Sponsor Management System Changes 2026: MFA, Level 2 Users and Inactive Accounts

In Brief

Sponsor licence holders need to review their Sponsor Management System users following three important changes introduced in 2026. Mandatory multi-factor authentication began a phased rollout on 3 September 2026, no new Level 2 users can be appointed from 9 September 2026, and existing Level 2 users must be converted to Level 1 where eligible or deactivated by 8 March 2027.

The Home Office is also identifying accounts that have not been accessed for at least 12 months. Once notified, affected Level 1 users generally have three months to log in, check their details and make necessary updates. If deactivation leaves the organisation without an active Level 1 user, its licence may be suspended and could normally be revoked if an eligible replacement is not nominated within 28 days.

Working with our Business Immigration Lawyers through the Sponsorship Licence Management Service can help you audit users, assess Level 2 conversion eligibility, correct access arrangements and establish a continuity plan before a key account or member of staff becomes unavailable.

What changed in the Sponsor Management System in September 2026?

The first point to understand is that the changes did not all take effect on the same date. Updated Home Office sponsor guidance introduced the phased rollout of mandatory MFA, began removing the Level 2 role and established a process for inactive SMS accounts. These are administrative conditions governing sponsor licence holders, not a new Act of Parliament or an amendment to the Immigration Rules.

For employers, the practical effect is that SMS access cannot be treated as a purely technical matter delegated without oversight. The Authorising Officer remains responsible for users, while Level 1 users perform critical functions such as assigning Certificates of Sponsorship, reporting changes and managing accounts. Weak access arrangements can therefore disrupt recruitment and prevent timely reporting.

Date or period	Change	Action for sponsors
3 September 2026	The phased rollout of mandatory SMS multi-factor authentication began.	Check whether MFA has been enabled and ensure each user can receive and enter a one-time passcode.
9 September 2026	Sponsors could no longer appoint new Level 2 users. Mandatory MFA applies to organisations granted a sponsor licence on or after this date.	Use eligible Level 1 users for new access arrangements and do not plan around creating another Level 2 account.
Within three months of an inactive-account notice	Affected Level 1 users must log in, check their details and update them where necessary.	Calculate the period from the notice date and record when each required action is completed.
8 March 2027	Existing Level 2 users must have been converted to Level 1, where eligible and still required, or deactivated.	Complete eligibility checks and user changes before the deadline. Remaining Level 2 accounts will be deactivated afterwards.
Within 28 days of suspension for loss of all active Level 1 users	The sponsor must nominate at least one eligible Level 1 user.	Use the required process promptly and provide requested evidence. The licence will normally be revoked if the problem is not corrected.

Against that background, 8 March 2027 is the final transition deadline, not the date on which to start reviewing users. The Home Office must consider a Level 1 request, and eligibility may be complicated where access is held by an external representative, outsourced HR employee or temporary worker. Delay could create a period in which the sponsor cannot complete essential SMS work.

Is multi-factor authentication compulsory for SMS users?

Mandatory MFA began its phased rollout on 3 September 2026 and was expected to reach all sponsors by November 2026. Not every existing account became subject to MFA on the first day. Sponsors are contacted when the functionality is due to be enabled, while organisations granted a sponsor licence on or after 9 September 2026 are brought within the mandatory arrangements.

Once MFA is enabled, each user must provide their user ID and password and enter a one-time passcode whenever they log in. The code is sent to the mobile number or email address registered to that account. The official MFA user manual explains the process, permitted contact-detail updates and common access problems.

In practice, MFA turns the accuracy of each user’s personal information into an operational requirement. Authority to use SMS will not resolve an incorrect date of birth, inaccessible email account or outdated mobile number at login. Access should be tested before a time-sensitive task, such as assigning a Certificate of Sponsorship or reporting a material organisational change.

Why individual email addresses and contact details now matter

What should not be overlooked is that SMS credentials and contact details must belong to the named user. Email addresses provided for Key Personnel must be secure, personal to and accessible only by that individual. A generic HR mailbox, shared inbox or password known to several colleagues is not a compliant substitute for an individual account.

