---
title: "Sandbox"
url: "https://mahouse.world/glossary/sandbox"
type: "glossary term"
topic: "Regulation"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-08-06"
---

# Sandbox

A regulatory sandbox is a supervised environment in which a firm tests a regulated financial product with real customers, for a limited time and scale, under requirements the regulator has relaxed or tailored and with the regulator watching closely — a way for a new product to meet the market before its full licence, and for the regulator to learn how the rules fit it. The UK's FCA launched the first in 2016; the EU AI Act mandates AI sandboxes.

**Also known as:** Regulatory sandbox, Innovation sandbox, Sandbox testing, Regulatory pilot

## Key facts

- **Used at:** fintechs with products the existing rules do not fit cleanly — new payment models, digital identity, tokenised assets, AI-driven advice or underwriting — and incumbents testing something new; also, separately, the technical sandboxes (test environments) that payment providers and banks offer developers, which share the name and nothing else
- **Binding:** the sandbox operates within the law — the regulator can waive or modify its own rules and give individual guidance, not disapply statute; participants are usually authorised (with restrictions) or operate under a limited licence; consumer protections, complaints and redress apply in full; the FCA's regime runs continuously since 2021, the EU AI Act requires national AI sandboxes with priority access for SMEs
- **Typical process:** application with a genuine innovation, a consumer benefit, a need for the sandbox, and a plan with safeguards; acceptance (the FCA accepted about a third of applicants in early cohorts); a test of 6–12 months with agreed limits on customers and volumes; regular reporting; an exit — full authorisation, a modified product, or withdrawal
- **Typical benefits:** a named regulator contact, faster authorisation afterwards, informal steers on how rules apply, and credibility with investors and partners; typical costs: the application effort, the restrictions, and the regulator's visibility into everything
- **Parties:** the regulator's innovation unit, the firm, the customers in the test (who must be told), and the partners — banks, schemes — whose willingness to work with a sandbox firm varies

## How a sandbox works in practice

A fintech has built a payments product that does not fit the licence categories: a payment initiation flow combined with a credit decision made by a model, settled through a stablecoin. It applies to the sandbox with a description of the product, the rules it is unsure about, the customer benefit, and a test plan: 2,000 customers, six months, a cap on transaction values, a compensation fund for losses, and clear disclosure that the product is in a test. The regulator accepts, assigns a case officer, grants a restricted authorisation, and agrees which rules are modified — reporting simplified, a capital requirement scaled to the test — and which are not (AML, safeguarding, complaints). The firm tests, reports monthly, and at the end applies for full authorisation with a regulator that already understands the product. Authorisation takes four months instead of twelve.

The limits are the reason sandboxes are less transformative than the 2016 excitement suggested. The regulator cannot waive statute; a product that the law forbids is forbidden in the sandbox. Banks and schemes may decline to partner with a restricted firm. The test is small, so the economics are unproven at the end. And the firm's every design choice has been seen by its regulator, which is a benefit for the firm that wants a relationship and a cost for the one that wanted room. The AI sandboxes under the EU AI Act will test the same trade-off for high-risk AI systems, with the added purpose of generating evidence for the regulators themselves. For a buyer, a target's sandbox history is a positive signal about its regulatory relationship and a caution about how far its product has actually been proven.

For a fintech with a product the rules did not anticipate, the sandbox is the fastest route to a regulator who understands it; for one with a product the rules already cover, it is a slower route to an ordinary licence.

## Example

A fintech offering instalment credit at the point of sale with a model-based decision and no traditional credit check applies to a sandbox in 2024. Test terms: 3,000 customers, a €1,000 cap per loan, six months, monthly reporting on decisions, defaults, complaints and the model's fairness metrics by segment, and a €200,000 compensation fund. The regulator waives two reporting requirements and modifies the affordability-assessment rule to allow the model's method with a manual fallback. Results: 2,600 customers, a 1.9% default rate, four complaints, and fairness metrics within the regulator's tolerance except one segment where the model's approval rate was lower, which the firm fixes with a feature change. Full authorisation follows in five months, with the affordability method approved as tested; a competitor without the sandbox history takes fourteen months and receives a narrower permission.

## Common mistakes

- Applying with a product that fits an existing licence; the sandbox is for what the rules do not cover.
- Expecting exemption from statute; only the regulator's own rules can be modified.
- Underestimating partners' reluctance to work with a restricted firm.
- Reading a successful test as proven economics; the test is small by design.
- Confusing the regulatory sandbox with a provider's technical test environment.

## Related terms

- [Fintech](https://mahouse.world/glossary/fintech.md)
- [PSD2](https://mahouse.world/glossary/psd2.md)
- [RegTech](https://mahouse.world/glossary/regtech.md)
- [E-Money](https://mahouse.world/glossary/e-money.md)
- [SCA Exemption](https://mahouse.world/glossary/sca-exemption.md)
- [AI Alignment](https://mahouse.world/glossary/ai-alignment.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov