The Home Office has published version 08/26 of both Part 1 (Apply for a Licence) and Part 3 (Sponsor Duties and Compliance) of its Workers and Temporary Workers sponsor guidance. Whilst many of the amendments are administrative, together they introduce the most significant changes to the operation of the Sponsor Management System (SMS) since the sponsorship regime was overhauled in 2020.
The principal changes include the introduction of mandatory multi-factor authentication (MFA), the phased withdrawal of the Level 2 User role, new procedures for managing inactive SMS accounts, and consequential amendments to the Home Office's approach to licence revocation where an organisation loses its licence solely because of inactive SMS users.
Although none of these amendments alter the substantive sponsorship duties imposed on employers, they demonstrate a clear shift in the Home Office's approach to sponsor governance. Increasingly, compliance is no longer concerned solely with whether sponsors meet their reporting and record-keeping obligations; it also extends to how sponsors administer access to the Sponsor Management System itself.
1. The Home Office is Treating SMS Governance as Part of Sponsor Compliance
One of the more interesting features of these updates is that the changes are spread across both Parts 1 and 3 of the guidance.
Part 1 now introduces new requirements governing who may access the SMS, how users authenticate themselves and how inactive accounts will be managed. Part 3, meanwhile, contains the corresponding compliance consequences where those administrative requirements are not met. Read together, the two guidance documents reinforce an important point: management of the SMS is an integral part of a sponsor's compliance obligations.
This reflects a broader trend in Home Office policy. Over recent years, sponsor compliance has expanded beyond ensuring sponsored workers are undertaking genuine employment into examining whether sponsors have appropriate internal governance, HR systems and oversight arrangements. The latest amendments continue that trajectory by focusing on the security and integrity of the systems through which sponsors discharge their duties.
2. Mandatory Multi-Factor Authentication
From 03 September 2026, the Home Office has begun introducing mandatory multi-factor authentication for users of the Sponsor Management System. Once enabled for a licence, users will no longer be able to access the SMS using only their username and password, instead being required to complete an additional authentication step.
At first glance, this appears to be little more than a cyber-security enhancement. However, its practical significance is much greater.
The Sponsor Management System is the mechanism through which sponsors assign Certificates of Sponsorship, report changes to sponsored workers, update key personnel and respond to Home Office requests. If authorised users cannot access the SMS because authentication details are inaccurate, linked devices are unavailable or access is concentrated in a single individual, sponsors may find themselves unable to comply with time-sensitive reporting obligations.
Sponsors should therefore view MFA not as an IT issue but as part of their wider compliance framework. Ensuring that user details are accurate, authentication methods remain accessible and sufficient trained personnel have access to the SMS will now be an essential component of good sponsor governance.
3. The Phased Withdrawal of the Level 2 User Role
Perhaps the most significant structural change is the Home Office's decision to phase out the Level 2 User role altogether.
From 09 September 2026, sponsors will no longer be able to appoint new Level 2 Users. Existing Level 2 Users will remain during a transitional period but must either be upgraded to Level 1 Users, where eligible, or have their accounts deactivated before the role is ultimately removed.
This represents a subtle but important shift in the way the Home Office expects sponsor licences to be managed.
Historically, many organisations have used Level 2 Users to delegate routine sponsorship functions to HR teams or external advisers whilst reserving broader responsibility for Level 1 Users. The removal of the Level 2 role will inevitably concentrate greater responsibility in a smaller number of authorised users. Sponsors will therefore need to review who currently manages their licence, whether existing governance arrangements remain appropriate and whether additional Level 1 Users should be appointed to ensure resilience.
For larger organisations in particular, this is likely to require more than simply changing user permissions. Internal authorisation processes, segregation of responsibilities and approval procedures may all need to be reconsidered.
4. Inactive SMS Accounts and Active Licence Management
The updated guidance also introduces a structured process for dealing with inactive SMS user accounts. Sponsors are expected to ensure that user accounts remain current and actively managed, with the Home Office now taking a more proactive approach where accounts become dormant.
This development is consistent with the wider emphasis on active sponsor management. The practical message is straightforward. Sponsors should not simply obtain a licence and leave it untouched until a Certificate of Sponsorship needs to be assigned. The Home Office increasingly expects sponsor licences to be actively administered throughout their lifetime.
5. A Welcome Clarification on Revocation
The corresponding amendment to Part 3 provides some welcome reassurance for sponsors.
The guidance now confirms that where a licence is revoked solely because of the inactive SMS account process, the enhanced cooling-off provisions will not apply. In other words, an organisation whose licence is revoked because it has failed to maintain active SMS users will not automatically face the same restrictions on making a fresh application as sponsors whose licences are revoked for substantive compliance breaches.
Although no sponsor will wish to find itself in that position, the distinction is a sensible one. Administrative failures relating to SMS account management do not necessarily indicate that a sponsor has exploited workers, breached immigration law or otherwise undermined the integrity of the sponsorship system. The revised guidance recognises that difference.
6. What Sponsors Should Do Now
Taken together, these changes should prompt sponsors to review not only their SMS users but also their wider governance arrangements.
Many organisations have accumulated user accounts over several years as staff have changed roles or left the business. Others continue to rely heavily on a single Level 1 User or have delegated operational responsibility to Level 2 Users whose role will shortly disappear. The latest amendments provide an opportunity to review those arrangements before they create operational difficulties.
Sponsors should ensure that all current users have accurate contact details recorded on the SMS, review whether existing Level 2 Users should be upgraded to Level 1 Users, remove obsolete accounts and consider whether responsibility for managing the sponsor licence is appropriately distributed within the organisation.
7. My View
Whilst the headline changes relate to authentication and user management, the broader message is one of increasing regulatory maturity.
The Home Office is steadily moving towards a sponsorship system in which good governance is measured not only by how sponsors recruit and monitor migrant workers, but also by how they control access to the systems through which sponsorship is administered. The Sponsor Management System is no longer simply an administrative portal; it has become a central component of the Home Office's compliance framework.
For sponsors, the lesson is clear. Robust internal governance, effective succession planning for key personnel and active management of SMS access should now be regarded as fundamental elements of sponsor licence compliance, rather than matters of administrative convenience.