For Level 1 users, sponsors should check the recorded email address, mobile number and date of birth because those details may be used during MFA registration or login. Level 2 users, and Level 1 users without a valid mobile number, rely on email for their passcode. A Level 2 user’s incorrect email address must be corrected by a Level 1 user.

The safer approach is to incorporate SMS information into joiner, mover and leaver procedures. When someone changes role, telephone number, email account or employment status, the sponsor should consider whether their details or access must also change. Connecting HR records with sponsor governance reduces the risk of discovering a problem after a reporting deadline has begun.

Can a sponsor still appoint a Level 2 user?

No new Level 2 user may be appointed from 9 September 2026. Before that date, Level 2 users could be given restricted permission to create and assign Certificates of Sponsorship and report activity relating to certificates they had assigned or that had been transferred to them. They did not have the wider permissions available to Level 1 users.

The important distinction is that existing Level 2 accounts did not all end immediately. A person appointed before 9 September 2026 can retain temporary access, but the sponsor must decide what should happen to that account by 8 March 2027. Transitional use does not remove the need for a documented conversion or deactivation decision.

For organisations that used Level 2 access to limit permissions, conversion requires a wider governance decision because Level 1 users receive broader responsibility and functionality. Sponsors should first confirm that the person remains necessary, suitable and eligible and that appropriate supervision will continue.

What must happen to existing Level 2 users by 8 March 2027?

By 8 March 2027, a Level 1 user must request conversion of each eligible Level 2 user to Level 1 or deactivate the account. Conversion is appropriate only where the individual still needs access and satisfies the Level 1 requirements. After the deadline, the Home Office will deactivate any Level 2 accounts remaining on the licence.

A common mistake would be to treat conversion as an automatic change of label. Level 1 users perform the sponsor’s day-to-day licence functions and can undertake significantly more SMS activity. Eligibility, employment status, location, suitability and the person’s relationship with the sponsor must be checked before a request is made.

Where a Level 2 user is no longer needed, early deactivation is usually preferable to leaving the account dormant. As a deactivated account cannot simply be reinstated, the sponsor should first transfer any outstanding work. It should then record the reason for the decision and its completion date.

Which Level 2 users can become Level 1 users?

Not every Level 2 user is eligible to become a Level 1 user. Key Personnel must normally be based in the UK, meet the relevant suitability requirements and have an acceptable relationship with the sponsoring organisation. At least one Level 1 user must meet the applicable internal role requirements, subject to specific exceptions and transitional provisions in the guidance.

This is particularly important where the Level 2 user works outside the sponsor’s direct workforce. A temporary staff member supplied by an employment business cannot be converted to Level 1 and must be deactivated by the deadline. A contractor or consultant should not be appointed as Key Personnel merely because the sponsor needs someone to retain access.

Different considerations apply to someone employed by an organisation delivering all or part of the sponsor’s HR function or to an eligible UK-based representative. That person may potentially act as an additional Level 1 user after the licence is granted but cannot replace the required internal arrangement. The sponsor remains responsible for activity undertaken through the account.

Because those distinctions are fact-sensitive, our Business Immigration Solicitors can review the proposed user’s status, duties and relationship with the sponsor before a conversion request is submitted. That review can identify whether an eligible internal Level 1 user must be appointed first and what evidence should be retained.

When will an SMS account be treated as inactive?

An SMS account is considered inactive where it has not been accessed for 12 months or more. If the Home Office identifies an inactive account, it will contact the Authorising Officer and affected inactive Level 1 users. A Level 1 user who still needs access must log in, check their information and make necessary updates within three months of that contact.

The process differs for inactive Level 2 users because the Home Office does not contact them directly. The sponsor must identify those accounts and decide whether temporary access is still required. If it is, the user should log in and check their details; a Level 1 user must make any necessary amendment.

For that reason, sponsors should not wait for an official notice before checking last-access dates. A user may hold an important role while rarely using SMS, leading the Authorising Officer to assume the account remains usable. Periodic review can expose inaccessible email addresses, outdated details and accounts held by people who no longer perform a sponsorship function.

How inactive accounts can put a sponsor licence at risk

Account inactivity does not automatically revoke a sponsor licence. If the required action is not taken within three months of the Home Office’s notice, the identified accounts will be deactivated. The more serious consequence arises if this leaves the organisation without an active Level 1 user.

In that situation, the guidance states that the licence will be suspended and the organisation will have 28 days from suspension to nominate at least one eligible Level 1 user. If it fails to do so, the Home Office will normally revoke the licence. The sequence is deactivation, loss of active Level 1 access, suspension, an opportunity to nominate an eligible user and then normal revocation if the problem remains unresolved.

Perhaps most critically, losing the only active Level 1 user can prevent routine SMS work while the sponsor is trying to correct the problem. Where no active Level 1 user remains, the organisation must use the sponsor change-of-circumstances process to request a replacement. Continuity planning should therefore occur before the sole user leaves, becomes unavailable or reaches the inactivity threshold.

A practical SMS user and access audit

The starting point should be a documented review of every person connected with the licence, not merely a test of the main user’s password. The audit should establish who has access, why they need it, whether they remain eligible, whether their details are accurate and what would happen if they were suddenly unable to log in.

1. Create a complete user register. List the Authorising Officer, Key Contact and every active or inactive Level 1 and Level 2 user shown on the licence.
2. Confirm the continuing business need. Identify what each user does and whether access remains proportionate to their responsibilities.
3. Check eligibility and status. Record whether each user is an employee, director, owner, representative, outsourced HR employee or temporary worker and assess the applicable restrictions.
4. Verify individual contact details. Check the personal email address, mobile number and, for Level 1 users, the recorded date of birth.
5. Test MFA access. Ask necessary users to log in and confirm that they can receive and enter a one-time passcode without sharing credentials.
6. Review last-access dates. Identify accounts approaching or exceeding 12 months without use and decide whether access should be preserved or removed.
7. Resolve Level 2 accounts. Convert eligible users who still require access or deactivate them before 8 March 2027.
8. Protect Level 1 continuity. Maintain enough suitable Level 1 users to cover foreseeable absence while keeping the total proportionate to operational need.
9. Connect SMS access with HR procedures. Make user review and deactivation part of role changes, extended absence and departures.
10. Retain an audit trail. Record checks, decisions, conversion requests, deactivations, testing dates and responsibility for outstanding action.

Once the audit is complete, unresolved actions should be assigned to named individuals with realistic dates. Recording a risk without completing a conversion, correction or deactivation will not protect access. The Authorising Officer should receive confirmation of completion because responsibility for SMS users remains part of the organisation’s sponsor governance.

When should a sponsor obtain licence management support?

Specialist support may be valuable where the sponsor has only one Level 1 user, relies on an external representative or outsourced HR provider, has dormant accounts or is unsure whether a Level 2 user can be converted. Changing one account before checking the full arrangement could leave the organisation without an eligible internal user or access during a reporting deadline. Early advice allows eligibility, evidence and continuity to be considered in the correct sequence.

Where the user structure is uncertain, the Business Immigration team at OTS Solicitors can provide a focused sponsor licence audit and compliance review, assess Key Personnel eligibility and help structure reporting responsibilities. The team can also identify the correct appointment or conversion process and the records to retain, so an immediate access problem is not addressed while wider sponsor duties are overlooked.

The message is not to create the maximum possible number of Level 1 accounts. Every additional user creates activity for which the sponsor and Authorising Officer remain responsible. A more defensible arrangement maintains enough eligible, trained users for continuity, restricts access to genuine roles and reviews their activity and status at planned intervals.

