HOW TO BUILD

A REGUL ATORY
SANDBOX
A Practical Guide for Policy Makers

September 2020 Ivo Jeník and Schan Duff

1
Consultative Group to Assist the Poor
1818 H Street NW, MSN F3K-306
Washington DC 20433
Internet: www.cgap.org
Email: [email protected]
Telephone: +1 202 473 9594
Cover photo by Artur Verkhovetskiy from depositphotos.com.
© CGAP/World Bank, 2020

RIGHTS AND PERMISSIONS

This work is available under the Creative Commons Attribution 4.0 International Public
License (https://creativecommons.org/licenses/by/4.0/). Under the Creative Commons
Attribution license, you are free to copy, distribute, transmit, and adapt this work, including
for commercial purposes. See license for conditions.
Attribution—Cite the work as follows: Jeník, Ivo, and Schan Duff. 2020. “How to Build a
Regulatory Sandbox: A Practical Guide for Policy Makers.” Technical Guide. Washington,
D.C.: CGAP.
All queries on rights and licenses should be addressed to CGAP Publications, 1818 H Street,
NW, MSN F3K-306, Washington, DC 20433 USA; e-mail: [email protected]
 CONTENTS

Executive Summary 1

Section 1: Introduction 2

Section 2: Objective Setting: Why Set Up a Regulatory Sandbox? 4

Section 3: How to Design a Regulatory Sandbox to Advance the Regulatory Objective 12

Section 4: How to Successfully Run a Regulatory Sandbox 15

Section 5: Alternatives to a Regulatory Sandbox 20

Annex 1: Setting Objectives for a Regulatory Sandbox 22

Annex 2: Templates for Sandbox Teams 23

Annex 3: Sandbox Simulation Guidance 32

Glossary 33

References 34


Acknowledgments
The authors of this Technical Guide are Ivo Jeník, financial sector specialist, and Schan Duff,
senior policy consultant. Stefan Staschen, senior financial sector specialist, and Gregory Chen,
lead financial sector specialist, oversaw this effort. Peer reviews were provided by Sharmista
Appaya, senior financial sector specialist (World Bank), Denise Dias, senior policy consultant
(CGAP), and Eric Duflos, senior financial sector specialist (CGAP).
The authors thank many other experts who have contributed to the paper, provided feed-
back, shared their experience, or cooperated with CGAP on in-country projects, including
Tamara Cook, Gitau Mburu, Rafe Mazer, and Francis Gwer of FSD Kenya; Joseph
Lutwama of FSD Uganda; and experts at the World Bank. Other experts provided feedback
through a workshop held in April 2020:
• Christopher Calabia (Bill & Melinda Gates Foundation)
• Viola K. Chelangat (Capital Markets Authority, Kenya)
• Stephen Mathew Ambore (Central Bank of Nigeria)
• Leon Perlman (Digital Financial Services Observatory)
• Jackson Mueller (Milken Institute)
• Matthew Homer and Sarah Matheny (NY Department of Financial Services)
• Sohail Javaad and Syed Irfan Ali (State Bank of Pakistan)
• David Symington (UNSGSA)
• Helen Luskin Gradstein (World Bank Group)

Thanks also go to the Bank of Bahrain, the Central Bank of Brazil, the Capital Markets
Authority of Kenya, the Central Bank of Lithuania, the South African Reserve Bank, the
Financial Supervisory Commission of the Republic of China (Taiwan), and many other
stakeholders—including numerous fintech firms—for invaluable insights.
 E XECUTIVE SUMMARY

R
EGUL ATORY SA NDBOX ES PROV IDE A • However, sandboxes are not appropriate in all circum-
controlled environment to live test new products, stances. There are significant limitations to their role,
technology, or business models under the watchful and they should not be automatically viewed as the
eye of a financial regulator. In many countries around go-to solution. They require a considerable investment of
the world, regulatory sandboxes have garnered significant time and resources to set up and run. As such, they risk
attention for their potential to enable regulators to carefully distracting regulators that have limited capacity from
monitor the opportunities and risks associated with inno- pursuing more fundamental tasks.
vations, while allowing firms to bring innovations into the • A range of alternative approaches for managing innova-
marketplace quickly and with less risk. Sandboxes also have tion should be carefully considered, including ad hoc
become a trademark program for forward-leaning financial test-and-learn approaches, rule changes, and regulatory
regulators, generating widespread excitement as a way to reforms. As explained in this Guide, depending on the
modernize their oversight of the financial sector in tandem objectives and environment, these might prove more
with the rapid pace of technical innovation. appropriate than a sandbox.
As they gain popularity, however, significant questions arise
over whether and under what circumstances sandboxes
should be used. This Technical Guide seeks to answer some
of those questions. It is intended to help financial regula-
tors through the process of deciding whether a regulatory
sandbox is suitable given their regulatory regime, and if so,
how to design and implement a successful sandbox. The
guide addresses practical questions that regulators face in
responding to innovation—it does not focus on theoretical
issues or on evaluating the impact of sandboxes.
The Technical Guide is informed by the following
perspectives:
• CGAP’s review of regulatory sandboxes globally shows
considerable potential for sandboxes to foster financial
inclusion by enabling firms to experiment in a safe
space with new technologies that address some of the
persistent barriers to poor people accessing and using
financial services.
• Sandboxes can accelerate innovation and generate
practical insights into the appropriate regulatory and
supervisory framework for promoting innovation in
inclusive finance and for mitigating risks. Thematic
sandboxes that promote regulatory enablers may be
particularly beneficial for financial inclusion.

E x ec u t i v e S umm a r y 1
SECTION 1

INTRODUCTION

R
EGUL ATORY SA NDBOX ES BURST ON The Guide is informed by four years of CGAP research that
the global scene in 2015 amid great excitement about includes:
their potential to modernize financial regulation
• Analysis of more than 30 regulatory sandbox
at the speed of technical innovation. Pioneered at scale by
frameworks.
the United Kingdom’s Financial Conduct Authority (FCA),
• In-depth interviews with financial sector regulators in
sandboxes offered firms the ability to live test new products,
Bahrain, Brazil, Kenya, Lithuania, South Africa, and
technologies, and business models in a controlled environ-
Taiwan.
ment. A milestone in the evolution of regulatory tools such as
test-and-learn, sandboxes quickly have become a trademark • High-level interviews with more than 100 stakeholders,
program for forward-leaning financial regulators. including regulators, financial services providers, interna-
tional development experts, academics, and investors.
Today, more than 60 jurisdictions around the world have
announced regulatory sandboxes, and interest in them shows • A global survey of innovation facilitators conducted
no sign of waning (Appaya and Gradstein 2020). This rapid jointly with the World Bank (Jeník and Appaya 2019a).
adoption prompted initial concern that sandboxes would • A global sweep of 134 entities that have tested in 16
distract regulators from developing more foundational legal different sandboxes.2
and regulatory frameworks for enabling responsible inno- • In-country design and implementation work with
vation. In addition, observations from CGAP’s fieldwork regulators in Kenya, Nigeria, and Uganda (and with less
support the view that some early sandbox programs were not intensity in many other countries).
clearly linked to specific regulatory objectives.
To our knowledge, there is no literature expressly directed The analytical tools, examples, and templates herein are
to regulators wrestling with the practicalities of tailoring grounded in practical experience and designed to help regu-
sandbox programs to support their local innovation and lators navigate common questions and challenges they face
regulation objectives.1 This Guide aims to fill that knowl- when designing and implementing regulatory sandboxes.
edge gap. It focuses on common questions and decision The Guide is organized around three phases of a typical
points regulators face at various stages of sandbox evalu- regulatory sandbox design and implementation processes:
ation, design, and implementation. It is a practical guide
1. Objective setting: Why set up a regulatory sandbox?
based on real-world insights and supplemented with
Regulators have a range of tools for engaging with and
decision frameworks and templates derived from ongoing
addressing innovation. These include innovation offices
sandbox programs.
or hubs, accelerator programs, and regulatory sand-
boxes (collectively described as “innovation facilitators”
by the Financial Stability Board [2017]), as well as
more familiar approaches such as “test-and-learn” and

1 Unless otherwise noted, “regulators” as used in this Guide refers to financial sector regulators, supervisors, or policy makers.
2 “Interactive Map of Regulatory Sandboxes,” CGAP, https://www.cgap.org/regulatory-sandbox/interactive-map.

HOW T O BUILD A REGUL ATORY S A NDBOX 2

 “wait-and-see.” These tools can be used on their own The impact of sandboxes on innovation generally and
or in combination. This Guide introduces a decision financial inclusion specifically has not been proven yet.3
process for assessing whether to implement a regulatory Our hypothesis is that regulatory sandboxes may help
sandbox and identifies common interactions between advance financial inclusion by enabling evidence-based,
sandboxes and alternative tools, such as innovation outcome-oriented regulation of new, consumer-friendly
hubs and formal rulemaking processes. Among other innovation that helps advance financial inclusion. To
things, the decision process directs regulators to closely achieve this potential, regulators must implement sandboxes
question the need for live testing. When the answer is appropriately. They should leverage the unique insights
unclear, regulators should gather additional insights from live-testing environments in close coordination with
from innovation facilitators that do not use sandboxes other complementary tools and programs. We created this
and carefully evaluate alternative tools before launching Guide in service of that objective.
a sandbox.
2. Design: How can I design a regulatory sandbox to
advance the regulatory objective? No two sandboxes
are the same, and regulators face several design choices
that ultimately affect cost, perception, and market
uptake. This Guide provides a diligence framework for
planning a regulatory sandbox, highlighting the key
jurisdictional, institutional, and market characteris-
tics that commonly influence sandbox design choices.
Rather than recommending a single, optimal design
for all circumstances, this variation serves as a practical
reminder that sandboxes should be fit for purpose and
customized to local conditions.
3. Implementation: How do I create a successful
regulatory sandbox? This section outlines several
operational prerequisites to consider when imple-
menting a sandbox, including organizational design and
governance; market engagement; and testing, evalua-
tion, and exit. It is followed by a detailed description of
complementary options and alternatives to regulatory
sandboxes.
The Annexes provide tools and sample documentation for
each stage of the process.
It is important to note that this guide is neither a blueprint
for launching a sandbox in any specific jurisdiction nor
a recommendation that regulators should adopt sandbox
programs in all cases. Rather, it is a summary of common
questions and decision points faced by regulators around the
world in a wide range of local contexts. To the extent this
Guide offers a strong recommendation, it is to encourage
regulators to view sandboxes as a specialized tool—best used
in conjunction with other innovation facilitators—to enable
evidence-based, outcome-oriented regulation.

3 See Jeník and Lauer (2017) and Appaya and Gradstein (2020).

In t rod u c t ion 3
SECTION 2

OBJECTIVE SET TING: WHY SET UP

A REGUL ATORY SANDBOX?

