The Home Office will normally revoke a sponsor licence if you "do not have in place the necessary processes and systems to be able to comply with your sponsor duties". That is item (b) of Annex C2 in the sponsor guidance, and its own example is an employer whose internal communications are not good enough to know when a sponsored worker has stopped turning up. For an employer with a large sponsored workforce, sponsor management software is one way to answer it. Buying it does not move the duty, though: under paragraph L4.15 you stay responsible for everything done on your licence, including by people from outside your organisation.
So the useful question is not which product has the longest feature list. It is whether a system will keep you inside the specific clocks, records, and access rules the guidance sets. This guide turns those rules into the questions to put to any vendor, and the questions each person in the buying group will want answered.
What sponsor management software is, and what it isn't
Start with a naming trap. The Home Office's own portal is the sponsorship management system, or SMS. It is where your licence lives: the guidance says your Level 1 Users "carry out their functions by using the sponsorship management system" (L4.5), and the SMS shows your users, your remaining Certificates of Sponsorship (CoS), and a message board where guidance updates are posted (L10.3). Every sponsor has it, and no product replaces it.
Sponsor management software is the layer around the SMS: the system that tracks what is due, holds the worker records, reminds the right person, and keeps a trail of what was reported and when. Our guide to the Sponsor Management System covers the Home Office portal itself. This piece is about choosing what sits around it.
Every paragraph reference below comes from the Part 1 and Part 3 sponsor guidance at version 08/26, valid from 28 August 2026, and Appendix D at version 10/26, published 8 October 2026.
The duties a system has to cover
A spreadsheet can hold a list of workers. What it can't do on its own is notice that a clock has started. These are the duties where timing or retrieval is the whole test, and what to ask a vendor about each one.
| Duty | What the guidance requires | Ask the vendor |
|---|---|---|
| Worker changes | Report within 10 working days of the event, unless stated otherwise (C1.13) | Where does the system learn that the event happened, and who is told? |
| Organisation changes | Report within 20 working days of becoming aware of the change (C2.3) | Does it track changes to addresses, ownership, and Key Personnel, not only to workers? |
| Evidence for an SMS change | Send the declaration, submission sheet, and any supporting documents within 5 working days, or the request is refused and the licence may be revoked (C2.19) | Does the task stay open until the evidence has gone, or close when the change is submitted? |
| Unauthorised absence | Report absence of more than 10 consecutive working days, no later than 10 working days after the 10th day (C1.19) | Can it see attendance, or does a line manager have to remember to tell HR? |
| Worker records | Keep the Appendix D documents, on paper or electronically, and make them available on request (C1.37, Appendix D) | How long does it take to produce one worker's complete file? |
| Retention | Keep records until one year after sponsorship ends, or until a compliance officer has examined and approved them if that is sooner. Licence application documents are kept for as long as you hold the licence (Appendix D) | Does retention run per worker from the date sponsorship ended? |
| Guidance changes | Read all parts of the guidance and stay aware of changes, which are announced on the SMS message board (C1.2, C1.3) | Who updates the system's rules when the guidance changes, and how quickly? |
The last row is the easiest to skip in a demo. The rules move: Part 3 went from version 05/26 to 08/26 in August, and Appendix D from 08/26 to 10/26 in October. A system built against last year's rules is a spreadsheet with a nicer screen.
Two more duties sit with the Authorising Officer, the senior person accountable for the licence. They are responsible for the activities of all SMS users, so you "must have a system in place to check these activities", and the Home Office recommends they check the CoS assigned to workers at least once a month (L4.37). It also recommends that your Level 1 User logs in to the SMS at least once a month (L10.4). Software can't log in for them, but it can put those checks in someone's diary and record that they happened.
If you want to see how your current set-up measures against these duties before you talk to any vendor, our sponsor compliance checker runs a mock Home Office audit.
Who gets access to your licence
This is where buying software turns into a compliance decision, and it is the section to forward to whoever owns IT security.
You are responsible for anything done by anyone you set up as an SMS User, including people from outside your organisation, and the Home Office will treat their actions as yours. The same paragraph tells you to check the identity of anyone you appoint from another organisation and make sure they are suitable (L4.15).
Your primary Level 1 User has to be your own employee, director, or partner, and a settled worker, and you must keep one in place for the life of the licence (L4.45, L4.47). Outsiders can only ever be additional Level 1 Users, and only in two categories. One is an employee of a firm that delivers some or all of your HR function (L4.20). The other is a UK-based representative, who cannot be your Authorising Officer and can only be added once the licence is granted and you have appointed them as your representative (L4.16 to L4.18). A contractor or consultant engaged for a specific purpose cannot fill any Key Personnel role at all (L4.14). So a provider that sells software and nothing else may not be eligible to sit on your SMS. Ask which category it falls under before you sign.
If the provider is a representative giving immigration advice or services, it must be authorised to do so, for example by being regulated by the Immigration Advice Authority (L6.7). The guidance warns that a representative doing that work without being qualified may be committing a criminal offence (L6.8).
