This week
The Basic Compliance Assessment everyone has been bracing for went live on 1 June. The previews are over; the rules are now in force, and the detail matters more than the headline. We have read the Home Office's updated guidance, Student Sponsor Guidance Document 3, in full. It confirms three: your compliance rating is set by your single worst metric rather than an average, the amber band on every metric is barely a point wide, and the real sanction is not the published colour but the cut to your CAS allocation that comes with a red. This week is the operator's guide to how the machine now works, taken from the source document rather than the press release.
The numbers
The pass thresholds moved on 1 June: the visa refusal rate ceiling dropped from 10% to 5%, the enrolment rate floor rose from 90% to 95%, and the completion rate stays at 85% until it rises to 90% in June 2027 (source). Green requires better still: under 4% refusals, 96% enrolment, and from 2027, 92% completion. Takeaway: model all three metrics against the green line, not just the pass line. Amber is still a cost, because it freezes your CAS allocation until you climb back to green, so green is the only fully safe place to sit.
A red rating cuts your next CAS allocation by a minimum of 10%, with no upper limit, and lands a "Final Warning" that stays live across your next five assessments (source). A first red also triggers an action plan of at least 12 months. A second red within those five assessments, or failing two metrics at once, is treated as a serious breach with intent to revoke the licence, and there is no right of appeal against that revocation decision (para 2.58). Takeaway: the published colour is the soft sanction. The hard one is the allocation cut and the five-assessment jeopardy that follows. Treat a first red as a multi-year event, not a single bad year.
The government's own modelling, published last year, estimated 22 institutions would have failed at least one of the tightened criteria (source). That estimate predates the Q1 2026 refusal spike, so the live number is plausibly higher. Takeaway: the first public RAG list is likely to put more than twenty institutions in amber or red. You get only 20 working days to challenge a rating, so if you might be on the list, have your evidence ready before the Outcome Notice lands, not after.
Policy watch
What else the guidance confirms, beyond the headline thresholds.
The withdrawal lever is now written into the rules. Where a sponsor withdraws a CAS before the visa decision is made, that case is excluded from the refusal-rate calculation entirely (para 2.19) (source). The mechanic Issue 005 flagged is not a loophole, it is in the guidance: a withdrawal protects the metric in a way a refusal does not.
Small and specialist providers get a carve-out. Providers using fewer than 100 CAS in the assessment period, and independent schools, are eligible for a Discretionary Assessment that can lift a red or amber rating. But a provider that has leaned on discretion to pass its last three assessments is told it is unlikely to be rescued again (paras 2.76 to 2.79).
The first year has guardrails, but thin ones. First-round RAG ratings will be published to the Register simultaneously rather than rolling out one by one, and UKVI may exercise "operational discretion" in a sponsor's first assessment, though the guidance is explicit that it will not necessarily do so (paras 2.87 to 2.90). Plan for the rating you would get on the maths, not the one you hope discretion delivers.
The reckoning is timed for summer 2027. Because the first ratings publish all at once rather than one by one, there is a single future moment when every institution's colour becomes public. Wonkhe notes the consequences will reach well beyond recruitment, into media coverage, reputation, and banks' willingness to lend to a sector already under financial strain (source).
The rules were amended on day one. Within hours of the regime going live, the Home Office rewrote the refusal-rate calculation to close a loophole The PIE had exposed. The old wording excluded any student with a live administrative review from the count, which, with the admin-review backlog now running to six months and refusals climbing, let an institution keep refusals out of the BCA by nudging refused applicants to appeal. The amended paragraph 2.17 now excludes only refusals that are successfully overturned, not those merely under review (source, background). The withdrawal route in paragraph 2.19 stays open, so expect both levers to remain under scrutiny.
The signal
How the system is built tells you what it is designed to do. A compliance regime that wanted an overall health check would average the three metrics. This one does the opposite: paragraph 2.29 states the rating is set by the lowest-rated metric, so a provider that is green on enrolment and completion but red on refusals is red, full stop. The system is built to catch a single weak point, not to reward broad competence.
The second thing the design reveals is where the real pressure sits. The published RAG colour is the part the sector is anxious about, because it will sit on the Register for anyone to see. But the operative sanction is quieter and harder: a red cuts your CAS allocation by at least 10% with no ceiling, and an amber freezes it at last year's level until you climb back to green. The Home Office does not need to revoke a licence to shrink an institution. It can simply hand it fewer CAS, and the guidance lets it do that on the strength of one metric.
