Employers · Guide

Sponsor Management System changes 2026: what small employers need to do before March 2027

The Home Office changed how sponsors log in to the Sponsor Management System in September 2026. For a small business where one person holds every role, the changes add a new way to lose a licence without breaking any other rule.

Vishal Gautam, IAA-regulated adviser (Level 1)
Last reviewed 21 October 2026 · 4 min read

Our service

Sponsor Management System help

User roles, log-in and day-to-day SMS support for sponsors.

Find out more

Rules checked 21 October 2026. Every rule comes from the Home Office sponsor guidance, Part 1, version 08/26 (published 28 August 2026), quoted by paragraph. Rules change, so check the date before you rely on it.

Every few months, the office manager at a small engineering firm in Wolverhampton logged in to the Sponsor Management System, checked the details of the one worker the firm sponsors, and logged out again. She was a Level 2 user, which meant she could do the routine work without being one of the firm’s named key people. The director, who held every other role, hadn’t logged in himself for over a year. He didn’t need to. She did it for him.

In September 2026 the Home Office changed the rules on who can log in and how often, and that arrangement became a risk to the firm’s licence, even though nothing about its sponsorship had gone wrong.

The firm is a composite of common situations, not a client.

What changed in September 2026

The Home Office published version 08/26 of its sponsor guidance on 28 August 2026. Part 1 of that guidance brought in three changes to the Sponsor Management System, the online account every licensed sponsor uses to assign certificates and report changes:

Logging in now needs a code as well as a password (two-step log-in).
Level 2 users are being phased out. No new ones can be added, and existing ones have to go by 8 March 2027.
An account that hasn’t been opened for 12 months is treated as inactive, and a licence left with no active Level 1 user can be suspended and then revoked.

Your reporting duties are unchanged, but a licence can now be lost simply because nobody has logged in for a year.

Two-step log-in: who needs what

The Home Office began introducing two-step log-in on 3 September 2026, in phases, and expects every sponsor to have it by November 2026 (Part 1, L4.67). Licences granted on or after 9 September 2026 have it from the start.

For it to work, each Level 1 user’s mobile number, email address and date of birth must be correct in the system (L4.69, L4.84). If they aren’t, the person who needs to log in on a deadline may find they can’t.

Sharing a password or a log-in code with someone else is a ground for revoking a licence (Annex C3(f), L10.6), and two-step log-in makes a shared account harder to hide. If two people in your office have been using one log-in, give each of them their own.

Quick check

Is your SMS set up correctly? Six questions, one minute

Nothing is saved or sent. This is a general guide, not advice on your case.

Do you have a Level 1 User who is your employee, director or partner and a settled worker?Settled worker: for example a British or Irish citizen, or someone with indefinite leave or EU settled status. Licensed before 1 January 2025? Two users can meet these between them.
Is your Authorising Officer still with you, and the most senior person responsible for sponsorship?They can’t log in to the SMS unless they’re also a Level 1 User.
Have you upgraded or deactivated every Level 2 User?Do it by 8 March 2027. Agency staff can’t be upgraded.
Has every SMS User logged in within the last 12 months, with their own email, mobile number and date of birth on record?These are needed for multi-factor authentication.
Does someone check the certificates your users assign, at least monthly?UKVI recommends your Authorising Officer does this.
Do you know your certificate allocation and when your CoS year ends?Unused certificates don’t carry over.

Answer the questions to see where you stand.

Level 2 users: the 8 March 2027 deadline

A Level 2 user could carry out day-to-day tasks without being one of the named key people on the licence. From 9 September 2026 you can no longer appoint new Level 2 users. Any you already have must be upgraded to Level 1 or removed by 8 March 2027. After that date, the Home Office will deactivate the accounts itself (L4.4, L4.58 to L4.59).

If a Level 2 user does your routine SMS work, decide now whether they’ll become a Level 1 user. Check they’re eligible for the role before you make the change.

The 12-month rule for unused accounts

This is the change most likely to catch out a sponsor with one or two workers, because the steps run on a timetable whether or not anyone is watching the inbox.

Step	What happens	Guidance
1	A user hasn’t logged in for 12 months: the account is treated as inactive	L4.72
2	UKVI contacts the Authorising Officer and the inactive Level 1 users, who must log in and check their details within 3 months	L4.73 to L4.74
3	Inactive Level 2 users aren’t contacted. Finding them is up to you	L4.75
4	If nothing is done, the accounts are deactivated	L4.77
5	If that leaves no active Level 1 user, the licence is suspended and you have 28 days to nominate one. If you don’t, the licence will normally be revoked	L4.78

If a licence is revoked only because of this process, the cooling-off period that normally stops a sponsor from applying again doesn’t apply (L4.79). You could apply for a new licence straight away, though you’d still have lost the old one and your sponsored workers would be affected.

The Home Office recommends that a Level 1 user logs in at least once a month (L10.4), which for a small sponsor is the easiest way to stay clear of the whole process.

Who can hold the roles now

Every licence needs an Authorising Officer and at least one Level 1 user for as long as it exists. Without them, the Home Office says it will revoke the licence (L4.6). Key people must normally be based in the UK (L4.3, L4.8). Since 9 September 2026, someone supplied to you by an employment agency can no longer be one of your key people (L4.14).

If your only Level 1 user is about to leave, go on long leave or retire, add a second one first.

A 15-minute check for this week

Who in your business can log in to the Sponsor Management System today? Write the names down.
When did each of them last log in?
Are their mobile numbers, email addresses and dates of birth correct?
Do you have any Level 2 users? If so, what’s the plan for each before 8 March 2027?
Is anyone sharing a log-in?
Is any of your key people supplied through an agency?

If any answer worries you, talk to us before the Home Office does.

Free guide · 5 pages · PDF

What your sponsor licence asks of you and when, as a printable calendar for whoever looks after your licence.

Every reporting deadline in one table
The September 2026 changes to the sponsor system
A month-by-month calendar

Sources

Home Office, Workers and Temporary Workers: guidance for sponsors, Part 1: apply for a licence, version 08/26 (published 28 August 2026), section L4 (L4.3, L4.4, L4.6, L4.8, L4.14, L4.58 to L4.59, L4.67, L4.69, L4.72 to L4.79, L4.84), L10.4, L10.6 and Annex C3(f). Checked 21 October 2026.
Home Office, Sponsor Management System user manual 13 (updated 2 October 2026).

You’ve reached the end. Want us to look at your own situation against the current rules?

Book a consultation

About the author

Vishal Gautam

Principal adviser at V Immigration Ltd, regulated by the Immigration Advice Authority at Level 1 (organisation F202638454). Vishal advises individuals and employers in Birmingham and London. Appeals and complex cases are referred to a solicitor or higher-level adviser.

This article is general information, current at the date shown. It is not legal advice on your case.

Keep reading