The Sponsor Management System: The Account Your Business Has to Run Once the Licence Arrives

What the SMS Is and Who Can Log In

The Sponsorship Management System, which almost everyone calls the SMS, is the online account the Home Office gives you when it grants your sponsor licence. It is not a portal you visit once. Every duty that comes with the licence is performed inside it: applying for and assigning Certificates of Sponsorship, reporting changes to your sponsored workers, reporting changes to your business, adding and removing the people who can use it, and reading the message board the Home Office uses to tell you the rules have changed.

Our guide to getting a UK sponsor licence stops at the point the licence is granted. This one starts there. The licence is a permission. The SMS is where you either keep it or lose it.

Three things about the account are worth knowing before anything else. Only SMS Users can log in, which means your Level 1 Users and, for a few more months, any Level 2 Users. The Authorising Officer and the Key Contact have no automatic access, and if either wants to use the system they must be appointed as a Level 1 User as well. And everything typed into it is stored and can be read by the Home Office. Part 2 of the sponsor guidance says of the Certificate of Sponsorship form that "all of the information you enter will be stored and can be viewed by us". Treat the whole account the same way.

Level 1 Users, and the End of Level 2

The Level 1 User is the person who actually operates the licence. Section L4 of Part 1 lists what they do: assign Certificates of Sponsorship, request an increase to the allocation, apply for Skilled Worker Defined certificates, add other Level 1 Users, deactivate SMS Users who have left, report changes to the organisation, report worker activity, withdraw certificates, and read the messages the Home Office posts.

The full eligibility rules for all three named roles are covered in the licence guide, so here is only what matters for running the account. Your primary Level 1 User must be an employee, director or partner in your organisation and a settled worker. After the licence is granted you can add more, and those additional users can be a paid member of staff, an employee of a company you have engaged to run your HR function, or a UK-based representative such as your immigration adviser. A contractor engaged for a specific project cannot fill any Key Personnel role, and from 9 September 2026 neither can a temp supplied by an employment business. The guidance also recommends having enough Level 1 Users to cover absences, and it recommends the Authorising Officer checks the certificates assigned at least once a month.

Level 2 Users are being wound down. For years the Level 2 role was the answer to "can my HR temp use the system", because a Level 2 User could create and assign certificates and report on the ones they had personally assigned, but nothing else. From 9 September 2026 you can no longer appoint one. If you have existing Level 2 Users, a Level 1 User must either convert them to Level 1 Users, where they meet the Level 1 requirements, or deactivate their accounts, and must do so by 8 March 2027. After that date the Home Office deactivates whatever is left. Staff supplied by an employment business cannot be converted at all.

If you are reading this because a law-firm page told you to set up a Level 2 User for your outsourced HR provider, that advice is now out of date. The seat for an outside HR employee is an additional Level 1 User.

Two Changes From September 2026

Version 08/26 of the guidance introduced two operational changes that matter more to a small sponsor than any rule about Key Personnel.

Multi-factor authentication is now mandatory. The Home Office began switching on MFA for SMS Users on 3 September 2026, on a phased basis, and expects every sponsor to be on it by November 2026. Any organisation licensed on or after 9 September 2026 has it from day one. Each login needs a one-time passcode as well as the username and password. For a Level 1 User with a valid mobile number the code arrives by text; otherwise it goes to their registered email. On first login to an MFA-enabled account by phone, the user must also confirm their date of birth. That means the date of birth, mobile number and email held for each Level 1 User have to be correct, and the guidance now makes it your responsibility to ensure they are. Every email address must be personal to the named individual and accessible only by them. Sharing a login was always a bad idea. Annex C3 of Part 3 now lists an SMS User disclosing their password or their one-time passcode to another person as a circumstance in which the licence may be revoked.

Inactive accounts will be removed. An SMS account that has not been accessed for 12 months or more is now treated as inactive. When the Home Office identifies one, it contacts the Authorising Officer and the inactive Level 1 User, who then has 3 months to log in and check and update their details. If nothing happens, the account is deactivated. If that leaves you with no active Level 1 User, the licence is suspended and you get 28 days to nominate an eligible replacement, after which it will normally be revoked. The guidance disapplies the usual cooling-off period when that is the sole reason for revocation, which is a small mercy, but you would still be applying for a new licence and paying the fee again.

