Regulatory Sandbox

Strict laws apply to banks, insurers, and many technical products. Anyone wanting to bring something new to market must fully comply with these laws right from the start. That makes sense, but it slows down ideas for which there are no suitable rules yet. A regulatory sandbox is the answer to this: a delineated testing space in which a supervisory authority allows a company to trial a product under relaxed conditions. The test runs only for a certain period of time, with few customers, and under constant observation. The name is meant literally: a sandbox in which you’re allowed to build without a collapse hurting anyone.

Why authorities voluntarily suspend rules

Laws emerge slowly, technology develops quickly. When the first payment apps appeared, no existing banking law really fit them. Authorities faced a choice: either ban everything or allow it blindly. The sandbox is a third way: controlled experimentation.

The benefit runs in both directions. The company finds out early whether its idea is legally viable, and doesn’t have to invest millions in a product that might later be banned. The authority, in turn, learns how the new technology actually works. This knowledge feeds into later legislation. You could say the legislator does an internship in the industry it wants to regulate.

Competition between locations also plays a role. Countries with sandboxes are seen as attractive to young technology companies. The United Kingdom launched the first known sandbox for financial technology in 2016, and many countries copied the model. Critics, however, warn of a race to the bottom, in which oversight degenerates into a marketing tool.

What is allowed in the sandbox — and what isn’t

A sandbox is not a law-free zone. Companies must apply and explain what they want to test and why the applicable rules don’t fit. The authority reviews the application and then sets the conditions. Typical is a duration of six to twenty-four months and a cap on the number of participants.

Central to this are the safeguards for customers. They must know that they are taking part in a test. Often the company must set aside money to be able to compensate for damages. Fundamental rights and liability rules continue to apply without restriction. Usually, only reporting, approval, and documentation obligations are relaxed.

At the end there is a report. If the test goes well, the company can apply for regular authorization. If it goes poorly, it is terminated and customers are compensated. It’s important to distinguish this from the real-world lab in the narrower sense: that often involves technical trials in public space, such as autonomous buses on an actual route. The sandbox, by contrast, is first and foremost a legal instrument.

AI Act, fintech, and the limits of the model

The term currently appears mainly in connection with the European Union’s AI law, the AI Act. This law obliges member states to establish at least one sandbox for Artificial Intelligence each by 2026. Small companies are meant to be able to test there free of charge before the strict requirements for high-risk applications kick in. This concerns, for example, systems in healthcare, human resources, or lending.

In the financial sector, the model has been established for longer. Well known are the sandboxes in the United Kingdom, Singapore, and the United Arab Emirates. Among the things tested there were insurance policies concluded via app, and trading venues for digital assets. Germany has so far relied more on case-by-case guidance from the financial supervisory authority BaFin than on a formal sandbox.

In business news, you’ll usually encounter the term in one of two roles. Either an industry association calls for more sandboxes to cut red tape. Or consumer advocates criticize that large corporations receive special privileges while competitors have to comply with all the rules. Another common misconception is that a sandbox is a permanent solution. It is explicitly temporary and does not replace authorization.