Amber isn’t a buffer zone in the new international RAG system – it’s a ledge

And the detail shows a system more punitive than many in the sector were expecting.

The proposals are worth unpicking – not least because their interaction with other parts of regulation may well cause real headaches.

From June 2026, the legacy Basic Compliance Assessment (BCA) framework for universities with a student sponsor licence is being replaced.

All sponsor assessments on or after 1 June will need to meet a visa refusal rate of less than 5 per cent, an enrolment rate of at least 95 per cent, and a course completion rate of at least 85 per cent.

That completion figure then rises to 90 per cent from June 2027. Sponsors will be assessed annually against the previous 12 months, with the assessment point linked to when the institution was first granted its licence.

The thresholds will end up five percentage points stricter than the current rules across the board – and as the white paper noted back in May, 22 providers would have failed at least one metric in 2023-24 had these rules applied then.

Weakest link wins

The first thing to understand about the proposed red-amber-green (RAG) system is that it isn’t an aggregate. A sponsor’s overall rating is proposed to be determined by its worst-performing metric – not an average of the three. A provider with excellent refusal and completion rates but an enrolment figure that dips below the line will still be rated red.

That “weakest link” approach makes the system more unforgiving than it might first appear. There’s no scope for trading strength in one metric against weakness in another – every provider needs to be compliant across all three areas simultaneously.

The proposed banding thresholds are tight. On visa refusals, red kicks in at 5 per cent or above, amber runs from 4 per cent to just under 5 per cent, and green requires below 4 per cent.

On enrolment, red is triggered below 95 per cent, amber covers 95 to just under 96 per cent, and green requires 96 per cent or above. On course completion, red applies below 90 per cent, amber covers 90 to just under 92 per cent, and green requires 92 per cent or above.

One thing to flag – the core completion requirement from June 2026 is 85 per cent, rising to 90 per cent from June 2027.

But the RAG bands in the draft guidance appear to be set against the 90 per cent figure from the outset. It is not yet clear from the draft material whether there will be transitional bands for year one, or whether providers will face tighter RAG thresholds on completion before the underlying core requirement catches up.

That ambiguity matters. If the RAG bands apply at 90 per cent from June 2026 while the core threshold is still 85 per cent, some providers could be rated amber or red on completion while technically still meeting the basic requirement.

Look at the width of the amber band – or rather, the near-total absence of it. On refusals it’s a single percentage point. On enrolment it’s a single percentage point. On completion it’s two. The amber band is extremely narrow.

Red amber green

Providers rated red will be placed on a UK Visas and Immigration (UKVI) action plan and their next Confirmation of Acceptance for Studies (CAS) allocation reduced by a minimum of 10 per cent, with no stated maximum.

They’ll lose privileges including the ability to self-assess English language levels and the ability to deliver teaching remotely. And they’ll be issued with a “final warning” that stays active for the next five BCAs. If they’re rated red again in that period, UKVI will begin the licence revocation process.

The draft guidance does note that sanctions may not be applied where “exceptional circumstances” can be demonstrated proving that fault was outside the sponsor’s control. But it also makes clear that individual student cases won’t be considered as part of this – the exceptions are for systemic issues, not hard-luck stories.

The assumption in much of the sector appears to have been that amber would amount to a “watch” category – a warning without teeth. That’s not what’s proposed.

Amber-rated providers will be required to attend formal engagement meetings with UKVI within 30 days. Those meetings must be attended by the vice chancellor or chief executive of the institution – not delegated to the compliance team. And UKVI won’t grant more CAS than the provider previously used until they return to green.

That CAS cap is the key sanction. It means an amber rating effectively freezes an institution’s international recruitment at its current level – at a time when many providers are increasingly dependent on growth in international numbers to fund domestic provision.

For institutions already in financial difficulty, a freeze is a serious constraint. And remember – you can hit amber by being just one percentage point off green on a single metric.

Green-rated providers won’t face compliance action. But they also won’t automatically receive an increased CAS allocation – and they can still be audited and sanctioned on a discretionary basis. In other words, even full compliance doesn’t buy certainty.