A
R EGUL ATORY SA NDBOX IS A TOOL review of the same policies by an insurance professional.
for developing evidence about how a new product, The sandbox results left the regulator satisfied that NLP
technology, or business model (innovation) works identified coverage issues and gaps similar to what the
and the outcomes it produces. Evidence gathering can help live reviewer identified, and the regulator approved the
assuage (or confirm) regulatory concerns about the impact product for launch in the marketplace.
of innovations, allowing beneficial innovations to reach the
marketplace. Consider the following real-life examples: In both cases, the new technology presented potential
risks that were difficult to assess in the abstract—it also
• Alternative data underwriting. A fintech lender
identified potential consumer benefits that would be lost if
proposed using alternative data (education and employ-
the technology was not allowed to enter the marketplace.
ment history) and machine learning to underwrite
Experimenting with live data helped to show that these
consumer credit (CFPB 2017). While acknowledging
technologies operated as promised and yielded potential
the potential for expanding access to credit and lower-
consumer benefits.
ing costs, the regulator worried that the underwriting
model would discriminate among borrowers based on Most innovations do not require this level of evidence-based
race, ethnicity, gender, or age. Using a sandbox test, the regulatory analysis before launch. Regulators should have
regulator determined the technology expanded access to a clear understanding of the circumstances that warrant
credit and reduced costs relative to a traditional under- a sandbox test and when other tools and frameworks may
writing model, resulting in (i) approval of 27 percent suffice because sandboxes are time and resource intensive
more applicants and 16 percent lower average annual and generally not available to all market participants (Jeník
percentage rates overall and (ii) substantially higher and Appaya 2019). The sandbox decision process illustrated
approval rates for applicants under age 25 and consumers in Figure 1 can help to facilitate this analysis. This decision
with incomes under $50,000. Moreover, the test identi- process is intended to prompt regulators to closely scrutinize
fied no discrimination in approvals. the need to conduct a live test, exploring the underlying
• Insurance coverage optimization. Insurtech start- hypotheses for adopting a sandbox. When the answer is
up PolicyPal offered a tool that used natural language unclear, regulators should gather additional insights from
processing (NLP) to assess policy coverage and gaps in innovation facilitators that do not use sandboxes and care-
consumer insurance policies. The regulator recognized fully evaluate both complementary and alternative tools.
the potential benefits of helping consumers understand Although the decision process is highly generalized, it
and navigate complex insurance policies but also the envisions a sandbox test as the final stage of an iterative
potential harm if the tool made recommendations that engagement between the regulator and innovator. As a prac-
exposed individuals to uncovered risks or liabilities. tical matter, this exchange helps to sharpen the questions
The regulator therefore used a sandbox to compare the that must be resolved by evidence developed in the sandbox
results of NLP recommendations with an in-person testing environment. More broadly, the decision process

HOW T O BUILD A REGUL ATORY S A NDBOX 4

 FIGURE 1. Decision process: Overview

START
HERE RATIONALE FOR SANDBOX KEY
Y Answer to question is “Yes”
N Answer to question is “No”

Address Consider Innovation Facilitation

Learn about Promote
STEP 1

regulatory barriers
marketplace competition
to beneficial
developments or innovation
innovation

N Y N
Is the strategy Is the strategy
Within scope Y to test N to reduce
of mandate? commericial regulatory
viability? barriers?
Y

B A R R I E R S T O I N N O VAT I O N
STEP 2

Compliance Regulation Regulation

is creates prohibits
costly uncertainty innovation

Does the new

Can be resolved tech promise
with rule update significant
or clarification? benefits?
Y N Y N

Can be resolved
STEP 3

Can you update

through industry
the rules?
consultation?
Y N N Y

Is live testing
N
necessary?

OTHER INNOVATION RULE OR POLICY OTHER NO SANDBOX

FACILITATOR UPDATE REGULATORY TOOLS

YES
SANDBOX

DE V E L OP IN G Y O UR R EMO T E S E N S IN G C A PA BIL I T IE S 5
 channels questions about the regulatory status of an innova- Considering each objective separately can help regulators
tion (i.e., whether it is permitted or prohibited) to either (i) decide whether a sandbox—or an alternative or complemen-
informal resolution through a low(er) cost, broadly acces- tary approach—is the best strategy for advancing the policy
sible innovation facilitator or (ii) a regulatory or licensing objective. See Figure 2.
process that already is in place.
This process is intended to reduce the risk that the sandbox P R O M O T E I N N O VAT I O N A N D C O M P E T I T I O N
will inadvertently (i) distort normal market mechanisms Regulators often begin with the assumption that a sandbox
(unless that is what the regulator is mandated to do), (ii) act should be used to promote innovation and competition by
as an imperfect substitute for other regulatory enablers and/ accelerating market entry for new firms or products. To
or a regulatory change, (iii) create an uneven playing field, achieve this objective, sandboxes sometimes are positioned
or (iv) act as a de facto gatekeeper or substitute for interac- as “safe spaces” to defer the up-front time and expense of
tions with traditional licensing or supervisory processes.4 licensing and registration until after commercial viability of
the innovation has been confirmed. While bringing more
firms into the market by lowering the ex ante cost of regula-

Step One:
tion may be an important objective, sandboxes are not the
best tool to achieve it.
Determine the sandbox objective
Most financial regulators do not have an express statutory
Regulators frequently cite three overarching objectives for mandate to promote competition or innovation. For the
their sandbox programs: few financial regulators with a competition or innovation
1. Promote innovation and/or competition. mandate, regulatory sandboxes have been used to simulta-
neously “test” large cohorts of firms with the goal of moving
2. Address regulatory barriers to innovation. as many as possible into the regulated marketplace.5 In
3. Learn about developments in the marketplace. these cases, the testing activity relates more to assessing

FIGURE 2. Decision process: Step one

START
HERE RATIONALE FOR SANDBOX KEY
Y Answer to question is “Yes”
N Answer to question is “No”

Address Consider Innovation Facilitation

Learn about Promote
STEP 1

regulatory barriers
marketplace competition
to beneficial
developments or innovation
innovation

N Y N
Is the strategy Is the strategy
Within scope Y to test N to reduce
of mandate? commericial regulatory
viability? barriers?
Y

B A R R I E R S T O I N N O VAT I O N
STEP 2

Compliance Regulation Regulation

is creates prohibits
costly uncertainty innovation

Does the new

Can you resolve tech promise
4 For more details on design elements see Jeník and Lauer (2017). with new Does the new
Can be resolved significant
5 This is one of the key metrics tracked in FCA (2017). rulemaking? tech promise
benefits?
with rule update
Y or clarification?
N Y significant N
benefits?
Y N Y N

HOW T O BUILD A REGUL ATORY S A NDBOX Can you resolve Can you resolve
6
PT E3P 3
TEP 3

through industry by updating the

Can be resolved
consultation? rules?
Can you update
through industry
commercial viability—and accelerating time to market— LEARN ABOUT DEVELOPMENTS
than developing outcomes-based evidence to assess risk or IN THE MARKETPL ACE
make a regulatory determination. However, the regulator’s A CGAP and World Bank survey of financial regulators
role in promoting competition and innovation is far more showed that 81 percent of respondents said the primary
complex and nuanced than helping a handful of early-stage reason for launching an innovation facilitator (including
firms gain market traction. A potentially harmful effect a sandbox) was to learn more about emerging innovations
of sandboxes is their potential to distract regulators from in the marketplace (Jeník and Appaya 2019a). Although
providing clear guidance on more foundational enablers of this may be a valuable policy objective and help inform the
innovation, such as cloud computing, data protection, tiered regulator’s viewpoint on the risks and benefits of emerging
know-your-customer (KYC) requirements, and open data technologies and business models, this type of general
access, which could benefit more firms overall.6 learning is better accomplished through a less formal inno-
vation facilitator rather than a sandbox. The regulator can
A D D R E S S R E G U L AT O R Y B A R R I E R S craft a more nimble and broad-reaching learning mecha-
T O I N N O VAT I O N nism outside of the hypothesis-driven, resource-intensive
Alternatively, the regulator may believe that a sandbox will confines of a sandbox. If insights from informal interac-
help lower regulatory barriers to beneficial innovation. tions with market participants ultimately point to using
This may be the most compelling rationale for a regula- a sandbox, the regulator can proceed with a clear under-
tory sandbox and the most critical for understanding the standing of market demand and potential use cases.
comparative advantage of sandboxes over other regulatory
tools. The perceived regulatory barriers to innovation can
be varied, but they often include (i) compliance cost, (ii) The regulator may use an innovation
limited understanding of rules and regulations, (iii) rules facilitator (other than a sandbox) to gather
or regulations that prohibit an innovation, and (iv) regula- additional data from the marketplace to
tory uncertainty. determine whether a sandbox is needed. These
facilitators—whether dedicated fintech offices,
At the outset it may be difficult to determine which of these
innovation hubs, hotlines, or similar initiatives—can
barriers is most pressing. Therefore, the regulator may use be reliable substitutes for sandboxes by providing
an innovation facilitator (other than a sandbox) to gather a venue for both regulators and innovators to
additional data from the marketplace to determine whether understand how a new technology might fit within a
a sandbox is needed. These facilitators—whether dedicated regulatory regime.
fintech offices, innovation hubs, hotlines, or similar initia-
tives—can be reliable substitutes for sandboxes by providing
a venue for both regulators and innovators to understand
how a new technology might fit within a regulatory regime. Step Two:
If the regulator ultimately decides to launch a sandbox, Identify regulatory barriers
the facilitators can provide an important venue for vetting to innovation
potential sandbox applications. Many jurisdictions with
sandboxes have adopted complementary innovation facilita- If the regulator is seeking to identify and address regulatory
tors to provide informal regulatory engagement channels for barriers to innovation, a sandbox may be an appropriate
market participants (Jeník and Appaya 2019a). tool. But several questions remain. Regulators need to
understand the different types of barriers that market
participants may face when bringing innovation to the mar-
ketplace and consider the various possible solutions. Three
common barriers to consider are (i) costly compliance, (ii)
uncertainty created by regulation, and (iii) innovation pro-
hibited by regulation (see Figure 3).

6 See Jeník and Lauer (2017, 10): “[R]egulators will remain responsible for supporting the creation of an enabling environment for digital financial ser-
vices based on basic regulatory enablers. A regulatory sandbox should not be a distraction for policy makers.”

Ob jec t i v e S ett in g: W h y S et Up a Reg ulato r y S a nd bo x? 7

 FIGURE 3. Decision process: Step two

START
HERE RATIONALE FOR SANDBOX KEY
Y Answer to question is “Yes”
N Answer to question is “No”

Address Consider Innovation Facilitation

Learn about Promote
STEP 1

regulatory barriers
marketplace competition
to beneficial
developments or innovation
innovation

N Y N
Is the strategy Is the strategy
Within scope Y to test N to reduce
of mandate? commericial regulatory
viability? barriers?
Y

B A R R I E R S T O I N N O VAT I O N
STEP 2

Compliance Regulation Regulation

is creates prohibits
costly uncertainty innovation

Does the new

Can be resolved tech promise
with rule update significant
C O M P L I A N C E I S C O S T LY or clarification?
and content
of publicly available
benefits? resources so that they can
Y N Y N
Market participants may perceive the cost of compli- be easily understood by industry newcomers (as is the case
ance with regulation as a barrier that prevents beneficial in Malaysia [Bank Negara Malaysia 2019] and Lithuania
innovation from reaching the marketplace. This may Can be resolved [Bank of Lithuania 2017]) and reduce their legal costs.
STEP 3

