Home Office introduces Mandatory Multi-Factor Authentication for Sponsor Management System Users: What Sponsors Need to Know

The Home Office has confirmed a phased roll-out of the Multi-Factor Authentication (MFA) for all Sponsorship Management System (SMS) users.  The introduction of MFA ensures an added layer of security and protects sponsor accounts from unauthorised access by requiring users complete an additional verification step to access their SMS account.  Introduced in phases from 3 September 2026, MFA is expected to reach all sponsors by early November 2026.

If you are an employer with a Sponsor Licence, you must ensure that the SMS account details (particularly for Level 1 users) are correct and that internal teams understand the MFA registration process to avoid the risk of access difficulties once MFA is enabled.

How will MFA Work?

Once MFA is activated for a Sponsor Licence, every SMS login will require:

 -         The user’s SMS username and password; and

-         A one-time passcode (OTP) generated during the login process.

 Users will receive their OTP dependent on their level and their account details recorded in the SMS:

 -         Level 1 users will receive their OTP via text message to the registered mobile phone number; and

-         Level 1 users without a valid mobile phone number and all Level 2 users, will receive an OTP sent to the email address recorded on their account.

 Changes to Users

Level 1 users will also be required to verify their date of birth when they first log into an MFA-enabled account using a mobile phone, of if they update a registered mobile phone number or email address on the SMS.

The Home Office have also announced it will soon no longer be possible to add Level 2 users to a Sponsor Licence. This was initially intended to be effective from 9 September 2026 but has now been delayed to an unspecified date. Sponsors are required to take action to either upgrade any existing Level 2 users to Level 1 users if eligible and if required by 8 March 2027 or alternatively deactivate their Level 2 accounts by this date. There is no change for sponsors being able to add Level 1 users to SMS accounts.

What Should Sponsors Do Now?

The Home Office advises that sponsors should take these preparation steps and read the MFA guidance in its entirety to ensure familiarity with the new system.

The guidance covers information on:

-         Checking your licence details;

-         Preparing your account for MFA;

-         Completing MFA registration;

-         Troubleshooting common issues;

-         Common questions and answers; and

-         How to access support if required.

These changes should prompt organisations to conduct a broader review of their Sponsor Licence arrangements and user details.  Once MFA is enabled, sponsors that fail to update user details could experience delays accessing the SMS to effectively maintain oversight of their Sponsor Licence responsibilities. 

 Beware of Fraudulent Communications

The Home Office stresses the need to remain cautious against phishing attempts or any suspicious communications.

 Sponsors should note that the Home Office will never:

 -         Ask for your date of birth, SMS user ID or your password;

-         Send you a link or password to log in to SMS;

-         Send you an email with a link to review messages or take further action on SMS; or

-         Send you an OTP when you have not requested one on SMS.

Any fraudulent communications should be reported and escalated internally.  When sponsors suspect their account has been compromised, they should report it to the Business Helpdesk at businessHelpdesk@homeoffice.gov.uk.

Further Support

If you have any further questions about the MFA rollout, or would like support reviewing your SMS account arrangements, please contact contact@eversageimmigration.com.