SMS multi-factor authentication and the end of Level 2 users: dates and a checklist

1. What MFA asks of each user

L4.67. We have been trialling the use of MFA on a voluntary basis with a limited number of sponsors since November 2025. We will introduce mandatory MFA on a phased basis, beginning on 3 September 2026, and expect this to be in place for all sponsors by November 2026. Mandatory MFA will be enabled for any organisation granted a sponsor licence on or after 9 September 2026.

L4.68. MFA requires the user to enter a one-time passcode, in addition to their user name and password, each time they wish to access their SMS account.

The passcode goes by text message to a Level 1 user with a valid mobile number, and by email to a Level 1 user without one and to every Level 2 user (L4.68). The guidance points to SMS User Manual 13 for detailed instructions (L4.71), and says the Home Office will contact the sponsor when MFA is due to be enabled on its account. We have not reproduced the manual here.

L4.84. You must ensure we have a current email address for your SMS Users, as well as a current mobile phone number and correct date of birth for your Level 1 Users. This is to ensure they can use multi-factor authentication when they access the SMS.

The date of birth matters at first login: “For Level 1 Users, a valid date of birth will be required when they attempt to log into an MFA-enable account for the first time using a mobile phone, or if they subsequently change their phone number or email address when logging into SMS” (L4.69).

2. Level 1 and Level 2: who can hold each

A Level 1 user does the day-to-day work on the SMS: assigning Certificates of Sponsorship, reporting worker activity, telling the Home Office about changes, and deactivating other SMS users (L4.43). A Level 2 user has fewer permissions:

L4.60. Level 2 Users have fewer permissions than Level 1 Users. Level 2 Users can only perform the following actions in SMS: create and assign CoS to workers; report worker activity to us relating to CoS they have personally created and assigned, or which have been transferred to them by a Level 1 User

L4.18. You cannot nominate a representative as a Level 1 User when you first apply for your licence. You must first ‘appoint’ them as your representative. When you have been granted a licence, you can then nominate that person as an additional Level 1 User. If you have only one Level 1 User, that person must not be a representative

L4.15. You are responsible for anything done by anyone you have set up as an SMS User, including people from outside your organisation. If we are considering taking action against you, we will treat anything done on your behalf by a person from outside your organisation as if it were done by you.

L4.19 adds that a representative must be based in the UK, and that you should check they are suitably qualified to provide immigration advice or immigration services. The guidance also says you must have at least one Level 1 user throughout the life of the licence (L4.47).

3. The Level 2 deadline: convert or deactivate

L4.58. From 9 September 2026, you can no longer appoint Level 2 Users to your licence. If you have any existing Level 2 Users, your Level 1 User must either: convert them to Level 1 Users if they meet the requirements for Level 1 Users and you still wish them to have SMS access to your licence; deactivate their account

L4.59. You must take this action by no later than 8 March 2027. After that date, we will deactivate the accounts of any Level 2 Users you still have.

The choice is the sponsor’s, made person by person. Ask of each Level 2 user: do they still need SMS access, and would they meet the Level 1 requirements for who can hold the role (table above)? If both answers are yes, a Level 1 user converts them. Otherwise a Level 1 user deactivates the account. Anyone supplied by an employment business falls into the second group (L4.65). Level 2 users who work for your HR provider or are a UK-based representative are covered by the same dates (L4.16, L4.20).

4. Account hygiene

Passwords and passcodes are not shared

f. Any of your sponsorship management system (SMS) Users disclose their SMS password or their multi-factor authentication one-time passcode to another person.

Each user needs their own login and, in effect, their own phone or email. The guidance says the email addresses for Key Personnel “must be secure, personal to, and only accessible by, the named individual” (L4.81). A shared mailbox such as a general HR address does not fit that wording.

Inactive accounts

L4.72. A user account is considered to be inactive if the user hasn’t accessed it for 12 months or more. We will deactivate any such accounts unless you take the action described in paragraphs L4.73 to L4.76 below.

When the Home Office contacts the Authorising Officer and any inactive Level 1 user, the Level 1 users must log in and check their details within 3 months of the date of contact (L4.73, L4.74). After that the accounts of inactive SMS users are deactivated (L4.77). If that leaves no active Level 1 user, the licence is suspended, with 28 days from suspension to nominate one, and the licence is normally revoked if that is not done (L4.78). Inactive Level 2 users are not contacted directly: finding them is the sponsor’s job (L4.75).

Leavers and changes

L4.76. If you identify any Level 1 or Level 2 Users you no longer wish to have access, a Level 1 User must deactivate the accounts of those users.

C2.4. A Level 1 User on your licence must access SMS and use the ‘request changes to licence details’ or ‘Manage Level 1 and 2 users’ functions to: replace your Authorising Officer or Key Contact; amend your current Authorising Officer’s or Key Contact’s details; amend or update their own Level 1 User details, or those of any Level 2 Users currently active on your licence; add or remove other Level 1 Users, as required

The Authorising Officer is responsible for the activities of all SMS users, and the guidance says you must have a system in place to check them (L4.37). A person who leaves, or whose phone number or email changes, is a change to make on the SMS the same week, not at the next audit: an MFA code sent to a leaver’s phone is a code someone else may receive.

5. Checklist

For the records an SMS user may be asked to produce at a visit, see Appendix D: the records to keep and what a compliance visit checks.

How SponsorGuard handles this

SponsorGuard keeps a Key Personnel and SMS users register for the licence: the Authorising Officer, the Key Contact and every SMS user, with their level. For each SMS user it records whether the email, mobile number and date of birth needed for MFA are on file, and the date of their last login, with a flag when an account is approaching the 12 months in L4.72. An existing Level 2 user is flagged against 8 March 2027, and a new Level 2 user dated on or after 9 September 2026 is refused with the paragraph. Reminder emails go to the account owner and administrators as dates approach. The register records what you tell it. It does not log in to the SMS, and the Home Office record remains the one that counts.

Questions people ask

Sources

• Workers and Temporary Workers: guidance for sponsors, Part 1: apply for a licenceVersion 08/26, valid from 28 August 2026 (GOV.UK page updated 3 September 2026); retrieved 2 October 2026 · GOV.UK
• Workers and Temporary Workers: guidance for sponsors, Part 3: sponsor duties and complianceVersion 08/26, valid from 3 August 2026 · GOV.UK

SponsorGuard provides compliance software and record-keeping tools. It is not a law firm or an immigration adviser and does not give legal or immigration advice, which are regulated activities (Immigration and Asylum Act 1999, section 84). This page describes what the published Home Office guidance and the Immigration Rules say, with the paragraph for each point, so you can read the source yourself. Guidance versions and figures are those in force on the date shown; the Home Office changes them, so check the current version before you rely on any of it.