All Sponsorship Management System users will need a one-time passcode at each log-in once multi-factor authentication is enabled on their licence, with sponsors told two weeks before their start date.
Key facts
- Who: All sponsors using the Sponsorship Management System (SMS), including Level 1 and Level 2 users
- From: No single date. The guidance says multi-factor authentication (MFA) will be rolled out to all sponsors "in the coming months". Each licence is enabled on its own date.
- Source: Multi-factor authentication for UK visa sponsors: SMS manual 13
UK Visas and Immigration has published SMS manual 13, which explains MFA for sponsors. The guide is marked as updated on 2 October 2026. It describes MFA as mandatory for all SMS users.
Once MFA is enabled on a licence, users enter their SMS user ID and password, and Level 1 users also enter their date of birth. They then enter a six-digit one-time passcode (OTP). Level 1 users receive it by text message from "GOVUK" at the registered mobile number. Level 2 users, and Level 1 users without a mobile number, receive it by email. An OTP is required at every log-in, and it is valid for 10 minutes.
The guide sets these limits:
- Three attempts to enter the date of birth correctly. After that the account is locked for 24 hours.
- Three attempts to enter a valid OTP.
- Two requests for a new OTP. Exceeding either OTP limit locks the account for 20 minutes.
The Authorising Officer, Key Contact, Level 1 and Level 2 users are emailed two weeks before the account is enabled, with the start date. The guide says MFA affects only the log-in process.
Level 2 users cannot change their own email address. A Level 1 user must change it for them. If a mobile phone is lost or stolen, the OTP can be sent by email, and the lost number must be removed from SMS as soon as possible.
The guide also lists what the Home Office says it will never do. It will not send a link to the SMS log-in page, ask for a user ID, password or OTP outside SMS, or send an OTP that was not requested. Suspicious contact can be reported to BusinessHelpdesk@homeoffice.gov.uk.
What this means for applicants
Sponsors should check, before MFA is enabled on their licence, that every user's email address is correct. Level 1 users should also check their mobile number and date of birth. Level 2 users cannot change their email address themselves.
If a Level 1 user's date of birth is wrong on SMS, the sponsor must send the Sponsor change of circumstances form to SCOC@homeoffice.gov.uk with the subject "DOB change request". The guide says an incorrect date of birth at the point MFA is introduced may mean the user cannot log in and could face delays.
Related guide: Skilled Worker sponsorship requirements
Sources
- Multi-factor authentication for UK visa sponsors: SMS manual 13, UK Visas and Immigration, GOV.UK