UK Sponsor Management System: Complete HR Guide 2026

Key TakeAways for Sponsor Management System (SMS)

The SMS is the Home Office portal every licensed UK employer must use to issue CoS, report changes, and maintain compliance records errors carry real legal weight.
User access must be tightly controlled: every Level 1 and Level 2 user needs their own login; shared credentials are a compliance violation the Home Office actively checks for.
Report worker changes (role, salary, location, absences over 4 weeks) within 10 working days; organisational changes within 20 working days missed deadlines trigger audits.
Treat SMS as part of your standard HR workflow, not a standalone compliance tool integrating it with your HRIS reduces missed reporting and improves audit readiness.
From 31 December 2026, all right-to-work checks must use eVisa share codes; physical BRPs will no longer be valid evidence.

What the SMS Actually Controls

Most HR teams treat the Sponsor Management System as a glorified form-filling portal. It's considerably more than that. The SMS is the Home Office's primary tool for monitoring sponsor compliance every action taken within it, and every action not taken, is timestamped and fully auditable. When a UKVI inspector reviews your licence, the SMS activity log is one of the first places they look.

The system handles four core functions:

Issuing Certificates of Sponsorship (CoS) : the mandatory digital record every sponsored worker must have before submitting a visa application
Reporting changes : covering shifts in a worker's circumstances, employment terms, or your organisation's structure
Managing key personnel : adding or removing authorised users and keeping the Authorising Officer details current
Maintaining organisation records : business address, contact information, and licence rating

Setting Up SMS Access: Roles and Credentials

When your sponsor licence is approved, UKVI issues login credentials to your Authorising Officer. From there, your organisation appoints Level 1 and Level 2 users but the setup step many companies rush past is user governance. Our UK Sponsor Licence management service gives a complete guide on sponsor license management.

SMS User Roles at a Glance

Role	Access Level	Key Responsibilities
Authorising Officer	Ultimate accountability	Responsible for all SMS activity; must be a paid employee, director, or partner.
Key Contact	Liaison	Primary point of contact with UKVI; can be the same person as the Authorising Officer.
Level 1 User	Full system access	Issues CoS, reports changes, manages other users; at least one Level 1 User must be a settled worker.
Level 2 User	Worker-level access	Can manage individual sponsored workers but cannot change organisation settings.

First Login: What to Do in the First 48 Hours

Once your licence is approved, UKVI sends credentials to your Authorising Officer. On first login you are prompted to change the password - do this immediately and store it in a shared password manager accessible to your backup Level 1 user. Then appoint your Level 1 users and set up their individual accounts before anything else. Do not assign a CoS or report a change using the AO credentials; that is a governance risk from day one.

Common mistake in SMS Compliance

Compliance Area	Risk	Recommended Action
Shared SMS credentials	Treated by the Home Office as a governance failure during compliance visits, not a minor oversight.	Assign individual logins to every user; never share credentials.
Dormant accounts with active permissions	Flagged during audits and may indicate weak access controls.	Remove SMS access immediately when users leave the organisation or change role.
Only one Level 1 User appointed	Creates operational and compliance risk if urgent CoS issuance or reporting deadlines arise during absence.	Appoint at least two Level 1 Users from day one to ensure continuity.

You can check if your sponsor license is truly compliant or not by using our UK Sponsor Licence compliance assessment calculator.

Issuing Certificates of Sponsorship: What to Check Before You Assign

Issuing a CoS is the most frequent task your Level 1 users will perform. It is also where the most errors occur. Before assigning, confirm three things:

CoS type: Defined CoS for workers applying from outside the UK (requires individual Home Office approval). Undefined CoS for workers already in the UK switching or extending. Issuing the wrong type results in automatic visa refusal there is no correction process.
Role eligibility: The job must meet RQF Level 3 or above and the relevant SOC 2020 going rate. From April 2026, check the updated going rates for your SOC code several occupations changed. The general £41,700 floor is not the only threshold to verify. Our CoS document checklist for HR gives complete Employer documents & compliance requirements.‍
CoS allocation: Check your remaining balance before assigning. Undefined CoS come from your annual pre-approved quota. If you are running low, request an additional allocation before you run out the Home Office review takes time and a depleted quota can stall your hiring.

Once assigned, a CoS must be used within three months. It cannot be used more than three months before the job start date entered in the SMS. Build these windows into your recruitment timeline most companies wait until offer acceptance to start the process, which is already cutting it fine. Read more details on CoS in our UK Certificate of Sponsorship complete guide.

