If you hold a Worker or Temporary Worker sponsor licence, three linked changes to the sponsorship management system (SMS) matter now. Mandatory multi-factor authentication (MFA) is rolling out for SMS Users. From 9 September 2026 you cannot appoint new Level 2 Users. Inactive SMS accounts are being cleaned up, and leaving yourself without an active Level 1 User can put the licence at risk.

This spoke explains what the live Home Office guidance says, what to check on SMS, and when to get advice. It is not a rewrite of our sponsor-licence service page.

Worldwide Immigration is regulated by the Immigration Advice Authority (IAA) under reference F201900032. We are IAA-regulated immigration advisers, including Level 3 Immigration Adviser advice where applicable. We are not solicitors.

What changed for SMS Users in September 2026

Workers and Temporary Workers sponsor guidance Part 1 (Key Personnel, section L4) sets out three headline changes:

  • From 3 September 2026, mandatory MFA for SMS Users begins on a phased basis. The Home Office expects MFA to be in place for all sponsors by November 2026. Organisations granted a licence on or after 9 September 2026 get mandatory MFA enabled.
  • From 9 September 2026, you can no longer appoint new Level 2 Users.
  • Existing Level 2 Users must be converted to Level 1 Users where eligible, or deactivated, by 8 March 2027. After that date the Home Office will deactivate remaining Level 2 accounts. Temporary staff supplied by an employment business who are not employed by the sponsor cannot be converted to Level 1 and must be deactivated by that date if not already removed.

Separately, the Home Office inactive-user deactivation process is now in operation. A user account is treated as inactive if it has not been accessed for 12 months or more.

Primary sources: Workers and Temporary Workers — Part 1: Apply for a licence (accessible) and SMS Manual 13 — MFA.

MFA: what sponsors need ready

SMS Manual 13 explains that MFA adds a one-time passcode (OTP) after the usual user ID and password. Once MFA is enabled on your licence, an OTP is required each time an SMS User logs in.

Typically:

  • Level 1 Users with a mobile number receive the OTP by text and may need a date of birth that matches SMS records on first mobile MFA login or when changing contact details.
  • Level 2 Users (and Level 1 Users without a mobile number) receive the OTP by email.
  • The OTP is time-limited (Manual 13: valid for 10 minutes).

Before MFA is enabled on your account, check that Level 1 Users have a correct email address, mobile number and date of birth on SMS, and that Level 2 Users have a correct email address. Level 2 Users cannot amend their own email — a Level 1 User must do that.

The Home Office says it will email the Authorising Officer, Key Contact, Level 1 and Level 2 Users about two weeks before MFA is enabled for your organisation. Manual 13 also stresses scam awareness: access SMS via GOV.UK, never share user IDs, passwords or OTPs, and never follow unexpected login links in email.

Level 2 Users: no new appointments, action by 8 March 2027

Level 2 Users have always had fewer SMS permissions than Level 1 Users (mainly creating and assigning Certificates of Sponsorship they control, and reporting on those CoS). From 9 September 2026 the role is closed to new appointments.

If you still have Level 2 Users:

  1. Decide who still needs SMS access.
  2. Where they meet Level 1 eligibility and suitability rules, convert them to Level 1 Users.
  3. Otherwise deactivate their accounts.
  4. Complete that work by 8 March 2027 — after that date remaining Level 2 accounts will be deactivated by the Home Office.

Do not assume every Level 2 User can become Level 1. For example, temporary staff supplied by an employment business who are not employed by the sponsor are not eligible to convert and must be deactivated by 8 March 2027 if still on the licence.

You must still keep an eligible Authorising Officer and at least one eligible Level 1 User throughout the life of the licence. Build in enough Level 1 User cover so you are not dependent on a single person — if that person leaves, falls inactive, or cannot complete MFA, you may lose effective SMS access. Where the inactive-user process leaves the licence with no active Level 1 User, the Home Office will suspend the licence.

Inactive SMS User accounts and licence risk

Part 1 L4 explains that if the Home Office identifies inactive SMS Users (no access for 12 months or more), it will contact the Authorising Officer and any inactive Level 1 User with instructions.

Level 1 Users who want to keep access must log in and check (and update) their details within three months of that contact. Inactive Level 2 Users are not contacted directly — sponsors must identify them and either have them log in (while the Level 2 role still exists) or deactivate accounts that are no longer needed.

If you do nothing within three months, inactive accounts can be deactivated. If that process leaves you with no active Level 1 User, the Home Office will suspend the licence and you may have 28 days to nominate an eligible Level 1 User. Failure to do so will normally lead to revocation. Part 1 notes there is no cooling-off period where revocation is solely for this inactive-SMS process — but you would still need a fresh licence application that meets the rules then in force.

Practical takeaway: treat “nobody has logged into SMS for months” as a compliance risk, not an admin nicety.

Sponsor checklist

  • Confirm who your Authorising Officer, Key Contact and Level 1 Users are, and that at least one Level 1 User remains eligible — ideally more than one, so you are not single-user dependent.
  • Update SMS contact details before MFA hits your licence (email, mobile, date of birth for Level 1 Users).
  • Plan Level 2 conversions or deactivations before 8 March 2027; stop trying to add new Level 2 Users.
  • Log into SMS regularly so accounts do not drift into the 12-month inactive bucket.
  • Access SMS only through GOV.UK and train users not to share OTPs.
  • If you have lost Level 1 access entirely, use the sponsor change-of-circumstances route described in the guidance rather than hoping SMS will still open.

For wider sponsor duties context, see our earlier guide UK sponsor duties and Skilled Worker rules in 2026.

How we can help

Worldwide Immigration’s IAA-regulated immigration advisers (F201900032) help employers with sponsor-licence compliance, Key Personnel changes and SMS access issues. If MFA lock-outs, Level 2 sunset planning or inactive-user risk is blocking your team, we can review your position against current GOV.UK guidance.

Start with our Sponsor Licence service page, call 020 3488 2308, or email info@worldwideimmigration.co.uk.

Frequently asked questions

Is MFA optional for SMS?

No. Part 1 and SMS Manual 13 describe mandatory MFA for SMS Users, phased from 3 September 2026, with the Home Office expecting all sponsors covered by November 2026. New licences from 9 September 2026 have mandatory MFA enabled.

Can we still add Level 2 Users?

Not from 9 September 2026. Existing Level 2 Users must be upgraded to Level 1 where eligible or deactivated by 8 March 2027.

What counts as an inactive SMS User?

Part 1 treats an account as inactive if it has not been accessed for 12 months or more. The Home Office can deactivate those accounts if you do not take the action it requests after contact.

What if we have no Level 1 User left?

Without an active eligible Level 1 User you cannot operate SMS normally. Part 1 says the Home Office will suspend the licence if inactive-user clean-up leaves you with no active Level 1 User, with possible revocation if you do not nominate an eligible Level 1 User in time. Get advice quickly and use the change-of-circumstances process where SMS access is already gone.

Sources (GOV.UK)