Sponsor licence SMS changes: MFA, Level 2 Users and inactive accounts

01 · Commencement

The dates do different work.

The revised sponsor guidance is dated 28 August 2026 and replaces the May 2026 edition. It records the policy changes which govern SMS access, but the operational measures do not all start on the same day.

Mandatory MFA begins to be enabled from 3 September 2026 and is expected to apply to all sponsors by November 2026. A licence granted on or after 9 September 2026 will have MFA enabled. Existing sponsors should wait for the Home Office notification, while making the underlying user data accurate now.

From 9 September 2026, no new Level 2 Users can be appointed. Existing Level 2 Users must be converted to Level 1 Users, if eligible, or deactivated by 8 March 2027. The Home Office says it will deactivate any remaining Level 2 accounts after that date.

The inactive account provisions are part of the new guidance. Their practical effect depends upon when an account has last been accessed and when the Home Office sends its notification. Sponsors should not wait for a notice before identifying dormant access.

02 · Multi factor authentication

Personal contact data becomes part of the sponsor's operating control.

Once MFA is enabled, an SMS user must enter a one time passcode each time they log in. The user will continue to use their existing SMS credentials, but access will also depend upon the contact channel recorded for that individual.

The revised guidance says a Level 1 User with a mobile number recorded in the SMS will receive the code by text message. A Level 1 User without a recorded mobile number, and an existing Level 2 User during the transition, will receive it by email. Each Level 1 User should therefore have the correct date of birth, mobile number and email address recorded before activation.

Sponsor guidance also requires the email address used by an SMS user to be secure, personal to that user and accessible only by them. A shared mailbox may appear administratively convenient, but it conflicts with individual accountability and creates uncertainty over who actually approved or performed an SMS action.

The practical test is whether the named user can receive the code and access the system during an urgent reporting event. A nominal user whose contact details belong to a former employee, shared team or external person who no longer acts for the sponsor is not resilient access.

03 · Level 2 Users

The abolition of Level 2 Users requires a permissions redesign.

Level 2 Users have historically held limited SMS permissions. The Home Office is now removing that user category. Sponsors should not automatically convert every existing Level 2 User into a Level 1 User simply to preserve their access.

A Level 1 User has wider operational authority and must satisfy the eligibility requirements in the sponsor guidance. After a licence has been granted, an additional Level 1 User may ordinarily be a paid member of staff or office holder, an employee of an outsourced HR provider engaged by the sponsor, or a UK based representative, provided the applicable requirements are met.

The guidance expressly states that temporary staff supplied to the sponsor by an employment business cannot be converted from Level 2 to Level 1. If such an account has not already been deactivated, the Home Office will deactivate it after 8 March 2027.

The correct exercise is to classify each existing user by present role, continuing business need, eligibility and required permissions. Some should be converted. Some should be removed. The sponsor should then verify that enough eligible Level 1 Users remain to maintain access during holiday, illness, departure or an internal investigation.

04 · Inactive accounts

A dormant login can become a licence continuity problem.

An SMS account will be treated as inactive where it has not been accessed for 12 months. The Home Office will contact the Authorising Officer and an inactive Level 1 User. The user must log in and check or update their details within 3 months of that contact if access is still required.

Inactive Level 2 Users will not be contacted individually. The sponsor is expected to identify those accounts and decide whether the user should be converted, if eligible, or deactivated. That responsibility reinforces the need for the organisation to maintain its own current user register rather than relying upon Home Office reminders.

After the 3 month response period, the Home Office will deactivate accounts which remain inactive. Deactivation of 1 unnecessary account need not affect the licence. The serious consequence arises where the process leaves the sponsor without any active Level 1 User.

In that situation, the guidance says the Home Office will suspend the sponsor licence and allow 28 days to nominate an eligible Level 1 User. If the sponsor does not do so, the licence will normally be revoked. The chain is therefore inactivity, notice, deactivation, absence of active Level 1 access, suspension and possible revocation. Each stage offers a point at which competent governance should prevent escalation.

05 · Revocation consequence

No cooling off period does not make revocation inconsequential.

The revised guidance provides that a cooling off period will not apply where the sole reason for revocation is the inactive SMS user process. That is a narrow exception to the ordinary restrictions on a new sponsor licence application.

The organisation would nevertheless have lost its licence. It would need to make and pay for a fresh application, satisfy the requirements in force at that time and manage the consequences for recruitment and its sponsored workforce. The absence of a cooling off period removes 1 barrier; it does not preserve the old licence or guarantee a replacement.

If other compliance defects also contributed to revocation, the no cooling off exception may not apply. An organisation facing suspension should therefore examine the complete decision, the condition of its sponsor records and the eligibility of the proposed replacement user before responding.

06 · Governance ownership

The Authorising Officer should own the transition.

The Authorising Officer remains responsible for the conduct of SMS users and the sponsor's compliance arrangements. The transition should be documented through that governance line, even where practical administration is performed by HR, an outsourced provider or professional representative.

The sponsor should be able to produce a current list of users, their category, employment or appointment basis, eligibility, last access date, contact details and business reason for holding permission. It should also record who approved conversions or deactivations and when the review will next occur.

The guidance requires a sponsor to have at least 1 eligible Level 1 User throughout the life of the licence, subject to the stated administration exception. A prudent organisation will usually require more than 1 eligible route to access, but it should not create unnecessary privileged accounts. Resilience and access minimisation must be reconciled rather than treated as competing objectives.

07 · Immediate action

Sponsors should complete an evidence based access review now.

Begin with the actual SMS account list, not an HR organisation chart. Match every account to a current individual and test whether the recorded person still works for or is properly appointed by the sponsor, remains eligible, needs access and can receive the future authentication code.

Decide the future of every Level 2 User before 8 March 2027. A conversion should follow a positive eligibility and permissions decision. Deactivation should follow the end of the business need. Neither outcome should be left to automatic Home Office action.

Verify that at least 1 eligible Level 1 User can act throughout the transition and that the sponsor has cover for foreseeable absence or departure. The resulting register, approvals and periodic review record should be retained as evidence of sponsor control.

08 · Counsel judgment

The real test is whether the sponsor can lawfully act under pressure.

A clean user list is not an end in itself. The sponsor should test whether it can access the SMS, assign or report sponsorship activity and respond to the Home Office when its usual administrator is unavailable. That is the point at which an apparently technical change becomes an institutional compliance question.

The most significant risk is often concentrated in a small organisation, a recently restructured group or a sponsor which has outsourced most HR administration. In each case, the organisation may assume somebody else holds workable access. The new process exposes that assumption by connecting individual inactivity to licence enforcement.

A controlled transition aligns the SMS record with corporate reality. It removes historic access, assigns permissions only to eligible individuals, protects continuity and leaves an audit trail which can be explained during a compliance visit or suspension response.

Practical questions.