The practical rule that falls out of both changes is simple. Someone with the right phone number logs in at least once a quarter, even when there is nothing to report.

Assigning a Certificate of Sponsorship, Step by Step

A Certificate of Sponsorship is not a certificate. Part 2 describes it as "a database record which confirms details of the worker you intend to sponsor and the job they will do". You create it in the SMS, you pay for it, and the worker uses its reference number in their visa application.

Defined or Undefined. There are two types, and the distinction is still current in the 08/26 guidance. A Defined certificate is for a Skilled Worker applying for a visa from outside the UK. You cannot hold a stock of these. You apply for each one through the SMS, and GOV.UK says applications are usually approved within one working day unless UKVI needs to run further checks. Once approved it appears in your account and you assign it. An Undefined certificate covers a Skilled Worker applying from inside the UK and every worker on every other route, and comes out of your annual allocation. The allocation is granted for a 12-month CoS year, unused certificates are removed at the end of it, and an A-rated sponsor with an active allocation is normally renewed automatically at the number it actually assigned the year before. Assign the wrong type, an Undefined where a Defined was required, and the guidance says the licence will normally be revoked.

The steps. SMS Manual 8 sets out the route for a single certificate. From the Workers screen, select Create and assign. Choose the route from the drop-down and, for Skilled Worker, the category. Select Create new single certificate. On the Create a CoS screen, enter the worker's personal details and the details of the job, then Save. From the confirmation screen, select Assign, check every field on the confirmation page, read the declaration and tick it, then select Assign CoS. The online payment screen opens a third-party payment service. When it completes, the certificate is assigned and given its unique number.

What has to be on it. Section S3 of Part 2 lists what a valid certificate must contain: the route; the worker's name, nationality, date of birth, passport details and contact address; the usual work address or addresses; total weekly hours, as an average if they vary; the job title, job description, start date, end date, salary and occupation code; whether you used an agent such as a recruitment agency to find the worker and, if so, that agent's details; whether you are certifying that the worker meets the financial requirement; and for some routes whether an ATAS certificate is needed. That agent question is worth noticing. If CA Recruitment found the worker, we appear on the record.

Three rules that get certificates cancelled or licences revoked. The fee, currently £525 for a Skilled Worker certificate, is yours to pay and you must not recoup any part of it from the worker. An SMS User must never assign a certificate to themselves, their partner or a close relative; that is a mandatory ground for revocation. And the occupation code and job description must match the job the worker will actually do.

After you assign. The reference number goes to the worker, and the guidance says to treat it as secure and confidential. The worker must use it in a visa application within 3 months of assignment, and cannot apply more than 3 months before the start date on the certificate, so time the assignment against their notice period and your start date. In your account the certificate shows as assigned until a decision is made, then as used. If something changes before the worker applies, such as the start date moving, you cannot edit a live certificate; you add a sponsor note through the Report migrant activity function instead. If the worker never applies, or takes a job elsewhere, you withdraw the certificate through Manage live CoS. A worker who wants to move to another sponsor must ask you in writing to withdraw it and give you 5 working days, because the new sponsor cannot assign theirs until yours is gone. Refusing is itself something the Home Office can act on.

Reporting Changes to the Worker: 10 Working Days

Part 3, section C1, sets the clock. Changes to a sponsored worker's circumstances must be reported "by no later than 10 working days after the relevant change or event has occurred", unless a specific change says otherwise. The report is made through the Report migrant activity function, reached from Sponsorship duties on the Workers screen, where you search for the certificate, pick a reason from the drop-down, add the date and full details, and save.

The events that trigger a report:

