5 Red Flags in Sponsor Licence Compliance Audits and How to Eliminate Them

In the 12-month period ending June 2025, the Home Office revoked 1,948 UK sponsor licences. Furthermore, from April 2026, HMRC payroll data feeds directly into Home Office enforcement systems, thereby enabling automated detection of salary discrepancies without a prior inspection. Specifically, the underlying causes are overwhelmingly administrative: missed reporting deadlines, incomplete Appendix D files, and payroll misalignments found in Sponsor Licence audits.

• Red Flag 1: Incomplete right-to-work records. Specifically, missing or expired evidence is the primary source of audit findings, carrying civil penalties of up to £45,000 per worker for a first breach and up to £60,000 per worker for repeat breaches.
• Red Flag 2: Missed SMS reporting deadlines. Sponsors must report worker changes within 10 working days. Notably, UKVI cross-references SMS timestamps against HR files and payroll records.
• Red Flag 3: Salary deviations from the CoS figure. Notably, from April 2026, automated HMRC data integration flags variations between effective pay and the stated Certificate of Sponsorship figure without a prior visit.
• Red Flag 4: Incomplete Appendix D files. A single missing document per worker file constitutes a direct compliance breach. Notably, this red flag accounts for the highest volume of enforcement action.
• Red Flag 5: Unreported organisational changes. Importantly, mergers, restructuring, and changes in directorship are mandatory reportable events. Specifically, reporting deadlines are 10 or 20 working days depending on the change type.

In short, this guide details the criteria UKVI applies during sponsor licence audits and outlines the corrective steps you must take to address each vulnerability.

How UKVI Conducts Sponsor Licence Audits

During sponsor licence audits, UKVI conducts a formal evaluation to determine whether your organisation is fulfilling its statutory sponsorship duties. Specifically, UKVI deploys two primary audit formats:

On-site inspections: An inspector attends your premises, announced or unannounced, to review HR files, payroll records, and SMS data, and may also conduct interviews with sponsored workers and senior personnel.

Desktop audits: Alternatively, UKVI issues a targeted document request, typically requiring submission within five to ten working days. Notably, both formats carry identical regulatory weight.

Unannounced Inspections

Specifically, automated risk indicators trigger unannounced visits, including HMRC data discrepancies, a significant or unexplained increase in Certificate of Sponsorship assignments, and salary data inconsistent with sector norms. Importantly, there is no safe period after the Home Office grants a licence, and the Home Office does not accept administrative oversight as a defence.

Enforcement Outcomes

Notably, compliance failures result in escalating enforcement action. Specifically, minor infractions may result in an advisory letter requiring self-correction. Conversely, systemic failures typically result in a B-rating downgrade, which suspends the assignment of new Certificates of Sponsorship and imposes a mandatory action plan with a fee of £1,579.

Furthermore, severe violations that come from sponsor licence audits lead to licence suspension or full revocation. Notably, revocation cancels the licence entirely, imposes a 12-month cooling-off period before reapplication, and reduces sponsored workers’ remaining leave to 60 days to find a new employer or depart the UK. Importantly, there is no standard right of appeal against revocation.

Red Flag 1: Outdated or Incomplete Right-to-Work Records

Notably, UKVI reviews right-to-work records among the first items in sponsor licence audits. Specifically, sponsors must complete compliant checks and securely retain them before employment commences. However, monitoring time-limited permissions and checking the mandatory transition to eVisas frequently exposes administrative gaps during an audit.

Consequently, lapsed or missing checks expose your organisation to strict liability. Notably, civil penalties reach up to £45,000 per worker for a first breach and up to £60,000 per worker for subsequent breaches, regardless of how the failure occurred.

The eVisa Transition Deadline

Specifically, from 31 December 2026, physical Biometric Residence Permits are no longer valid for right-to-work verification. Accordingly, sponsors must conduct all checks via the UKVI online share code service. Importantly, sponsors retaining only a BRP copy after that date will have an automatic compliance gap for those workers.

Recommendations

• First, audit all sponsored worker files to identify and update any BRP-reliant records. Furthermore, flag these immediately for action.
• Additionally, request and securely log eVisa share code verifications for affected workers, recording the date and the name of the person who carried out the check.
• Finally, implement 90-day renewal reminders for every worker on time-limited permission as a standing calendar process.

