Level 2 Users, multi-factor authentication and inactive accounts: what UK employers need to know following the September 2026 changes
The Home Office has introduced important changes to the way sponsor licence holders manage access to the Sponsorship Management System (SMS).
From 9 September 2026, sponsors can no longer appoint new Level 2 Users. Existing Level 2 Users are being phased out and sponsors must take action by no later than 8 March 2027.
At the same time, the Home Office is introducing mandatory multi-factor authentication on a phased basis and taking action against SMS User accounts that have been inactive for 12 months or more.
These changes should not be treated simply as administrative or IT updates.
For some sponsors, failing to deal with inactive accounts could ultimately result in suspension and potentially revocation of the sponsor licence.
Employers should therefore review their SMS Users and Key Personnel arrangements now.
1. No New Level 2 Users From 9 September 2026
The Home Office is phasing out the Level 2 User role.
From 9 September 2026, sponsors can no longer appoint new Level 2 Users to their licence.
Organisations that already have Level 2 Users can retain them temporarily, but a Level 1 User must take action by no later than 8 March 2027.
Broadly, the sponsor will need to either:
- request a Level 1 User account for the existing Level 2 User, provided that person is eligible to become a Level 1 User; or
- deactivate the Level 2 User’s account.
After 8 March 2027, the Home Office will deactivate any remaining Level 2 User accounts.
Employers should therefore identify their existing Level 2 Users now rather than waiting until the deadline approaches.
2. Converting a Level 2 User Is Not Automatic
It is important not to assume that an existing Level 2 User can simply be changed into a Level 1 User.
The individual must satisfy the Home Office requirements for appointment as a Level 1 User.
The process also involves requesting a Level 1 User account for the individual. It is therefore sensible to deal with this well before the March 2027 deadline.
This may be particularly important for larger organisations where several people currently have access to the SMS.
3. Agency Workers Can No Longer Be Appointed as Key Personnel
There is an additional change that some employers could easily overlook.
From 9 September 2026, a worker supplied to the sponsor by an employment business or agency cannot be appointed as Key Personnel.
There are transitional arrangements for agency workers who were already Level 2 Users before 9 September 2026.
However, they cannot be converted to Level 1 Users or appointed to another Key Personnel role, and their Level 2 accounts must be deactivated by no later than 8 March 2027.
Employers that use agency or temporary staff to assist with sponsorship administration should therefore check their current arrangements carefully.
4. What About Outsourced HR Providers?
The rules are different for organisations using outsourced HR services.
An employee of a third-party organisation providing an outsourced HR function can, subject to the relevant requirements, be appointed as an additional Level 1 User.
However, that person cannot be the sponsor’s primary or sole Level 1 User.
This is an important distinction for organisations that rely heavily on external HR or compliance support.
The sponsor must retain appropriate internal responsibility for its licence.
5. Multi-Factor Authentication Is Being Rolled Out
Another major development concerns multi-factor authentication (MFA).
The Home Office began introducing mandatory MFA on a phased basis from 3 September 2026 and expects it to be in place for all sponsors by November 2026.
For organisations granted a sponsor licence on or after 9 September 2026, MFA is mandatory.
For existing sponsors, the Home Office will contact the organisation with instructions when MFA is due to be enabled on its account.
This means that employers should not assume that every existing sponsor became subject to MFA on 3 September.
The rollout is phased.
6. How Will MFA Work?
Once MFA applies to the account, an SMS User must enter a one-time passcode (OTP) each time they access the Sponsorship Management System.
The passcode will generally be sent:
- by text message to a Level 1 User who has a valid mobile telephone number recorded on the SMS;
- by email to a Level 1 User without a valid mobile telephone number; or
- by email to a Level 2 User.
Level 1 Users may also be required to provide their date of birth when first accessing an MFA-enabled account using their mobile telephone, or following certain changes to their contact information.
Accurate SMS User details have therefore become even more important.
Sponsors should check that the relevant telephone numbers, email addresses and other personal information recorded for their users are correct.
7. Do Not Share SMS Passwords or MFA Codes
An SMS account belongs to the individual User.
The Home Office guidance makes clear that SMS Users must not give their password or MFA passcode to anyone else.
This is particularly important in organisations where several HR staff are involved with sponsored workers.
One person’s SMS login should not simply be shared around the HR department for convenience.
Each person who requires access should have the appropriate authority and access arrangements.
The Home Office also makes clear that the sponsor is responsible for anything done by anyone it has set up as an SMS User, including a person from outside the organisation.
The management of SMS access should therefore form part of an employer’s wider sponsor compliance procedures.
8. The Home Office Is Targeting Inactive SMS Accounts
One of the most significant changes concerns inactive SMS User accounts.
The Home Office treats an SMS User account as inactive where the user has not accessed it for 12 months or more.
Where inactive accounts are identified, the Home Office will contact the sponsor’s Authorising Officer and any affected inactive Level 1 User with instructions about the action that needs to be taken.
