The Home Office has confirmed that Multi‑Factor Authentication (MFA) will be introduced for all Sponsorship Management System (SMS) users on a phased basis from 3rd September 2026 and is expected to apply to all work route sponsors by November 2026.
If you are a work route sponsor, you must ensure that SMS user details (particularly for Level 1 Users) are correct and that internal teams understand the MFA registration process to avoid disruption to access and sponsorship operations.
How will MFA work on the SMS?
Once MFA is enabled, every SMS login will require:
The user's SMS username and password; and
A one‑time passcode (OTP) sent to the user.
The way the OTP is delivered depends on the user's level and the contact details recorded in the SMS:
Level 1 Users with a valid mobile phone number will receive an OTP sent by text message to the registered mobile phone; and
Level 1 Users without a valid mobile phone number, and all Level 2 Users will receive an OTP sent by email to the registered email address.
Level 1 Users will also need to provide their date of birth when they first log into an MFA‑enabled account using a mobile phone; or if they subsequently change their mobile phone number or email address on the SMS.
You should therefore ensure that the correct date of birth and mobile phone number and email address are recorded for every Level 1 User on the licence, and that the correct email address is recorded for all Level 1 and Level 2 Users. Once the new operational system is in place, it will no longer be possible to add Level 2 Users although further Level 1 Users may continue to be added as required.
What additional guidance is there about the new MFA requirements?
The Home Office will send sponsors a link to the MFA guidance when it confirms the MFA start date on their licence. The Home Office stresses the importance of reading the MFA guidance in full before MFA is enabled and keeping it open during set-up and first login.
Failure to complete the preparation steps may result in difficulties accessing SMS when MFA is enabled. The guidance covers:
Checking your sponsor licence details;
Preparing your SMS account for MFA;
Completing MFA registration;
Troubleshooting common issues;
Answers to common questions; and
How to access support.
You should ensure the preparation steps are completed to avoid difficulties accessing the SMS once MFA is enabled.
For guidance on the rules on sponsoring workers, contact our business immigration solicitors.
