If your organisation holds a sponsor licence, some of your staff may already have access to the Sponsorship Management System (SMS), the online portal used to assign Certificates of Sponsorship (CoS) and report on sponsored workers, as a Level 2 User. That arrangement is being withdrawn. From 9 September 2026, the Home Office will no longer let sponsors appoint new Level 2 Users, and every Level 2 User you already have must either be upgraded to a Level 1 User or have their SMS account deactivated by 8 March 2027.
This change appears in version 08/26 of the Home Office’s sponsor guidance for the Worker and Temporary Worker routes, published on 28 August 2026, and it applies to every sponsor with an existing or planned Level 2 User, whatever your size or sector. This article sets out what the Level 2 User role was, why it is being phased out, the exact dates to diarise, which of your existing Level 2 Users can be converted and which cannot, and what your Authorising Officer and Level 1 Users should do now. It does not cover the separate Key Personnel rules for UK Expansion Worker sponsors, which sit in a different part of the guidance.
Key Takeaways
From 9 September 2026, sponsors can no longer appoint new Level 2 Users to their sponsor licence.
Every existing Level 2 User must be converted to a Level 1 User, if eligible, or have their SMS account deactivated by 8 March 2027.
After 8 March 2027, the Home Office will deactivate any Level 2 User accounts still open.
Level 2 Users supplied by an employment business (agency staff) cannot be converted to Level 1 Users and must be removed instead.
The change coincides with mandatory multi-factor authentication, rolling out from 3 September 2026, and a new process for removing inactive SMS User accounts.
This is a change to Home Office sponsor guidance rather than to the Immigration Rules themselves, so it took effect without a statement of changes.
Why Is the Home Office Phasing Out the Level 2 User Role?
The Home Office has not published a detailed public rationale for withdrawing the Level 2 User role. What is clear from the guidance itself is that the change sits alongside two other measures introduced in the same update: mandatory multi-factor authentication (MFA) for everyone who accesses the SMS, and a new process for removing SMS User accounts that have gone inactive. Read together, these three changes point in one direction: the Home Office is narrowing who can hold direct SMS access, and tightening the standards those account holders must meet.
A related change in the same guidance version reinforces this. From 9 September 2026, sponsors can no longer appoint any worker supplied by an employment business, in other words agency staff, to any Key Personnel role at all (paragraph L4.14 of the sponsor guidance). Level 2 User had been the one route by which agency staff could hold any form of Key Personnel access. Closing that route, and phasing out the Level 2 User role altogether, removes what had become one of the more loosely controlled corners of the sponsorship system.
What the Level 2 User Role Was, and How It Differed from a Level 1 User
Every sponsor licence application must nominate three mandatory Key Personnel roles: an Authorising Officer, a senior person with overall responsibility for the licence; a Key Contact, the organisation’s main point of contact with UK Visas and Immigration (UKVI); and at least one Level 1 User, the person responsible for day to day sponsorship activity, including assigning CoS and reporting worker activity (paragraph L4.2). The Level 2 User was a fourth, optional role, introduced to give organisations more flexibility once a licence had already been granted (paragraph L4.4).
A Level 2 User could only be appointed by an existing Level 1 User, and only after the licence itself had been granted; you could never nominate a Level 2 User on the original licence application. Their permissions were narrower than a Level 1 User’s. Under paragraph L4.60, a Level 2 User could create and assign a CoS, and report on worker activity relating to any CoS they had personally created and assigned, or which a Level 1 User had transferred to them. They could not report on a CoS that a Level 1 User had assigned unless it was specifically transferred to them first (paragraph L4.61).
A Level 2 User could be drawn from a wider pool than a Level 1 User. Under paragraph L4.64, eligible categories included your own paid staff or office holders, an employee of a third party organisation engaged to deliver some or all of your HR function, a temporary worker supplied by an employment business, or a UK based representative. That breadth, particularly the ability to bring in agency staff, is exactly what the phase out removes.
The Phase Out Timeline: Key Dates to Diarise
Two dates matter most, with a related MFA date sitting either side of them.
