Quick answer
A regulatory sandbox is a programme run by a financial regulator that lets firms test new products or business models with real customers, for a limited time and with safeguards. The UK's Financial Conduct Authority, which popularised the idea, opened its sandbox to applications in May 2016[1][2].
Key points
- A sandbox is a controlled, time-limited live test of a new financial product, overseen by a regulator.
- The idea was popularised by the UK's Financial Conduct Authority, which opened its sandbox to applicants in 2016.
- By April 2020, the World Bank counted 73 fintech sandboxes in 57 countries, with tests lasting from two weeks to two years.
- Being in a sandbox is not an endorsement: it is a supervised experiment, and normal consumer protection still matters.
- Sandboxes are resource-intensive for regulators, and the World Bank notes other innovation tools can sometimes work better.
On this page
- Why would a regulator let firms 'play' in a sandbox?
- How does a sandbox test actually work?
- How many sandboxes are there around the world?
- What is the difference between a sandbox and an innovation hub?
- What do newer sandboxes look like?
- Do sandboxes have downsides?
- Where do sandboxes fit in the wider regtech picture?
- FAQ
- Sources
#Why would a regulator let firms 'play' in a sandbox?
Financial rules were written for products that already exist. When a start-up invents something new, such as a new way to pay, lend or hold assets, it can be unclear which rules apply, and getting a full licence before testing anything is slow and expensive. A regulatory sandbox is the regulator's answer: a supervised space where firms can try an idea on real customers, on a small scale, while the regulator watches and learns.
When the UK's Financial Conduct Authority (FCA) opened its sandbox to applications on 9 May 2016, it described it as a 'safe space' in which businesses can test innovative products, services, business models and delivery mechanisms while ensuring that consumers are appropriately protected[1]. The World Bank says the term was popularised by the FCA through its Project Innovate[2].
#How does a sandbox test actually work?
Details differ by country, but the World Bank describes a sandbox as an environment that enables live testing of new products or services in a controlled and time-bound manner, while giving the regulator good oversight[2]. All jurisdictions it studied require limited testing periods, ranging from two weeks to two years[2]. Firms that apply have typically already developed an offering and want to test its viability in the market[2].
The life of a typical sandbox test
Apply
The firm explains the innovation, who it helps and why it needs a live test. The FCA accepts applications at any point in the year.
Agree the test
Regulator and firm set limits such as duration, customer numbers and safeguards.
Test live
Real customers use the product under the agreed conditions while the firm reports back.
Exit
At the end, the firm either gets the permissions it needs to continue, changes the product, or stops.
The FCA lists the support a sandbox firm may receive: a restricted authorisation tailored to the test, signposting to relevant rules, an informal steer (which the firm follows at its own risk), individual guidance on how rules apply to the test, waivers or modifications of rules, and no enforcement action letters that apply only for the duration of the test[3]. Authorised firms, firms seeking authorisation and technology businesses can all apply[3].
| Sandbox can offer | What it means | What it does not mean |
|---|---|---|
| Restricted authorisation | A licence limited to the test | Permission to scale up freely[3] |
| Individual guidance | The regulator explains how its rules apply to this test | General approval of the business |
| Waivers or modifications | Some rules adjusted for the test | Freedom from all rules |
| No enforcement action letter | Comfort during the test period only | Protection after the test ends[3] |
The FCA adds that its sandbox support is not comparable to the services of a compliance consultant[3].
#How many sandboxes are there around the world?
The idea spread fast. A World Bank study of fintech sandboxes analysed 73 sandboxes in 57 countries, using data up to April 2020[2]. In Europe, a joint report by the three European Supervisory Authorities published in January 2019 found that 21 EU member states and 3 EEA states had innovation hubs and 5 EU member states had regulatory sandboxes in operation[4].
Worked example
Worked example: reading the sandbox numbers
Simple ratios from the figures above, computed with code. The last two rows are an invented test plan, used only to show how limits cap risk.