• The worker does not start within 28 days. A worker should start no later than 28 days after the latest of the start date on the certificate, the "valid from" date on their eVisa, or the date they were told of the grant. A delay of up to 28 days needs no report. Beyond it, you either give the new start date and the reason or stop sponsoring them, and you must report either way by the end of 10 working days after the 28-day period.
• Unauthorised absence of more than 10 consecutive working days. You report this even if you intend to keep sponsoring the worker, by no later than 10 working days after the tenth day of absence, and the report should include when the absence began, whether they have returned, what you did to contact them, any pay deductions, and whether you are continuing sponsorship.
• Unpaid or reduced-pay absence of more than 4 weeks in a calendar year. There are exceptions in section S4 of Part 2 for things like statutory leave, but the report duty sits with you.
• A reduction in salary from the figure on the certificate. Increases do not need reporting, with one exception for a pre-registration nurse or midwife who has completed registration.
• Significant changes to the job that do not need a change of employment application: a different role, title or core duties, or a promotion, provided the new role stays in the same occupation code and meets the conditions in section S9 of Part 2. A move to a different occupation code is not a report. It is a new certificate and a new application by the worker, approved before they start the new job.
• A change of normal work location: a different branch or a client site not on the certificate, or a move to working entirely from home. A hybrid pattern with regular attendance at your premises does not need reporting, but a contractual home worker does, and the guidance reserves the right to ask why you needed to sponsor someone who could work from their home country.
• You stop sponsoring the worker for any reason: resignation, dismissal, redundancy, a contract ending early, the visa being refused, a required professional registration being withdrawn, or the worker getting settlement. When you report that you are no longer sponsoring someone, or that they are absent without permission, you must also give their last recorded residential address, telephone number and any personal email address you hold.

Two things sit outside the 10-day clock and are faster. If you know or suspect a worker has breached their conditions of stay, you tell the Home Office as soon as reasonably practicable. Anything suggesting terrorism or criminal activity goes to the police.

Reporting Changes to the Business: 20 Working Days

Section C2 of Part 3 covers your side of the licence. Most organisational changes are reported through the SMS, "by no later than 20 working days after the date you became aware of the change". The one carve-out in that sentence is replacing your Authorising Officer or Key Contact, which the guidance separates from the 20-day rule, and Part 1 says the Home Office will normally revoke a licence where you fail to tell it of a change of Authorising Officer. Treat that one as immediate.

What a Level 1 User must report through Request changes to licence details or Manage Level 1 and 2 users:

• replacing the Authorising Officer or Key Contact, or amending their details
• adding or removing Level 1 Users, and removing Level 2 Users
• changes to the organisation's name, address, contact details or head office
• new branches, sites or linked UK entities
• a change in the status of any registration or accreditation you are legally required to hold, such as a care provider's CQC registration
• stopping trading, or entering any insolvency procedure
• a merger, takeover or similar change
• anyone falling under the guidance's definition of "you" being convicted of a relevant offence
• for a Worker sponsor, a change in organisation size or charitable status, because it changes what you pay for the licence and the Immigration Skills Charge
• adding or removing a representative, surrendering the licence, or substantially changing the nature of your business

The mechanics matter as much as the deadline. SMS Manual 2 walks through the functions: Amend your organisation details for a new address or name, Replace your Authorising Officer or Replace your Key Contact for a change of person, and Request any other change to your licence details for everything else. A change of head-office address, or an address change for Key Personnel where the new postcode matches the head office, normally updates automatically. Replacing an Authorising Officer or Key Contact, or adding a Level 1 User, also updates automatically if your licence is fully active, A-rated and the postcodes match, but you still send a signed submission sheet for a new Authorising Officer or Key Contact. Everything else waits for a UKVI caseworker. And where the system produces a submission sheet, you have 5 working days to send it with any supporting documents, or the request is refused and the licence may be revoked.

A change of company name is handled with suspicion, because the reason decides whether you need a new licence. Incorporating for the first time, with nothing else changing, is a name change. A name change that is part of a merger or takeover may mean a new application. Mergers, takeovers, TUPE transfers and insolvency each carry their own 20-working-day clock and are covered in sections C3 and C4.

One trap catches small employers more than any other. If your only Level 1 User leaves and nobody else has access, you cannot use the SMS to fix it. You must use the paper sponsor change of circumstances form to add a Level 1 User, and until then you cannot assign a certificate or make any report. The guidance is explicit that, unless you are surrendering the licence, you must have at least one Level 1 User in place at all times.

The Records the System Assumes You Are Keeping

Nothing you type into the SMS satisfies your record-keeping duty. Appendix D of the sponsor guidance lists the documents you must hold for every sponsored worker, in paper or electronic form, and be able to produce on request. Part 3 says that if you fail to provide them "when asked or within the timeframe we specify, we will take action against you". Compliance checks can be announced or unannounced, on site or by video call.

The retention rule is that all documents relating to a sponsored worker must be kept for the whole period of sponsorship and then until the earlier of one year after sponsorship ended or the date a compliance officer examined and approved them. The documents from your licence application must be kept for as long as you hold the licence. Other legislation, including the illegal-working rules, may require longer.