There is no reason to wait until the deadline. Paragraph L4.59 gives sponsors until 8 March 2027 to act, but nothing stops you converting or deactivating a Level 2 User as soon as you have reviewed your licence. Given that mandatory MFA is being introduced over the same window, and that the Home Office will contact you separately about inactive accounts, dealing with your Level 2 Users early reduces the number of moving parts you are managing at once.
Can Your Existing Level 2 Users Be Converted to Level 1 Users?
This depends entirely on which category of person your Level 2 User falls into, and the answer is not the same for everyone on your account.
If your Level 2 User is a paid member of staff or an office holder within your own organisation, they can generally be converted to an additional Level 1 User, provided they meet the general eligibility requirements for the role: based in the UK, holding a valid National Insurance number unless exempt, not a contractor or consultant engaged for a specific purpose, and able to meet the suitability requirements the Home Office applies to all Key Personnel (paragraphs L4.8 and L4.49).
If your Level 2 User is an employee of a third party organisation delivering your HR function, or a UK based representative, they can also be converted, but only as an additional Level 1 User, never as your sole or primary one (paragraph L4.49). Your primary Level 1 User must still be an employee, director or partner within your own organisation who is a settled worker, broadly a British or Irish citizen or someone with permanent residence rights such as indefinite leave to remain, unless a specific exception applies (paragraphs L4.44 to L4.53).
If your Level 2 User is a temporary worker supplied by an employment business, in other words agency staff, they cannot be converted to a Level 1 User under any circumstances (paragraph L4.65). The only option for this category is deactivation, and the Home Office will do this itself after 8 March 2027 if you have not already.
Worked Example: A Logistics Sponsor with Three Level 2 Users
Consider a mid sized logistics company with a sponsor licence and three Level 2 Users: a payroll administrator employed directly by the company, an HR consultant employed by an outsourced HR provider the company has engaged, and an administrative assistant supplied through a recruitment agency to help process paperwork during a busy hiring period.
If the two convertible users had been the only people, aside from the Authorising Officer, handling day to day CoS work, doing nothing leaves the company needing to appoint or convert a new Level 1 User from scratch, at short notice, with no transition period.
These figures are illustrative. The categories your Level 2 Users fall into, and their eligibility for conversion, depend on your organisation’s specific arrangements.
What Happens If You Take No Action Before 8 March 2027?
Losing access for a Level 2 User does not, by itself, breach your duty to maintain at least one eligible Level 1 User under paragraph L4.6, because Level 2 Users were never counted towards that requirement. The immediate risk is operational rather than existential: if your Level 2 Users were the people actually creating and assigning CoS day to day, their access stops on 8 March 2027 at the latest, and whoever remains as your Level 1 User needs to be ready to take on that workload, or you need to have converted or replaced them in time.
The risk becomes a licence level risk if it combines with a separate change introduced in the same guidance update: the Home Office’s new process for removing inactive SMS User accounts. If your organisation is left with no active, eligible Level 1 User at all, whether because of the Level 2 phase out, the inactive account process, or both, the Home Office will suspend your licence and give you 28 days to nominate a replacement before it will normally revoke the licence altogether.
What Should Sponsor Licence Holders Do Now?
The practical steps are the same whether you have one Level 2 User or twenty.
Identify every Level 2 User currently on your licence and note which category each falls into: own staff, outsourced HR employee, agency staff, or UK based representative.
For each eligible Level 2 User, decide whether you want to convert them to a Level 1 User or remove their access instead.
If there is anyone you still want to appoint as a Level 2 User, do it before 9 September 2026; after that date the option disappears entirely.
Have your existing Level 1 User carry out the conversions or deactivations through SMS well ahead of 8 March 2027, rather than waiting for the deadline.
Check that every Level 2 User, and every Level 1 User without a mobile number, has a current, personal email address recorded on your licence, ready for mandatory multi-factor authentication.
Confirm you have at least one Level 1 User who is a UK based, settled employee, director or partner of your organisation, so your licence is not exposed if Level 2 access disappears before you have replaced it.
Related Changes to Prepare for: Mandatory MFA and Inactive Account Reviews
Two other changes in the same guidance update affect the same group of SMS Users and are worth handling alongside the Level 2 phase out rather than separately. The first is mandatory multi-factor authentication (MFA), which began rolling out on a phased basis from 3 September 2026 and is expected to cover all sponsors by November 2026; it applies automatically to any organisation granted a licence on or after 9 September 2026 (paragraphs L4.66 and L4.67).
