Sandbox
Sandbox Conditions Regulation
C 6/2023 Effective from 15/4/20241. Introduction
1-1
One of the Central Bank’s objectives, as mandated by the Central Bank Law is to organise Licensed Financial Activities, establish the foundations for carrying them on, and determine the standards required for developing and promoting prudential practices in accordance with the provisions of the Central Bank Law.
1-2
A regulatory sandbox is a supervisory tool which enables its Participants to test innovative business models, products and services in relation to financial services within a defined space and duration and subject to appropriate regulatory oversight and supervision, to ensure the best outcomes for all stakeholders (the “Regulatory Sandbox”).
1-3
The Sandbox Conditions Regulation lays down the Conditions established by the Central Bank for exempting from the requirement to obtain a Licence all persons who wish to test innovative business models, products and services in relation to Licensed Financial Activities. Such testing will be conducted within a defined space and duration and is subject to appropriate supervision by the Central Bank throughout the testing period, to ensure the best outcomes for all stakeholders. The purpose of these Conditions is to enable a Participant to understand how best to structure its business in a regulatory compliant manner, whilst also enabling the Central Bank to understand the impact of such Participant’s activities on the pursuance of the Central Bank’s objectives, via exercising supervisory tools such as monitoring and oversight.
1-4
The performance of Licensed Financial Activities requires a person to apply to the Central Bank for a Licence to operate as a Licensed Financial Institution. The Conditions provide an alternative route to undertake Licenced Financial Activities on a time-limited basis and subject to the requirements specified herein and any other requirements established by the Central Bank. The Central Bank relies upon its powers in Article (64)(4) of the Central Bank Law to exempt certain activities and practices from the requirement to seek a Licence to carry on or promote Licensed Financial Activities.
1-5
The Conditions are issued pursuant to the powers vested in the Central Bank according to Article (67) of the Central Bank Law.
1-6
In order to ensure appropriate regulation and supervision, the Central Bank will mandate that any successful Applicant to the Regulatory Sandbox meets minimum eligibility criteria and complies with ongoing regulatory and supervisory obligations, and any additional criteria and obligations, as the Central Bank determines, in its sole discretion. Throughout the duration of their participation in the Regulatory Sandbox, Participants will be required to engage with the Central Bank via an assigned case supervisor. This will enable both Participants and the Central Bank to understand the key areas of regulatory impact on the proposed business. At, or towards the end of the duration of the Regulatory Sandbox, Participants will either be subject to a streamlined procedure to obtain a Licence, with assistance from the Central Bank to determine the required enhancements, if any, to their governance, structure, operations, systems and controls, amongst other things; or otherwise be asked to cease all or part of their business depending on the Central Bank’s determination of the business’s impact on the Central Bank’s objectives. Notwithstanding the foregoing, the Central Bank may require any Participant to cease all or part of its business in the Regulatory Sandbox, at any point during its participation in the Regulatory Sandbox.
2. Objective
2-1
The Central Bank aims to create an environment that fosters innovation within a suitable regulatory and supervisory framework, in the development of Licensed Financial Activities. On this basis, the Central Bank aims to apply appropriate regulatory standards for entities conducting Licensed Financial Activities, to protect Consumers of such entities, amongst other objectives. To achieve this objective, the Central Bank will implement channels of engagement with Participants.
2-2
The Regulatory Sandbox acts as an environment that attracts innovators to test innovative products, services, solutions and business models in a controlled space. This is achieved by adopting an approach of ensuring that regulatory requirements are applied to such Participants in a proportionate manner, while at the same time, ensuring that appropriate Consumer protection safeguards are in place.
2-3
The Central Bank envisages that Applicants may include operators (including start-ups and established businesses) and technology businesses that are looking to deliver innovation in the financial services sector.
2-4
The Conditions provide clarity on the criteria for entry into, and rules for participation within the Regulatory Sandbox. The Regulatory Sandbox is intended for entities offering innovative products, services, or solutions which are regulated under the Central Bank’s regulatory regime.
3. Definitions
3-1
For the purposes of this Regulation, words and expressions shall have the usual meaning assigned to them, unless the context otherwise requires, as mentioned below and/or it is defined in other laws and Regulations:
3-2
Applicant: the person making an application to enter the Regulatory Sandbox in accordance with the terms of the Conditions.
3-3
Banks: any juridical person licensed in accordance with the provisions of the Central Bank Law, to primarily carry on the activity of taking deposits, and any other Licensed Financial Activities.
3-4
Board of Directors: the Board of Directors of the Central Bank.
3-5
Central Bank: the Central Bank of the United Arab Emirates.
3-6
Central Bank Law: the Decretal Federal Law No. 14 of 2018 Regarding the Central Bank & Organisation of Financial Institutions and Activities, as amended.
3-7
Conditions: the Sandbox Conditions Regulation issued by the Central Bank.
3-8
Consumer: a customer, being any natural person or juridical person who obtains or may prospectively obtain services by Participants, with or without charge, to satisfy his/her personal need or others’ needs.
3-9
Consumer Protection Regulation: the Consumer Protection Regulation issued by the Central Bank under Circular No. 8/2020, as amended.
3-10
Exemption Right: the right of the Board of Directors to exempt any activities or practices, or exempt natural or juridical persons, either generally or in particular from the prohibition to carry on or promote Licensed Financial Activities.
3-11
Licence: authorisation issued by the Central Bank to conduct Licensed Financial Activities.
3-12
Licensed Financial Activities: the financial activities subject to Central Bank licensing and supervision, which are specified in Article (65) of the Central Bank Law.
3-13
Licensed Financial Institution: Banks and Other Financial Institutions licensed in accordance with the provisions of the Central Bank Law, to carry on a Licensed Financial Activity or more, including those which carry on the whole or a part of their business in compliance with the provisions of Islamic Shari’ah, and are either incorporated inside the State or in other jurisdictions, or have branches, subsidiaries or Representative Offices inside the State.
3-14
Other Financial Institutions: any juridical person, other than Banks, licensed, in accordance with the provisions of the Central Bank Law, to carry on a financial activity or more, of the Licensed Financial Activities.
3-15
Participant: a person whose application to enter the Regulatory Sandbox has been accepted in full by the Central Bank.
3-16
Regulations: any resolution, regulation, circular, rule, standard or notice issued by the Central Bank.
3-17
The State: The United Arab Emirates.
4. Overview
4-1
These Conditions set out the criteria and requirements concerning:
(a)
eligibility, including the scope of permitted activities for entry into the Regulatory Sandbox, which should be met on a continuous basis throughout the duration of participation in the Regulatory Sandbox;
(b)
the application process for entry into the Regulatory Sandbox;
(c)
the minimum safeguards that Participants should satisfy whilst in the Regulatory Sandbox, which may be augmented by the Central Bank on a case-by-case basis; and
(d)
the exit routes and requirements on exit from the Regulatory Sandbox.
4-2
These Conditions clarify the role and powers of the Central Bank in relation to Participants in the Regulatory Sandbox.
5. Regulatory Sandbox Framework
5-1
The Regulatory Sandbox is intended for any persons wishing to conduct testing of their business, products or services which constitute Licensed Financial Activities. The Regulatory Sandbox will not be available for Applicants wishing to conduct the following:
(a)
taking deposits of all types;
(b)
carrying out insurance activities in the State; and
(c)
acting as principal in financial products that affect the financial position of the person, including but not limited to foreign exchange, financial derivatives, bonds and sukuk, equities, commodities, and any other financial products, as determined by the Central Bank.
5-2
Licensed Financial Institutions will not be permitted to participate in the Regulatory Sandbox, and any innovative testing falling outside of such entities’ authorised business activities must be discussed with the Central Bank prior to market deployment.
5-3
The Central Bank will work with the Applicant to evaluate the innovative products, services, solutions or business models to identify legal and regulatory obligations, which will be applied throughout the duration when the Participant is in the Regulatory Sandbox. This will be done on a case-by-case basis. The Central Bank reserves the right to impose restrictions on any Regulatory Sandbox Participant’s activities, or impose additional regulatory compliance obligations, at any time during the Participant’s operation within the Regulatory Sandbox.
5-4
In addition to the Conditions, the Central Bank will exercise the full range of its supervisory powers under the Central Bank Law on all Regulatory Sandbox Participants.
5-5
The Central Bank’s decision to apply additional regulatory compliance obligations will take into account the:
(a)
Participant’s compliance with the requirements set in the ’Safeguards’ section of these Conditions;
(b)
Participant’s demonstrated ability to identify and assess potential risks and define applicable mitigations; and
(c)
Participant meeting the defined eligibility criteria on an ongoing basis.
