Insight
How to Appoint and Manage Level 1 Users in the Sponsor Management System
Author:
Jeremy Ling
Corporate Immigration Specialist
A Level 1 User manages the day-to-day operation of an organisation’s sponsor licence through the Sponsor Management System (SMS).
Because Level 1 Users can assign Certificates of Sponsorship, report changes and manage access to the system, appointing the wrong person—or failing to remove someone who has left—can expose the organisation to serious compliance and security risks.
The rules are also changing. Mandatory multi-factor authentication begins rolling out on 3 September 2026, while the Level 2 User role will begin to be phased out from 9 September 2026.
Key points
Every sponsor must maintain at least one eligible Level 1 User throughout the life of its licence.
The primary Level 1 User will normally need to be an internal employee, director or partner and a settled worker.
Additional Level 1 Users can be appointed after the licence is granted.
Level 1 Users must be based in the UK, subject to limited exceptions.
New Level 2 Users cannot be appointed from 9 September 2026.
Mandatory multi-factor authentication begins rolling out on 3 September 2026.
SMS accounts inactive for 12 months may be deactivated by UKVI.
User credentials must be personal and must never be shared.
What is a Level 1 User?
A Level 1 User is the person—or one of the people—authorised to carry out the sponsor’s day-to-day activities within the SMS.
Their permitted actions include:
Assigning Certificates of Sponsorship
Requesting an increase in the organisation’s CoS allocation
Applying for Defined Certificates of Sponsorship
Requesting additional Level 1 Users
Deactivating SMS users who have left or are no longer eligible
Reporting changes to sponsored workers
Reporting changes to the organisation
Withdrawing Certificates of Sponsorship
Viewing licence activity and key personnel information
Reading messages issued through the SMS
Level 1 User access should therefore be given only to people who understand the sponsor’s legal duties and can be trusted with sensitive worker and organisational information.
The sponsor remains responsible for actions taken through its SMS account, including actions taken by external representatives or outsourced HR providers.
How does a Level 1 User differ from the other key personnel?
The roles are connected, but they do not form a simple reporting hierarchy.
Role | Main responsibility | Automatic SMS access? |
Authorising Officer | Senior person responsible for the conduct of SMS users and the organisation’s sponsorship arrangements | No, unless separately appointed as a Level 1 User |
Key Contact | Main point of contact between the organisation and UKVI | No, unless separately appointed as a Level 1 User |
Level 1 User | Day-to-day management of the sponsor licence through the SMS | Yes |
Level 2 User | Restricted SMS functions during the transitional period | Yes, but with limited permissions |
The same person can hold more than one role, provided they meet the eligibility and suitability requirements for each role.
The Authorising Officer remains responsible for monitoring the activity of the organisation’s SMS users. Current Home Office guidance recommends that the Authorising Officer checks Certificates of Sponsorship assigned to workers at least once a month.
Who can be a Level 1 User?
Unless a transitional or route-specific exception applies, the sponsor must have at least one primary Level 1 User who is both:
An employee, director or partner within the sponsoring organisation; and
A settled worker.
A settled worker can include a British or Irish citizen, a person with indefinite leave to enter or remain, and certain other people who have the right to work in the UK without immigration time restrictions.
The primary Level 1 User must normally also:
Be based in the UK while carrying out the role
Have a valid National Insurance number, unless exempt
Meet the Home Office suitability requirements
Access the SMS regularly
Keep their personal and contact details current
Not be a contractor or consultant engaged for a specific project
If a sponsor does not maintain an eligible Authorising Officer and at least one eligible Level 1 User throughout the life of its licence, the Home Office can revoke the licence.
Transitional rules for licences granted before 1 January 2025
A transitional arrangement applies where an organisation successfully applied for its sponsor licence before 1 January 2025 and has held that licence continuously.
Under this arrangement, the sponsor must have:
At least one Level 1 User who is an employee, director or partner; and
At least one Level 1 User who is a settled worker.
These requirements can currently be met by one person or by two separate Level 1 Users.
However, the Home Office has indicated that it is likely to require all sponsors to have at least one Level 1 User who personally meets both requirements. Sponsors relying on two different people should therefore consider appointing an internal settled worker who satisfies both conditions.
Can an external representative be a Level 1 User?
Yes, but only as an additional Level 1 User after the sponsor licence has been granted.
An additional Level 1 User can be:
A paid employee or office holder within the sponsor organisation
An employee of a third-party organisation delivering some or all of the sponsor’s HR function
An eligible UK-based representative
A representative cannot be nominated as a Level 1 User in the initial sponsor licence application. The representative must first be formally appointed and can then be requested as an additional Level 1 User after the licence is granted.