Can you update

through industry
These approachesthe
be out-of-pocket costs, such as licensing fees or capital consultation? rules?
can help regulators assess the need and
Y
requirements, or effective costs, such as relative complexity N use
potential Y
N cases for a regulatory sandbox while they also
of the licensing or application process, number of years in improve the quality of the applications that are ultimately
operation, time required to complete the application, and considered for sandbox testing.
other practical aspects of accessing a regulated marketplace. Is live testing
N
necessary?
In terms of out-of-pocket costs, regulators should consider R E G U L AT I O N C R E AT E S U N C E R TA I N T Y
Y
addressing cost barriers directly, for example, by reducing Sometimes the regulator’s engagement with the marketplace
fee requirements or eliminating fees or streamlining the reveals friction or uncertainty caused by the regulatory
licensing process for companies operating with only a few environment and felt by many firms across a sector. These
customers or assets. This is the case of the restricted autho- insights may arise through the work of the innovation
rized deposit-taking institution regime in Australia (APRA facilitator or through informal conversations with market
OTHER INNOVATION RULE OR POLICY OTHER NO SANDBOX
participants or fellow regulators. Rather than prohibiting a
2018) and the sequenced licensing of banks in the United
FACILITATOR UPDATE REGULATORY TOOLS
single firm from operating, a significant regulatory uncer-
Kingdom (Bank of England 2016).
tainty can reduce the efficiency of the entire marketplace by
At times, the sheer complexity of the licensing or registra- confusing market participants, deterring investment, or gen-
tion process creates a barrier to innovation—for example, by erally slowing the adoption of new digital financial services.
requiring new companies to retain expensive legal counsel.
In such cases, the regulator should consider adopting an In these circumstances, the regulator should consider the
innovation facilitator to help companies navigate basic following:
licensing requirements and expectations. Alternatively, or • Can the confusion or uncertainty be resolved using
in addition, the regulator may simplify the presentation
YES
SANDBOX
tools that are already available? It may be through

HOW T O BUILD A REGUL ATORY S A NDBOX 8

 formal guidance, such as on the use of electronic assess the likely validity of the claims. At the same time,
know-your-customer (eKYC) regimes for remote account the regulator will need to understand the potential harm
opening or a policy on consumer-permissioned account or risks that may result from the product, technology, or
access. Or it may be through regulation, such as rules for business model if it does not work as intended.
equity crowdfunding. In many cases, the regulator will • If it promises a benefit, can the innovation be enabled
have sufficient information to adopt a clear framework by a simple rule change? This could be in the form of a
that resolves the uncertainty without further evidence, marketwide intervention (e.g., a regulation amendment,
based on international standards, emerging practices, updated guidance, or a changed regulatory practice) or
peer learning, desk research, or internal deliberations. a firm-specific exemption (e.g., such as a no-action letter
• Can the regulator organize an industrywide consulta- or a no-objection finding). The actual tools available will
tion to provide clear direction on the issue or to inform differ by jurisdiction so the key determination is whether
the design of a new policy? The regulator can collect the regulator already has in place a method to allow a
this market feedback via written commentary, public previously prohibited innovation to reach the market in
consultations, or a combination of the two. Hearing a timely manner. A rule change occasionally may require
from market participants directly can help refine the industry consultation.
relevant compliance issues, bring to light unintended • Is live testing necessary? The regulator must assess
consequences and knock-on effects of regulation, and its own comfort level in permitting (or preventing)
allow the regulator to gauge the intensity of interest and the innovation without additional factual evidence of
impact of these issues. its risks and benefits. This is the primary purpose of a
sandbox: to develop evidence to support a regulatory
determination. At this stage, much is left to the regula-
R E G U L AT I O N P R O H I B I T S I N N O VAT I O N
tor’s discretion, and it is difficult to draw a clear line
In some cases, the innovation may be prohibited in the
between the circumstances that require a sandbox and
absence of a regulatory change or accommodation. This
those that do not.
may be because it runs afoul of a rule or otherwise appears
to create a significant risk for consumers or investors. In this
If, after going through these steps, the regulator still needs
case, the regulator may wish to use a sandbox test to assess
more insights to resolve relevant technical questions or if the
the risks and benefits of allowing the innovation to reach
policy intervention will benefit from tighter, more collabora-
the marketplace.
tive coordination with the marketplace, the regulator should
consider a sandbox. (See the example in Box 1.)
As this analytical structure suggests, there are good reasons
Step Three: to view sandboxes as the final stage of a nested regulatory
Assess the alternatives process. Even when the decision process clearly recommends
a regulatory sandbox, a regulator still may decide not to
A simple framework for determining whether to proceed
implement it if significant constraints, such as a prohibitive
with live testing in a sandbox may be useful where regulation
legal and regulatory framework or limited resources, prevail
blocks innovation or creates uncertainty. Figure 4 illustrates
(see Section 3).
this process and focuses on three threshold questions: (i)
Does the innovation promise a significant new benefit to the
marketplace? (ii) If so, can the innovation be enabled by a
simple rule change? (iii) Is live testing necessary?
• Does the innovation promise a significant new benefit
to the marketplace? Since most entrepreneurs will
claim to have identified a novel solution to an important
problem, it may be difficult to assess the actual benefits
of the innovation. The regulator will need to make a
judgment call and perhaps draw on external advisers to

Ob jec t i v e S ett in g: W h y S et Up a Reg ulato r y S a nd bo x? 9

 innovation

N Y N
Is the strategy Is the strategy
Within scope Y to test N to reduce
of mandate? commericial regulatory
FIGURE 4. Decision process: Step three viability? barriers?
Y

B A R R I E R S T O I N N O VAT I O N
STEP 2

Compliance Regulation Regulation

is creates prohibits
costly uncertainty innovation

Does the new

Can be resolved tech promise
with rule update significant
or clarification? benefits?
Y N Y N

Can be resolved
STEP 3

Can you update

through industry
the rules?
consultation?
Y N N Y

Is live testing
N
necessary?

OTHER INNOVATION RULE OR POLICY OTHER NO SANDBOX

FACILITATOR UPDATE REGULATORY TOOLS

KEY
Y Answer to question is “Yes”
N Answer to question is “No”

Consider Innovation Facilitation YES

SANDBOX

HOW T O BUILD A REGUL ATORY S A NDBOX 10

 Box 1. B
 ank of Thailand: A regulatory sandbox for shared KYC/CDD utility

The Bank of Thailand is using its regulatory sandbox to the bank they already use. The goal of the test, which
to test a shared KYC and ID verification utility that is limited to opening savings account products during
relies on the National Digital Identity Platform (NDID) normal business hours, is to foster more convenient and
to verify and authenticate identity (BOT 2020). NDID is more secure remote account opening for digital financial
provided by National Digital ID Company Limited, which services. The Bank of Thailand is monitoring the results
has shareholders from 69 companies, including Thai of the test before making NDID functionality available
commercial banks, specialized financial institutions, more broadly to the financial sector.
securities companies, fund management companies, life
The test builds on a previous sandbox effort in which
insurance companies, casualty insurance companies,
12 commercial banks and payment services providers
electronic payment service companies, the Stock
tested biometrics technology—facial recognition—to
Exchange of Thailand, and Thailand Post Company.
verify customer identity through eKYC. The test was
The test allows six commercial banks to sign up new conducted to develop further guidance on the use
customers into savings account products using a of eKYC regulation to comply with requirements on
combination of facial recognition technology and the ID anti-money laundering and combating the financing of
verification information customers previously provided terrorism (AML/CFT).

Ob jec t i v e S ett in g: W h y S et Up a Reg ulato r y S a nd bo x? 11

SECTION 3

HOW TO DESIGN A REGUL ATORY

SANDBOX TO ADVANCE
THE REGUL ATORY OBJECTIVE

S
A NDBOX DESIGN SHOULD BEGIN The feasibility assessment should confirm institutional com-
with a thorough feasibility assessment that is linked mitment to the sandbox by identifying an executive sponsor
to the overall objectives of the program. (See Annex and a tentative governance structure. Sandbox programs
2 for tools on feasibility diligence assessments). The assess- often cause cultural friction within financial regulators, if for
ment helps identify the resources required; align internal no other reason than the perception that they may encourage
and external stakeholders; highlight complementary regula- excessive risk taking with untested products, technologies, or
tory programs, such as innovation facilitators; and uncover business models. Clear and unambiguous commitment from
other potential constraints. the highest levels of the regulator is essential.7

TABLE 1. Regulatory sandbox design elements

Design Element Description Design Choices (examples)

Eligibility Defines who can participate in the sandbox. Eligibility should • Open to incumbents only
be articulated clearly to ensure a level playing field across all • Open to newcomers only
market participants. • Open to nonfinancial services providers (e.g.,
technology providers, regtech)
Governance Defines the internal operating structure of the sandbox, roles • Specialized sandbox unit
and responsibilities, and key operational processes. • Hub-and-spoke: a central point of contact
coordinating sandbox inquiries with other units
of the regulator
Timing Includes: • Periodic admission (cohort-based)
• Duration of the admission window • Permanent admission window (on-tap)
• Duration of the test • Testing periods range from 3 to 36 months

Test restrictions Limits to the scope, scale, and/or conduct of the sandbox • Number of clients
test to minimize potential harm. • Number of transactions
• Volume of transactions
• Geographical limits
• Consumer protection safeguards
• Minimum AML/CFT requirements
Exit Includes: • For test outcomes see Section IV
• Individual test outcomes (graduation, terminated test, etc.) • KPIs in terms of the absolute output (number
• Program-level key performance indicators (KPIs) of graduated firms)
• Incorporation of insights and lessons learned into the • KPIs in terms of a regulatory change promoted
broader regulatory agenda

7 According to the CGAP/World Bank study, 87 percent of sandboxes surveyed have governor or board-level sponsorship (Jeník and Appaya 2019a).

HOW T O BUILD A REGUL ATORY S A NDBOX 12

3.1 Design Elements Entities outside the regulatory framework. A
2. 
regulatory sandbox is open to entities that experi-
Regulatory sandboxes typically include five core design ment with innovation outside the existing legal and
elements that may be combined in various ways to accom- regulatory framework (e.g., PolicyPal in Singapore
modate local objectives and circumstances. (See Table 1.) and Pezesha in Kenya).
The design elements are as follows:
3. Nonfinancial services providers. Regulators
• Eligibility often will condition sandbox admission for non-
• Governance financial services providers, such as regtechs, on a
• Timing partnership between the sandbox applicant and a
regulated entity.
• Test restrictions
• Exit options • Testing restrictions. Sandbox activities must comply
with legally mandated restrictions and requirements that
fall outside a regulator’s discretion, such as minimum
AML/CFT compliance. In addition, many regulators
3.2 Threshold Constraints devote particular attention to managing the potential
consumer risks caused by sandbox testing, even when
Sandbox design should reflect local conditions, including it is within the regulator’s discretion to relax or modify
(i) applicable legal framework, (ii) market conditions, and consumer protection rules and requirements.
(iii) capacity.
• Exit options. The regulator should understand its options
for “graduating” sandbox participants when an innova-
LEGAL FRAMEWORK tion has tested successfully, and the regulator considers it
A sandbox is a formal program that must align with the worthwhile for the market. There are three options, but
regulator’s statutory mandate and background legal and reg- not all of them are available to all regulators:
ulatory requirements. Therefore, threshold legal feasibility
analysis is necessary to confirm permissible sandbox objec- 1. The sandbox graduate is granted a license or other
tives (mandate), eligible participants, testing constraints, form of authorization under the legal framework.
and regulatory relief available.
2. The sandbox graduate is allowed to operate in
• Statutory mandate. In some cases, the regulator may be the marketplace because it has obtained a waiver,
authorized to establish a sandbox (e.g., see Section 12A of exemption, or a no-objection letter or has been
the Capital Markets Authority Act in Kenya) or pursue allowed to operate at the discretion of the regulator.
a legislative change to grant such authority (as is the case An example of this is Upstart in the United States.
in Colombia, Lithuania, Mexico, Poland, and Spain). In
3. The regulator initiates a regulatory or legislative
other cases, the sandbox program may need to be justified
change to govern the activity of the sandbox gradu-
as a permissible extension of the regulator’s discretion.
ate—for instance, Pezesha in Kenya.
• Eligibility criteria. Sandbox eligibility is likely to be
limited to firms and/or activities that are within the
scope of the regulator’s mandate. This typically includes
MARKET CONDITIONS
A vibrant local fintech marketplace is not a prerequisite
the following:
for a regulatory sandbox—in fact, where there is little or
Licensed or otherwise formally authorized
1.  no local innovation activity, a sandbox may be introduced
entities. A regulatory sandbox is open to either to encourage new market entrants. Nevertheless, it is
authorized entities already operating in the market important to assess local demand to appropriately design
only, as is the case with the Hong Kong Monetary the sandbox in anticipation of application and testing
Authority (HKMA), or to any entity that obtains a volumes. (See Table 2.) A regulator can develop this market
formal authorization before launching the test, as is intelligence through formal or informal engagement—for
the case with FCA. example, requests for information and public roundtables.
Alternatively, the regulator may choose to engage a third

How to Des ign a Reg ulato r y S a nd bo x to A d va nc e t he Reg ulato r y O b jec t i v e 13

TABLE 2. Market conditions and capacity

High demand Low demand

High capacity • Cohort-based sandbox • Permanent (“on tap”) application
• Dedicated sandbox team • Emphasis on nonsandbox innovation facilitators
• Subject matter experts available to assess a diverse type
of innovation
• Operations and governance integrated into core regula-
tory and supervision functions
Low capacity • Cohort-based sandbox • Nonsandbox innovation facilitators
• Rigorous preapplication vetting
• Narrow eligibility requirements
• Short testing windows
• Hub-and-spoke governance, with shared staffing of
sandbox operation

party to conduct a more specialized market diagnostic to • Interactions with other relevant regulatory programs,
inform the sandbox strategy. such as innovation hubs, licensing processes, and super-
vision programs.
C A PA C I T Y
Every feasibility assessment should include a clear-eyed The resources committed to a sandbox widely differ from
evaluation of capacity, which mostly is defined in terms of a single point of contact (more akin to a fintech office) to
resources that can be committed to the sandbox over several more than 30 staff members and from several thousands of
years. An internal capacity review should assess, among dollars to over a million dollars (Jeník and Appaya 2019b).
other things, the following: Capacity constraints ultimately may favor lower cost inno-
vation facilitators, such as fintech offices.
• Whether the sandbox will include dedicated or shared
staff.
• Technical skills required for program management,
market engagement, application evaluation, technology
assessment, test design and administration, and inter-
and intra-regulator coordination.

HOW T O BUILD A REGUL ATORY S A NDBOX 14

SECTION 4

HOW TO SUCCESSFULLY RUN

A REGUL ATORY SANDBOX

4.1 Procedural and advance financial inclusion should be in a department that

Organizational Design focuses on inclusion or it should closely coordinate with
that department.
The threshold constraints explained in Section 3.2—legal
Line up internal support. The sandbox team is unlikely
framework, market conditions, and capacity—will help
to have all the expertise necessary to run the sandbox. Any
to determine who should be responsible for implementing
sandbox initiative often will require knowledge in licensing,
a regulatory sandbox, the amount of monetary resources
regulation, supervision, information technology, and
available, who else (from within the organization or exter-
communication. Moreover, sandbox teams frequently are
nally) should support it, and when and how it functions and
composed of junior-level staff who are willing to experi-
for how long.
ment but who may lack in-depth technical knowledge and
Key steps to ensure that a sandbox runs well include the experience (Dalberg 2019). That is why each department
following: with the relevant expertise should appoint a contact person
• Define who owns the sandbox. to support the sandbox team as needed. For example, the
Financial Superintendence of Colombia has different “accel-
• Line up internal support.
erators” in different departments to provide the expertise
• Allocate sufficient resources. that is needed.
• Outline the internal process.
In instances where the regulator does not have in-house
• Ensure coordination with external stakeholders. expertise in a specific area (e.g., distributed ledger tech-
• Establish formal and informal support channels. nology), a process should be in place to seek such expertise
from outside, perhaps by establishing an advisory com-
Define who owns the sandbox. The sandbox team may mittee or hiring an expert on an as-needed basis. Most
be housed in any department or unit of the organization. sandboxes reviewed by CGAP use a multidepartment body
Often, if the sandbox is established by a central bank, the to facilitate implementation.
team is part of the payment department and reports to the
Allocate sufficient resources. The operating budget must
department director. The sandbox team should have a high
allow for a dedicated sandbox team that can focus on its
profile in the organization and be visible to market stake-
work and not be distracted by other responsibilities. The
holders. Its status is more important than what department
average cost of implementation is difficult to assess because
it is in. The team should be identified and given a clear
the major cost components (such as salaries) are highly
mandate. Although the number of team members can range
context specific (Jeník and Appaya 2019b).
from one to 30 (Jeník and Appaya 2019a), in most cases,
three to five members are adequate. A sandbox designed to

How to S u c c ess f ully Run a Reg ulato r y S a nd bo x 15

Outline the internal process. The internal process should 4.2 Consultation and
define responsibilities and response times to ensure the
Public Engagement
sandbox runs smoothly once it is operational. Note, however,
that this step should not be overwrought. There is no need for Stakeholder engagement is an important part of sandbox
complex and sophisticated internal manuals. It is enough to design and implementation. In crafting a stakeholder
have a list of responsible employees and defined expectations engagement plan, regulators should consider addressing
of their response times. The key to a well-defined internal market participants, internal stakeholders, and peer regula-
process is making sure that it clearly covers all the steps from tors. (See an example of an engagement strategy in Box 2.)
the beginning (receiving applications) to the end (post-exit First, the regulatory sandbox sponsor should plan to engage
evaluation), that everyone understands their role, and that directly with market participants. Informal engagement
sandbox applicants and participants get clear instructions with the marketplace through an innovation facilitator
about what is expected of them. is essential to understand both the nature and scope of
Ensure coordination with external stakeholders. innovation activities and the need for regulatory modern-
Coordination with external stakeholders is necessary ization. These interactions will help the regulator frame a
when several financial sector regulators may be involved. clear hypothesis for its regulatory sandbox or, in some cases,
Regardless of the form it takes—whether it be a memo- refute the need for a sandbox entirely. These conversations
randum of understanding, a joint committee, an informal also may help identify emerging industry practices that
information exchange, or a simple referral mechanism— require more focused regulatory attention, as was the case,
there should be a process in place to cover at least the for example, with early consumer-permissioned data access
instances where a sandbox applicant or participant falls practices between banks and fintechs.
under the mandate of a different regulator or tests an inno- Apart from engaging market participants on the need
vation that is relevant to a different regulator. for a regulatory sandbox, regulators also may wish to
Establish formal and informal support channels. consult the marketplace about sandbox design. In addi-
Sandboxes frequently generate interest from market partic- tion to substantive feedback on sandbox design elements,
ipants who contact the regulator to learn more about the including important features such as application fees and
process or inquire about their eligibility for sandbox testing. protection of intellectual property shared with the regu-
Most of these inquiries do not require sandbox testing, but lator during the test, the consultation process itself helps
the regulator should build organizational and reporting to raise general awareness of the sandbox initiative and its
structures to take advantage of these interactions to learn intended purpose. Market participants sometimes mis-
more about the marketplace, emerging risks, and percep- takenly believe that regulatory sandboxes are created to
tions of the regulatory process. provide funding for start-ups,8 allow participants to operate
without regulatory oversight, or provide business advice
Regulators often face uncertainty and anxiety in the
on the commercial viability of a new product. Clarifying
prelaunch phase. They often wonder whether they have
the purpose of the sandbox early on can help improve the
done everything they could to prepare for real-life imple-
quality of the applicant pool and help firms avoid the time
mentation. This uncertainty may delay the launch of a
and expense of applying to a program that is intended to
sandbox. In this case, regulators could create a minimum
deliver a regulatory outcome, not capital or commercial
viable sandbox, launch it, and tweak it based on feedback
advice. In certain jurisdictions, public consultation on a
and experience (Duff 2018). Regulators also may want to
proposed sandbox framework may be required as a matter
consider a “sandbox simulation”—basically a sandbox for
of administrative law.
a sandbox. This tool can help regulators test the sandbox
before launching it. See Annex 3 for instructions on how to Second, the regulator should conduct internal consulta-
run a sandbox simulation. tions with key staff to build alignment and support for the
project (see Section 4.1).

8 There are exceptions where regulators have set up a fund to promote innovation, as is the case in Kazakhstan, Sierra Leone, and Singapore.

HOW T O BUILD A REGUL ATORY S A NDBOX 16

 Box 2. Public engagement: Bank of Sierra Leone

In 2018, the Bank of Sierra Leone (BSL) launched and provided written comments explaining its approach
its Regulatory Sandbox Pilot Program to foster local to the proposed amendments. The BSL Regulatory
fintech innovation and encourage the development Sandbox admitted its first cohort in May 2018.
of new products, technologies, and business models
The sandbox benefited from a combination of
designed to improve financial inclusion in Sierra
high-level executive support, a thorough public
Leone. The sandbox framework was coordinated in
consultation process, and a dedicated sandbox team
conjunction with the Sierra Leone FinTech Challenge
charged with managing all aspects of the project. But
supported by FSD Africa and UNCDF. The FinTech
the application evaluation, and subsequent design
Challenge was intended to foster collaboration
and evaluation of the testing plan, proved to be more
between regulators, nontraditional market players,
onerous and time consuming for the sandbox team
licensed financial institutions, and other partners to
than anticipated, particularly because of the large
pilot innovative products, services, or solutions in
amount of time dedicated to each participating firm.
Sierra Leone’s fragile state context. Cash prizes, seed
capital, and admission to BSL’s sandbox were offered The sandbox has evolved and matured since and now
to Challenge winners. serves as a primary point of contact for all inquiries on
fintech innovation. The sandbox framework, likewise,
BSL announced the sandbox framework in July
has evolved into an open admission format that allows
2017 in connection with the FinTech Challenge. A
firms to apply for testing at any point, rather than in
BSL committee drafted the preliminary framework
specially designated cohort windows. BSL has been
and application process with the help of external
constantly engaging with the industry through road
advisers. BSL then solicited input on the draft from
shows, conferences, and even a radio show to raise
key stakeholders in Sierra Leone, including incumbent
public awareness, address initial questions, and improve
financial institutions and the local fintech association.
the quality of sandbox applications.
Based on this feedback, BSL revised the framework

Third, where necessary and appropriate, the regulator 4.3 Testing, Evaluation, and Exit
should consult with peer regulators that have overlapping or
adjacent jurisdiction. Many promising fintech innovations Testing plans typically are proposed by sandbox participants
raise issues that cut across traditional regulatory boundaries and evaluated by the sandbox team on a case-by-case basis.10
because they have payment and money transmission services (See Annex 2 for a testing plan template.) Testing plans
that are common to many new product and service offerings. should be customized to develop evidence on the regulatory
Financial and telecommunications regulators likewise are questions presented by the specific innovation. As a basic
under greater market pressure to collaborate, particularly on rule, the regulator must feel comfortable that, once the
issues related to mobile network data access and portability. testing is conducted as planned, the regulator will be able to
In a complicated regulatory environment, the ability to coor- decide what the next steps will be and choose an exit option
dinate a single point of regulatory contact for an aspiring (see Figure 5). In reviewing a proposed testing plan, the
innovator can be a significant enabler. Indeed, some jurisdic- regulator must confirm the plan is comprehensive and clear.
tions have established formal mechanisms for coordinating It should do the following:
sandbox tests across multiple regulators.9 While such formal • Define the overall timeline and budget.
mechanisms may not be necessary in all cases, regulators • Identify precisely what is being tested, as well as how
should take care to assess potential areas of jurisdictional and why.
overlap with peer regulators early in the process.

