Mandatory MFA for the Sponsor Management System

Mandatory MFA for the Sponsor Management System: what Skilled Worker sponsors need to know

The Home Office has begun introducing mandatory multi-factor authentication (“MFA”) for users of the Sponsorship Management System (“SMS”). The change affects employers holding Skilled Worker sponsor licences and is intended to strengthen protection against unauthorised access to sponsor accounts.

The phased rollout began on 3 September 2026. Once MFA is enabled for a sponsor licence, each SMS user must provide a one-time passcode (“OTP”), in addition to their usual user ID and password, every time they log in. Skilled Worker sponsors should review their SMS user records now to minimise the risk of losing access or delaying time-sensitive sponsorship activity.

What is changing with MFA for the Sponsor Management System?

MFA adds a further identity-verification step to the SMS login process. When MFA has been activated for a sponsor licence, a Level 1 or Level 2 User will need:

• their individual SMS user ID and password;
• their date of birth, where required for a Level 1 User; and
• an OTP sent to the mobile telephone number or email address recorded against their SMS user account.

The OTP is valid for 10 minutes. MFA is mandatory and cannot be switched off. It applies to each user individually, reinforcing the existing requirement that SMS credentials must not be shared.

The Home Office is rolling out MFA in phases rather than activating it for every sponsor simultaneously. Authorising Officers, Key Contacts and Level 1 Users should receive advance notification of the activation date for their licence. Newly granted sponsor licences have MFA enabled automatically.

Why does mandatory MFA matter for Skilled Worker sponsors?

The SMS is the principal system through which a Skilled Worker sponsor manages its licence, requests and assigns Certificates of Sponsorship, reports changes affecting sponsored workers and updates key personnel and organisational details. If an authorised user cannot complete the MFA process, the sponsor may be unable to carry out these functions within the required timeframe.

This creates an operational risk, as well as a security issue. An incorrect date of birth, an obsolete email address or a mobile number belonging to a former employee could prevent access at a critical point – for example, shortly before a proposed worker submits a visa application or when a reportable change must be notified to the Home Office.

Information sponsors should check now

Each sponsor should conduct an immediate audit of its SMS account and confirm that:

1. Key personnel details are accurate: check the names and contact details recorded for the Authorising Officer, Key Contact and all Level 1 Users;
2. Each Level 1 User’s date of birth is correct: an incorrect date of birth may need to be corrected through the Sponsor Change of Circumstances process before the user can complete MFA;
3. Email addresses and mobile numbers are current: users must be able to access the email account or mobile telephone to which the OTP will be sent;
4. Every user has an individual account: shared SMS credentials should not be used. Each person accessing the system should do so through their own authorised user profile;
5. Former employees’ accounts have been deactivated: leaving dormant accounts in place creates both security and compliance risks; and
6. There is adequate Level 1 User coverage: a sponsor should not depend on one person alone for SMS access, particularly where that person may be absent or unavailable.

Related changes to SMS user management

The MFA rollout forms part of a wider tightening of SMS account security and user management.

From 9 September 2026, sponsors can no longer appoint new Level 2 Users. Existing Level 2 Users must be upgraded to Level 1 status, where eligible, or deactivated by 8 March 2027. Sponsors should therefore review what functions each existing Level 2 User performs, and decide whether Level 1 access remains necessary and appropriate.

The Home Office is also taking steps to remove inactive SMS user accounts. Users should log in regularly using their own credentials and sponsors should not assume that an account left unused for a prolonged period will remain available. If a sponsor is left without an active Level 1 User, its ability to manage the licence – and potentially the licence itself – may be placed at risk.

Authorising Officers will also receive email notifications concerning specified licence activity, including certain changes to Level 1 Users and, for some sponsors, the assignment of Certificates of Sponsorship. Those notifications should be incorporated into the sponsor’s internal monitoring and escalation procedures, rather than treated as routine system emails.

Recommended action plan

Skilled Worker sponsors should take the following steps:

• identify the MFA activation date for their licence and circulate it to all SMS users;
• review the Home Office’s SMS Manual 13 before activation;
• verify the personal and contact details of every current user;
• deactivate accounts belonging to people who have left the organisation or no longer require access;
• review and rationalise Level 2 User accounts before the March 2027 deadline;
• ensure at least two suitable Level 1 Users are available where practicable;
• test internal procedures for urgent SMS activity if the primary user is unavailable;
• remind users never to share passwords or OTPs and to treat unexpected requests for login information as potential fraud; and
• retain a written record of the audit and any corrective action as part of the organisation’s sponsor compliance records.

Gherson insight

The introduction of MFA is a significant but manageable change for Skilled Worker sponsors. The principal risk is not the additional login step itself, but inaccurate user records, over-reliance on a single Level 1 User and failure to address dormant or obsolete accounts.

Sponsors who review their SMS records, user permissions and internal access arrangements before MFA is activated should be well placed to avoid disruption. Those who delay may find themselves unable to assign a Certificate of Sponsorship or make a required report when timing is critical.

Frequently Asked Questions

Is multi-factor authentication mandatory for Sponsor Management System users?

Yes. The Home Office is introducing mandatory MFA for SMS users on a phased basis. The rollout began on 3 September 2026 and is expected to be in place for all sponsors by November 2026. MFA is automatically enabled for organisations granted a sponsor licence on or after 9 September 2026.

How does MFA work when logging into the Sponsor Management System?

Once MFA has been enabled, an SMS user must enter a one-time passcode in addition to their username and password. The passcode is sent to the mobile telephone number or email address registered for that user, depending on the user’s account details and level of access.

What information should sponsors check before MFA is activated?

Sponsors should check that their key personnel and SMS user details are accurate and up-to-date. In particular, they should verify Level 1 Users’ dates of birth, email addresses and mobile telephone numbers, ensure each user has an individual account and deactivate accounts belonging to former employees.

What happens if an SMS user cannot complete MFA?

The user may be unable to access the SMS. This could prevent the sponsor from carrying out time-sensitive activities, such as assigning a Certificate of Sponsorship, reporting changes relating to sponsored workers or updating licence information.

Can sponsors still appoint Level 2 Users?

No. From 9 September 2026, sponsors can no longer appoint new Level 2 Users. Existing Level 2 Users must be converted to Level 1 Users, where eligible and appropriate, or have their accounts deactivated by 8 March 2027.

Can SMS users share passwords or MFA passcodes?

No. SMS users must use their own credentials and must not share their password or MFA passcode. Home Office sponsor guidance states that sharing these details may result in sponsor licence revocation.

How Gherson can assist

Gherson’s Immigration Team are highly experienced in advising on all UK visa and immigration matters. If you have any questions arising from this blog, please do not hesitate to contact us for advice, send us an e-mail, or, alternatively, follow us on X, Facebook, Instagram or LinkedIn to stay up to date.

The information in this blog is for general information purposes only and does not purport to be comprehensive or to provide legal advice. Whilst every effort is made to ensure the information and law is current as of the date of publication it should be stressed that, due to the passage of time, this does not necessarily reflect the present legal position. Gherson accepts no responsibility for loss which may arise from accessing or reliance on information contained in this blog. For formal advice on the current law please do not hesitate to contact Gherson. Legal advice is only provided pursuant to a written agreement, identified as such, and signed by the client and by or on behalf of Gherson.

©Gherson 2026