If the organisation has only one Level 1 User, that person must not be an external representative. The sponsor must still maintain an eligible internal Level 1 User.
Where the representative provides immigration advice or services, they must also be authorised to provide those services in the UK.
Can a sponsored worker be appointed as a Level 1 User?
Potentially, but the sponsor must still maintain at least one Level 1 User who satisfies the primary internal and settled-worker requirements.
The proposed user must have immigration permission allowing them to work for the relevant organisation and must meet all other eligibility and suitability requirements.
Sponsors should assess this carefully rather than assuming that any sponsored employee can be given Level 1 access.
New multi-factor authentication requirements
Mandatory multi-factor authentication will be introduced in phases from 3 September 2026 and is expected to apply to all sponsors by November 2026.
It will be enabled for organisations granted a new sponsor licence on or after 9 September 2026.
Once enabled, SMS users will need to enter a one-time passcode in addition to their username and password. For a Level 1 User, the code will normally be sent to:
Their registered mobile number by text; or
Their registered email address where no valid mobile number is available.
Level 1 Users may also need to verify their date of birth when first accessing an MFA-enabled account or after changing their telephone number or email address.
Sponsors should now check that every Level 1 User’s:
Date of birth is correct
Mobile number is current
Email address is personal and secure
Work address remains accurate
Incorrect or outdated details could prevent a user from accessing the SMS when a report or CoS assignment is time-sensitive.
Level 2 Users are being phased out
From 9 September 2026, sponsors will no longer be able to appoint new Level 2 Users.
Existing Level 2 Users must be dealt with by 8 March 2027. A Level 1 User must either:
Request their conversion to Level 1 User status, provided they meet the requirements; or
Deactivate their SMS account.
After 8 March 2027, UKVI will deactivate any remaining Level 2 accounts.
Not every Level 2 User will be eligible to become a Level 1 User. In particular, temporary workers supplied by an employment agency cannot be converted into Level 1 Users.
Sponsors should review existing Level 2 accounts now rather than waiting until the March 2027 deadline.
What happens to inactive SMS accounts?
Under the current guidance, an SMS user account is considered inactive where the user has not accessed it for 12 months or more.
If UKVI identifies an inactive Level 1 User, it will contact the Authorising Officer and the affected user. To retain access, the Level 1 User must log in, check their details and update them where necessary within three months of that notification.
If no action is taken, UKVI can deactivate the account.
Where this leaves the sponsor with no active Level 1 Users, UKVI will suspend the sponsor licence and give the organisation 28 days to appoint at least one eligible Level 1 User. If the sponsor fails to do so, the licence will normally be revoked.
Level 1 access should therefore not be treated as something that is needed only when a CoS is assigned. Users must access the account regularly and monitor messages posted by the Home Office.
How should Level 1 User access be managed?
Maintain enough cover without giving access too widely
The Home Office does not require every sponsor to have two Level 1 Users. However, it recommends having enough eligible users to cover absences.
For many organisations, maintaining two appropriately trained Level 1 Users reduces the risk of losing access when somebody is ill, on leave or leaves the business.
At the same time, the Authorising Officer is responsible for every SMS user’s conduct. Access should therefore be limited to the number genuinely required.
Introduce a joiner-mover-leaver process
SMS access should form part of the organisation’s standard HR access controls.
When a user changes role or leaves:
Review whether they still need SMS access
Deactivate their account promptly where they no longer require it
Confirm that another eligible Level 1 User remains active
Update any related key personnel information
Retain an internal record of the action taken
A Level 1 User can deactivate other users but cannot deactivate their own account. The change should therefore be completed by another active Level 1 User wherever possible.
Never share SMS credentials
Each SMS account belongs to one named individual.
Usernames, passwords and MFA codes must not be shared, including during annual leave or when somebody leaves the organisation. Another authorised person should have their own Level 1 User account.
Review activity regularly
The Authorising Officer should review SMS activity and Certificates of Sponsorship at least monthly.
A wider access review can also check:
Which users remain active
Whether their contact details are current
When each person last accessed the SMS
Whether any Level 2 Users need conversion or removal
Whether access still matches each person’s responsibilities
Whether recent leavers have been deactivated
Can a Level 1 User assign a CoS to themselves?
Generally, no.
An SMS user must not assign a Certificate of Sponsorship to:
Themselves
Their partner
A close relative
The Home Office states that it will revoke a sponsor licence if it finds that this has happened.
The limited exception is a provisionally rated UK Expansion Worker sponsor. In that situation, the overseas Authorising Officer—who must also act as the Level 1 User—may be required to assign their own CoS to apply for entry clearance.