9 For example, HKMA, Securities and Futures Commission, and Insurance Authority coordinate cross-sector sandbox tests, when necessary, on behalf of
applicant firms. See HKMA (2016).
10 As a practical matter, many of the observations concerning testing are generalized. This is because testing plans typically are developed under conditions
of strict confidentiality between regulators and sandbox participants, and they differ substantially across jurisdictions and even within single sandboxes.

How to S u c c ess f ully Run a Reg ulato r y S a nd bo x 17

• Define milestones and success criteria. properly, fails to follow the agreed-on testing plan, does
• Define risks and mitigating measures. not share information with the regulator as requested, or
raises other concerns. The sandbox participant should not
• Identify staff and their responsibilities.
be forced to remain in the sandbox against its will either. At
• Establish rules for engaging with and reporting to the its own discretion, it should be allowed to cease testing and
regulator throughout the testing period. disengage in an orderly manner.

See Box 3 to learn how Taiwan’s Financial Supervisory Once testing is over, the final evaluation is facilitated by
Commission (FSC) approaches its sandbox test plan. regular reporting delivered throughout testing and the final
report prepared either by the sandbox participant itself (as
The regulator oversees the test as part of its supervision happens in Kenya) or by an independent auditor (as hap-
mandate. The sandbox participant should report to the pens in Bahrain). The final report must be delivered within
regulator regularly (e.g., weekly or monthly). The regulator a prescribed deadline and the regulator should proceed
should have the right to request additional information at swiftly with the final decision. See Figure 5 for an overview
any time, conduct an onsite visit, or discontinue a sandbox of exit options.
test if justified by regulatory concerns. This may happen
when the sandbox participant does not comply with appli- The completed sandbox test may be deemed successful or
cable rules, does not implement the imposed safeguards unsuccessful. A successful test means that the test ran as
planned, but it does not mean that the sandbox participant
will be allowed to bring the innovation to market. That
happens only when the sandbox participant wants to pro-
Box 3. Sandbox test plan ceed, and the regulator considers the innovation subject to
FSC requires that the sandbox test plan includes the its mandate and market worthy (see Table 3).
following:
Every regulator should carefully map its own regulatory
• Description of the source of funds framework against each of the possible outcomes (as shown
• Proposed financial business in Figure 5) to determine whether and how easy it would be
to implement each. The regulator should avoid setting up a
• Description of innovativeness
sandbox without having legal clarity on each of the poten-
• Scope, duration, and scale of the tial exit options.
experimentation

• Participant protection measures

• Risk management mechanism (e.g., money

laundering and terrorist financing risk,
cybersecurity risk)
Every regulator should carefully map its
• Exit mechanism own regulatory framework against each
• Expected benefits of the possible outcomes to determine
whether and how easy it would be to implement
• Benchmarks for measuring the benefits achieved
each. The regulator should avoid setting up a
Based on the nature of responsible innovation, sandbox without having legal clarity on each of the
the key performance indicators (KPIs) or potential exit options.
other performance indicators of innovative
experimentation are set by the applicants.

When a local bank tested the use of an alternative

credit scoring system based on mobile phone user
data, the monitored metrics for the testing plan
included the number of customer applications,
the time needed for customer due diligence,
the accuracy of credit modeling, the number of
approved applications, and the default rate.

HOW T O BUILD A REGUL ATORY S A NDBOX 18

FIGURE 5. Exit options (all possible scenarios)

Re-application for sandbox

test after necessary changes

Did not meet test criteria

Failed Test Re-Apply Innovation deemed unfit
for the market

Test Starts Discontinued Test Cease and Desist

• Noncompliance
Successful Test License
• Firm’s decision

Other Formal Approval

Regulatory Change Innovation is not

regulated or falls under
the mandate of another
regulator
Outside of Perimeter

TABLE 3. Regulatory sandbox exit options in case of successful test

Description Example
License The sandbox participant can roll out the innovation in the All successful firms graduating from the UK FCA
market in compliance with regulatory requirements. sandbox have been licensed under a licensing regime
that was already in place.
Other formal The sandbox participant can roll out the innovation in The Capital Markets Authority of Kenya uses the
approval the market in compliance with regulatory requirements widely defined discretion granted in the Capital Mar-
subject to exemptions and/or waivers granted. This also kets Authority Act to authorize temporary operations
may include a mandatory partnership with a licensed until an appropriate regulation is adopted.
financial institution.
Regulatory change The tested solution falls under the regulator’s mandate The Central Bank of Brazil has created a sandbox
but cannot be permitted without changes in the legal and framework that allows testing up to three years,
regulatory framework. which should provide enough time for regulatory
changes should they be needed.

How to S u c c ess f ully Run a Reg ulato r y S a nd bo x 19

SECTION 5

ALTERNATIVES
TO A REGUL ATORY SANDBOX

A
R EGUL ATORY SA NDBOX TA K ES innovations. There are several options that either complement
substantial time and resources to create and use. It or substitute for a regulatory sandbox.
should be used selectively to advance regulatory or
The closest alternative to a regulatory sandbox is the ad hoc
policy objectives. A regulator should have a basic framework
test-and-learn approach. Other tools often listed along with
for engaging with industry to assess the value and viability of
a regulatory sandbox serve a different purpose than that of a

TABLE 4. Alternatives and complements to a regulatory sandbox

Description When applicable Examples

Wait-and-see/ The regulator monitors an innovation be- Early-stage innovation where the level of reg- Person-to-person
forbearance fore deciding on a regulatory treatment. ulatory uncertainty is too high to be overcome lending in China (early
In case of forbearance, the regulator through a limited live testing (e.g., the innova- stages)
decides to tolerate certain behavior in the tion continues evolving, scale needed to make Cryptocurrencies
market otherwise deemed noncompliant. assessment, unclear mandate to regulate). around the world (early
stages)
Test-and-learn The regulator defines an ad hoc frame- The regulator deems a financial innovation Mobile money in Kenya,
work for safeguarded live testing of a potentially beneficial and market worthy but the Philippines, Tanzania
specific innovation. needs more information to resolve uncertainty
and doesn’t see a need for a more permanent
testing framework.
Innovation The regulator sets a structured and for- The regulator identifies a reasonable demand France, Uganda, United
office/hub mal framework for regular engagement for regulatory consultation and guidance from Kingdom
with the industry on issues concerning innovators.
innovation (without live testing).
Regulatory The regulator (or other eligible entity) The regulator has identified gaps or inconsis- Remote customer iden-
change initiates a legislative change, adopts tencies in the legal and regulatory framework or tification in Malaysia
new regulation, or amends the current has deemed a changed circumstance requiring
one or it reconsiders interpretation and a change in the current rules.
application of the current rules within
the regulator’s purview and discretion.
New license A special instance of the regulatory The regulator has identified a new category Australia
change scenario is creation of a new of business that requires a distinct treatment. Colombia
licensing regime for innovative business- Fintech licenses and class exceptions (apply- Switzerland
es. The license may be permanent or ing standardized safeguards that sufficiently
temporary and should come with a set of mitigate risks from live implementation of the
restrictions to differ from other licenses to innovation without the need to evaluate them
avoid regulatory arbitrage. on a case-by-case basis) fits here as well.

HOW T O BUILD A REGUL ATORY S A NDBOX 20

sandbox and, thus, do not constitute a true alternative, but
rather a different approach. These tools range from the wait- Box 4. Innovative ecosystem in Taiwan
and-see approach to making regulatory changes.11 Initiatives established by FSC to support innovation
As Table 4 suggests, some approaches are directly com- in the financial sector include the following:
plementary to a sandbox. Innovation facilitators, such as • Business trial. A licensed financial institution
innovation offices and innovation hubs, are less demanding may apply for a business trial if it seeks to
to implement in terms of resources and discretionary powers expand its approved business in innovative
needed. In addition, they are more scalable because their technological ways. FSC has established
main purpose is a light-touch engagement with the industry separate operating guidelines for business trials
that allows the regulator to offer fee-free guidance to inno- for the banking, securities and futures, and
insurance industries.
vators in exchange for the learning opportunity. (For an
example of a holistic innovative ecosystem see Box 4). • FinTechSpace. In 2018, FSC directed
Financial Roundtable (an association that brings
together the banking, securities, and insurance
associations) to set up FinTechSpace—an
incubator and accelerator for fintech start-ups.

• Crowdfunding platforms. The Taipei

Exchange set up equity-based “Go Incubation
Board for Startup and Acceleration Firms” in
2014 to help start-ups raise capital. In 2015,
many securities firms set up equity crowdfunding
platforms.

• Consultation points. FSC also established

consultation points such as the Innovation
Center and the Regulatory Clinic in
FinTechSpace to help start-ups resolve
questions about financial regulation.

• Task forces. FSC directed financial industry

associations to set up task forces to deal with
innovative businesses, fintech general issues,
open banking, e-payment, blockchain, and
robo-advisors.

11 See Jeník and Lauer (2017).

A lte r n at i v es to a Reg ulato r y S a nd bo x 21

A NNE X 1

SET TING OBJECTIVES

FOR A REGUL ATORY SANDBOX

W
HEN BUILDING A R EGUL ATORY adjustments may be needed. A sandbox may have more than
sandbox, defining objectives early on is one objective, but it should be well aligned with the regula-
essential. They help inform other design tory mandate and priorities. Table A1-1 lists some common
components, get stakeholder buy-in, set expectations, objectives and their implications.
target implementation, measure results, and identify where

TABLE A1-1. Examples of sandbox objectives

Objective Implications Excerpts from authority statute

Increase customer This objective connects to the main “[The main goals and objectives of the FinTech Sandbox are to e]xpand in innovating and
benefits: To improve policy objectives of financial stability, designing services, products, and solutions that effectively: Increase effectiveness and
convenience, bring new consumer protection, and financial efficiency in DFS, and widens choices for financial consumers so they can choose what’s
customer services to the inclusion (where applicable). Such a more suitable.” Jordan, Central Bank of Jordan (FinTech Regulatory Sandbox Document,
market, lower the end-cost, sandbox likely will attract business-to- https://www.cbj.gov.jo/EchoBusV3.0/SystemAssets/9328fddf-3f3d-40d8-9ed3-d98bb-
and otherwise improve the consumer innovations. The regulatory c89db20.pdf, pp. 2–3).
customer experience through expectation is to see financial services “Article 3 (1) Bank Indonesia decides the testing in the Regulatory Sandbox for Financial
tech-enabled financial already in place improved in areas Technologies Providers including their products, services, technology, and/or business
innovation. relevant to customers and/or new models. (2) The decision set forth in paragraph (1) is adopted by considering that: …
services catering to under- and The Financial Technology is beneficial or can provide benefits for consumers and/or
unserved customer segments or needs. the economy….” Indonesia, Bank Indonesia (Regulation of Member of the Board of
Governors Number 19/14/PADG/2017 Concerning Regulatory Sandbox [RUANG UJI
COBA TERBATAS] for Financial Technologies, 30 November 2017, https://www.bi.go.id/
elicensing/helps/PADG%20REGSAND.pdf [in Bahasa only], p. 3).
Promote competition: The sandbox should facilitate licensing “1.2.7. The [Central Bank of Eswatini] FinTech Regulatory Sandbox aims to achieve the
To increase the number of of new entities and approval of new following objectives:…To promote effective competition and the provision of a wider
contenders in the financial services. The regulatory expectation range of products in the interest of the consumer.” Eswatini, Central Bank of Eswatini
market or a segment thereof is to have new entrants and services (Financial Technology Regulatory Sandbox Guidelines, May 2020, https://www.
and/or stimulate competitive reach the market. centralbank.org.sz/fintech/sandbox/CBEFINANCIALTECHNOLOGYREGULATORYSAND-
behavior among the entities BOXGUIDELINES.pdf, p. 5).
that are already regulated. “The [Central Bank of Bahrain] has made a conscious decision to initiate a Sandbox in
order to promote effective competition, embrace new technology, encourage financial
inclusion and improve customer experience.” Bahrain, Central Bank of Bahrain (Regu-
latory Sandbox Consultation Paper, 28 March 2017, p. 1).
Advance financial The sandbox combines implications de- See Regulatory Sandbox Consultation Paper, Central Bank of Bahrain, 28 March 2017,
inclusion: To widen access scribed above. The regulatory expectation p. 1.
to and promote use of formal (and the corresponding KPIs) is to see “[T]he Sandbox is intended to foster responsible innovation that benefits consumers
financial services by under- more previously excluded and under- in Sierra Leone by improving the quality of, and access to, financial products and
and unserved customer served customers using formal financial services.” Sierra Leone, Bank of Sierra Leone (Regulatory Sandbox Pilot Program
segments (low-income services to address their needs. Guidelines and Application Form, April 2018, http://www.bsl.gov.sl/BSL_Sandbox_Pro-
individuals, MSMEs). gram.html, p. 3).

HOW T O BUILD A REGUL ATORY S A NDBOX 22

A NNE X 2

TEMPL ATES FOR SANDBOX TE AMS

T Template 1
HIS A NNEX INCLUDES FOUR TEM-
plates that can help sandbox teams draft and
Sample regulatory sandbox
feasibility assessment plan
implement their regulatory sandbox framework.
The templates are not intended to be universal blueprints
and always should be adapted to specific circumstances. The Preparing and announcing a sandbox framework docu-
templates are for the following: ment is relatively straightforward. However, the success
Regulatory Sandbox Feasibility Assessment. Helps of sandbox initiatives requires careful initial evaluation of
create a structured, high-level project plan for assessing, the legal, regulatory, market, and political economy condi-
designing, and implementing a regulatory sandbox. tions to help tailor the sandbox and any related initiatives.
Preparing and announcing a sandbox framework document Moreover, it is critical to involve market participants and
is relatively straightforward. However, experience in other other stakeholders in an active dialogue early in the process
jurisdictions suggests that the success of sandbox initiatives to deepen regulator–marketplace connections, confirm
requires careful initial evaluation of the legal, regulatory, internal alignment, raise industry awareness, and facilitate
market, and political economy conditions and the regula- mutual learning.
tory capacity (the threshold restrictions) to help tailor the A feasibility assessment requires careful attention to and
sandbox and any related initiatives. customization for local conditions. Accordingly, the model
Sandbox Project Plan. Helps create a Gantt chart with a plan outlined here identifies key outputs in generalized
detailed step-by-step process, assigned responsibilities, and terms on the assumption that the regulator will guide the
timeline. feasibility assessment and engagement in a manner most
appropriate to the context.
Internal Operating Guidelines. Outlines the sandbox pro-
cess and summarizes common activities performed at each Among other things, the feasibility assessment should help
stage of the process. It can be used to inform the process the regulator determine the form of sandbox best suited
flow or facilitate drafting of an internal regulatory sandbox to advancing its objectives, begin the process of market
manual where needed. engagement and institutional buy-in, and help identify any
alternative initiatives essential to supporting sandbox objec-
Sandbox Testing Plan. Offers an example of a testing plan. tives. Subsequent phases of the project plan will focus on
The actual testing plan always must be adapted to the regu- the practicalities of putting the sandbox into operation.
latory sandbox framework and the innovation being tested.
Regulators should not attempt to create a one-size-fits-all
testing plan.

A P P E NDIX 23
PHASE 1. Feasibility Assessment (45–90 days)

Project Lead and

Work Stream Core Topics Outputs Due Date
Purpose and Objective • Rationale for launching a • Consensus among senior regulator leadership on the need for a sandbox, the
sandbox purpose it will serve, and relation to other regulatory initiatives.
• Internal alignment on regula- • Consensus among senior regulator leadership on the desired form of sand-
tory sandbox initiative box, including either:
1. Policy-focused (removing regulatory barriers to innovation)
2. Innovation-focused (lowering the cost of entering the regulated market-
place)
3. Thematic (accelerating adoption of a specific regulation or innovation)
Legal • Statutory mandate • Legal memorandum (or equivalent) confirming authority for sandbox initiative.
• Range of regulatory discre- • Identification of permissible scope of initiative, including options for regulatory
tion (e.g., tools including relief (no-action letters, etc.) and process for regulatory change.
no-action letters, licensing • Intra- and inter-regulatory briefing sessions to gather input and ensure a
requirements, no-objection common understanding of the sandbox project.
letters, etc.)
• Regulatory and statutory
requirements (e.g., AML/CFT,
consumer protection, etc.)
• Intra/inter-regulatory coor-
dination
• Legislative options, if
necessary
Market Conditions • Market perception regula- • Preliminary market landscaping (including incumbents and start-ups) that
tion/regulator describes market demand for a regulatory sandbox.
• Need for a regulatory sand- • Facilitated external consultations and conversations (awareness raising).
box or related programs • Draft concept note for public consultation.
Regulatory • Internal regulatory capacity • Identify preliminary operational and governance structure, including required
Capacity to implement sandbox and/or institutional capabilities per agreed-upon sandbox objectives.
related initiatives

Alternatives and • Assess alternative formal • A list of programs to complement/support the sandbox initiative, including,
Complements and informal regulatory e.g., help desk, fintech office, innovation hub, market outreach initiatives, etc.
initiatives that could serve This list should consider the timing of any related programs and potential
the same purpose as the operational interactions with the sandbox.
sandbox more effectively or
at lower cost
Institutional Champion • Executive sponsor of sand- • Commitment from senior leader(s) as principal executive sponsor of sandbox
and Dedicated box initiative initiative.
Resources • Internal, cross- • Designation and approval of core sandbox implementation team (3–5
functional team individuals).
responsible for delivering
sandbox initiative

HOW T O BUILD A REGUL ATORY S A NDBOX 24

Template 2
Sample regulatory sandbox project plan
Planned Planned Actual Percent
Owner Actual Start
Start Completion Completion Complete
Preapplication Phase
1 Create outreach and communi- Marketing/ communi-      
cation plan to promote the sandbox cations lead
program. Plan should include strategies
for identifying and reaching all relevant
industry and regulatory stakeholders.
2 Designate a sandbox contact lead Sandbox committee    
to engage with local fintech and finan-
cial inclusion communities.
3 Design sandbox portal on regula- Technical lead      
tor website with links to application
materials, FAQs, documentation, and a
dedicated email address for submitting
inquiries on the process.
4 Designate a sandbox contact Sandbox committee
person to field inquiries from potential
applicants, participate in targeted
outreach activities, and document key
learnings for real-time feedback on the
process.
5 Develop FAQs and guidance to Technical lead      
reduce ineligible or incomplete applica-
tions and encourage high-quality (and
complete) submissions.
6 Develop tracking database of in- Sandbox contact
bound inquiries. Data may include, e.g., person
name of person/company, product/
technology type, product stage, contact
information, nature of inquiry.
7 Review, revise, and approve Sandbox committee      
communications and engagement plan,
sandbox portal, FAQs.
8 Identify and invite key regulator Sandbox committee      
personnel (and any external experts)
to participate on the review and selec-
tion committee.
9 Develop application eligibility Sandbox committee      
checklist.
10 Develop administrative follow-up Sandbox committee      
form letter for incomplete applica-
tions.
Application Phase
11 Publicly announce and launch ap- Marketing/ communi-      
plication period for sandbox program. cations lead

12 Launch sandbox portal on regulator Technical lead      

website.
13 Implement communications and All      
engagement plan.

T emplates for S a nd bo x T ea m s 25
 Planned Planned Actual Percent
Owner Actual Start
Start Completion Completion Complete
14 Hold [weekly/monthly] check-ins All      
that include sandbox contact lead and
sandbox committee to discuss trends,
feedback, and observations.
15 Revise and update publicly Sandbox contact      
available sandbox materials and/ lead; sandbox com-
or processes, as necessary, and in mittee
consultation with sandbox committee.
16 Identify and engage internal and Sandbox contact      
external subject matter experts lead; sandbox com-
(e.g., supervision, payments, consumer mittee
protection, technology) to resolve
targeted regulatory inquiries identified
by sandbox contact lead for referral.
Review Phase
17 Review and screen applications. Administrative review    
team
18 Contact applicants who have Administrative review      
submitted incomplete applications. team
Provide opportunity to remediate
administrative or technical omissions
within a proscribed timeframe (2–3
business days). Maintain and update
database of sandbox applicants for
future interactions and ongoing market
intelligence.
19 Prepare and distribute “board Administrative review      
books” of application materials for re- team
view by selection committee. Distribute
one week before scheduled review.
20 Convene selection committee to Selection committee      
discuss applicants and identify finalists.
21 Contact finalists for in-person inter- Administrative review      
view with selection committee. team
22 Conduct background check on Administrative review      
finalist companies and their respective team
principals.
23 Conduct interviews with finalists Selection committee      
with selection committee.
24 Reconvene selection committee for Selection committee      
final vote and approval of applicants to
be offered admissions.
25 Draft and send formal notice of Administrative review      
acceptance into sandbox pilot program. team
26 Follow up with accepted appli- Selection committee;      
cants. Confirm participation and administrative review
collect payment of sandbox participa- team
tion fee, if applicable.
27 Publicly announce names of sandbox Administrative review      
participants. team
28 Contact finalists not selected for Selection committee;      
cohort to explain rationale of the deci- administrative review
sion, invite into future cohorts, and/or team
offer informal regulatory counseling.

HOW T O BUILD A REGUL ATORY S A NDBOX 26

 Planned Planned Actual Percent
Owner Actual Start
Start Completion Completion Complete
Testing Design
29 Select and assign supervisory Sandbox committee      
teams to sandbox participants.
30 Conduct preliminary meeting Supervisory team and      
with supervisory team to identify cohort participants
approach to testing and supervision.
31 Draft preliminary testing plan. Supervisory team and      
cohort participants

32 Conduct feasibility review of Supervisory team      

proposed testing plan with internal and
external experts.
33 Identify additional resources super- Supervisory team      
visory teams need to conduct test.

34 Review and approve proposed Supervisory team;      

testing plans by sandbox committee. sandbox committee

Test Implementation
35 Implement testing plan (logistics and Supervisory team      
timelines will vary by plan).
36 Conduct checkpoint meeting be- Supervisory team;      
tween supervisory teams and sandbox sandbox committee
committee.
37 Create interim report to sandbox Supervisory team;      
committee on instances of breach, sandbox committee
early exit, or completion.
Exit and Review
38 Report testing outcomes and Supervisory team;      
recommendations on regulatory sandbox committee
treatment and sandbox exit.
39 Review and discuss testing out- Sandbox committee      
comes and recommendations.
40 Approve exit plans. Sandbox committee      

41 Prepare public report on cohort Sandbox committee      

results.
Procedural Review, Documentation, and Assessment
42 Review lessons learned from cohort Selection committee          
experience. and supervisory team

43 Interview sandbox participants Review team          

and applicants on their views of the
sandbox process.
44 Draft internal memorandum that Review team; sand-          
summarizes lessons learned, including box committee
observations on specific technologies/
companies, trends observed in the
applicant pool, procedural insights from
the application, selection or supervi-
sion process, testing and regulatory
outcomes, and recommended revisions
to the sandbox program.

T emplates for S a nd bo x T ea m s 27
 Planned Planned Actual Percent
Owner Actual Start
Start Completion Completion Complete
45 Initiate regulatory process and/or Sandbox committee          
rule reviews as necessary based on
procedural review of sandbox.
46 Draft and publish public-facing Sandbox committee          
assessment of sandbox process,
including anticipated timelines for next
steps.

HOW T O BUILD A REGUL ATORY S A NDBOX 28

Template 3 • Revise and update publicly available sandbox materi-

Sample regulatory sandbox als and/or processes as necessary and in consultation

internal operating guidelines

with the sandbox committee.
• Identify and engage internal and external subject
1.  O P E R AT I O N A L D E S I G N matter experts (e.g., experts on supervision,
A N D A P P L I C AT I O N P H A S E payments, consumer protection, technology) as
Once the regulatory sandbox framework is finalized and necessary to resolve targeted regulatory inquiries
approved, a sandbox committee will publicly invite firms to identified by the sandbox contact person for referral.
apply to participate in the sandbox. In some jurisdictions,
informal but active regulatory engagement with the fintech
ecosystem at this stage has been critical to driving interest 2. S E L E C T I O N P H A S E
in the sandbox and encouraging high-quality applications Once the application phase has closed, a selection com-
from eligible companies. Application phase activities are mittee will begin to review applications of eligible firms to
intended to broadly publicize and promote the sandbox and participate in the sandbox. The committee should agree and
to help potential applicants understand the types of prod- commit to the initial selection criteria before beginning the
ucts, technologies, and business models that are appropriate review process.
for the sandbox.
Committee staffing
Indicative activities and governance considerations
1.1. Develop digital and in-person marketing/communi- 2.1. Identify and invite key internal staff to participate on
cations plans to promote the sandbox. These outreach the review and selection committee.
events should include public and private sessions with 2.2. Engage internal or external resources necessary to sup-
key government, private sector, and development port the committee.
partner stakeholders.
Note: As a practical matter, the need for additional
1.2. Designate sandbox “ambassadors” to engage with the expertise may be evident only after the initial applica-
local fintech and financial inclusion communities and tion review has begun (e.g., if an application proposes
implement the communications and engagement plan. a technology that uses SIM-card-based identity scoring
1.3. Launch the sandbox portal on the regulator’s public that requires technical input from telecommunications
website with links to application materials, frequently experts).
asked questions (FAQs), documentation, and a ded- Selection process
icated email address for submitting inquiries on the 2.3. Collection and preliminary administrative review of
process. applications
1.4. Designate a sandbox contact person to field inqui- An administrative review team will conduct an initial
ries from potential applicants, participate in targeted review of all applications submitted to quickly identify
outreach activities, and document key learnings for and provide an opportunity to remediate any technical or
real-time feedback on the process. Specific activities administrative errors or omissions in the application.
may include the following:
Applicants who have submitted incomplete applications
• Develop FAQs and guidance to reduce ineligible and will be contacted and provided the opportunity to reme-
incomplete applications and encourage high-quality diate administrative or technical omissions, such as failure
and complete submissions. to attach a business plan, provide proof of citizenship, pay
• Develop and maintain a tracking database of application fee, and so forth, to their applications, within a
inbound inquiries. The information captured in prescribed timeframe (3–5 days).
the database may include name of person/company,
product/technology type, product stage, contact
information, and nature of inquiry.

T emplates for S a nd bo x T ea m s 29
The administrative review team will be provided applica- At the end of the selection phase, the selection committee
tion and eligibility checklists to streamline the application will publicly announce the sandbox participants.
review and a form letter (or email) to notify applicants that
have been disqualified based on desktop review.
Sandbox phase
3.1 Testing design
2.4. Preparation of “board books” for review by selection
After participants pay the required sandbox fee, if there is
committee
one, they will be assigned to a sandbox supervisory team
The designated administrative team will organize all com- that will oversee the design, negotiation, and implementa-
pleted applications into an easily reviewable format, which tion of a testing plan and safeguards. The testing plan will
includes a summary document that compares applicants include the following, among other things:
across a variety of metrics. The metrics may include (i)
• A statement of the regulatory hypothesis that will be
summary of business model, (ii) product type, (iii) product/
evaluated through the test.
company stage, (iv) identified partners (if any), and (v)
remaining eligibility criteria. The goal of this summary doc- • Testing outcome metrics or KPIs.
ument is to provide a high-level landscaping of the applicant • Testing methodology.
pool for the selection committee. • Customer acquisition plan.
Board books will be provided to the selection committee • Customer communications, including risk disclosures.
5–7 business days before it convenes to discuss the appli-
• Agreed-upon safeguards (e.g., limited test duration,
cant pool.
security of consumer information, consumer dispute
2.5. Selection of finalists to be interviewed by selection resolution and compensation plans, remediation
committee measures, AML/CFT safeguards).
After individual members have reviewed the application • Specific regulatory requirements, if any, to be relaxed
materials, the selection committee will convene in person during the testing period.
one or more times to discuss the applications and identify • Identification and approval of service partners.
questions that may need further research or diligence. • Plans for exiting or winding down the test in the event
Applicants that are selected to proceed in the process will be of failure or unanticipated risks.
vetted for management fitness via background checks before
• Reporting timelines and content of reports.
they advance to in-person presentations.
2.6. In-person meetings with finalists Participants will be asked to commit to the terms of the
Eligible companies and/or individuals will be invited to testing plan and provide written acknowledgment of the
meet with the selection committee to discuss their proposal various disclaimers set forth in the sandbox framework doc-
in detail and answer any specific questions that may have ument. These may include acknowledgment that sandbox
arisen during the review. participation does not guarantee a license to operate, the
option of either party to terminate the test at any time, and
2.7. Selection and notification of cohort participants (and so forth.
holdovers)
Supervisory teams will present test plans to the sandbox
Following the desktop review, background checks, and committee for review, discussion, and approval before the
in-person interviews, the selection committee will deter- plans are finalized with participants. Among other things,
mine the final cohort participants via committee vote. the committee will seek to coordinate testing methodologies
Eligible applicants will be admitted to the sandbox if the and standards across the cohort and ensure that test plans
selection committee determines that all of the eligibility maintain safeguards, consumer protections/disclosures, and
criteria have been satisfied. remediation plans commensurate with the anticipated level
of risk.
Approved applicants will be notified and provided
with preliminary meeting dates to begin consultations 3.2 Test implementation
with the sandbox supervisory team on test design and Participants will begin their sandbox tests once the test
implementation. plans have been finalized. Depending on the number and

HOW T O BUILD A REGUL ATORY S A NDBOX 30

type of participants in the cohort, testing periods may not Template 4
run contemporaneously.
Sample regulatory sandbox
Supervisory teams will meet with the committee (i) every testing plan template
month to share progress reports and updates from their
respective participant tests and (ii) upon completion or 1. Overview
termination of a test. 1.1 Describe the technology, business model, and use
case to be tested.
Incidents of consumer injury, data breach, fraud, or other
consumer or financial injuries that occur during the test 1.2. Identify the specific regulatory requirements to be
must be immediately reported to the sandbox committee. relaxed or modified to accommodate the test.
1.3. Identify the specific regulatory requirements to be
Cohort exit
evaluated during the test.
Upon completion of the sandbox phase and implementation
of any changes recommended through the sandbox process, 2. Testing plan
the sandbox participants will either (i) go live in the local 2.1 Test objectives and intended outcomes.
market, (ii) continue to develop and modify their solutions
2.2 Anticipated test duration.
off market, or (iii) wind down within the jurisdiction.
2.3 Test methodology.
Supervisory teams will recommend specific regulatory treat-
ment of the sandbox participants based on testing outcomes 2.4 Key metrics and outcome indicators (KPIs).
and performance against the indicators and metrics speci- 2.5 Reporting requirements, including reporting frequency.
fied in the testing plan. Recommendations may include, for 2.6 Control boundaries (e.g., client type and number,
example, approval to operate under current licensing regimes transaction size, and total exposure limit).
or exemption, approval to operate conditioned upon mod-
2.7 Client acquisition plan.
ification of the business model, and prohibition to operate.
The sandbox committee will review and approve or modify 2.8 Client communication plan and templates, including
the recommendations in conjunction with the appropriate sample risk disclosures for the live tests.
supervisory department or agency with jurisdiction. 2.9 Key milestones and timelines.

Procedural review, documentation, 2.10 Exit strategy upon completion or discontinuation of

and regulatory assessment [60 days] the live test.
The sandbox committee, selection committee, and super- 3. Control program and safeguards
visory teams will meet within 30 days after the final
3.1 Develop and commit to core controls and safeguards,
participant has exited the sandbox to identify lessons
including:
learned from the initial cohort. Before this meeting, an
• Limited test duration
external review team will interview all regulatory contrib-
• Data security requirements
utors and participants to gather their impressions of the
• KYC processes
process and solicit recommendations for future sandbox
• AML/CFT safeguards
cohorts. These observations will be summarized and
submitted for review as part of the procedural review and 3.2 Develop measures to monitor and ensure compliance
regulatory assessment process. with the boundary conditions established for the test.

The procedural review and regulatory assessment process 3.3 Develop measures to mitigate risks to and impact on
will identify opportunities, if any, for revising or modi- customers arising from any test failures, including
fying any part of the regulatory sandbox to improve future insurance or compensation programs.
outcomes. The sandbox committee will then determine 3.4 Identify and describe risks that can be managed
whether modifications to the sandbox framework, internal through other test partners, such as regulated finan-
operating procedures, or formal regulatory or licensing cial institutions.
requirements are necessary. Public documentation and/or 3.5 Develop and implement measures to handle client
outreach will follow, as appropriate. inquiries, after-test services, and complaints in a fair
and effective manner.

