Discover the importance of Annaizu Compliance Management in today's business landscape and how a Home Office compliance management platform can help your business streamline its compliance efforts, reduce risks, and stay ahead of regulations.
The way UK sponsor licence holders access and manage the Sponsorship Management System is changing. For employers sponsoring overseas workers, the SMS is one of the most important compliance systems in the organisation. It is where sponsors assign Certificates of Sponsorship, report changes, manage users and maintain information connected to their sponsor licence.
That also makes it an attractive target for fraud and phishing attacks.
Earlier in 2026, the Home Office warned sponsors to pay closer attention to SMS account security following concerns around phishing attempts designed to obtain sponsor login credentials. At that stage, the Home Office was also preparing to introduce Multi Factor Authentication, or MFA, to strengthen the SMS login process.
That change has now arrived.
From 3 September 2026, mandatory MFA began rolling out for SMS users. The Home Office has also introduced significant changes affecting Level 2 users and inactive SMS accounts. For sponsors, this is no longer simply an IT security issue. It is part of sponsor licence compliance.
What has changed with the Sponsor Management System?
There are three changes sponsors should pay particular attention to.
1. Multi Factor Authentication is now mandatory
From 3 September 2026, the Home Office introduced mandatory MFA for SMS users.
2. Level 2 users are being phased out
From 9 September 2026, sponsors can no longer appoint new Level 2 users.
Existing Level 2 users will need to be upgraded to Level 1 users, where eligible, or deactivated before the Level 2 role disappears after 8 March 2027.
3. Inactive SMS accounts are now a compliance concern
An SMS user account is considered inactive if it has not been accessed for 12 months or more.
The Home Office can deactivate inactive accounts and, if a sponsor ends up without an active Level 1 user, this can ultimately place the sponsor licence at risk.
Why has MFA been introduced for SMS?
- Sponsor Management System accounts contain sensitive information relating to sponsored workers, sponsor licences and organisational activity.
- A compromised SMS account could therefore have significant consequences.
- Phishing attacks may attempt to imitate Home Office communications and pressure users into clicking a link, entering login details or disclosing personal information.
- MFA adds another security layer so that possessing a username and password alone should not be enough to gain access.
- The Home Office describes MFA as an additional security measure intended to reduce the risk of unauthorised SMS access even where a password has been compromised.
How does the new SMS MFA login work?
- When MFA is enabled for an SMS account, users will continue to start with their individual SMS user ID and password.
- A one time passcode is then sent to the mobile number or email address associated with the user's SMS account.
- For Level 1 users, the process can also require the user's date of birth when setting up or amending their MFA details.
- The Home Office states that an OTP is valid for 10 minutes.
- This makes the accuracy of SMS user information particularly important.
- An outdated email address, old telephone number or incorrect personal information could prevent an authorised user from successfully completing the login process.
SMS security best practice sponsors should follow
MFA improves security, but it does not remove the threat of phishing. Sponsors should therefore continue to follow basic SMS security controls across their organisation.
Always access SMS through GOV.UK
Do not rely on a login link sent by email. The Home Office MFA guidance specifically tells sponsors to access the Sponsor Management System through GOV.UK.
Never share SMS login credentials
- An SMS user ID belongs to an individual user.
- User IDs, passwords and MFA passcodes should not be shared with colleagues, external consultants or other employees.
- Home Office guidance specifically states that SMS users must not give their password or MFA passcode to another person and warns that doing so could lead to action against the sponsor licence.
Treat unexpected OTPs as a warning sign
If an SMS user receives a one time passcode when they are not attempting to log in, someone else may be attempting to access the account.
Never provide that code to another person.
Review your SMS users
- Sponsors should regularly check who currently has access to SMS.
- Anyone who has left the organisation, changed role or no longer needs access should be reviewed and, where appropriate, deactivated.
- This is particularly important now that the Home Office is phasing out Level 2 users.
The Level 2 user role is disappearing
- The Home Office is making a significant change to the way SMS access is structured.
- From 9 September 2026, sponsors can no longer appoint new Level 2 users.
- Existing Level 2 users can continue temporarily, but sponsors need to decide whether those individuals should become Level 1 users, assuming they meet the relevant eligibility requirements, or whether their access should be removed.
- The Level 2 role is scheduled to cease after 8 March 2027.
- This means organisations should not wait until 2027 to review their access structure.
- Sponsors with several people involved in immigration, HR and compliance should start mapping who genuinely needs SMS access and who will be responsible for specific sponsorship activities.
Inactive SMS accounts could put your sponsor licence at risk
- The latest Home Office guidance also introduces a clearer process for inactive SMS user accounts.
- An account is considered inactive where it has not been accessed for 12 months or longer.
- Where the Home Office identifies inactive users, it can contact the Authorising Officer and relevant Level 1 users and require action.
- Level 1 users asked to take action have three months from the date of contact to access their account and check or update their information.