Sponsors should use a different authorised SMS user where a proposed assignment could create a prohibited personal connection.
Reporting deadlines Level 1 Users need to understand
The draft should not treat every SMS report as having the same deadline.
Unless a different deadline applies:
Changes involving a sponsored worker must generally be reported within 10 working days
Changes to the sponsoring organisation must generally be reported within 20 working days
Worker events can include:
Failure to start employment
Unauthorised absence
Termination of employment
Changes in role, duties or job title
Reportable salary changes
A change in work location
Withdrawal of sponsorship
Organisation changes can include:
Changes to the business address or contact details
Changes to the size of the business (small sponsors and large sponsors pay different fees)
Changes to key personnel
Adding or removing branches
Changes to required registrations or accreditations
Insolvency
Mergers, takeovers or changes in ownership
A substantial change in the nature of the business
The precise deadline and reporting route should be checked against the current sponsor guidance for the event concerned. In the event of ownership changes, you must surrender the licence and complete additional reporting steps.
For broader compliance guidance, read our sponsor licence compliance guide.
Level 1 User governance checklist
At least one eligible internal Level 1 User remains active
The primary user meets the settled-worker requirement or a valid exception applies
Sufficient cover exists for absence, illness and staff departures
Every user has an individual and secure email address
Dates of birth, mobile numbers and work addresses are current
MFA readiness has been checked
Inactive users have been reviewed
Existing Level 2 Users have a conversion or deactivation plan
Former employees and unsuitable users have been removed
No user shares their SMS credentials or MFA codes
CoS activity is reviewed by the Authorising Officer at least monthly
Worker and organisation reporting deadlines are documented
Level 1 Users have received sponsor compliance training
Frequently asked questions
Does every sponsor need a Level 1 User?
Yes. A sponsor must maintain at least one eligible Level 1 User throughout the life of its licence. Failing to do so can result in revocation.
Can an external legal representative be our only Level 1 User?
No. A UK-based representative can be appointed as an additional Level 1 User after the licence has been granted, but cannot be the sponsor’s sole Level 1 User.
The sponsor must retain an eligible internal Level 1 User, subject to limited route-specific and transitional provisions.
Is it mandatory to appoint two Level 1 Users?
No. There is no general requirement to have two. However, the Home Office recommends having enough eligible Level 1 Users to cover periods of absence.
For many sponsors, two trained users provide sensible operational resilience.
Can a Level 1 User share their login with another employee?
No. SMS credentials and MFA codes are personal to the named user and must not be shared. Another employee who needs access should be appointed as a separate Level 1 User.
What happens if our only Level 1 User leaves?
The organisation should ideally appoint and activate a replacement before the existing user leaves.
If nobody has active SMS access, the sponsor cannot add a replacement through the system. It must complete the manual Home Office sponsor change of circumstances form to request a new Level 1 User.
Login details should not be handed over to the replacement.
Can a Level 1 User deactivate their own account?
No. A Level 1 User can deactivate other SMS users but cannot deactivate themselves. Another active Level 1 User should remove them.
Can we still appoint Level 2 Users?
Only until 8 September 2026. From 9 September 2026, no new Level 2 Users can be appointed.
Existing Level 2 Users must be converted to Level 1 Users, where eligible, or deactivated by 8 March 2027.
How often should a Level 1 User access the SMS?
The guidance requires SMS users to access their accounts regularly. An account that has not been accessed for 12 months can be treated as inactive and may be deactivated.
Regular access is also necessary to review Home Office messages and ensure reportable events are handled on time.
Final thoughts
Level 1 User access is not simply an administrative convenience. It is one of the main controls through which an organisation fulfils its sponsor duties.
The strongest approach combines carefully limited access with reliable operational cover.
Sponsors should know who can access the SMS, ensure every user is eligible and trained, review activity regularly and remove access as soon as it is no longer required.
The 2026 introduction of mandatory MFA, the removal of inactive accounts and the phasing out of Level 2 Users make this a good time for every sponsor to review its SMS access arrangements.
If you are concerned about your key personnel structure, reporting processes or SMS access controls, contact WestBridge Business Immigration for guidance before a user change creates a compliance problem.
Get Immigration Advice
Our expert team of senior immigration lawyers can provide clear, practical direction.
Contact Us
Disclaimer
The information provided in these articles is for general guidance only and does not constitute legal advice. Immigration rules change frequently and individual circumstances vary, so you should always seek tailored advice from a qualified immigration lawyer before making any decisions. If you require professional support, our team would be pleased to assist you.
Stay Updated
Be the first to know — access timely immigration updates that matter to your business.
Sign-up to our newsletter