Put those two together and you have a machine that makes universities regulate themselves. Faced with a refusal rate that could tip them from amber to red, the rational move is to stop recruiting in the markets that carry refusal risk, exactly the behaviour the wider policy wants. The compliance line does the deciding, and the institution administers the cut to itself.
Spotlight · Sector · The operator's guide to the new BCA
Your compliance rating is now your worst single metric, not your average. One number over the line turns the whole institution red, and a red cuts your CAS allocation by at least 10% with no upper limit.
Source: Home Office Student Sponsor Guidance, Document 3, version 06/2026
The bands in the chart are the whole game, and they are narrow. Amber on every metric is barely a point wide: a refusal rate between 4% and 5%, an enrolment rate between 95% and 96%, a completion rate between 90% and 92%. There is almost no cushion between passing and failing, and because the rating takes your lowest band (para 2.29), you are only ever as compliant as your weakest number.
What each colour actually triggers is the part to internalise. Green means no action. Amber freezes your CAS allocation at last year's usage until you recover, and normally requires a formal engagement meeting with UKVI that the guidance says must be attended by the institution's acting chief executive in person, the Vice-Chancellor or Principal, alongside the Authorising Officer and the Head of Compliance (paras 2.65 to 2.69). Many in the sector assumed amber would be a "must do better" warning; that it functions as an immediate punishment has come as a nasty surprise. Red is a step change: an action plan of at least 12 months, a CAS cut of at least 10% with no stated maximum, and a Final Warning that puts you on a five-assessment probation. A red can also strip privileges tied to its cause, such as the right to self-assess applicants' English or to run courses with higher proportions of remote delivery. Fail two metrics in one assessment, or earn a second red inside that window, and the guidance moves straight to intent to revoke, with no right of appeal (para 2.58).
There is a relief valve, with a limit. Smaller providers, those using fewer than 100 CAS, and independent schools can qualify for a Discretionary Assessment, which lets UKVI lift a rating the raw maths would otherwise give. But the guidance is blunt that it is not a permanent crutch: a sponsor that has passed on discretion for three assessments running should not expect to be rescued a fourth time (paras 2.76 to 2.79).
The withdrawal mechanic is the last thing to understand, because it changes recruitment behaviour directly. A CAS withdrawn before the visa decision drops out of the refusal-rate sum entirely. For a provider sitting near the 5% line, the difference between a refused application and a withdrawn one is the difference between a metric that bites and one that does not. That is an uncomfortable incentive the rules have now codified, and it is worth deciding your institution's policy on it deliberately rather than letting it happen case by case. Tellingly, the Home Office moved within hours to close a parallel route: refusals parked in a pending administrative review now count unless the review actually succeeds, which shows how closely it is watching anything that keeps refusals out of the number. The withdrawal route it has left open, for now.
What to action this week:
Calculate your live refusal, enrolment and completion rates on the 12-month window the guidance uses, and identify your single worst metric. That number is your rating.
Model the CAS impact of a red on that worst metric. A minimum 10% allocation cut against next year's plan is the number to put in front of your executive team now.
Decide your withdrawal-handling policy in writing, given that withdrawals are excluded from the refusal calculation. Cover who initiates one, on what trigger, and how the student is treated.
If you could land amber or red, prepare the representations evidence early and brief the Vice-Chancellor that an engagement meeting will require their personal attendance.
Jobs · Who's hiring
London South Bank University, Chief Commercial Officer, Portfolio Strategy and Business Development (source).
University of Winchester, Head of International Recruitment and Partnerships (source).
Canterbury Christ Church University, Director of Marketing, Admissions, Recruitment and Communications (source).
The last word
For a year the sector argued about whether the new compliance regime was fair. That argument is now moot. As of 1 June it is the rule, and the only question left is operational: do you know your worst metric, and what happens to your CAS allocation if it tips.
The guidance rewards a particular kind of institution, the one that runs its compliance numbers like a finance function, watches its weakest metric weekly, and has its representations evidence ready before the Outcome Notice arrives. It punishes the institution that treats compliance as an annual form-filling exercise and finds out its rating when everyone else does, on the public Register.
The deeper point is the one in the design. By making the rating the worst single metric and tying the CAS allocation to it, the Home Office has built a system where the safest commercial response is to recruit less from anywhere that carries risk. Most institutions will conclude, rationally, that the way to protect the rating is to shrink the exposure. That is not a side effect of the policy. On the evidence of the guidance, it is the point.
If this was forwarded to you, subscribe to receive every Tuesday at 7am UK time.
Sources
