UKVI Sponsor Guidance August 2026 Changes to Part 1 and Part 3 Explained

The UKVI Sponsor Guidance August 2026 changes represent one of the most significant compliance updates of the year for licensed sponsors. UK Visas and Immigration (UKVI) has published a fresh version of its Sponsor Guidance, and this Sponsor Guidance Part 1 and Part 3 update lands squarely on the systems and processes that licensed sponsors rely on every day. Version 08/26 of Sponsor Guidance Part 1 (Apply for a Licence) and Part 3 (Sponsor Duties and Compliance) was published on 28 August 2026, replacing version 05/26 from 20 May 2026. Together, the two documents introduced a phased withdrawal of the Level 2 User role, mandatory multi-factor authentication for the Sponsorship Management System (SMS), a new compliance process for dormant SMS accounts, and a widened right to work checking duty.

None of these changes are cosmetic. They alter who can access a sponsor’s SMS account, how they log in, what happens if an account is left unattended, and, in one case, who is legally required to carry out right to work checks in the first place. For any organisation holding or applying for a sponsor licence on the Worker or Temporary Worker routes, two deadlines still remain: the right to work check extension on 1 October 2026 and the final Level 2 User cut-off on 8 March 2027.

This article, based directly on UKVI’s published guidance, sets out exactly what changed in Part 1 and Part 3, when each change took effect, and what sponsors should be doing now to stay compliant.

Why UKVI Revised the UKVI Sponsor Guidance in August 2026

UKVI Sponsor Guidance is subject to ongoing revision. UKVI reviews and republishes it periodically to reflect policy developments, close gaps identified through compliance activity and respond to system or security requirements. These UKVI Sponsor Guidance August 2026 changes fit that pattern of regular revision, though this round is more consequential than most because it rewrites core SMS access and security rules as part of ongoing Home Office sponsor compliance work. This is the third version of Part 1 and Part 3 guidance published in 2026, following updates on 6 March 2026 and 20 May 2026. The August update centres on a single theme: strengthening control and accountability over the SMS, the online portal through which every sponsor manages its licence, users and Certificates of Sponsorship.

Part 1 (Apply for a Licence): Key Changes

This update made several changes to Part 1 specifically, most of them centred on SMS account access and security. The sections below cover each one in turn.

The Level 2 User Role Is Being Phased Out

The most significant change in Part 1 is the withdrawal of the Level 2 User tier of SMS access. Level 2 Users have restricted permissions: they can create and assign a Certificate of Sponsorship (CoS) and report on activity relating to CoS they personally created or that were transferred to them, but they cannot report on CoS assigned by a Level 1 User.

Since 9 September 2026, sponsors have no longer been able to appoint new Level 2 Users to their licence. Sponsors with existing Level 2 Users must, through a Level 1 User, either convert them to Level 1 status (where they meet the Level 1 eligibility criteria) or deactivate their account. This must be completed by 8 March 2027, after which UKVI will deactivate any remaining Level 2 accounts itself. One group cannot be converted at all: temporary staff supplied by an employment business, rather than employed directly by the sponsor, are not eligible for Level 1 status, and their accounts will be deactivated after the March 2027 deadline regardless of any action taken.

This phase-out is one of the most operationally significant elements of the wider update, since it forces every sponsor to review its existing SMS user list rather than simply reading about a policy change. It runs through section L4 of Part 1, including paragraphs L4.4, L4.5, L4.14, L4.16, L4.18, L4.20, L4.21, L4.36, L4.42, L4.43, L4.58 to L4.59 and L4.65, all updated to reflect that Level 2 Users can no longer be appointed from 9 September 2026.

Mandatory Multi-Factor Authentication for SMS Users

UKVI introduced mandatory multi-factor authentication (MFA) for all SMS Users, having trialled the feature voluntarily since November 2025. MFA began rolling out on a phased basis from 3 September 2026, with UKVI expecting full coverage across all sponsors by November 2026. Any organisation granted a new sponsor licence on or after 9 September 2026 has MFA enabled from the outset.

This requirement is intended to reduce the risk of account compromise across the sponsorship management system, and sits alongside UKVI’s own SMS User Manual guidance on account security. In practice, MFA requires a one-time passcode in addition to a username and password on every login. The passcode is sent by text message to Level 1 Users with a registered mobile number, or by email to Level 2 Users and any Level 1 Users without a mobile number on file. A valid date of birth is also required the first time a Level 1 User logs into an MFA-enabled account using a mobile phone, or whenever their phone number or email address changes. Sponsors should ensure that accurate contact details, including email address, mobile number and date of birth, are held for every SMS User, since the rollout is still under way and not every account will yet have activated MFA.

New Rules for Inactive SMS User Accounts

A new compliance mechanism addresses SMS accounts that fall out of use. An account is treated as inactive once it has not been accessed for 12 months or more. Where UKVI identifies an inactive account, it will contact the sponsor’s Authorising Officer and any inactive Level 1 User directly, giving three months to log in, review and update the relevant details. UKVI will not contact inactive Level 2 Users directly, so responsibility for identifying and managing inactive Level 2 accounts rests with the sponsor.