To retain access, an affected Level 1 User must log into the SMS, check their details and update them where necessary within three months of the Home Office contacting them.
The Home Office will not contact inactive Level 2 Users directly. Sponsors are responsible for identifying those users and taking the appropriate action.
9. What Happens If an Employer Does Nothing?
This is where the changes become particularly important.
If the required action is not taken within the three-month period, the Home Office will deactivate the relevant inactive SMS User accounts.
That could create a much more serious problem.
If deactivation leaves the organisation with no active Level 1 User, the Home Office will suspend the sponsor licence.
The sponsor will then have 28 days from the date of suspension to nominate at least one eligible Level 1 User.
If the sponsor fails to do so, the Home Office states that the licence will normally be revoked.
Where the licence is revoked solely because the sponsor ceased to have an active Level 1 User through this particular inactive-account process, the normal sponsor licence cooling-off period does not apply.
Nevertheless, suspension or revocation of a sponsor licence can have serious consequences for an organisation and its sponsored workforce.
The practical message is straightforward: employers should not allow responsibility for their SMS account to drift.
10. How Often Should Employers Check the SMS?
The Home Office recommends that a Level 1 User accesses the SMS at least once a month.
This allows the organisation to review the details recorded on its licence and keep up to date with relevant messages and forthcoming changes.
The Home Office also recommends that the Authorising Officer checks the Certificates of Sponsorship assigned to workers at least once a month.
These are useful internal compliance practices even for organisations that do not regularly assign new Certificates of Sponsorship.
A sponsor licence should not simply be obtained and then left untouched until the organisation needs to sponsor another worker.
11. What Should Sponsor Licence Holders Do Now?
The September changes provide a good opportunity to carry out an immediate SMS and Key Personnel review.
Employers should consider:
- Identifying every Level 1 and existing Level 2 User currently attached to the licence.
- Checking whether each User still works for, or remains appropriately connected with, the organisation.
- Checking whether every User still requires SMS access.
- Identifying existing Level 2 Users who will need to become Level 1 Users.
- Checking whether those individuals actually satisfy the Level 1 User eligibility requirements.
- Requesting Level 1 User accounts for eligible individuals where appropriate.
- Deactivating Level 2 Users who will not be moving to Level 1 status by no later than 8 March 2027.
- Identifying any agency workers currently acting as Level 2 Users and planning for their accounts to be deactivated by the deadline.
- Reviewing arrangements involving outsourced HR providers.
- Checking whether any SMS User accounts have been inactive for a significant period.
- Ensuring the personal and contact information recorded for SMS Users is accurate in preparation for MFA.
- Reminding all SMS Users that passwords and MFA passcodes must not be shared.
- Putting in place a process for a Level 1 User to review the SMS regularly.
- Ensuring the Authorising Officer maintains appropriate oversight of Certificates of Sponsorship and the organisation’s sponsorship arrangements.
12. Do Not Wait Until March 2027
Although existing Level 2 Users can remain temporarily, employers should avoid treating 8 March 2027 as the date on which they need to start dealing with the issue.
An internal review may reveal that:
- former employees still have SMS accounts;
- an existing Level 2 User cannot satisfy the Level 1 eligibility requirements;
- an agency worker is currently involved in sponsorship administration;
- an external HR provider is being relied upon too heavily;
- SMS User contact information is out of date; or
- there is no clear internal responsibility for regularly reviewing the SMS.
These problems are easier to resolve now than immediately before a Home Office deadline or during a compliance issue.
Sponsor Licence Compliance Is an Ongoing Responsibility
The September 2026 SMS changes illustrate a wider point about the sponsorship system.
Obtaining a sponsor licence is only the beginning.
Licensed sponsors have continuing duties concerning their sponsored workers, record keeping, reporting, Key Personnel and management of the licence itself.
The Home Office can take compliance action where those responsibilities are not met.
Employers should therefore periodically review their sponsorship systems rather than waiting for a Home Office compliance visit, an urgent Certificate of Sponsorship request or a problem involving a sponsored worker.
How Atwal Law Can Help
Atwal Law provides specialist UK immigration and sponsor licence advice to employers.
We can assist organisations with:
- sponsor licence applications;
- sponsor compliance reviews;
- SMS and Key Personnel issues;
- Certificates of Sponsorship;
- sponsor reporting obligations;
- changes affecting sponsored workers;
- preparation for Home Office compliance activity; and
- ongoing sponsor licence and immigration support.
Through Atwal Shield, we also provide practical immigration support designed to help HR teams and managers keep on top of changes affecting sponsor licence holders and international employees.
If your organisation holds a sponsor licence and has not recently reviewed its SMS Users or Key Personnel arrangements, the September 2026 changes provide a good reason to do so now.
Atwal Law
UK Immigration Lawyers
Coventry | Birmingham | London | UK-wide online advice
This article is for general information only and does not constitute legal advice. Immigration Rules, sponsor guidance and Home Office procedures can change. Employers should obtain advice based on their individual circumstances.