What Appendix D expects to find in the file:

• Right to work. Evidence of a right to work check for every worker you employ or sponsor, carried out before they start, normally through the online share-code service on GOV.UK. Where you sponsored a visa from overseas, evidence of the date the worker entered the UK: a copy of the passport page with the entry stamp, or a record of the entry date backed by travel tickets where there was no stamp.
• Recruitment. How you found the worker. Where a role was advertised, the advert details and where and for how long it ran. Where it was not, an explanation of how you identified the worker as suitable, with evidence where practicable.
• Salary. Payslips showing name, National Insurance number, tax code, allowances and deductions; evidence of each payment into the worker's own bank account; and the contract or written statement of particulars.
• Skill level. A detailed job description, copies of the qualifications relied on, and any professional registration the role requires. If your advert said a qualification was mandatory and you hired without it, written reasons why.
• Everything else. A copy of the National Insurance number; a history of the worker's UK residential address, personal email and phone number, which must always be kept up to date; a DBS check where the role requires one; a record of absences; and evidence that you gave the worker information about their employment rights in the UK.

The address history is the one that trips people up, because it ties back to the reporting duty. If a worker disappears and you report it, the SMS asks for their last recorded residential address, telephone number and personal email. If your file has the address from the day they arrived and nothing since, the report is wrong on the day you make it.

The Mistakes That Turn Into a Compliance Finding

Part 3 lists the sanctions in ascending order: reducing your certificate allocation or setting it to zero, downgrading to a B-rating, suspending the licence while the Home Office investigates, and revoking it. A B-rating means a time-limited action plan with a fee, paid within 10 working days through the Action plan details function, and no new sponsored workers until the A-rating is regained. Refuse or ignore it and the licence is revoked.

The findings that produce those sanctions are rarely dramatic. Reading the revocation annexes against the duties above, these are the ones an ordinary employer walks into:

1. Nobody has logged in for a year. The inactive-account process now ends in suspension and, 28 days later, normally revocation.
2. The only Level 1 User left and was never replaced. Having no eligible Level 1 User in place is listed in Annex C2 as a circumstance in which the licence will normally be revoked.
3. A shared login. Disclosing a password or one-time passcode to another person is now a listed ground under Annex C3.
4. The role drifted from the certificate. A worker doing a job that does not match the occupation code or job description on their certificate, where that was not a permitted change, is a mandatory ground for revocation. A permitted change that was never reported within 10 working days is the smaller version of the same finding.
5. The submission sheet was not sent. Five working days, or the request is refused and the licence is at risk.
6. Internal communication too poor to know a worker has not turned up. Annex C2 gives this as its own example of not having the processes to comply.
7. The wrong type of certificate, or a certificate assigned to a relative.
8. Recovering the certificate fee or the Immigration Skills Charge from the worker. Both are listed as grounds on which the licence will normally be revoked. Our guide to the Immigration Skills Charge covers what you can never pass on.

None of these requires dishonesty. They require a licence that was granted, filed, and not operated.

What CA Recruitment Does and Does Not Absorb

It is worth being plain about this, because some agency pages are not. When CA Recruitment runs a placement for a UK sponsor, you still hold the licence, you still operate the SMS, and every reporting duty on this page stays with you. We are not your Level 1 User. We cannot assign your Certificate of Sponsorship. We do not make your reports. Our guide to what an international recruitment agency can and cannot do for a UK sponsor sets out the five duties that never leave you, and this is the account they live in.

What we do is the half the account cannot do for you. We source and vet the candidate, primarily from the Philippines, and check the role and salary against the current thresholds before you spend anything. We give you the details the certificate form asks for, in the form it asks for them: passport details, contact address, the job description matched to the occupation code. We stay with the worker through the visa application and arrival, which is when the 28-day start clock and the date-of-entry record begin. And because the certificate asks whether you used an agent, we are named on it.

If you want outside help operating the system itself, the guidance allows a UK-based representative such as a regulated immigration adviser to be appointed as an additional Level 1 User once the licence is granted. That is a different profession from ours, and we will say so rather than pretend otherwise.

If you hold a licence, or are about to, and the problem is finding the worker rather than running the account, our UK Skilled Worker visa sponsorship page explains how we work with UK employers. Or message Monette on WhatsApp and tell her the role. She will tell you honestly whether we can fill it.

Frequently asked questions