Whatever category a provider falls into, the wrong answer is a shared login. Annex C3(f) lists, as a ground on which the Home Office may revoke a licence, an SMS User disclosing "their SMS password or their multi-factor authentication one-time passcode to another person". Any vendor whose onboarding asks for your SMS credentials has told you something important about how it works.
Two dated changes make this a live question for 2026 and 2027. Multi-factor authentication on the SMS is being introduced on a phased basis from 3 September 2026, and the Home Office expects it to be in place for all sponsors by November 2026 (L4.67). And you can no longer appoint Level 2 Users: existing ones must be converted to Level 1 Users where eligible, or deactivated, by 8 March 2027 (L4.4, L4.58, L4.59). Whatever system you choose should know who your SMS users are, which role each holds, and who still needs moving. Offboarding matters as much as onboarding: having no Level 1 User able to do your day-to-day sponsorship work is a ground on which the Home Office will normally revoke (Annex C2(k)). Our guide to the Level 1 User role covers what each of them is responsible for.
The checks your records have to survive
The Home Office can check a sponsor at any time, and a check that involves visiting or interviewing you can be announced or unannounced (C7.9). A compliance check does not have to be a visit at all: it can be a request for documents, a remote video interview, or checks with other government departments (C7.6). The Home Office also makes regular checks with HMRC to confirm you are paying your workers in line with the Immigration Rules and the guidance (C7.7). When it asks for documents, you must provide them (C1.38), and failing to produce an Appendix D document within the time limit given is a ground on which the Home Office will normally revoke (Annex C2(g)).
That changes what "good records" means at volume. The test is not whether the documents exist somewhere. It is whether you can pull one worker's file, their reporting history, and evidence that their pay matches their CoS, on the day someone asks. Our guides to Home Office compliance visits and Home Office document requests cover what each of those looks like in practice.
Questions for each person in the buying group
At an employer with a sizeable sponsored workforce, this purchase rarely belongs to one person. These are the questions each of them is likely to bring, and the answers worth holding a vendor to.
HR and People
Will it fit the way we already work? Ask whether it connects to your HR and recruitment systems, so that a change in one place reaches the sponsorship record without someone re-keying it. Ask what it does with a reportable change: does it only remind you, or does it track the change through to a confirmed report?
The Authorising Officer and compliance owner
Will it prove what we did? Ask for an audit log showing who reported what, and when. Ask how it supports the monthly CoS check the guidance recommends (L4.37), and whether it can show you, today, which workers have something outstanding.
Finance
What does it cost against what it replaces? The comparison is not software against nothing. It is software against the hours your team spends on manual tracking, the cost of outside advice on each question, and the exposure if a missed report puts the licence at risk. If a licence is revoked, it goes on every route you hold, you can't sponsor anyone new, and the Home Office will normally cancel the permission of the workers you sponsor (C10.2), usually cutting it to 60 days for workers who weren't involved in the breach (C10.10). No budget line captures that cost.
Legal and data protection
Where does the data sit, and how long is it kept? Appendix D reminds sponsors of their responsibilities under the Data Protection Act 2018 and the UK GDPR. Ask how the system applies the Appendix D retention rule, and what happens to a leaver's file when that period ends.
IT and security
Who can see what? Ask about user access controls, multi-factor authentication on the vendor's own platform, and how SMS access is handled for anyone outside your organisation. The answer you want is named, individual Level 1 Users, each in an eligible category, and no shared credentials.
When a spreadsheet stops being enough
A spreadsheet works while one person holds the whole licence in their head. It stops working when the reporting clock starts in one team and the knowledge sits in another: a pay cut goes through payroll, a line manager notices an absence, a site moves. Annex C2(b) describes exactly that failure, an organisation whose internal communications are not good enough to know when a sponsored worker has not reported for work. At that point the spreadsheet is not saving money. It is the gap the Home Office lists as a reason to revoke.
Where Borderless Immigration fits
Borderless Immigration is the end-to-end platform for UK work visas, with in-house immigration experts, used by more than 600 UK employers. It tracks the 10 and 20 working-day reporting clocks and flags what is due, sends alerts for reportable changes and visa expiry, keeps a record of what was reported and when, and includes user access controls and a full audit log. It connects with HR and recruitment systems, and once appointed as your representative, Borderless can be added as an additional Level 1 User on your licence to help manage the SMS directly. Our experts also run mock audits, so gaps are found before the Home Office finds them.
If your sponsorship records live across a spreadsheet, an inbox, and one person's memory, book a demo and we'll show you how the duties above map onto your licence. For more on the duties themselves, start with our guide to sponsor licence duties and compliance.
Automate Home Office Audits with Borderless
The Borderless platform provides a centralized system for all sponsorships, automating reminders for key tasks and ensuring best practices across your organization, simplifying audit preparation and ongoing compliance.
