Sponsor Licence Key Personnel UK: AO & Level 1/2 User Rules, Replacements and Compliance (2026)

Sponsor licence key personnel UK rules sit at the heart of every employer’s sponsorship obligations, and in 2026 the Home Office’s tightened approach to sponsor governance has made the appointment, replacement and management of these individuals a live compliance risk rather than an administrative afterthought. If your organisation holds, or is applying for, a Skilled Worker or other sponsor licence, the people you name as Authorising Officer (AO), Level 1 user and Level 2 user directly determine whether your Sponsorship Management System (SMS) records stay accurate and whether UK Visas and Immigration (UKVI) can hold your business accountable. This guide is written for HR, global mobility teams and in-house counsel who need step-by-step rules, notification timescales and practical controls.

It explains each role, the process for adding and removing users, what to do when you replace an AO, and the pitfalls that most commonly trigger suspension, downgrade or revocation.

Executive summary: what’s changed and why it matters

The direction of travel across recent Home Office guidance and wider immigration policy has been towards stricter, more auditable sponsor governance. Sponsors are expected to keep the identity and contact details of their sponsor licence key personnel UK accurate at all times, and to demonstrate that the named individuals are genuinely carrying out their duties, not simply listed on paper. The published sponsor guidance sets out the duties, the reporting obligations and the range of sanctions that follow when those duties are not met, from downgrading a licence to an action plan through to suspension and revocation.

Two themes matter most in 2026. First, change control: UKVI expects sponsors to keep the SMS current whenever key personnel join, leave or change role, and to retain the underlying evidence. Second, accountability: the AO carries responsibility for the actions of everyone using the SMS on the organisation’s behalf. Together these make the governance of sponsor licence key personnel UK a board-level compliance concern, because a single lapse in updating the SMS or evidencing an appointment can expose the whole licence.

Wider policy context, including the ongoing consolidation of the Immigration Rules and enforcement priorities, reinforces that sponsors will be judged on the robustness of their internal systems. The practical takeaway is simple: appoint the right people, evidence every appointment and change, and act quickly when personnel move on.

Who are “key personnel” on a UK sponsor licence? AO, Level 1 & Level 2 explained

Under the Home Office sponsor guidance, every licensed sponsor must nominate a set of key personnel who manage the licence through the SMS. Getting these roles right is the foundation of managing sponsor licence key personnel UK obligations, because each role carries different permissions and different levels of responsibility.

• Authorising Officer (AO). The most senior person responsible for the actions of all SMS users. The AO is accountable to UKVI for compliance with sponsor duties.
• Key Contact. The main point of contact between the sponsor and UKVI on the licence application and thereafter.
• Level 1 user. The day-to-day manager of the SMS with full access to carry out sponsorship activities, including assigning Certificates of Sponsorship (CoS) and reporting changes.
• Level 2 user. An optional operational user with restricted permissions, typically limited to routine tasks under the supervision of Level 1 users.

One individual can hold more than one role, but as explained below, segregation of duties is best practice for larger organisations to reduce single-point-of-failure risk.

Authorising Officer: responsibilities

The AO is the person who takes overall responsibility for the sponsor’s compliance and for the conduct of every SMS user. In practice this means the AO should be a senior and competent person within the organisation, and the Home Office expects the AO to be, in most cases, a paid member of staff or an office holder rather than an external agent. The AO does not personally have to carry out every SMS transaction, but is answerable for those transactions. When considering who among your sponsor licence key personnel UK should be the AO, choose someone with genuine authority to enforce compliance policy across HR and hiring managers, because UKVI expects the role to have teeth.

The framework underpinning immigration control and sponsorship derives ultimately from the Immigration Act 1971, and the sponsor guidance builds the operational duties on that statutory foundation together with the Immigration Rules.

Level 1 user: permissions and tasks

At least one Level 1 user must be in place at all times so the licence can be actively managed. Level 1 users have full functional access within the SMS: they can assign and manage CoS, report sponsor and migrant changes, add and remove Level 2 users, and maintain the sponsor’s details. Because Level 1 access is powerful, the individuals holding it should be trusted, trained staff. The first Level 1 user is usually nominated at the licence application stage and, in general, must be a paid member of staff or office holder who is a settled or otherwise eligible worker as set out in the guidance. Further Level 1 users can be added afterwards through the SMS.

Level 2 user: operational tasks

Level 2 users perform a narrower set of routine activities. Their permissions are deliberately restricted, for example, they can typically report certain changes to sponsored workers and create CoS drafts, but they cannot assign CoS or manage other users. This restricted profile makes the Level 2 role suitable for support staff who assist with day-to-day sponsorship administration but should not have full control. Managing the balance between Level 1 and Level 2 access is a core part of good governance for sponsor licence key personnel UK, because it limits how much any single user can do and creates natural checkpoints.

AO appointment: eligibility, internal sign-off and practical checklist

Appointing an AO should never be a quiet administrative step. It is a governance decision that carries statutory and reputational weight, so it deserves a documented internal process. The person you appoint must be suitable, must consent to the role, and must understand the duties they are taking on. A robust appointment process also protects the organisation if UKVI later asks how the appointment was made.

Board resolution or delegation

Record the appointment formally. For many organisations this means a board resolution or a written delegation from a director or senior officer authorising the individual to act as AO. The minute or memo should name the individual, confirm they consent, describe the scope of their authority over the SMS and compliance policy, and be dated and signed. This creates an evidence trail that demonstrates the appointment was a considered, senior-level decision rather than a default.

Right to work and identity checks

As with any staff appointment, complete and retain identity and right to work checks for the AO and other key personnel. Robust right to work checking is itself a core sponsor duty, and demonstrating that your own key personnel are correctly documented signals to UKVI that your systems work. Keep copies of the checks, the check dates, and the person carrying out the check as part of the appointment pack for each of your sponsor licence key personnel UK.

Document retention

Retain the appointment memo, consent, identity and right to work evidence, and any conflict-of-interest checks for the periods required by the sponsor guidance and consistent with data protection obligations. Where the retention of personnel records intersects with employee data, the Information Commissioner’s Office (ICO) employment guidance sets out the principles of lawful, proportionate and secure processing. Retaining evidence too briefly leaves you exposed on audit; retaining it indefinitely without justification breaches data protection principles, so align retention to the documented compliance need.

A practical note on cost. Employers frequently ask what external advice costs for AO and Level 1/2 changes. Advisory scope typically ranges from a short fixed-fee review of a single AO change and evidence pack, through to a full governance audit covering role matrices, SMS access and retention. Fees vary between providers, so obtain a written scope and quote. In-house teams can handle routine SMS user changes; specialist input is worth budgeting for where an AO change coincides with a corporate restructure, a compliance concern or an impending UKVI visit.

Adding and removing SMS users (Level 1/2): step-by-step in practice

Managing SMS users is one of the most frequent operational tasks for sponsor licence key personnel UK, and it is also where avoidable errors creep in. The official Sponsorship Management System user guidance sets out the exact menu paths and role options; the steps below summarise the workflow, but you should follow the current published guidance for the precise on-screen wording.

How to add a Level 1 user

1. An existing Level 1 user logs in to the SMS and selects the option to add a new user, choosing the Level 1 user role.
2. Enter the new user’s personal and contact details accurately, matching identity documents.
3. Confirm the new user’s eligibility for the role in line with the guidance (for example, that they are an eligible worker who is a paid member of staff or office holder).
4. Submit the request; the SMS generates login credentials and the new user completes activation.
5. Record the appointment internally, including who approved it and the date, and retain identity and right to work evidence.

How to add a Level 2 user

1. A Level 1 user logs in and selects the add-user function, choosing the Level 2 user role.
2. Enter the new Level 2 user’s details and confirm the restricted permissions appropriate to their tasks.
3. Submit and allow the SMS to issue activation details.
4. Brief the new Level 2 user on the limits of their access and the escalation route to a Level 1 user.
5. Log the appointment in your access register so the role matrix stays current.

