The Home Office has introduced a number of important changes affecting Sponsor Management System (SMS) users, including mandatory multi-factor authentication (MFA), the removal of inactive user accounts and the phased withdrawal of Level 2 users.
These changes are designed to strengthen the security of sponsor licence accounts, improve oversight of licence activity and ensure sponsor records remain accurate and up to date.
Mandatory Multi-Factor Authentication (MFA)
The Home Office will begin introducing MFA for SMS users on a phased basis from 3 September 2026. Once MFA has been enabled on a sponsor licence, users will be required to enter a one-time passcode (OTP), sent by text message or email, in addition to their username and password each time they log into SMS.