- If the required action is not taken, inactive accounts can be deactivated.
- The consequences become much more serious if this leaves the organisation without an active Level 1 user.
- In that situation, the Home Office guidance states that the sponsor licence can be suspended and the organisation given 28 days to nominate at least one eligible Level 1 user.
- Failure to do so would normally result in revocation of the licence.
- This makes SMS access management a genuine sponsor licence governance issue rather than simple account administration.
How often should a Level 1 user access SMS?
- The latest sponsor guidance recommends that a Level 1 user accesses the Sponsor Management System at least once a month.
- This gives the organisation an opportunity to review the licence, check messages from the Home Office, verify user access and identify any information that may need updating.
- For larger sponsors, this should ideally form part of a documented monthly sponsor compliance process.
What should UK sponsors do now?
- There are several practical actions employers should take.
- Review every SMS user. Identify current Level 1 users and any remaining Level 2 users.
- Check personal information. Make sure relevant email addresses, mobile numbers and Level 1 user information are correct.
- Review your Level 2 users. Decide who should be upgraded to Level 1 access where eligible and who should be removed.
- Make monthly SMS access part of your compliance routine. The Home Office specifically recommends monthly access by a Level 1 user.
- Never share credentials or OTPs. Each authorised individual should use their own account.
- Access SMS through GOV.UK. Avoid logging in through links contained in unsolicited emails.
- Document your process. Access management, reporting and sponsor licence administration should form part of a broader compliance record rather than relying on individual memory.
How Annaizu helps employers manage SMS and sponsor compliance
Managing the Sponsor Management System is only one part of maintaining a sponsor licence.
Employers also need to track sponsored workers, reporting deadlines, immigration documents, Certificates of Sponsorship, organisational changes and ongoing Home Office compliance obligations.
This becomes increasingly difficult when information sits across spreadsheets, inboxes, HR systems and individual members of staff. Annaizu combines sponsor compliance technology with immigration support to help employers create a more structured process.
With Annaizu Sponsor Management System Support, employers can receive assistance with SMS setup and maintenance, role management, Certificate of Sponsorship activity and ongoing sponsor licence administration.
Annaizu can help organisations with:
- SMS user and role management : Review who has access, maintain appropriate Level 1 arrangements and prepare for the removal of Level 2 access.
- Certificate of Sponsorship support : Maintain a clearer process around CoS allocation, assignment and associated sponsored worker records.
- Change of circumstance reporting : Help teams identify changes that may need to be reported through the Sponsor Management System.
- Sponsor compliance monitoring : Bring sponsorship records, worker information and compliance activity into a more structured workflow.
- Audit preparation : Review processes and records before a Home Office compliance visit rather than waiting for a problem to appear.
- Ongoing immigration support : Access regulated immigration support alongside the technology used to manage workforce compliance.
The objective is not to replace the Home Office Sponsor Management System. It is to make the processes surrounding SMS more organised, visible and easier to manage.
SMS access is now part of sponsor licence risk management
The introduction of MFA is important, but the broader message from the Home Office is arguably even more significant.
Sponsors are expected to know who has access to their licence, keep their user information current, regularly access SMS and maintain appropriate Level 1 coverage.
At the same time, phishing attempts are becoming more sophisticated and the Level 2 user model is being phased out.
For employers sponsoring multiple workers, SMS management should therefore sit within a documented sponsor compliance process rather than depending on one person's inbox or memory.
A monthly check may take relatively little time.
Recovering from lost SMS access, missed reporting duties or sponsor licence action could be considerably more difficult.
Frequently Asked Questions
Is MFA now mandatory for the Sponsor Management System?
Yes. The Home Office introduced mandatory MFA for SMS users from 3 September 2026.
What information is required for SMS MFA?
Users begin with their SMS user ID and password and then complete MFA using a one time passcode sent to the relevant registered mobile number or email address. Level 1 users may also need to verify their date of birth when configuring or changing MFA details.
Can sponsors still create Level 2 SMS users?
No new Level 2 users can be appointed from 9 September 2026. Existing Level 2 users need to be reviewed before the role disappears after 8 March 2027.
When is an SMS user considered inactive?
The Home Office considers an account inactive where the user has not accessed it for 12 months or more.
How often should sponsors log into SMS?
Current Home Office guidance recommends that a Level 1 user accesses the account at least once a month.
Can Annaizu manage sponsor compliance alongside SMS?
Annaizu provides Sponsor Management System support alongside sponsor licence guidance, CoS assistance, compliance monitoring and related immigration services.
Keep your sponsor licence processes organised
SMS access, sponsored worker records, reporting responsibilities and Home Office compliance should not sit across disconnected spreadsheets and inboxes.
Annaizu brings sponsor compliance technology and immigration support together so your team can manage sponsorship with greater visibility and control.
Manage your workforce. Maintain your compliance. Stay audit ready.
.svg)