Red Flag 2: Missed SMS Reporting Deadlines

Notably, during sponsor licence audits, UKVI systematically reconciles SMS submissions against HR files, employment contracts, and payroll records to identify reporting delays. Furthermore, the Sponsorship Management System (SMS) functions as the primary real-time compliance metric.

Specifically, common failure points include:

• Failing to report the departure of a sponsored worker from employment
• Failing to report internal salary adjustments, role changes, or location changes

Notably, while SMS failures are rarely deliberate, attributing them to administrative oversight or the departure of a Level 1 SMS user does not mitigate the regulatory breach. Importantly, the obligation exists regardless of the reason for the failure. You cannot provide a defence for this.

Recommendations

• First, integrate SMS notification requirements into standard HR workflows, including employee exit checklists, contract amendment processes, and absence management procedures.
• Additionally, maintain a named Level 1 SMS user and a designated backup at all times. Importantly, reporting continuity must not depend on a single individual.
• Finally, conduct monthly reconciliations between SMS records and current payroll, contract, and location data for every sponsored worker.

Red Flag 3: Salary Misalignment with the CoS Figure

Notably, the salary on a Certificate of Sponsorship constitutes a mandatory minimum threshold for the duration of sponsorship. Furthermore, from April 2026, the Home Office has automated access to HMRC payroll data and cross-references it against every sponsored worker’s CoS figure. Notably, enforcement action can follow without a prior visit.

In practice, effective pay can fall below the CoS figure even when the headline salary appears unchanged. Specifically, the following all reduce the pay a worker receives:

• Pay restructuring or reductions in working hours
• Unpaid leave periods or bonus clawbacks
• Salary sacrifice arrangements

Consequently, the gross compensation the worker receives is the definitive compliance metric, not the contractual salary figure alone.

The Eligible Role Test (March 2026)

Notably, the March 2026 Sponsor Guidance replaced the genuine vacancy requirement with an eligible role test. Specifically, under this test, a role qualifies only if:

• It exists at the time UKVI assigns the CoS
• The worker performs the specific duties and hours stated on the CoS
• The role meets the required skill level and salary threshold
• The role aligns with the sponsor’s business model and scale

Specifically, a sponsored worker performing duties materially different from the role description on the CoS is a mandatory revocation trigger. Notably, unlike most enforcement outcomes, the Home Office can impose this without prior warning or the opportunity for an action plan. Furthermore, the current minimum salary for most Skilled Worker roles is £41,700 gross per year.

Recommendations

• First, review every sponsored worker’s current job description against their CoS at least annually. Furthermore, where the role has evolved materially, report the change via SMS within 10 working days and assess whether you need a new CoS.
• Furthermore, verify that effective pay, after all deductions, salary sacrifice arrangements, and any unpaid leave, remains at or above the CoS figure at all times.
• Additionally, assess the impact on CoS compliance before implementing any pay restructuring that affects sponsored workers.

Red Flag 4: Deficient Appendix D Records

Notably, Appendix D of the Sponsor Guidance sets out the specific documents sponsors must retain for every sponsored worker, and UKVI uses it as a direct checklist in all sponsor licence audits.

Importantly, a single missing document in a worker file is a separate compliance breach. For example, across a workforce of 20 sponsored workers, one absent payslip per file constitutes 20 individual findings.

Notably, failure to produce required documents promptly upon request, even where those documents exist elsewhere within the business, constitutes a record-keeping breach and frequently serves as grounds for enforcement action. In a significant proportion of the 1,948 revocations recorded in the year to June 2025, the relevant documents existed within the organisation — but NOT in the correct location, in the required format, or retrievable on demand.

Mandatory File Contents

Specifically, every sponsored worker file must contain the following:

1. Passport or travel document: current, readable copy
2. Right-to-work evidence: eVisa share code confirmation (required from 31 December 2026), or valid BRP or passport endorsement where still current
3. Signed employment contract: showing job title, duties, salary, and start date
4. Job description: matching the Standard Occupational Classification code on the CoS
5. CoS reference number and assignment details
6. Payroll records: showing salary payments aligned with the CoS figure
7. Absence records: all leave, including any unauthorised absences
8. Contact details: current address, phone number, and email address
9. Qualifications or professional registration evidence where the role requires it

Retention Timelines

Specifically, sponsors must retain records for the duration of sponsorship plus one year following the worker’s departure, or the licence’s suspension or revocation. Importantly, prematurely destroying records under standard HR data hygiene policies violates immigration law. Notably, inspectors regularly identify leavers’ files deleted under routine HR schedules, and each constitutes a separate finding.

