United Kingdom: Mandatory Multi-Factor Authentication Rolls Out for Sponsor Licence Users

Existing sponsors 

Phased rollout began on September 3, 2026. The Home Office is allocating existing sponsors to onboarding cohorts and notifying them of their individual MFA activation date. The Home Office has indicated that most existing Work sponsors were expected to have been notified of their onboarding date by September 18, 2026; with all sponsors (including Study sponsors) to be notified by early November 2026. 

New sponsor licences 

Mandatory MFA is enabled for organisations granted a sponsor licence on or after September 9, 2026.  

Prepare for MFA 

Sponsors should use the MFA rollout to review their wider SMS user arrangements rather than treating MFA simply as a new login requirement.  

Sponsors should check that Level 1 Users have the correct date of birth, mobile number and email address recorded. Existing Level 2 Users must have a valid email address. These details are required to ensure users can continue to access SMS once MFA is enabled.  

Allow time for amendments 

Home Office communications to sponsors state that requests to change Level 1 User details which do not update automatically in SMS, including amending a date of birth, may take up to 18 weeks to consider.  

Where a date-of-birth amendment remains under consideration when MFA is enabled, the Home Office recommends that the Level 1 User selects email delivery of the one-time passcode until consideration is complete. 

Review Level 2 Users 

New Level 2 Users cannot be appointed from September 9, 2026. Existing Level 2 Users must be converted to Level 1 Users, where eligible and continued access is required, or deactivated by March 8, 2027. After that date, the Home Office will deactivate any remaining Level 2 accounts.  

Keep SMS users active 

An SMS user account is considered inactive if it has not been accessed for 12 months or more. Where the Home Office identifies an inactive Level 1 User, the user must log in and check or update their details within three months of the Home Office contacting them if they are to retain access.  

Maintain Level 1 access 

Sponsors must have at least one eligible Level 1 User throughout the life of the licence. If the inactive-user process leaves a sponsor without any active Level 1 Users, its licence will be suspended and it will have 28 days from suspension to nominate at least one eligible Level 1 User. Failure to do so will normally result in revocation.  

Ensure Authorising Officer oversight 

Authorising Officers are responsible for the activities of SMS users. The Sponsor Guidance recommends that the Authorising Officer checks Certificates of Sponsorship assigned to workers at least once a month.  

The Home Office has also confirmed that Authorising Officers and Key Contacts will receive email notifications when a new SMS user is added to the licence. This provides an additional means of identifying and overseeing changes to SMS access. 

Authorising Officers should ensure SMS user details are current, sufficient Level 1 access is maintained, inactive accounts are addressed and existing Level 2 Users are reviewed well ahead of the March 8, 2027 deadline. 

Keep SMS password and MFA passcode safe 

SMS users must not disclose their SMS password or MFA one-time passcode to another person. The updated Sponsor Guidance identifies this as a circumstance in which the Home Office may revoke the sponsor licence.