Mandatory MFA for Sponsor Management System Users: What Sponsors Need to Know
- 02 September 2026
- Immigration
Keep up to date with the latest tips, analysis and upcoming events by our legal experts, direct to your inbox.
The Home Office is introducing a significant security change to the Sponsor Management System (SMS). From 3 September 2026, the Home Office will begin a phased rollout of mandatory Multi-Factor Authentication (MFA) for SMS users. The rollout is expected to extend to all work-route sponsors by November 2026.
Sponsors should take action now to ensure that their SMS users can continue to access the system and that there is no disruption to their sponsorship activities.
What is changing?
The SMS is the online system through which licensed sponsors manage their sponsor licence and undertake key sponsorship functions. This includes assigning Certificates of Sponsorship (CoS), reporting changes in sponsored workers’ circumstances, reporting changes to the organisation and managing the sponsor licence.
At present, SMS users primarily access the system using their user ID and password. The Home Office is introducing MFA as an additional security measure designed to reduce the risk of unauthorised access, particularly following an increase in phishing attacks targeting sponsor licence holders.
Once MFA is enabled for a sponsor, users will need to complete an additional verification step when logging in. This will involve a one-time passcode (OTP) in addition to the existing login requirements.
The Home Office’s rollout will be phased. Sponsors should therefore pay close attention to communications from UKVI confirming when MFA will be activated for their particular licence.
For work-route sponsors, the first scheduled implementation is expected to take place after business hours on 3 September 2026, meaning MFA-enabled logins may be required from 4 September 2026.
Why does this matter to sponsors?
Although MFA is primarily a security enhancement, it has important practical implications for sponsor compliance.
Access to the SMS is essential to the day-to-day management of a sponsor licence. For example, a sponsor may need to access the system to:
- assign a CoS to a sponsored worker;
- request or manage CoS allocations;
- report a sponsored worker’s change of circumstances;
- report the departure of a sponsored worker;
- report changes to the sponsor’s organisation or key personnel;
- manage the sponsor licence; and
- respond to Home Office requests or other sponsorship-related matters.
The Home Office’s sponsor guidance makes clear that SMS users are responsible for carrying out important sponsorship functions through the system.
A sponsor that loses access to its SMS account could therefore face practical difficulties in complying with its reporting and sponsorship obligations. This is particularly important where a sponsor has imminent CoS requirements, sponsored workers approaching visa expiry or reporting deadlines.
This operational change has important implications for both UK sponsors and sponsored workers.
Facilities/Time Off
Currently trade union officials and learning representatives of an independent trade union recognised by the employer are entitled to paid time off to carry out their duties. The ERA 2025 extends this to ensure that they are also provided with such accommodation and other facilities as is reasonable in relation to this.
Further equality representatives of a trade union do not currently have any right to time off or facilities and so the ERA 2025 creates a new right to better align to the above.
Employers will need to familiarise themselves with the detail of these requirements so they understand when the right applies and what needs to be provided. Training will also need to be provided to those likely to receive such requests.
Enhanced protection for taking part in industrial action
The Supreme Court recently held that there is currently no protection against detriments, short of dismissal, on the grounds of protected industrial action. As such, the ERA 2025 is amending existing legislation to include this.
Employers will need to ensure they are aware of the new obligations and that training is provided as appropriate.
Enhanced duty to take ‘all reasonable steps’ to prevent sexual harassment
Employers are currently required to take reasonable steps to prevent sexual harassment. If they do not, compensation in any successful sexual harassment claim can be uplifted by up to 25%. The ERA 2025 amends this requirement to ‘all reasonable steps’. Whilst this may seem like a small change, it makes the requirement much more onerous for employers as, even if they have taken reasonable steps, if one further reasonable step can be identified, they will not have satisfied this test. The government has the power to set out in regulations what will be regarded as reasonable steps an employer should take but this will be created after the duty has already come into force.
Employers should review their existing sexual harassment risk assessments to ensure these cover all reasonable steps envisaged and that any such steps are properly implemented and evidenced.
New duty to protect against third party harassment
The ERA 2025 creates a new duty on employers not to permit third parties harassing their employees. Employers will be liable if the harassment occurs in the course of the employee’s employment and the employer failed to take all reasonable steps to prevent the third party from harassing their employee. This will cover any third party (i.e. not the employer or its employees) including contractors, customers and suppliers.
This will be onerous for some employers, especially those whose employees work in customer facing roles. However, the government has confirmed that the expectations on employers in terms of preventing third party harassment will be lower than those relating to their own employees.
Employers should consider creating/reviewing harassment risk assessments to ensure they cover third party risks. If risks are identified, an action plan should be created to address these. Training and policies may also need to be updated to ensure third party harassment is covered and contracts with third parties considered to see if these can be amended to include further obligations and commitments on third parties to help reduce the risks.
Our employment lawyers are on hand to guide you through the changes coming in the ERA 2025, please do not hesitate to get in contact.
Is your organisation ready for the Employment Rights Act 2025?
Please reach out to our employment team to discover how we can support you:
- Explore our tailored support packages for UK businesses
- Request your personalised Employment Rights Act action plan today
Disclaimer
This information is for guidance purposes only and should not be regarded as a substitute for taking legal advice. Please refer to the full General Notices on our website.
About this article
-
SubjectMandatory MFA for Sponsor Management System Users: What Sponsors Need to Know
-
Author
-
Expertise
-
Published02 September 2026
HR Resources
HR Legislation and Case Law Update
Quick reference guide to upcoming key employment and immigration law cases and legislation.