OTS Solicitors’ View

Rather than treating the Level 2 phase-out as a one-off clean-up, sponsors should test whether their access arrangements can withstand absence, departure or an urgent reporting period. The key question is not only who can log in today, but who is eligible to act and how the organisation would continue if that person became unavailable. Without that analysis, a successful conversion may still leave a serious operational dependency.

In our view, the strongest control framework joins technical access checks with sponsor compliance governance. MFA testing and accurate personal details address immediate login risk, while suitable Key Personnel, documented decisions and regular review explain why each user has access. That combined record helps the Authorising Officer identify a gap before it prevents a required report or Certificate of Sponsorship assignment.

Ultimately, completing the main review before 8 March 2027 is only the first stage. Sponsors must continue monitoring accounts because the end of Level 2 users does not end user-management risk. Inactivity, staff departures, changing contact details and unsuitable external access can still interrupt essential work unless the organisation follows a repeatable review process.

Frequently Asked Questions

Do all sponsor licence users need multi-factor authentication?

MFA is intended to be mandatory for all SMS users, but the rollout for existing sponsors began in phases on 3 September 2026 and was expected to reach all sponsors by November 2026. For that reason, sponsors should follow the activation notice for their licence and test each necessary user’s access. Once enabled, every user must enter a one-time passcode when logging in and must not share the passcode or other credentials.

Can we appoint a new Level 2 user?

No. New Level 2 users cannot be appointed from 9 September 2026. If another person needs access, the sponsor must consider whether they can be appointed as an eligible Level 1 user. Their employment status, location, suitability and relationship with the organisation should be checked first because operational need does not override Key Personnel eligibility requirements.

What happens to existing Level 2 users after 8 March 2027?

Existing Level 2 users must be converted to Level 1 where they are eligible, still need access and can undertake the broader role, or their accounts must be deactivated by 8 March 2027. After that date, the Home Office will deactivate remaining Level 2 accounts. Completing the assessment early matters because unresolved eligibility or evidence questions could otherwise create an access gap.

Can an agency worker become a Level 1 user?

A temporary staff member supplied by an employment business and not employed by the sponsor is not eligible for conversion from Level 2 to Level 1, so their account must be deactivated by the deadline. Sponsors should first identify who legally employs the person rather than assume all outsourced personnel have the same status, as different provisions may apply to an employee of an organisation genuinely providing an HR function.

Can an external adviser be our only Level 1 user?

No. An eligible UK-based representative may potentially be appointed as an additional Level 1 user after the licence is granted, but cannot replace the required internal arrangement or act as Authorising Officer. The sponsor must therefore identify an internal person who satisfies the applicable requirements and remains responsible for activity undertaken through the representative’s account.

How often should a Level 1 user log into SMS?

The guidance treats an account as inactive after 12 months without access, but a login shortly before that threshold is not a complete compliance system. Level 1 users should access SMS when needed to perform sponsor duties, read official messages and check licence and user details. A planned review should record who checked the account, what action followed and when the next review is due.

Can the Home Office revoke a licence because user accounts are inactive?

Potentially, but revocation is not the immediate consequence of one inactive account. Failure to respond within the three-month period first leads to deactivation of the affected accounts. If that leaves no active Level 1 user, the licence will be suspended and the sponsor will have 28 days to nominate an eligible replacement. The Home Office will normally revoke the licence if the problem is not corrected through that process.

What should we do if our only Level 1 user leaves?

Act immediately and do not use the former user’s credentials. Another active and eligible Level 1 user can manage the required changes; if none remains, the sponsor must use the sponsor change-of-circumstances process to request a replacement. It should also identify outstanding reporting or Certificate of Sponsorship work, preserve departure records and assign responsibility for monitoring the request.

Contact OTS Solicitors

If you need advice on SMS access, Level 2 conversion, Key Personnel eligibility or sponsor licence compliance, call OTS Solicitors on 0203 959 9123 or contact OTS Solicitors. Our Business Immigration Lawyers can audit your arrangements, identify access and compliance risks and help you implement a practical sponsor licence management plan.