Recommendations

• First, conduct quarterly Appendix D audits of every sponsored worker file, with a named individual assigned accountability for each file’s completeness.
• Additionally, establish a dedicated immigration retention schedule, separate from standard HR timelines. Furthermore, when a worker’s sponsorship ends, mark the retention expiry date and do not remove the file before it.
• Finally, ensure you store all files in a format that enables immediate retrieval during an unannounced inspection, whether you keep them in paper or digital form.

Red Flag 5: Unreported Organisational Changes

Notably, unreported organisational changes are an increasingly common trigger for enforcement action in a sponsor licence compliance audit. Specifically, structural changes to your business, including company restructuring, changes in directorship, acquisitions, and new branch openings, are mandatory reportable events under the sponsor licence framework.

However, the Home Office actively identifies unreported changes by cross-referencing Companies House filings and HMRC records against SMS data. Notably, the gap between a reportable event and the corresponding SMS update is where risk of enforcement action increases.

Mandatory Reporting Timeframes

Within 10 working days:

• Change of Authorising Officer

Within 20 working days:

• New business address or additional branch location
• Merger, acquisition, or change of ownership
• Material change in the nature of the business

Mandatory immediate revocation trigger (no action plan opportunity):

Notably, since January 2025, recovering any sponsorship costs from a worker constitutes a mandatory ground for immediate licence revocation. Specifically, this applies to the CoS fee, the Immigration Skills Charge, or any associated administrative costs, recovered through any mechanism, including salary deduction, repayment clause, or clawback arrangement. Importantly, unlike other enforcement outcomes, there is no opportunity for an action plan before the Home Office imposes revocation.

Recommendations

• First, embed UKVI notification requirements as a mandatory step in every M&A, restructuring, and senior personnel change process. Importantly, this obligation must sit within the legal or HR checklist and you must not treat it as discretionary.
• Additionally, audit all sponsored worker contracts for any repayment or clawback clauses relating to immigration costs, and remove or renegotiate any that exist before UKVI identifies them during an inspection.
• Finally, designate the Level 1 SMS user as a required sign-off on any organisational change that may trigger a reporting obligation. Specifically, their confirmation that they have updated the SMS should form part of the change management sign-off process.

Maintaining Continuous Readiness for Sponsor Licence Audits

Importantly, sponsor licence compliance audit readiness requires integrating compliance protocols into standard daily operations, rather than treating compliance as a reactive measure prior to an inspection. Notably, UKVI can visit without notice, so audit readiness should be a continuous obligation, not a one-time preparation.

The Role of Mock Audits

Specifically, a structured mock audit replicates UKVI procedures:

• reviewing every sponsored worker file against Appendix D,
• reconciling SMS records against HR data,
• testing salary compliance against CoS figures,
• and identifying unreported changes before they become enforcement findings.

Specifically, the most effective mock audits assess files chosen at random, cross-reference every SMS entry against the underlying contract, and verify every salary against the corresponding CoS.

Consequently, you can remedy gaps you identify through an internal audit before UKVI identifies them during a Home Office visit.

Integrating Sponsorship Duties into HR Workflows

Notably, compliance failures occur most frequently when sponsorship duties sit alongside HR processes rather than within them. Therefore, sustainable compliance relies on embedding sponsor obligations into existing HR infrastructure:

• SMS reporting: HR workflows must include SMS notification triggers for contract changes, leavers, and escalated absences.
• Right-to-work renewals: Sponsors must hold renewal reminders within the same system that manages employment contracts, not in a separate process that operates independently.
• Appendix D completeness: File completeness must be a standard check at every new hire and every annual review, not a task you undertake only before an inspection.
• Leaver retention: Sponsors must set the immigration retention expiry date at the point a worker’s sponsorship ends, before considering file deletion.

How A Y & J Solicitors Can Help

Importantly, with the right systems and legal advice in place, the administrative failures that lead to licence revocation are entirely preventable. Notably, the five red flags above account for the majority of the 1,948 revocations recorded in the year to June 2025, and you can address every one before enforcement action begins.

A Y & J Solicitors is SRA regulated, recognised in the Legal 500, and has handled more than 5,000 immigration cases with a 98% success rate. Furthermore, our business immigration team conducts formal sponsor licence compliance audits, prepares UK businesses for UKVI visits, and even completely manages the responses to suspension or revocation notices. Contact us for a free initial consultation.