New Sponsor Management System security rules affect UK worker sponsors
28 Sep 2026
If you're on a Skilled Worker, Health and Care Worker, or Scale-up Worker visa, your right to stay depends on your employer keeping their sponsor licence in good order. The Home Office has just updated its guidance for sponsors covering how they manage the Sponsor Management System (SMS), the online portal employers use to sponsor workers and report changes.
From 03 September 2026, the Home Office began requiring multi-factor authentication to log into the SMS. The updated guidance states that "the Home Office has begun introducing mandatory multi-factor authentication" and that users "will no longer be able to access the SMS using only their username and password, instead being required to complete an additional authentication step." From 09 September 2026, sponsors can no longer appoint new "Level 2 Users" on the system. Existing Level 2 Users can stay on during a transitional period, but must either be upgraded to a Level 1 User or have their account deactivated.
None of this is something you do yourself, it's your employer's HR or immigration team who manage the SMS. But it's worth knowing about, because the guidance also says that sponsors should "ensure that all current users have accurate contact details recorded on the SMS" and "review whether existing Level 2 Users should be upgraded to Level 1 Users, remove obsolete accounts." If your employer lets their SMS accounts go stale, it can put their sponsor licence at risk, which in turn affects your Certificate of Sponsorship and any future extension or ILR application. The guidance does clarify that a licence revoked solely because of the inactive SMS account process will not trigger the tougher "cooling-off" restrictions that apply to more serious compliance breaches, but a lost or suspended licence is still disruptive to your visa status.
If you're not sure whether your employer's sponsor status is affected, it's reasonable to ask your HR or immigration team whether they've reviewed their SMS user accounts since these changes took effect. This is not something you can check yourself on GOV.UK.
Sources: