UK – Home Office Rolls Out Mandatory Multi-Factor Authentication for SMS Users and Sets Deadline to Prevent Account Deactivation

All November Global Immigration Updates:

• UK – Home Office Rolls Out Mandatory Multi-Factor Authentication for SMS Users and Sets Deadline to Prevent Account Deactivation
• Canada – Recent Changes to Express Entry CRS and OINP Award Additional Points to Eligible Foreign Nationals 
• Spain – Pilot Program Automatically Assigns Fingerprinting Appointments for Select TIE Card Applicants 
• Saudi Arabia – Skilled Workers Now Eligible to Relocate to the Kingdom with Dependents; Increased Salary Requirement to Meet Saudization Rates 
• France – Standardized Issuance of 12-month Talent Visas Across Jurisdictions
• Germany – Temporary Residence Measures for Eligible Ukrainian Nationals Extended
• Japan – Revised Eligibility Criteria for Permanent Residence to Take Effect in April 2027
• Vietnam – Decree 393 Introduces New Pathways and Requirements for Foreign Talent and Employers

Important Update: On November 3, 2026, the UK Government published an important update regarding its Earned Settlement policy. A detailed article on this topic will be forthcoming.  

The UK Home Office is rolling out a Multi-Factor Authentication (MFA) that will soon be mandatory for all Sponsorship Management System (SMS) users. The new MFA requirement aims to protect accounts from unauthorized access by adding an additional layer of security.  

Given this, employers with a Sponsor Licence should ensure that all account details are correct, particularly for Level 1 users, and make their internal teams aware of the MFA to prevent accessibility issues once it is enabled. 

Once MFA is activated for a Sponsor Licence, every SMS login will require a username, password, and a One-Time Password (OTP) generated during the login process. The OTP will be sent to the user via one of the following methods: 

• Text – Level 1 users with a mobile phone number registered to their account; or 
• Email – Level 1 users without a registered mobile phone number and all Level 2 users*. 

As an added measure of security, Level 1 users will also be required to verify their date of birth when logging into an MFA-enabled account for the first time on a mobile phone, or if they update the phone number or email address associated with their account.  

*Since September 9, 2026, no new Level 2 users can be appointed. Sponsors should upgrade any existing Level 2 users to Level 1 users by March 8, 2027, if they still need to have access to the account. Alternatively, Level 2 users should be deactivated prior to this date.  

Sponsors are reminded that SMS user accounts that have been inactive for 12 months are subject to deactivation. Where this results in the Sponsor having no active Level 1 users, the Home Office may take compliance action against the Sponsor, including the potential revocation of the Sponsor Licence, as is it a strict requirement that all Sponsors have at least one Level 1 user in place at all times. 

To avoid penalties for non-compliance, Sponsors should ensure that all SMS users log in before December 6, 2026, and encourage regular use of the system to avoid account deactivation. Additionally, Sponsors should proactively remove any users who no longer require access. 

The complete MFA guidance issued by the Home Office can be accessed here on GOV.UK.  

Employer Takeaway: Employers should read the MFA guidance in its entirety and conduct a review of their Sponsor License arrangements and user details to ensure ongoing compliance and continued access to their SMS account.