T emplates for S a nd bo x T ea m s 31
A NNE X 3

SANDBOX SIMUL ATION GUIDANCE

A
SANDBOX SIMULATION IS AN EXERCISE framework, the regulator should use the actual templates
for regulators that are interested in setting up a (e.g., application forms).
regulatory sandbox. Through a series of practical
Step 2. Organize the simulation. The simulation can
case studies based on real or realistic examples, the regulator
be organized as a half-day workshop. The sandbox team
tests (i) the need for a sandbox, its design, and limits and (ii)
should be the primary participant in the simulation. Since
the proposed sandbox framework.
other experts (e.g., legal and regulatory, licensing, supervi-
In the former case, the simulation helps answer: (i) Do we sion experts) from within the regulatory authority should
need a sandbox or do other regulatory tools allow us to cope support the sandbox implementation, they also should
with innovation? (ii) Can we set up a sandbox that would participate.
help address the situations presented in the case studies? (iii)
Step 3. Run the simulation. Present the case studies to
What would the sandbox look like? (iv) Who needs to be
the participants, and ask them to evaluate the case studies.
involved in setting up the sandbox?
Participants can be organized into multiexpert teams.
In the latter case, the simulation helps answer: (i) Does the Ideally, participants first receive an incomplete sandbox
sandbox work or should it be modified? (ii) Are all the pro- application and decide whether they accept it, reject it,
cesses correctly defined? (iii) Do we have enough capacity or seek more information. After that, they receive a full
to implement the sandbox? (iv) Does the sandbox cover all application with detailed information about the innovation
possible scenarios? and planned live test. Participants then decide whether to
accept or reject the application or whether a different action
The sandbox simulation can be conducted internally or
would be more appropriate. For the applications that are
with the help of an external expert. For example, the
accepted, participants draft test plans. Finally, participants
World Bank conducts sandbox simulations as part of its
receive information about test results and decide on a suit-
technical assistance.
able exit option.
Step 4. Evaluate and tweak. Use the simulation results to

How can a regulator conduct a draft and/or adapt the sandbox framework.

regulatory sandbox simulation?

Step 1. Draft case studies. Identify real or realistic exam-
ples of tech-enabled financial innovation at the fringes of
the current legal and regulatory framework. These can
be, for example, fintech companies operating in other
markets or companies that have approached the regulator
with their innovative idea. It is important to identify cases
where enough information is known about the innovation
(i.e., its nature) to craft a granular enough case study.
Three to five case studies should be sufficient. Where the
regulator uses the simulation to test the current sandbox

HOW T O BUILD A REGUL ATORY S A NDBOX 32

GLOSSARY

Innovation: A new technology, product, or business model Regulatory sandbox: A framework set up by a financial
in the financial market. In specific jurisdictions, innovation sector regulator to allow private firms to live test small-scale
likely will be defined more narrowly, but the broad defini- innovations in a controlled environment (operating under a
tion is used in this guide. special exemption, allowance, or other limited time-bound
exception) under the regulator’s supervision (Jeník and
Innovation facilitator: A public sector initiative to engage
Lauer 2017).
with the fintech sector, for example, a regulatory sandbox,
innovation hub, or innovation accelerator (FSB 2017). In Sandbox applicant: An entity that has formally applied for
this guide, the term is used to generally describe regula- testing in a regulatory sandbox.
tory engagement with the marketplace to develop a better
Sandbox graduate: An entity that has exited from a regula-
understanding of practical challenges innovators face when
tory sandbox upon successfully accomplishing the test.
navigating the regulatory environment.
Sandbox participant: A sandbox applicant admitted to a
Innovation hub/office: An innovation facilitator set up
regulatory sandbox for testing.
by a regulator. It provides support, advice, or guidance to
regulated or unregulated firms in navigating the regulatory
framework or identifying supervisory policy or legal issues
and concerns. An innovation hub can take various avatars
depending on the appetite and mandate of the regulator. It
is most often a central contact point to streamline queries
and provide support, advice, and guidance. Support can be
direct or indirect via guidance to the market and generally
does not include testing of products or services (Appaya and
Gradstein 2020).

Glossa r y 33
REFERENCES

Appaya, Sharmista Mandepanda, and Helen Luskin Gradstein. 2020. Duff, Schan. 2017. “Regulatory Sandboxes: Modernizing Digital
“How Regulators Respond to FinTech: Evaluating the Different Financial Regulation.” Washington D.C.: Aspen Institute. https://www.
Approaches—Sandboxes and Beyond.” Washington, D.C.: World Bank. aspeninstitute.org/publications/modernizing-digital-financial-regula-
https://documents.worldbank.org/en/publication/documents-reports/ tion-evolving-role-reglabs-regulatory-stack/
documentdetail/579101587660589857/how-regulators-respond-to-fin-
———. 2018. “A Better Way to Create a Regulatory Sandbox.”
tech-evaluating-the-different-approaches-sandboxes-and-beyond
CGAP blog post, 18 December. https://www.cgap.org/blog/
APRA (Australian Prudential Regulation Authority). 2018. better-way-create-regulatory-sandbox
“Licensing Guidelines for Authorized Deposit-Taking
———. 2019. “A Growing Trend in Financial Regulation: Thematic
Institutions.” Sydney, Australia: APRA. https://www.apra.gov.au/
Sandboxes.” CGAP blog post, 14 February. https://www.cgap.org/blog/
licensing-guidelines-for-authorised-deposit-taking-institutions
growing-trend-financial-regulation-thematic-sandboxes
Bank Negara Malaysia. 2019. “Application Procedures for New Licenses
FCA (U.K. Financial Conduct Authority). 2017. “Regulatory Sandbox
under Financial Services Act 2013 and Islamic Financial Services
Lessons Learned Report.” London: FCA. https://www.fca.org.uk/
Act 2013.” Kuala Lumpur, Malaysia: Bank Negara Malaysia, 27
publications/research/regulatory-sandbox-lessons-learned-report
December. BNM/RH/PD 030-4. https://www.bnm.gov.my/index.
php?ch=57&pg=137&ac=888&bb=file FSB (Financial Stability Board). 2017. “Financial Stability Implications
from FinTech: Supervisory and Regulatory Issues that Merit Authorities
Bank of England. 2016. “New Bank Start-Up Unit.” London: Bank of
Attention.” Basel: FSB. https://www.fsb.org/wp-content/uploads/
England. https://www.bankofengland.co.uk/prudential-regulation/
R270617.pdf
new-bank-start-up-unit
He, Dong, Ross Leckow, Vikram Haksar, Tommaso Mancini-
Bank of Lithuania. 2017. “Newcomer Programme.” Vilnius, Lithuania:
Griffoli, Nigel Jenkinson, Mikari Kashima, Tanai Khiaonarong,
Bank of Lithuania. https://www.lb.lt/en/newcomer-programme
Céline Rochon, and Harvé Tourpe. 2017. “Fintech and
BCBS (Basel Committee for Banking Supervision). 2017. “Sound Financial Services: Initial Considerations.” Washington,
Practices: Implications of Fintech Developments for Banks and Bank D.C.: International Monetary Fund. https://www.imf.org/
Supervisors.” Basel, Switzerland: BCBS. https://www.bis.org/bcbs/publ/ en/Publications/Staff-Discussion-Notes/Issues/2017/06/16/
d431.htm Fintech-and-Financial-Services-Initial-Considerations-44985

BOT (Bank of Thailand). 2020. “The Bank of Thailand Approves Banks Herrera, Diego, and Sonia Vadillo. 2018. “Regulatory Sandboxes in Latin
to Provide Online Cross-bank Identity Verification for Opening Bank America and the Caribbean for the FinTech Ecosystem and the Financial
Accounts in the Regulatory Sandbox.” Press release, 6 February. https:// System.” Washington, D.C.: Inter-American Development Bank. https://
www.bot.or.th/English/PressandSpeeches/Press/2020/Pages/n0663.aspx publications.iadb.org/en/regulatory-sandboxes-latin-america-and-carib-
bean-fintech-ecosystem-and-financial-system
CFPB (U.S. Consumer Financial Protection Bureau). 2017. “No-Action
Letter to Upstart.” Washington, D.C.: CFPB, 14 September. https://files. HKMA (Hong Kong Monetary Authority). 2016. “Fintech Supervisory
consumerfinance.gov/f/documents/201709_cfpb_upstart-no-action- Sandbox (FSS).” Hong Kong: HKMA. https://www.hkma.gov.
letter.pdf hk/eng/key-functions/international-financial-centre/fintech/
fintech-supervisory-sandbox-fss/#cross-sector-fintech-services
Dalberg. 2019. “CGAP Insights: How Do Policy Makers
Learn and Adapt Today?” Washington, D.C.: FinDev Jeník, Ivo, and Kate Lauer. 2017. “Regulatory Sandboxes and Financial
Gateway. https://www.findevgateway.org/paper/2019/06/ Inclusion.” Washington, D.C.: CGAP. https://www.cgap.org/research/
cgap-insights-how-do-policy-makers-learn-and-adapt-today publication/regulatory-sandboxes-and-financial-inclusion

di Castri, Simone, and Ariadne Plaitakis. 2018. “Going Beyond Regulatory Jeník, Ivo, and Sharmista Mandepanda Appaya. 2019a. “CGAP–World
Sandboxes to Enable FinTech Innovation in Emerging Markets.” New Bank: Regulatory Sandbox Global Survey (2019).” Washington, D.C.:
York: BFA Global. https://bfaglobal.com/wp-content/uploads/2020/01/ FinDev Gateway. https://www.findevgateway.org/slide-deck/2019/07/
GOINGBEYONDREGULATORYSANDBOXESTOENABLEFI cgap-world-bank-regulatory-sandbox-global-survey-2019
NTECHINNOVATIONINEMERGINGMARKETS.pdf
———. 2019b. “Running a Sandbox May Cost Over $1M, Survey
Shows” CGAP blog post, 1 August. https://www.cgap.org/blog/
running-sandbox-may-cost-over-1m-survey-shows

HOW T O BUILD A REGUL ATORY S A NDBOX 34

Jeník, Ivo. 2018. “Briefing on Regulatory Sandboxes.” New York:
UNSGSA. https://www.unsgsa.org/files/1915/3141/8033/Sandbox.pdf

Mueller, Jackson, Dan Murphy, and Michael Piwowar. 2019. “Comment

Letter to the Global Financial Innovation Network.” Washington,
D.C.: Milken Institute. https://milkeninstitute.org/reports/
comment-letter-global-financial-innovation-network

Mueller, Jackson. 2017. “FinTech: Considerations on How to Enable

a 21st Century Financial Services Ecosystem.” Washington, D.C.:
Milken Institute. https://milkeninstitute.org/reports/fintech-consider-
ations-how-enable-21st-century-financial-services-ecosystem

Philippon, Thomas. 2017. “The FinTech Opportunity.” Basel: Bank for

International Settlements. https://www.bis.org/publ/work655.htm

Shah, Shrupti, Rachel Brody, and Nick Olson. 2015. “The Regulator
of Tomorrow: Rulemaking and Enforcement in an Era of Exponential
Change.” New York: Deloitte University Press. https://www2.deloitte.
com/tr/en/pages/public-sector/articles/regulatory-agencies-and-tech-
nology.html

UNSGSA (United Nations Secretary-General’s Special Advocate for

Inclusive Finance for Development). 2019. “Early Lessons on Regulatory
Innovations to Enable Inclusive FinTech: Innovation Offices, Regulatory
Sandboxes, and RegTech.” New York: UNSGSA. https://www.unsgsa.
org/files/2915/5016/4448/Early_Lessons_on_Regulatory_Innovations_
to_Enable_Inclusive_FinTech.pdf

Wechsler, Michael, Leon Perlman, and Nora Gurung. 2018. “The

State of Regulatory Sandboxes in Developing Countries.” New
York: Digital Financial Services Observatory at the Columbia
Business School. https://dfsobservatory.com/publication/
state-regulatory-sandboxes-developing-countries

Zetzsche, Dirk A., Ross P. Buckley, Douglas W. Arner, and Janos Nathan
Barberis. 2017. “Regulating a Revolution: From Regulatory Sandboxes
to Smart Regulation.” Frankfurt: European Banking Institute. https://
papers.ssrn.com/sol3/papers.cfm?abstract_id=3018534

Ref er enc es 35
cgap.org