Mandatory Multi-Factor Authentication Coming to Sponsor Licence Holders

The Home Office has announced the phased introduction of mandatory Multi-Factor Authentication (MFA) for all Sponsorship Management System (SMS) users. The change is intended to strengthen security and reduce the risk of unauthorised access to sponsor licence accounts.

The rollout will begin on 3 September 2026 and is expected to be completed for all sponsors by November 2026.

What is MFA?

Multi-Factor Authentication adds an additional layer of security to an account by requiring users to verify their identity using more than one method before they can gain access.

For SMS users, this means that, in addition to entering a username and password, users will be required to enter a one-time passcode (OTP) each time they log in.

The Home Office has been testing MFA with a limited number of sponsors since November 2025 and will now make its use mandatory across all sponsor licence holders.

How Will MFA Work?

When signing into the Sponsorship Management System, users will receive a one-time passcode which must be entered to complete the login process.

The method used to receive the passcode will depend on the user’s role:

Level 1 Users

For Level 1 Users, the OTP will be sent by text message to the mobile telephone number recorded on the SMS account.

To access an MFA-enabled account, Level 1 Users must have:

• A valid date of birth recorded on the system;
• A valid mobile telephone number; and
• A current email address.

The Home Office has advised that users may also be required to verify their date of birth if they later update their contact details.

Level 2 Users

For Level 2 Users, OTPs will be sent to the email address recorded on SMS. Sponsors should therefore ensure that all email addresses are accurate and up to date.

Changes to Level 2 Users

The new MFA functionality brings an important change for sponsors.

Once MFA is introduced, sponsors will no longer be able to add new Level 2 Users to their sponsor licence account. Sponsors will, however, continue to be able to appoint new Level 1 Users where required.

Organisations that currently rely heavily on Level 2 Users may wish to review their SMS user structure and ensure that appropriate Level 1 User coverage is in place.

What Should Sponsors Do Now?

Sponsors should review their SMS account details as soon as possible to ensure they are ready before MFA is enabled.

The Home Office recommends that sponsors:

• Log into SMS and review all user details;
• Check that email addresses are correct for all users;
• Verify mobile telephone numbers for Level 1 Users;
• Ensure dates of birth are accurate for all Level 1 Users; and
• Read the Home Office MFA User Guide before implementation.

Failure to update user details could result in delays or difficulties accessing SMS once MFA becomes mandatory

Beware of Fraudulent Communications

The Home Office has reminded sponsors to remain vigilant against phishing attempts and fraudulent communications.

The Home Office will never:

• Ask for your password, SMS User ID or date of birth;
• Send you a password for SMS;
• Send a link requiring you to log into SMS; or
• Send a one-time passcode that has not been requested through the SMS login process.

Any concerns regarding suspicious emails, calls or potential account compromise should be reported immediately to the Home Office Business Helpdesk.

How Field Seymour Parkes Can Help

The introduction of mandatory MFA is another reminder of the importance of maintaining accurate sponsor licence records and ensuring ongoing compliance with sponsor duties.

If you have any questions about the MFA rollout, your sponsor licence duties, or would like support reviewing your SMS user arrangements, please contact our Immigration Team at immigration@fsp-law.com