This gives sponsors a defined window to respond before losing access. If no action is taken within the three-month window, UKVI will deactivate the inactive accounts. Where this leaves a sponsor with no active Level 1 User at all, the licence will be suspended, with 28 days to nominate an eligible replacement before UKVI will normally revoke the licence entirely. Sponsors who believe a suspension or revocation on this basis has been wrongly applied retain the usual routes to challenge the decision, including judicial review.

Cooling Off Period Clarifications

Because the inactive account process could otherwise trigger the same cooling off consequences as a compliance-related revocation, Part 1 has been updated so that a sponsor licence revocation caused solely by this process does not carry a cooling off period. This clarification runs through the cooling off table at L9.17 and Annexes L1(h) and L2(f).

Part 3 (Sponsor Duties and Compliance): Key Changes

Part 3 is affected largely by cross-referencing the Part 1 reforms, alongside a small number of standalone updates of its own.

SMS Access Changes Cross-Referenced in Part 3

Part 3 does not repeat the detail set out in Part 1, but it confirms the practical duties that follow from it. Section C2.4 specifies that Level 2 Users could only be added up to 9 September 2026, cross-referring sponsors to Part 1 for the full detail. Annex C2(i) and Annex C2(k) mirror the Part 1 cooling off carve-out for licences revoked solely due to the inactive SMS User process, and Annex C3(f), UKVI’s list of circumstances in which a sponsor’s licence may be revoked, was updated so that failure to comply with the mandatory MFA requirements is itself a ground for revocation.

Inactive Sponsor Licences Renamed and Reframed

Section C5, previously a brief note on licence validity, has been retitled “Inactive Sponsor Licences.” It now actively invites sponsors who are not currently sponsoring any workers to surrender their licence voluntarily under section C6, rather than leaving it dormant on the register. UKVI has indicated that further guidance on how it will manage inactive licences is expected in a future update, so this section currently signals a direction of travel rather than a complete new enforcement regime.

Right to Work Checks Extended to Wider Working Arrangements

Separately from the SMS reforms, Part 3 confirms a substantive change to the scope of right to work check duties. From 1 October 2026, the statutory duty to conduct right to work checks, currently owed by employers in respect of their employees, extends to organisations that engage individuals under a worker’s contract, engage individual sub-contractors, or operate an online matching service that puts service providers in front of potential clients or customers. This widens right to work check obligations well beyond the sponsorship system itself, sitting alongside, and going further than, a sponsor’s existing duty to right to work check any worker it directly sponsors.

The duty applies to relevant engagements beginning on or after 1 October 2026, so existing arrangements entered into before that date are not brought within scope retrospectively. Organisations should still map who they engage now, because the distinction between an existing and a new engagement will matter from day one.

Effective Dates

Each change took effect on its own date, and sponsors should track these separately rather than treating the update as a single event.

• 28 August 2026 – Version 08/26 of UKVI Sponsor Guidance Part 1 and Part 3 was published, and the changes to section C5 on inactive sponsor licences and the related cooling off clarifications took effect immediately.
• 3 September 2026 – Mandatory multi-factor authentication began rolling out in phases across existing SMS accounts.
• 9 September 2026 – Sponsors lost the ability to appoint new Level 2 Users, and any sponsor licence granted on or after this date has had multi-factor authentication enabled immediately.
• 1 October 2026 – The extended right to work checking duty comes into force for organisations engaging workers under a worker’s contract, individual sub-contractors and online matching services, for relevant engagements beginning on or after that date.
• November 2026 – UKVI expects multi-factor authentication to be fully rolled out across all sponsors.
• 8 March 2027 – The Level 2 User role will be abolished entirely, and UKVI will deactivate any Level 2 accounts still in existence at that point.

What This Means for Sponsor Licence Holders

In short, this calls for a practical audit rather than a wait-and-see approach. Sponsors who have not already done so should review their full list of SMS Users now and decide, for each Level 2 User, whether to convert or deactivate the account, bearing in mind the 8 March 2027 final deadline. Contact details for every SMS User, namely mobile number, email address and date of birth, should be checked and corrected if this has not already been done, since MFA is still being rolled out in phases through to November 2026 and an out-of-date phone number or email address could leave a user locked out at the point of login. Any SMS account that has not been accessed in the past year should be logged into and reviewed before UKVI’s own compliance process identifies it, since staying ahead of SMS compliance now prevents avoidable disruption later. Organisations that engage contractors, sub-contractors or service providers through an online matching model should prepare for the right to work check extension that takes effect on 1 October 2026 for relevant new engagements, since this duty is not limited to sponsored workers.

Conclusion

These UKVI Sponsor Guidance August 2026 changes, spanning the full Sponsor Guidance Part 1 and Part 3 update, mark a significant compliance shift for sponsor licence holders. The update is best understood as a modernisation of sponsor account security and oversight, paired with a targeted expansion of right to work obligations. The phasing out of Level 2 Users, the introduction of mandatory multi-factor authentication, and the new process for inactive SMS accounts all point in the same direction: UKVI wants sponsor licences to be actively and securely managed, not left to sit unattended on the register. With the right to work extension landing on 1 October 2026 and the final Level 2 User deadline on 8 March 2027 still ahead, sponsors who have not yet reviewed their SMS user access and contact details should treat this as an immediate action item.

Frequently Asked Questions