The Home Office has confirmed that Multi‑Factor Authentication (MFA) will be introduced for all Sponsorship Management System (SMS) users on a phased basis from 3 September 2026. It is expected to apply to all work route sponsors by November 2026.

In an email communication to sponsors, the Home Office has stated that MFA is first scheduled to be enabled after business hours on 3 September 2026, so MFA‑based logins will be required from 4 September 2026.

If you are a work route sponsor, you must ensure that SMS user details (particularly for Level 1 Users) are correct and that internal teams understand the MFA registration process to avoid disruption to access and sponsorship operations.

What is changing for the SMS login process?

MFA adds an extra mandatory verification step when logging into the SMS, to protect your sponsor account from unauthorised access even if a password is compromised.

The Home Office will shortly update Part 1 and Part 3 the sponsor guidance for work route sponsors to reflect the introduction of mandatory MFA for all SMS users, although the date for this hasn't been confirmed.

How will MFA work on the SMS? 

Once MFA is enabled, every SMS login will require:

• The user's SMS username and password; and
• A one‑time passcode (OTP) sent to the user.

The way the OTP is delivered depends on the user's level and the contact details recorded in the SMS:

• Level 1 Users with a valid mobile phone number will receive an OTP sent by text message to the registered mobile phone; and
• Level 1 Users without a valid mobile phone number, and all Level 2 Users will receive an OTP sent by email to the registered email address.

For Level 1 Users, a valid date of birth will also be required in the following circumstances:

• When they first log into an MFA‑enabled account using a mobile phone; or
• If they later change their mobile phone number or email address on the SMS. 

You should therefore ensure that the correct date of birth and mobile phone number and email address are recorded for every Level 1 User on the licence, and that the correct email address is recorded for all Level 1 and Level 2 Users.

Importantly, once the new functionality is in place, you won't be able to add Level 2 Users to the licence. It will still be possible to add Level 1 Users as required.

What additional guidance is there about the new MFA requirements?

At the time the Home Office advises you of the specific MFA go-live date for your licence, you will be provided with a link to new MFA guidance. Your SMS users should read this before MFA is implemented on your licence, and refer to it when completing the setup process and logging in using MFA for the first time. The guidance covers:

• Checking your sponsor licence details;
• Preparing your SMS account for MFA;
• Completing MFA registration;
• Troubleshooting common issues;
• Answers to common questions; and
• How to access support. 

You should ensure the preparation steps are completed to avoid difficulties accessing the SMS once MFA is enabled. 

Security reminders and fraud awareness

The Home Office reiterates critical security points to maintain the integrity of SMS accounts. 

They will never:

• Ask for a user's date of birth, SMS user ID or password;
• Send a link or password for logging into the SMS;
• Send an email with a link to view messages or take further action on the SMS; or
• Send an OTP unless it has been requested by the user on the SMS. 

If you receive a suspicious email or telephone call, or have concerns that your SMS account may have been compromised, you should contact the Business Helpdesk at BusinessHelpdesk@homeoffice.gov.uk. 

If the Home Office receives information suggesting that an account has been compromised, they may take steps to secure the account, but will also notify key personnel this has happened and will advise on next steps.

Need further help?

If you have questions regarding MFA or need assistance with its implementation, you can contact MFACOC@homeoffice.gov.uk, quoting your organisation's name and sponsor licence number in the subject line of the email. 

For more general queries regarding this development or sponsorship requirements, please get in touch with a member of our Immigration Team.