Removing users and emergency steps

When a Level 1 or Level 2 user leaves, changes role, or must be removed for a compliance reason, act promptly. A Level 1 user can remove another user’s access through the SMS. Where the departing individual is the sole Level 1 user, you must ensure continuity, appoint a replacement Level 1 user so the licence is never left without active management. In an emergency, such as a suspected misuse of SMS access, revoke the user’s access immediately, preserve the audit trail of their activity, and document the reason for removal. Prompt de-provisioning is a simple but frequently overlooked control for protecting sponsor licence key personnel UK arrangements.

Never leave the licence without an active Level 1 user. If your only Level 1 user departs and no replacement is in place, you lose the ability to manage the SMS and to meet reporting obligations, which itself increases suspension risk.

Replacing an AO or other key personnel: notification, timing and evidence to retain

Replacing an AO is one of the highest-stakes personnel changes on a sponsor licence, because the AO carries overall accountability. Whether the change is planned (a resignation or promotion) or forced (a dismissal or disciplinary exit), the process is the same in principle: appoint a suitable successor, update the SMS, and retain a complete evidence pack. Getting the timing and the record-keeping right protects the licence and demonstrates that your governance of sponsor licence key personnel UK is functioning.

When to notify UKVI: report changes to your key personnel through the SMS in line with the Home Office sponsor guidance, keeping the reporting within the timescales specified in that guidance. As a general rule, changes to key personnel and to certain sponsor details must be reported through the SMS within the reporting period set out in the guidance (which for many reportable changes is a limited number of working days). Because these timescales can change, follow the current published guidance and do not allow a gap between the change happening and the SMS being updated.

Forced change (dismissal or disciplinary), preserving records

Where an AO or key user leaves under difficult circumstances, the compliance stakes rise. Preserve the full record: the reason for the exit, any disciplinary or investigation documentation relevant to sponsorship, the date access was revoked, and confirmation that the SMS was updated. If the departure related to a compliance failing, be ready to show UKVI both what went wrong and what corrective action you took, including the appointment of a competent replacement and any tightening of controls.

When to report vs when not to report

• Report. Changes to the AO, changes to Level 1 and Level 2 users, changes to the Key Contact, and changes to the sponsor’s own details such as name, address or ownership, in line with the guidance timescales.
• Internal only. Purely internal reallocations of tasks that do not change the named individuals or the details held on the SMS, but even these should be logged in your access register so your role matrix stays accurate.

The evidence pack for an AO replacement should typically include: the outgoing AO’s resignation letter or exit record; the board minute or delegation appointing the new AO; the new AO’s written acceptance; identity and right to work checks for the incoming AO; and a dated confirmation that the SMS was updated. Assembling this pack contemporaneously is far easier than reconstructing it during a UKVI compliance visit.

Compliance controls and employer-side policies to reduce sanction risk

Strong policies turn the management of sponsor licence key personnel UK from a reactive scramble into a controlled, auditable process. UKVI does not just look at whether your records are correct on the day of a visit; it looks at whether you have systems that keep them correct. The following controls, split between technical and operational, form a practical baseline.

Technical controls in SMS

• Access hygiene. Grant Level 1 and Level 2 permissions on a least-privilege basis and review them regularly. Remove access immediately when a user leaves.
• Account naming and integrity. Ensure each SMS user account maps to a real, identifiable individual, so activity can be attributed. Avoid shared or generic accounts.
• Secure processing. Because SMS use involves personal data about employees and sponsored workers, apply the ICO’s employment data principles, lawful basis, minimisation, security and defined retention, to how that data is stored and shared.

Operational controls

• Role matrix. Maintain a live matrix of who holds AO, Level 1 and Level 2 roles, with appointment dates and evidence references.
• Handover checklists. Use a standard handover for every personnel change so nothing is missed when an AO or user moves on.
• Training. Train key personnel on their duties and refresh training when the guidance changes.
• Audit and logs. Run periodic self-audits of SMS records against HR data, and keep a sanctions risk register that flags where gaps could arise.
• Retention. Set retention periods for appointment and change evidence that align with the sponsor guidance and data protection principles, and document the rationale.

Documenting these controls, and evidencing that you actually operate them, is often the difference between a licence that survives a compliance visit and one that is downgraded. For a structured approach, an audit checklist for sponsor licence compliance can be used as the standing hub for your templates and self-assessment.

