🇰🇿Regulatory Sandboxes: FCA, MAS, ADGM, DFSA, Lithuania and Kazakhstan

Concept

A regulatory sandbox is a temporary regime in which a regulator lets a firm test a new financial product on real customers before the firm meets every requirement of a full licence. In return the firm accepts the conditions of the test: a limited number of customers and transaction volume, a fixed period, mandatory disclosure of its status to customers and an exit plan in case the test fails.

The earliest of the regimes covered here, the FCA sandbox, opened in May 2016; MAS and ADGM launched theirs the same year. Regulators were facing business models that did not fit existing licences or ran into requirements designed for mature businesses. For the regulator, a sandbox shows the risks of a new product on a small sample. For a founder, it is a way to reach the market earlier and to get the regulator's view on how the rules apply to the model.

Behind the single word sit three different legal constructions, and which one applies in a jurisdiction decides the main practical question: does the sandbox replace the licence at launch.

National sandboxes in the EU operate only on the second model, and in a narrowed form: a national regulator cannot disapply EU-law requirements, including the obligation to obtain a licence before starting the activity. The ESAs' joint report on regulatory sandboxes and innovation hubs states this expressly.

The EU's special regime sits at Union level: Regulation 2022/858, applicable since 23 March 2023, gives DLT market infrastructures a specific permission with exemptions from CSDR and MiFID II, limits on eligible securities and a term of up to six years. It is covered in The EU DLT Pilot Regime.

The overall map of licences is in the Financial Licences hub; what a full licence costs to hold after leaving the sandbox is covered in The Annual Cost of Owning a Financial Licence.

How the path through a sandbox works

The sequence is similar across regulators, and the order of stages is set by their rules. Taking ADGM's RegLab, where the path is described most fully:

1. An application describing the innovation, the test plan, risks to clients and the exit strategy.
2. The regulator identifies which rules are irrelevant to the model and waives or modifies them by notice.
3. A permission for the activity of "Developing Financial Technology Services" is granted, with limits on clients, exposures and geography.
4. The test lasts up to two years; limits can be varied as it progresses.
5. At the end the firm either migrates to the full regime, having shown its test outcomes and fitness and propriety, or executes its exit strategy — closing the business or transferring the product and clients to another licensed firm.

The fifth step is the pivot. A sandbox cannot be extended indefinitely: ADGM extends only in exceptional circumstances and on an application made at least three months before expiry, MAS on an application made at least one month before, and MAS's decision on extension is final. If the firm is not ready for full requirements by the end of the period, the test is discontinued.

A successful exit looks like this: in November 2018 the robo-adviser Sarwa became the first firm to graduate from the DFSA sandbox to full authorisation in the DIFC. The DIFC test typically lasts 12 months, after which the firm either removes its restrictions by meeting all requirements or withdraws its ITL.

Eight regimes on one grid

The regimes differ in three things that decide the outcome: what the firm legally obtains, how long the test lasts and what happens at exit. The first table sets out legal form and duration.

The table shows the split: in the Gulf financial centres and the AIFC the sandbox is itself a licence, in the FCA Regulatory Sandbox and national EU sandboxes it sits on top of a licence, and the DSS, the DLT Pilot Regime and the National Bank regime stand in for permanent rules that do not yet exist.

The second table covers what each regulator is prepared to relax and how many firms have actually gone through. Not all of them publish statistics.

The common conclusion of both tables: relief concerns money and scale. Regulators do not take vetting of owners and managers, AML/CFT or client-asset protection out of the sandbox: MAS expressly lists them among requirements it maintains, and AFSA requires a fit and proper questionnaire from the controllers of a FinTech Lab participant. How regulators vet owners is covered in Qualifying Holdings and Fit & Proper.

The regimes one by one

United Kingdom: Regulatory Sandbox and Digital Securities Sandbox

The FCA sandbox is not regulatory exempt. The FCA names four tools it uses for a test:

• restricted authorisation or registration through a process tailored for sandbox firms, tied to the agreed test;
• individual guidance on how FCA rules apply to the model;
• a waiver or modification of an FCA rule — national and international law cannot be changed this way;
• a no enforcement action letter for the duration of the test, which does not limit liability to consumers.

Applications to the general sandbox are accepted all year; until 2021 the FCA used a cohort model. Selection runs on five criteria: in scope, genuine innovation, consumer benefit, readiness and need for support. Applications to the sandbox and Innovation Pathways rose 49% in 2025.

Alongside it the FCA runs themed cohorts. From 20 applications to the stablecoin cohort it selected four firms — Monee, ReStabilise, Revolut and VVTX — which test within the permissions they already hold. The climate scenarios cohort takes applications from 1 October to 30 November 2026, with testing from the first quarter of 2027 and an average test of six months. AI projects have a separate Supercharged Sandbox with computing infrastructure and datasets.

