Three changes to how Sponsor Management System (SMS) accounts work land in September 2026. They affect who can sign in, who you can add, and what happens to accounts nobody uses. None of them changes your sponsor duties, but ignoring them can lock you out of your own licence.
Multi-factor authentication is mandatory from 3 September 2026
From 3 September 2026 every SMS user must use multi-factor authentication to sign in. That means a password plus a second step, in the same way as online banking. Sponsor guidance version 08/26 confirms the requirement and reflects it in the circumstances in which the Home Office may revoke a licence, so this is a compliance point, not only an IT one.
The guidance does not set out the step by step process, and you will be prompted through it when you next sign in. Two things are worth doing now:
Check that the contact details held for each of your SMS users are current, so the second step reaches the right person.
Make sure more than one person at your organisation can sign in, so a lost phone or an absent colleague does not stop you assigning a CoS or filing a report on time.
The Home Office will never ask for your SMS login details by email. If you receive an unexpected message about your account, see Phishing emails impersonating the Home Office or UKVI and What to Do If You Suspect Your SMS Account Is Compromised.
Level 2 users are being phased out
The Home Office began phasing out Level 2 users in October 2024 and is now closing the door on new ones. You can add a Level 2 user up to 9 September 2026. After that date you cannot create new Level 2 accounts.
A Level 2 user can create and assign Certificates of Sponsorship (CoS) and report worker activity, but only on the CoS they created and assigned themselves. They cannot report on a CoS assigned by a Level 1 user unless it has been transferred to them, which is one of the more common reasons a report gets missed. A Level 1 user can do everything, including adding and removing other users.
If you rely on Level 2 users today, move that work to Level 1 access before 9 September 2026. Adding a Level 1 user is not instant: the request goes to the Home Office and sits at Requested until they decide, which can take several days or longer. Existing Level 2 users can be removed under Manage Level 1 and 2 users in the SMS.
Inactive accounts and inactive licences
The Home Office is tidying up what nobody uses, at two levels.
For user accounts, there is now a process for inactive SMS user accounts. Version 08/26 confirms that where a licence is revoked solely because of that process, the usual cooling-off period does not apply. The protection is simple: make sure at least one Level 1 user signs in regularly, rather than only when a CoS is needed.
For licences, the register of licensed sponsors is intended for organisations actively using their licence, and the Home Office now invites sponsors who are not sponsoring anyone to surrender. Licences no longer expire after four years, so an unused licence stays live, with all its duties, until it is surrendered or revoked. Surrendering carries a cost: you cannot re-apply for 12 months, or 24 months if your licence has been revoked on more than one occasion.
What to do this week
Confirm each SMS user can complete the multi-factor sign-in, and that at least two people can.
Check whether you have any Level 2 users, and request Level 1 access for anyone who needs it before 9 September 2026.
Review your Level 1 user list and remove anyone who has left.