Common pitfalls, enforcement outcomes and worked examples

Most enforcement action linked to personnel failings is preventable. The following are the pitfalls that most frequently undermine the governance of sponsor licence key personnel UK, drawn from the pattern of duties and sanctions in the Home Office sponsor guidance.

1. Failing to keep SMS user details up to date after someone leaves or changes role.
2. Leaving the licence without an active Level 1 user during a gap in staffing.
3. Delaying the appointment of a replacement AO after a resignation or dismissal.
4. Naming an AO who lacks genuine authority or is not a suitable, senior person.
5. Failing to record start dates and other reportable events within the required timescales.
6. Not retaining evidence of appointments and changes, so nothing can be shown on audit.
7. Granting excessive SMS permissions, so too many users can carry out high-risk actions.
8. Using shared or ambiguous SMS accounts that cannot be attributed to an individual.
9. Omitting right to work checks for the key personnel themselves.
10. Treating governance as a one-off application task rather than an ongoing duty.

The enforcement outcomes that follow escalate in severity. UKVI may downgrade a licence and require an action plan; it may suspend the licence while it investigates, during which no new CoS can be assigned; and in serious cases it may revoke the licence entirely, ending the ability to sponsor and affecting existing sponsored workers, whose permission may then be curtailed. In a typical anonymised scenario, an employer whose sole Level 1 user left and whose SMS records went stale found that a routine change had not been reported; the resulting compliance gap led to a downgrade and a costly remediation exercise.

In another, a delayed AO replacement after a disciplinary exit left the organisation unable to evidence who was accountable during the intervening period, precisely the kind of gap UKVI scrutinises. The lesson in each case is the same: continuity and evidence protect the licence.

Practical resources: templates, timelines and who to call for help

Operationalising the rules is easier with standard documents. A practical template pack for managing sponsor licence key personnel UK should include an AO appointment memo, an AO resignation and handover checklist, an SMS user request form, and an audit checklist. These give HR and compliance teams a repeatable workflow so that every appointment and change produces the same complete evidence pack.

On timing, build your internal deadlines to sit comfortably inside the reporting windows set out in the Home Office guidance, rather than at the edge of them. Update the SMS as soon as a change is confirmed, and complete the internal evidence pack in the same workflow. On resourcing, routine SMS user additions and removals are well within the capability of a trained in-house team; escalate to a specialist immigration solicitor for AO changes tied to restructures or compliance concerns, for responses to UKVI action plans or suspensions, and for enforcement or appeal situations. Where you instruct external help, check that advisers are appropriately regulated, solicitors by the Solicitors Regulation Authority, or advisers registered with the Immigration Advice Authority (formerly the Office of the Immigration Services Commissioner), and knowing when to instruct external counsel is itself a governance control.

Comparison table: AO vs Level 1 vs Level 2 (permissions, accountability and typical users)

The table below compares the three core SMS roles that make up sponsor licence key personnel UK, summarising responsibilities, permissions, who should hold each role and whether a change must be reported.

For the detailed on-screen steps behind each row, use the official SMS user guide on reporting sponsor changes as your operational companion.

Conclusion

Managing sponsor licence key personnel UK obligations well is one of the most cost-effective forms of compliance an employer can invest in. The current emphasis on accurate, evidenced and continuous governance means the AO, Level 1 and Level 2 roles must be treated as live responsibilities rather than static entries on the SMS. Appoint suitable, senior people; document every appointment and change; update the SMS promptly and within the guidance timescales; never leave the licence without an active Level 1 user; and keep a complete evidence pack for every change. With clear role definitions, disciplined change control and periodic self-audit, the organisations that manage their sponsor licence key personnel UK arrangements proactively are the ones that keep their licences intact and their sponsored workers secure. Where an AO change coincides with a restructure, a compliance concern or a UKVI intervention, treat specialist advice as part of the control framework rather than an afterthought.

Sources

1. Home Office, UK visa sponsorship for employers
2. Home Office, Workers and Temporary Workers: sponsor guidance
3. Immigration Rules, Appendix Skilled Worker
4. Legislation.gov.uk, Immigration Act 1971
5. ICO, Guidance for organisations
6. UK Parliament, House of Commons Library
7. The Law Society