For a full breakdown of CoS costs and allocation strategy, see Jobbatical's guide to UK CoS allocation and assignment.

Reporting Deadlines: The 10-Day and 20-Day Rules

Missing a reporting deadline is the single most common cause of compliance action. The rules are straightforward; the problem is operational — HR teams often do not have a reliable mechanism to trigger the SMS report at the point the event happens.

The Fix:

When someone's contract changes, the SMS report should be on the same checklist as updating payroll.
When an employee resigns, their SMS profile update should be part of the exit workflow. Companies that manage sponsored workers in a spreadsheet almost always miss deadlines. Jobbatical's immigration case management platform automates these triggers so your HR team gets flagged before a deadline passes, not after.
Report absences: An unauthorised absence of more than 10 consecutive working days must be reported regardless of the reason. Many sponsors only discover this requirement during a compliance visit.

What to Report and When

Event	Deadline	Examples
Worker circumstance changes	10 working days	Change of role, salary reduction, work location, absence exceeding 4 weeks, visa curtailment, or employee leaving the organisation
Organisational changes	20 working days	Change of Authorising Officer, new business address, TUPE transfer, change of ownership, or significant reduction in trading activity

Preparing for a Home Office Compliance Visit

Since the end of the four-year licence renewal cycle, compliance visits are now the primary mechanism through which the Home Office monitors sponsors. They can happen at any time, with or without notice. The expectation is that your HR processes and SMS records are audit-ready every day, not just when a renewal is approaching.

In practice, inspectors cross-reference three sources: your SMS activity log, your internal HR records (contracts, payslips, right-to-work checks), and what your sponsored workers themselves report about their employment. Discrepancies between any of these are treated as evidence of systemic compliance failure.

Before an audit, run this internal check:

Do your SMS records match current contracts and payroll for every sponsored worker?
Are right-to-work checks up to date and stored in the employee file?
Is every CoS correctly linked to an active, eligible role?
Are all Level 1 and Level 2 users currently active employees? Deactivate anyone who has left.
Are Appendix D records passports, visas, contact details complete and accessible? See Jobbatical's record-keeping guide for the full documentation requirements.

Honestly, most companies that fail compliance visits do not have a knowledge gap they have a process gap. They know what they are supposed to do; they just have no reliable system to ensure it happens every time.

Run a quick self-assessment before a visit to identify your highest-risk gaps" UK sponsor licence compliance assessment calculator

The eVisa Deadline: What Changes on 31 December 2026

From 31 December 2026, physical Biometric Residence Permits will no longer be valid evidence for right-to-work checks. All sponsored workers must demonstrate immigration status through an eVisa share code via their UKVI online account. This is not a future consideration it is a live operational change your HR team needs to prepare for now.

Three actions to take before the deadline:

Audit your sponsored worker list. Identify anyone still relying on a physical BRP as their primary evidence of right to work.
Prompt those workers to set up their UKVI account and generate a share code. Some workers particularly those with older visas have not done this yet.
Update your onboarding process. New hires from outside the UK should arrive with their share code ready; build the share code check into day-one paperwork, not as an afterthought.

Failure to use share codes from January 2027 onwards will itself constitute a right-to-work failure meaning a civil penalty of up to £60,000 per worker, regardless of whether the worker has valid leave to remain.

For more on the eVisa transition and what it means for your licence, read Jobbatical's UK Skilled Worker Visa guide for HR teams.

Integrating SMS into Your HR Workflow

The SMS works best when it is not treated as a separate system. For companies managing 10 or more sponsored workers, manual tracking spreadsheets, calendar reminders, email chains creates too many failure points. The reporting deadlines are tight, the consequences of missing them are serious, and the volume of changes across a workforce fluctuates constantly.

The practical answer is to connect your sponsorship workflow to your HRIS. When a contract change is processed in your HR system, it should automatically trigger a notification to your Level 1 user with the relevant SMS reporting deadline attached. When a sponsored worker's visa expiry date is approaching, your system should flag it before it becomes a compliance problem.

Jobbatical's platform integrates directly with leading HRIS systems and manages the end-to-end SMS process - CoS assignment, change reporting, audit preparation, and renewal tracking on behalf of your HR team.

If you are managing a growing cohort of sponsored workers and the administrative load is becoming unmanageable, book a demo to see how it works in practice.

For a full breakdown of UK sponsor licence costs and budgeting, see Jobbatical's sponsor licence fees guide for 2026.

Disclaimer: Immigration rules change quite frequently; please verify with official sources or contact us for the latest info before making any decisions.