- 73 sandboxes ÷ 57 countries (World Bank)
- ≈ 1.28 sandboxes per country with one
- Longest ÷ shortest test period (2 years = 104 weeks vs 2 weeks)
- 52 times longer
- Hypothetical test: up to 500 customers, each capped at £1,000
- Maximum customer money in the test: £500,000
- Same product launched without limits
- No built-in ceiling on how many people could be affected
#What is the difference between a sandbox and an innovation hub?
Both are what EU supervisors call innovation facilitators[4]. An innovation hub is a contact point where firms can ask the regulator questions about how rules apply to a new idea, without a live test. A sandbox goes further by letting the firm actually serve customers under agreed conditions. That is why hubs are far more common: in the 2019 EU count, hubs outnumbered sandboxes by 24 countries to 5[4].
#What do newer sandboxes look like?
Sandboxes are now built for specific technologies too. The Bank of England and the FCA run the Digital Securities Sandbox, which lets firms use technology such as distributed ledgers to issue, trade and settle securities under a temporarily modified legal and regulatory framework; it opened to applications with a joint policy statement on 30 September 2024, using powers created by the Financial Services and Markets Act 2023[5]. Singapore's central bank offers several routes, including Sandbox Express, a fast-track for activities whose risks are low and well understood, and Sandbox Plus, which adds regulatory support and a financial grant[6]. For the technology behind digital securities, see distributed ledger technology explained.
#Do sandboxes have downsides?
Yes. The World Bank warns that sandboxes are highly resource intensive, that a sandbox in a nascent fintech market may not be cost-efficient for regulators, and that other innovation tools may be more effective in some contexts[2]. Critics also worry that being 'in the sandbox' can be marketed as if it were a seal of approval. The FCA itself says its informal steers are followed at the firm's own risk[3].
Common beginner mistakes about regulatory sandboxes
Reading 'sandbox' as 'approved'
A sandbox is a supervised experiment with limits, not an endorsement of the product.
Thinking sandbox firms ignore the rules
Only specific rules may be waived or modified, for the test only; the rest still apply.
Assuming the test lasts forever
Every sandbox sets a limited testing period, from weeks to about two years.
Confusing a hub with a sandbox
Innovation hubs give guidance; only sandboxes allow live tests with customers.
#Where do sandboxes fit in the wider regtech picture?
Sandboxes are one way regulators keep up with innovation; another is the technology firms use to comply, covered in what is regtech. Many products tested in sandboxes touch open data or new payment methods; see what is open banking and instant payments explained.
The bottom line
A regulatory sandbox is a supervised, time-limited live test that helps new financial products meet the rules and helps regulators understand them. Firms get tailored permissions and guidance, not a free pass, and customers should treat a sandbox product as an experiment. Used well, sandboxes are one of several tools regulators use to let innovation in without letting risk run loose.
Frequently asked questions
Can any company join a regulatory sandbox?
It depends on the regulator. The FCA accepts authorised firms, unauthorised firms seeking authorisation and technology businesses of any size, and applications can be made at any time of year[3].
How long does a sandbox test last?
It is always time-limited. Across the sandboxes the World Bank studied, test periods ranged from two weeks to two years[2].
Is my money protected if I use a product in a sandbox?
Protection depends on the firm's permissions and the test conditions, so check the regulator's register and ask the firm. The FCA's sandbox is designed to keep consumers appropriately protected[1], but that is not the same as a guarantee.
Was the UK sandbox the first?
The World Bank says the FCA popularised the term through Project Innovate, which promoted the sandbox idea in 2016[2].
Sources
- Financial Conduct Authority's regulatory sandbox opens to applications (press release, 9 May 2016) — Financial Conduct Authority, 2016 Primary
- Global Experiences from Regulatory Sandboxes (Fintech Note No. 8) — World Bank Group, 2020 Primary
- Regulatory Sandbox — Financial Conduct Authority, 2026 Primary
- ESAs publish joint report on regulatory sandboxes and innovation hubs — European Securities and Markets Authority (on behalf of the ESAs), 2019 Primary
- Bank of England and FCA joint approach to the Digital Securities Sandbox (policy statement) — Bank of England, 2024 Primary
- Regulatory Sandbox — Monetary Authority of Singapore, 2026 Primary
.jpg){kind=link}
.jpg){kind=link}
.jpg){kind=link}