Once MFA is enabled on your account, a one time passcode is sent by text message to Level 1 Users with a valid mobile number, or by email to Level 1 Users without one and to all Level 2 Users (paragraph L4.68). This makes it essential to have accurate contact details, including a valid date of birth for Level 1 Users, recorded for everyone with SMS access (paragraph L4.69).
The second is a new process for inactive SMS User accounts, meaning any account not accessed for 12 months or more. The Home Office will contact your Authorising Officer and any inactive Level 1 User directly and give them 3 months to log in and update their details. It will not contact inactive Level 2 Users directly; identifying them and prompting action is your organisation’s responsibility, through your active Level 1 User (paragraphs L4.72 to L4.76). Failing to act within the 3-month window results in the account being deactivated, and, if that leaves you without an eligible Level 1 User, the same suspension and 28 day cure period described above applies (paragraph L4.77).
Frequently Asked Questions
Yes, for now. The restriction from 9 September 2026 stops you appointing any new Level 2 Users; it does not switch off the ones you already have. Existing Level 2 Users can keep working until you convert or deactivate them, or until 8 March 2027, when the Home Office removes any that remain.
They cannot be converted to a Level 1 User under paragraph L4.65, because they are not employed directly by your organisation. You must deactivate their account by 8 March 2027, and from 9 September 2026 you cannot appoint any further agency supplied staff to a Key Personnel role at all.
The conversion is carried out through SMS by your existing Level 1 User. You do not submit a separate notification outside the system, but your Authorising Officer remains responsible for confirming the newly converted Level 1 User meets the eligibility requirements before the change is made.
No. Deactivating a Level 2 User’s account removes their ability to create new CoS or report further activity, but it does not cancel or affect CoS they have already assigned. You should check whether anyone still needs to report on those existing CoS and, if so, transfer that responsibility to an active Level 1 User first.
No fee is set out in the sponsor guidance for changing who holds a Key Personnel role within an existing licence. Fees apply to the original licence application and to adding new sponsorship routes, not to changes in Key Personnel.
If the Home Office identifies your Level 1 User’s account as inactive, unused for 12 months or more, you have 3 months from being contacted to log in and update their details. If this lapses and you are left with no eligible Level 1 User, your licence will be suspended, and you will have 28 days to nominate a replacement before the licence is normally revoked.
Not directly. The phase out is a Key Personnel administration change, not a compliance failure in itself. However, if it leaves you without any eligible Level 1 User, or a poorly managed transition leads to CoS reporting errors, that could expose you to compliance action, including a downgrade to a B rating.
The Home Office will not contact inactive Level 2 Users directly, so it is your organisation’s Level 1 User, not the Level 2 User, who is responsible for identifying who needs converting or deactivating, and for making sure their SMS details, particularly their email address, are current ahead of mandatory multi-factor authentication.
Conclusion
If your organisation relies on Level 2 Users for day-to-day Certificate of Sponsorship work, the phasing out of the Level 2 User role is a live administrative task with a hard deadline, not a distant compliance footnote. Get the conversion wrong, or leave it too late, and you risk losing SMS access for the people who keep your day-to-day sponsorship compliance running, at the same time as mandatory multi-factor authentication and inactive account reviews are tightening scrutiny of every SMS User on your licence.
The categories, dates and consequences are set out clearly in the guidance but applying them correctly to your own mix of employees, outsourced HR staff, agency workers and representatives is where sponsors most often go wrong. If you would like a second opinion on how the Level 2 User phase out applies to your organisation, here is how to get one.
Sponsor Licence Key Personnel Review
At Sterling & Wells, we review your Authorising Officer, Key Contact, Level 1 User and Level 2 User set up against the 9 September 2026 and 8 March 2027 deadlines, confirm exactly who can be converted and who must be removed, and handle the SMS updates on your behalf.
This article is for general information only and does not constitute immigration advice. Your organisation’s circumstances, including the categories of Level 2 User you hold, may alter how these rules apply to you. The dates and requirements above reflect the Home Office’s guidance current as at 01/09/2026 and should be checked against the latest GOV.UK publication before being relied on. Speak to a qualified immigration adviser before acting.
