Discover the importance of Annaizu Compliance Management in today's business landscape and how a Home Office compliance management platform can help your business streamline its compliance efforts, reduce risks, and stay ahead of regulations.
Logging into the Sponsor Management System (SMS) is how a Level 1 user runs a sponsor licence day to day — assigning Certificates of Sponsorship, reporting changes, and managing who else in the organisation has access — and the login is tied to a named individual, not a generic company account.
Who is actually allowed to hold Level 1 access
A Level 1 user must be an employee, director or office holder of the sponsoring organisation itself — not an external immigration adviser, agent, or contractor — and must normally be based in the UK. Most sponsors have exactly one Level 1 user; the Home Office allows a second only in specific circumstances, such as a large organisation genuinely needing continuity of access. This sits alongside the wider structure covered in our guide to Level 1 users and key personnel.
Level 1 and Level 2 access are not the same login with different names
Sponsors that grow past a handful of sponsored workers usually add one or more Level 2 users so routine CoS work doesn't sit on a single desk. The distinction matters more than it looks: a Level 1 user can add, remove or restrict Level 2 logins, appoint another Level 1 user, and change the organisation's own registered details on the licence — a Level 2 login can do none of that. A Level 1 user can also narrow what a specific Level 2 login is permitted to do, for example limiting one to assigning CoS only, with no visibility into reporting or user management. What doesn't change with any of this delegation is accountability: the Home Office holds the licence, and by extension the Level 1 user and Authorising Officer, responsible for actions taken under any login on the account, including a mistake made by a Level 2 user acting within the access they were given.
What the login lets you do — and what it can't replace
SMS access lets a Level 1 user assign CoS, update key personnel, and submit the reports the licence requires. It does not do the underlying compliance work for you: assigning a CoS through SMS still depends on a valid right to work check having been completed correctly beforehand, following the share code checking process, and on immigration status having been verified through the proper online checking service rather than assumed from a passport copy. SMS records the sponsor's actions; it doesn't validate that the underlying checks were done properly.
SMS is also where reporting duties get discharged, not just where CoS get issued
It's easy to think of the login mainly as the tool for issuing Certificates of Sponsorship and to forget that it's also the actual channel for change-of-circumstances reporting, not an email to a caseworker or a letter to a Home Office address. Events that typically need to be reported through the system include, among others:
- a change to a sponsored worker's role, salary, work location or start date after the CoS was assigned
- a sponsored worker resigning, being dismissed, or simply not turning up to start the role
- a change to the organisation's name, structure, ownership or registered address
- a change to who holds a key personnel role, including the Level 1 user itself
None of these obligations pause because nobody can currently log in. A caseworker reviewing a late report is unlikely to treat 'the Level 1 user had left and access wasn't sorted out yet' as a satisfactory explanation, because keeping that access current is itself part of the duty.
The single-login risk most sponsors underestimate
Because Level 1 access is tied to one named person, a resignation, long-term absence, or role change without a prompt handover can effectively freeze a sponsor's ability to report changes or issue new CoS — itself a compliance failure, since reporting duties don't pause because the login is unavailable. The Home Office's sponsor duties guidance treats a lapse in key personnel accuracy as a reportable event in its own right, not an administrative footnote: Part 3 — sponsor duties and compliance.
Handling a handover before it becomes an emergency
The practical failure point is rarely the Home Office process itself — it's internal sequencing. If IT disables an outgoing Level 1 user's email account or single sign-on before the licence's key personnel record has been updated, the standard account-recovery route can stall at exactly the point it's needed, since SMS correspondence and password resets go to the registered contact details on file. The safer order is to update the key personnel record and confirm the new Level 1 user's access first, and only then decommission the departing employee's other accounts. An Authorising Officer's own login, kept current in parallel, is worth treating as a genuine fallback route rather than a formality. Building a standing reminder for key personnel reviews, rather than relying on someone remembering during an offboarding process, is the kind of gap that alerts tied to compliance deadlines are designed to close, and keeping a dated record of who held access and when supports the same audit trail as the underlying sponsorship records a caseworker may ask to see.
Common access questions
Can our immigration lawyer be our Level 1 user? No — Level 1 access is reserved for someone employed by, or holding office in, the sponsoring organisation. An adviser can typically be given a more limited user role, but not the top-level login.
What happens if the Level 1 user leaves without a handover? The organisation must appoint a replacement and update SMS promptly; access doesn't transfer automatically, and a prolonged gap here is itself something a caseworker will treat as a compliance weakness.
Can a Level 2 user assign a Certificate of Sponsorship? Yes, if the Level 1 user has granted that specific permission. Level 1 controls exactly what each Level 2 login can do, from full CoS assignment down to a narrow, read-only view.
Does SMS show our current sponsor licence rating? Yes — the A or B rating sits alongside CoS allocation and usage within the system, giving a live view of standing rather than something a sponsor has to ask the Home Office to confirm.
.svg)