Multi-Factor Authentication Introduced for Sponsor Management System Users

The Home Office has begun introducing mandatory multi-factor authentication (MFA) for users of the Sponsorship Management System (SMS).

Many sponsors will already have received, or will shortly receive, notification from the Home Office about this change. MFA provides an additional layer of security for SMS accounts and is intended to reduce the risk of unauthorised access.

What is multi-factor authentication?

MFA requires SMS users to provide additional verification when logging into their account.

Once MFA has been enabled, Level 1 and Level 2 Users will be required to provide:

• their SMS User ID and password;
• their date of birth, where required for Level 1 Users; and
• a one-time passcode (OTP) sent to the mobile telephone number or email address registered to their SMS account.

The OTP is valid for 10 minutes and must be entered into the SMS to complete the login process.

For Level 1 Users with a valid mobile telephone number, the OTP will normally be sent by text message. For Level 1 Users without a valid mobile number, and for Level 2 Users, the OTP will be sent to their registered email address.

When will MFA take effect?

The Home Office began the phased introduction of mandatory MFA on 3 September 2026 and expects it to be in place for all sponsors by November 2026.

Sponsors should receive instructions from the Home Office when MFA is due to be enabled on their SMS account.

What should sponsors do now?

Sponsors should ensure that the personal and contact information recorded for their SMS users is accurate and up to date.

In particular, sponsors should check:

• the email address registered for each SMS User;
• the mobile telephone number registered for MFA purposes for Level 1 Users; and
• the date of birth recorded for each Level 1 User.

Where any information is incorrect, sponsors should take the appropriate steps to update it.

SMS users should also familiarise themselves with the Home Office’s MFA guidance before MFA is activated on their account.

Changes affecting Level 2 Users

Sponsors should also be aware of a related change to SMS user arrangements. From 9 September 2026, sponsors can no longer appoint new Level 2 Users.

Existing Level 2 Users must be upgraded to Level 1 User status, where they are eligible, or their accounts must be deactivated by 8 March 2027.

Be alert to phishing and cyber scams

The Home Office has also warned SMS users to remain vigilant against phishing attempts. Users should access the SMS through GOV.UK and should never share their SMS User ID, password or one-time passcode with another person. The Home Office states that it will not ask users to provide their password, OTP or personal information such as their date of birth outside the SMS.

How we can help

Sponsor licence holders should review their SMS user arrangements now to ensure that their key personnel information is accurate and that relevant users are prepared for MFA.

If you require assistance with managing your sponsor licence, updating your key personnel or understanding your sponsor compliance obligations, please contact our immigration on contact@davenportsolicitors.com or 0207 9032 6689.