Mandatory MFA for all SMS users: what sponsors need to know now

The Home Office is introducing mandatory Multi-Factor Authentication (MFA) for all Sponsorship Management System (SMS) users. MFA adds a one-time passcode (OTP) step to the existing username and password login. A phased rollout starts on 03 September 2026 and is expected to cover all work route sponsors by November 2026.

The Home Office has said in an email to sponsors that MFA will be enabled after business hours on 03 September 2026 and that MFA logins will be effective from 04 September 2026.

To maintain uninterrupted SMS access, Level 1 Users for work route sponsors should log into SMS before 3 September 2026, or the start date they have been given, and verify that their date of birth, mobile number and email address are correct. Staff should also review the MFA user guide and familiarise themselves with the registration process.

Operational implications and risks

MFA is an additional security layer requiring more than one verification factor to access an account, to protect sponsor accounts from unauthorised access even if a password is compromised.

Once registered for an MFA, all users on your licence will require a one-time passcode (OTP) in addition to their SMS username and password to access the SMS.

If user records are incomplete or inaccurate, MFA may fail and access to the SMS may be disrupted.

In particular:

• Level 1 Users with a valid mobile number will be sent the OTP by text message to the registered mobile number.
• Level 1 Users without a valid mobile number, and all Level 2 Users, will be sent the OTP to their registered email address.
• Level 1 Users will need to give a valid date of birth when logging into the MFA-enabled account for the first time using a mobile phone, or if they later change their phone number or email address when logging into the SMS.
• Level 1 Users must therefore ensure that their correct date of birth, phone number and email address has been recorded on the licence. The correct email address must have been recorded for all Level 2 Users.

The Home Office has also confirmed that sponsors will no longer be able to add Level 2 Users to the licence, although they may continue to add Level 1 Users.

MFA guidance

The Home Office will send sponsors a link to the MFA guidance when it confirms the MFA start date on their licence.  The Home Office stresses the importance of reading the MFA guidance in full before MFA is enabled and keeping it open during set-up and first login.

Failure to complete the preparation steps may result in difficulties accessing SMS when MFA is enabled.

The guidance covers:

• Checking your sponsor licence details;
• Preparing your SMS account for MFA;
• Completing MFA registration;
• Troubleshooting common issues;
• Answers to common questions; and
• How to access support. 

Security reminder

The Home Office reminds sponsors that they will never:

• ask for your date of birth, SMS user ID or password
• send you a link or password to log in to SMS
• send you an email with a link to view messages or take action on SMS
• send you an OTP you did not request on SMS.

If you receive a suspicious email or call, or if you suspect your SMS account has been compromised, please report it to the [email protected] immediately.
If the Home Office receives information suggesting your account has been compromised, they will take steps to secure it, including deactivating users, and will contact you with next steps.

Key action points (before 3 September or as soon as the Home Office has confirmed your MFA start date)

SMS users should log into the SMS and check the accuracy of their details (date of birth, mobile number and email address).

• Open the link to the MFA user guide and read it in full. Keep it available during set-up and your first MFA login.
• Communicate the change to all SMS users and schedule time for first MFA logins and any troubleshooting.
• Review your SMS users. Note that you will no longer be able to add Level 2 Users.

Further support

For MFA-specific queries only, contact [email protected]. Include your organisation’s name and sponsor licence number in the email subject line.

Please contact us if you have any questions about the MFA process or require any other immigration support.