Multi-factor authentication coming for sponsor licence holders

UKVI has announced the roll out of a mandatory multi-factor authentication (MFA) for sponsor management system (SMS) users, marking one of several significant sponsor compliance changes being implemented this month.

Once MFA is enabled on a sponsor licence, SMS users will be required to enter a one-time passcode, in addition to their username and password, every time they log in. The passcode will be sent to either the email address or mobile number linked to their SMS account.

UKVI has confirmed that sponsors will receive notification approximately two weeks before MFA is activated on their licence. Based on recent communications, the next phase of sponsors is expected to be onboarded on 17 September 2026.

Sponsors should not wait until they receive notification to prepare. We recommend reviewing all SMS user accounts now to ensure email addresses, mobile telephone numbers and other user details are accurate and up to date. Taking proactive steps at this stage should help minimise the risk of access issues once MFA is introduced.

With wider changes also being made to SMS user management and sponsor compliance processes, this presents a useful opportunity for sponsors to undertake a broader review of their licence and key personnel records.