In a significant compliance shake-up, the Home Office on 21 September confirmed the nationwide roll-out of mandatory multi-factor authentication (MFA) for organisations holding immigration sponsor licences. The new protocol, already activated for licences granted after 9 September, will be phased in for existing sponsors between now and early November. MFA adds a one-time passcode—delivered by SMS or email—to the traditional username-and-password login for the Sponsorship Management System (SMS). Companies can no longer create new Level 2 user roles, which will be abolished altogether in March 2027. Sponsors must therefore audit current users, upgrade essential Level 2 accounts to Level 1, and prune dormant profiles or risk licence suspension. The Home Office warns that data-change requests for Level 1 users (for example, correcting a date of birth) may take up to 18 weeks. Mobility specialists should act swiftly to verify that all Level 1 users have accurate contact details and valid mobile numbers before their MFA switch-on date arrives. Failure to do so could lock users out, halting the issuance of Certificates of Sponsorship and jeopardising project-critical assignments. Beyond IT housekeeping, the move signals the government’s drive to tighten audit trails ahead of a planned increase in civil-penalty tariffs for non-compliance in 2027. Early-adopter sponsors report minimal disruption but emphasise the importance of staff training and back-up administrators to cover annual leave. Practical tip: maintain at least two active Level 1 users at all times and diarise semi-annual user-account reviews. Organisations with large, decentralised mobility programmes may find it cost-effective to centralise SMS access within a dedicated compliance hub.
Source: Fragomen Immigration Alert
