The Home Office has published version 08/26 of its Worker and Temporary Worker sponsor guidance—the most sweeping rewrite since the sponsorship regime overhaul in 2020. From 3 September 2026 every organisation that holds a sponsor licence will see multi-factor authentication (MFA) switched on for all users of the online Sponsor Management System (SMS). New sponsor licences granted on or after 9 September already come with MFA enabled by default, and the department expects 100 % coverage by November. In parallel, the once-popular ‘Level 2 User’ role—often assigned to junior HR staff or external advisers for routine Certificate of Sponsorship (CoS) tasks—has begun a phased retirement. Companies can no longer appoint new Level 2 users, and all existing accounts must be upgraded or deactivated by 8 March 2027. Any licence left without an active Level 1 user because of dormant accounts now faces automatic suspension unless a replacement is nominated within 28 days. While ostensibly a cyber-security upgrade, the reforms signal a cultural shift: SMS governance is now inseparable from immigration compliance. If a Level 1 user loses access to a phone needed for MFA, the employer could miss the 10-day reporting deadline for changes in a migrant’s employment, triggering downgrades or even licence revocation. The guidance clarifies, however, that licences revoked solely for inactive user accounts will not incur the usual 12-month cooling-off period before a fresh application. Employers should take immediate action. First, audit all SMS users and delete or upgrade Level 2 accounts. Second, ensure at least two trained Level 1 users hold up-to-date contact details and backup authentication methods. Third, incorporate SMS access reviews into monthly HR compliance checks. Large multinationals may need to update internal policies on segregation of duties and cyber-risk, as well as refresh contingency plans for out-of-hours CoS assignments. For global mobility managers, the message is clear: treat SMS like any other mission-critical system. Build MFA onboarding into staff workflows, maintain resilient staffing for Level 1 duties, and brief senior leadership that immigration compliance now extends to IT credentials. Early adopters report the set-up takes less than five minutes per user but saves hours of anxiety during Home Office audits.
