The Home Office has updated its Sponsor Management System (SMS) guidance, introducing mandatory multi-factor authentication (MFA) for all sponsor licence users and capping the number of account log-ins to two devices per user. The reforms, published on 24 September 2026, follow an investigation into credential-stuffing attacks that targeted professional-services firms earlier this year. From 15 October sponsors must register at least two Level 1 users and ensure each activates MFA via the gov.uk One Login app. The long-standing Level 2 user role will be phased out on 9 September 2027, forcing businesses to upgrade permissions or risk losing access. The Home Office says the measures will “align sponsor compliance with wider government cyber-security standards”. For HR and global mobility teams, the biggest operational change is a new requirement to review dormant accounts quarterly and to report compromised credentials within 24 hours. Failure to comply could trigger an unannounced compliance audit—something that already worries many SMEs given stretched resources. The guidance also warns sponsors not to store SMS passwords in shared spreadsheets, a common practice uncovered during recent audits. Experts advise conducting an immediate access review and updating internal policies, as the Home Office has introduced a fast-track downgrading mechanism that can suspend Certificates of Sponsorship issuance within 48 hours if serious breaches are found.
Source: Electronic Immigration Network