The Digital Securities Sandbox is a separate Bank of England and FCA regime for digital-securities infrastructure: depositories on distributed ledgers and trading venues. It is divided into gates, with permitted activity growing at each one.

Derivatives and unbacked cryptocurrencies are out of scope. Since 30 June 2026 a firm that has passed Gate 1 may request a modification of the Gate 2 rules to settle in a stablecoin; the Bank of England assesses and approves each such stablecoin individually.

As at 21 September 2026, 16 firms had passed Gate 1, including Euroclear UK & International, HSBC, J.P. Morgan Securities and Tradeweb, and two had been admitted to live activity: HSBC (13 July 2026) and ClearToken (18 September 2026).

The DSS regulations cease to have effect on 8 January 2029; the FCA's "until December 2028" rounds that date, and HM Treasury can extend the regime. The application window is expected to close around March 2027. Interbank settlement of tokenised securities is covered in Wholesale DLT Settlement.

Singapore: Sandbox, Sandbox Express and Sandbox Plus

MAS does not grant a separate sandbox licence: for the duration of the test it relaxes specific requirements that would otherwise apply to the firm, and at exit it requires full compliance. An exemption from licensing is considered case by case. After a rejection a fresh application is possible only after three months.

The Singapore sandbox exists in three variants that differ in speed of entry and flexibility.

Remittance was removed from Express from 7 January 2020, ahead of the Payment Services Act taking effect on 28 January. Express customers must be told that they have no access to the FIDReC dispute-resolution scheme. Sandbox Plus has applied since 1 January 2022: it extended eligibility to early adopters of technology, while the grant is meant only for first movers and not for Express. The full Singapore licence for brokers is covered in CMS Dealing Licence and Financial Adviser's Licence, and for payments in PSA Payment Licences.

UAE: ADGM RegLab and DFSA ITL

Both sandboxes of the UAE financial centres grant a restricted licence, but they treat capital in opposite ways.

The full FSRA, DFSA and VARA licences are compared on the UAE licence map, and fund management in both centres in Fund Management in ADGM and DIFC.

Lithuania: a sandbox within EU law

The Bank of Lithuania opened its sandbox in October 2018 to existing licensees and newcomers: testing in a live environment under supervision with pre-agreed relief. It does not waive EU law: if the product needs a licence under EU law — EMI, payment institution, investment firm — the licence is obtained before the test.

On its sandbox page the Bank of Lithuania documents the test of UAB Workpower's peer-to-peer insurance platform from 24 October 2019 to 23 October 2020. The regulator concluded that the existing licensing requirements would be an unreasonable barrier for such a service and undertook to set conditions proportionate to its risk. For payments and e-money in Lithuania the working route is an ordinary licence, covered in Lithuania: EMI, Payment Institution and Specialised Bank Licences and in EMI in Lithuania or Bulgaria.

Kazakhstan: AIFC FinTech Lab and regulators' special regimes

In the AIFC the sandbox is a two-year FinTech Lab licence with temporary relief from capital, IT-infrastructure and reporting requirements. Its parameters are set by the AIFC Financial Technology Rules and Schedule 8 of the AIFC Fees Rules.

Since 16 February 2026 applicants are assessed in a single stage: business model, proposed candidates, financial and non-financial resources. A participant may offer services only once AFSA is satisfied with its internal controls. In July 2026 AFSA put out for consultation further amendments: admitting existing Authorised Persons to the FinTech Lab without a separate licence and raising per-client and aggregate limits. Comments closed on 15 September 2026. Full AIFC licences are covered in AIFC and Broker Licence in Kazakhstan.

Outside the AIFC, the National Bank's special regulatory regime for digital assets and payment services operates under Board Resolution No. 178 of 11 November 2019. Participants are banks, organisations conducting certain banking operations, payment organisations and other resident legal entities. The applicant proposes the project term, scale and wind-down plan in its business plan, and pilot results feed into legislative change.

Since July 2026 crypto acquiring has run in the National Bank sandbox, as described in Kazakhstan: Financial and Crypto Licences. The ARDFM also introduces special regimes for individual financial-market projects; each one is set by a separate decision of the agency.

When a sandbox replaces the licence at launch

A sandbox saves time and money when three conditions hold together: the regulator grants its own licence or exemption under it, the relief targets what blocks the launch, and the business plan fits within the test limits.

In all three cases the full licence still lies ahead. The sandbox pushes it back by the length of the test and gives live product data instead of a forecast by the time of the application.

When it is an extra loop

A sandbox lengthens the path where an ordinary licence is needed before the test anyway, or where the product fails the innovation filter. The main cases:

Time is the other factor. Where the full licence in the chosen jurisdiction takes a comparable period, the sandbox route means two procedures in a row: admission to the sandbox and then migration to the full regime, with a review of test outcomes and fitness and propriety.