Key personnel, SMS access and business continuity

Separate accountability and system access

Part 1 distinguishes the Authorising Officer, Key Contact and SMS Users. Eligibility rules include route-specific and transitional provisions; appointing an adviser does not remove the sponsor’s own accountability.

• Keep a current role register, suitability evidence and planned cover for absence.
• Check the applicable Level 1 eligibility rules, including the transition for licences held continuously since before 1 January 2025.
• Remove access promptly when responsibilities or eligibility change.

Act on current account changes

New Level 2 appointments ended on 9 September 2026. Existing accounts must be converted where eligible or deactivated by 8 March 2027. Mandatory MFA began a phased rollout on 3 September 2026.

• Check the account’s actual MFA activation and contact details.
• Test recovery and deputy access without sharing a person’s credentials.
• Keep a dated record of the Level 2 transition decision for each affected account.

Suggested access review exercise

Compare the named people in the sponsor records with current employment, responsibilities and system access. For each user, record the business need, relevant eligibility review, contact details checked and any planned change. Include people who are leaving, changing roles or providing external support. The Authorising Officer should be able to understand who can act and who supervises that activity.

Use a tabletop absence exercise: the usual user is unavailable and an urgent task needs review. Ask the team to demonstrate the authorised route for completing it, including access recovery and escalation.

• Verify deputy arrangements through individual authorised access, not shared credentials.
• Assign an owner to each access amendment and retain its completion evidence.
• Check that security contacts and recovery arrangements still reach the right person.

Suggested transition and continuity record

Maintain a small transition register for affected accounts. Record the present role, the tasks performed, the eligibility questions, the proposed future arrangement and the person approving it. A plan to upgrade everyone automatically may overlook whether the expanded role is appropriate. Track completion and test that intended tasks remain covered.

Review the connection between staff leavers and sponsor access. An HR account closure may not update every external system. Ask for evidence of the specific sponsor-account action and check that essential records and responsibilities have been handed over securely before the departure.

Fictional practice scenario

A fictional small company relies on one Level 1 user, with an external adviser helping on complex cases. The user unexpectedly takes extended leave. A rehearsal reveals that the nominated deputy has neither confirmed access nor a clear understanding of the tasks they are expected to perform.

The company records the gap, reviews a suitable continuity arrangement and tests it through authorised channels. It does not share the absent user's password or assume the adviser's involvement removes internal responsibility.