Going public

The RAG ratings will eventually be published on the student sponsor register – but individual ratings won’t go up until every sponsor has received its first assessment, meaning the full picture probably won’t appear until the summer of 2027.

Universities UK (UUK) submitted to the Education Committee inquiry that a public list “creates significant reputational risk for the UK HE sector as a whole and could be misunderstood by banks and sponsoring bodies.” That lobbying appears to have failed – the ratings will be public, just delayed.

Providers aren’t waiting for the final guidance to change their behaviour. In advance of the new thresholds, plenty of universities are already pausing recruitment from countries deemed “high-risk”, increasing deposit payments and tuition fee instalments, and investing in more monitoring and auditing technology.

That’s the rational institutional response to a system that punishes non-compliance severely and offers very little margin for error – but it also means some potentially problematic practices are being embedded in the system.

The agent problem

Of the three metrics, the visa refusal rate is the one most heavily driven by the quality of an institution’s recruitment process – and by extension, its agent relationships. A CAS issued on the back of dodgy documentation, insufficient financial evidence, or a recruitment chain that’s been gamed by sub-agents in-market generates refusals that count against the provider, regardless of whether the provider could reasonably have spotted the problem.

The white paper promised mandatory sign-up to the Agent Quality Framework (AQF). But AQF membership is a floor, not a ceiling. Being signed up doesn’t mean your agents are behaving well. It means you’ve committed to a set of standards that in practice are extremely hard to enforce at the end of a long supply chain.

With the green threshold requiring a refusal rate below 4 per cent, the rational institutional response is to invest heavily in pre-CAS verification or to pull out of markets and agent relationships that feel risky.

The former costs money many providers don’t have. The latter catches legitimate applicants in the crossfire – and cuts against the white paper’s still-unfulfilled promise of an international education strategy focused on diversification.

Lock them in?

The enrolment metric is where the interaction with consumer protection law gets uncomfortable.

The green threshold requires 96 per cent of students who are issued a CAS and go on to receive a visa to actually enrol. The amber band is 95–96 per cent. That means for every 100 students issued a CAS who go on to receive a visa, no more than four students can fail to show up before the provider drops out of green – and no more than five before it hits red.

The obvious institutional response to that pressure is to lock applicants in – bigger deposits, earlier deadlines, more restrictive refund terms. Universities UK International (UUKi) has already been openly encouraging providers to “review their deposit requirements” and to “introduce or increase deposits or introducing earlier deposit deadlines” as a way of managing risk – advice that predates the RAG detail but fits the same logic.

The trouble is that many of these practices are, on their face, legally questionable.

Under the Consumer Rights Act 2015, a university can levy a charge for cancellation or early termination – but those charges must be limited to what is fair and proportionate. In practice that means the university should be recovering its actual costs or lost net revenue, not imposing a sum designed to punish a student for changing their mind or to scare them into staying in the contract.

Guidance from the Competition and Markets Authority (CMA) is clear at paragraph 5.14 of CMA37 that forcing consumers to forfeit prepayments “is open to serious objection where it bears no relation to the business’s actual costs.” Where universities are charging 50 per cent deposits – and many are – the burden of proof is on the institution to show this reflects actual loss rather than compliance risk management.

The Digital Markets, Competition and Consumers Act 2024 (DMCC) makes it sharper. The DMCC introduces a specific duty around vulnerable consumers – either because of permanent characteristics or because of temporary circumstances like financial stress or unfamiliarity with the system. International applicants making high-stakes financial decisions from abroad, often through agents, in a second language, under time pressure, fit that definition comfortably.

The law demands that providers design their sales practices, contracts, and communications with those vulnerabilities in mind. It’s no defence to say the “average” consumer would cope – if a foreseeable group is likely to be misled, disadvantaged, or harmed, the practice breaches the Act.

There’s also the DMCC’s duty of professional diligence, which requires the university to act with the skill, care, and honesty that a reasonable trader should exercise in line with good market practice. Breaching that duty becomes unlawful when it distorts – or risks distorting – the consumer’s decision-making. The bar drops further still when the consumers in question are vulnerable.

