level 2 to Level 1 User transition plan, account housekeeping and maintenance, and the appointment of back-up users part of their regular internal compliance reviews. Any changes in personnel should trigger a prompt review and update of relevant SMS access permissions and user information.

Larger organisations in particular should consider redesigning their delegation of authority and approval processes. This will reduce dependency on specific individuals and help maintain business continuity where a key user is unavailable, leaves the organisation, changes role, or experiences authentication difficulties.

Practical support from ARIS International Lawyers

ARIS International Lawyers provides comprehensive legal and practical support in relation to the maintenance and management of sponsor licences. We can assist with MFA registration and authentication-method checks; reviewing whether Level 2 Users are eligible to become Level 1 Users; identifying and deactivating unnecessary accounts; establishing back-up user arrangements; preparing internal procedures; assessing risks arising from inactive accounts; and dealing with communications with the Home Office.

If you require advice concerning a visa or sponsorship matter, please contact us on 020 3865 6219 or leave us a message.