OfS has published a list of “prohibited behaviours” as part of its new initial condition C5 – one of which specifically covers:

…requiring a student to pay a disproportionately high sum of money as penalty to the provider or for services which have not yet been supplied, where the student decides not to sign the contract or withdraws from the contract after signing it.”

Someone flagged the deposit-UKVI tension directly in the C5 consultation – one respondent suggested that OfS should work closely with UKVI:

…to agree a position on non-repayment of deposits for visa-sponsored students.”

OfS’s response, at paragraph 61 of the consultation outcomes, was to note that the prohibited behaviours in question:

…quite closely reflect existing legal requirements with which traders in any sector are required to comply.”

In other words – the law already covers this. C5 only applies to new providers seeking registration for the time being, but a version for everyone else is coming.

And then there’s a basic principle – providers shifting the burden of their regulatory obligations onto students. If UKVI demands a 95 per cent enrolment rate, the cost of meeting that target can’t be borne by individual applicants through punitive deposit terms.

UCL’s CAS oversubscription crisis last autumn demonstrated the other side of this trap – what happens when too many students actually show up. UCL overshot its CAS allocation, leaving hundreds of international students stranded, some already in the UK with non-refundable accommodation paid for. Its terms attempted to treat over-demand as an “event outside our control” – but CMA guidance is clear that oversubscription is a business choice, not force majeure.

The enrolment metric, in short, creates pressure in both directions. Issue too many CAS numbers relative to enrolment and you’re red. Lock students in with aggressive deposit terms and you may be breaching consumer law. The new RAG bands – with their vanishingly narrow amber zone – tighten the pressure further.

A perverse sanction

But it’s the completion metric that’s most exposed to perverse incentive effects – particularly given the proposed sanctions for a red rating.

Red-rated providers lose the ability to deliver teaching remotely. In practice, that means losing access to the 20 per cent baseline allowance for remote delivery confirmed in UKVI’s new attendance rules earlier this year – and for those with enhanced permission, the 40 per cent band as well. A red-rated provider would have to deliver 100 per cent of timetabled teaching face-to-face for international students.

That’s operationally severe. Many providers have already restructured their timetabling, room allocation, and module design around the current remote-delivery allowance. Remember too that UKVI’s definitions of “remote” are broad – any timetabled hour where the student has the option to attend online rather than in person counts as remote, including recorded lectures.

Yanking the allowance back to zero doesn’t just hit compliance teams. It hits academic planning, estates capacity, and the student experience across the institution.

But the deeper problem is that remote delivery flexibility is one of the things that helps some international students complete their courses. The ability to watch a recording, to manage attendance around part-time work, to cope with the cost-of-living pressures that make daily commuting expensive – these aren’t always signs of non-engagement. For many students they’re the margin between staying enrolled and dropping out.

The completion threshold rises to 90 per cent from June 2027, with the green band requiring 92 per cent. There’s barely any room to slip before hitting red. And if hitting red means losing the very flexibility tools that help students stay enrolled, the sanction for poor completion could actively make completion worse.

Two regimes, one provider

What the RAG system exposes – more clearly than anything in the white paper itself – is that two regulatory regimes are now pulling in opposite directions.

UKVI wants near-perfect enrolment rates, high completion, and minimal refusals. The rational institutional response involves locking students into contracts, restricting flexibility, and retreating from commercial risk.

Consumer protection law – the Consumer Rights Act 2015, the DMCC, CMA guidance, and OfS’s own consumer conditions – demands fair contract terms, proportionate charges, vulnerability protections, and real choice. The rational institutional response involves offering flexible cancellation, absorbing risk rather than passing it to students, and respecting the right to change your mind.

Providers are now being asked to satisfy both – and the amber bands in the proposed RAG system are so narrow that even a small number of students exercising their legitimate consumer rights could tip a provider from green to amber, or from amber to red.

The Home Office says that:

…these changes have been designed to work with the sector, not against it, and support sponsors to maintain high standards while protecting the reputation of UK education internationally.

Whether they’ve been designed to work with the rest of the law is another question entirely.