6. Target Applicant(s)
6-1
The following persons are potential Applicants to the Regulatory Sandbox, provided in each case that they serve the UAE financial services market and/or are citizens of the UAE: (a)
UAE based start-ups or established UAE based companies in any sector, whether or not they are currently regulated by a regulatory authority different from the Central Bank; or (b)
financial free zone companies without prejudice to the applicable legal framework. 7. Eligibility Criteria
7-1
Applicants shall meet the following defined eligibility criteria: (a)
The product, service, solution, or business model shall demonstrate the following: (i)
it shall relate to financial products and/or services that either may impact on the Central Bank’s objectives or otherwise may be a Licensed Financial Activity; (ii)
be innovative, in terms of the technology used in the product, service, solution or business model, or it utilises existing technology in an innovative way; (iii)
benefit for Consumers and/or the financial services industry (such as promoting growth, improving efficiency, mitigating risk, providing more options, encouraging social development, etc.); (iv)
exhibit a genuine need for testing within the Regulatory Sandbox; and (v)
an intention by the Participant to deploy the proposed financial service in the UAE on a broader scale after exiting the Regulatory Sandbox, subject to complying with all regulatory requirements. (b)
The Applicant shall demonstrate that it complies with, and will continue to comply on an on-going basis with, the following:
(i)
appropriate financial soundness requirements as determined by the Central Bank; (ii)
readiness to test the innovation in the live market with real Consumers; (iii)
willingness for market wide deployment of the innovation, post testing; (iv)
possess relevant technical, technological and business knowledge and experience; (v)
have a bank account in a UAE based Bank, if required by the Central Bank depending on the nature of the product, service, or solution being tested; (vi)
its owners, directors, senior officers and any other key person, as determined by the Central Bank, meet such ‘Fit and Proper’ requirements as determined by the Central Bank relating to integrity, competence, financial solvency and legal capacity; and (vii)
written consent must be obtained from the Consumer that states that the Consumer:(i) clearly understands the risks; (ii) has explicitly agreed to participate in the experiment; and (iii) acknowledges that they will not be subject to the Consumer Protection Regulation. The Applicant shall disclose all risks to the Consumer in a clear, fair and not misleading format prior to the Consumer providing its written consent under this paragraph. The risk disclosure shall reference the possible financial risks and all other potential risks that a Consumer could face and shall provide a summary of the regulatory protections the Consumer agrees to forego under the Consumer Protection Regulation. (c)
The Applicant must provide the Central Bank with a written commitment to fully comply with these Conditions and other Central Bank requirements on an ongoing basis. 7-2
The following information shall also be provided with the application: (a)
defined test scenarios and expected outcomes of the proposed Regulatory Sandbox experiment; (b) a comprehensive operational readiness and testing plan that identifies key milestones, a timeline, and likelihood of achieving target outcomes; (c)
defined exit strategy for discontinuation of the product, service, or solution and defined transition strategy for market wide launch of the product, service, or solution; (d)
a structured plan for regular reporting that includes a concise and comprehensive format which shall clearly outline the essential metrics and parameters to be utilised, as well as the methodology for analysing such parameters during the testing process; (e)
defined client acquisition and communication strategy; (f)
a robust wind-down plan; (g)
distinctly identified and assessed potential risks for Consumers and the financial market along with appropriate mitigation strategies; and (h)
the content of clear disclosures on testing objective(s), expectation(s), compensation and potential risks applicable to all Consumers participating in the Regulatory Sandbox. 8. Application Process
8-1
The application process is comprised of three distinct stages: (a)
Preliminary stage; (b)
Evaluation stage; and (c)
Decision stage. 8-2
Applicants that are satisfied they can meet the eligibility criteria must submit their application to the Central Bank’s Regulatory Sandbox team via online channels provided by the Central Bank. Applications must address each of the criteria in 7 and include the information requested in the application form made available to Applicants by the Central Bank. Admission to the Regulatory Sandbox is solely at the discretion of the Central Bank and is on a case by case basis. 8-3
Preliminary stage: the Central Bank will review the application once received and will endeavour to inform the Applicant of its potential suitability for entry to the Regulatory Sandbox within fifteen (15) working days after the Central Bank receives a complete set of information necessary for the assessment. The notification of potential suitability will not constitute approval of the Applicant’s entry into the Regulatory Sandbox. 8-4
Evaluation stage: the Central Bank will engage with the Applicant to determine whether any adjustments should be made to the Applicant’s application. This may also include the Central Bank determining the extent of safeguards that the Applicant must comply with, for which the Applicant must demonstrate how it will comply. The Applicant will then be invited to resubmit their application, as required. The evaluation stage will last no more than twenty-one (21) working days. 8-5
Decision stage: following completion of the evaluation stage, the Central Bank will have a further fifteen (15) working days following resubmission of the application to make a final decision on whether to approve the Applicant for entry into the Regulatory Sandbox. Where the Applicant is informed that its application has been rejected, the Central Bank will provide reasons. A rejected Applicant may reapply within six (6) months provided they have addressed the original reasons for the rejection. 8-6
An Applicant who is approved must notify its Consumers that the financial services or products it is providing are part of the Central Bank’s Regulatory Sandbox. 8-7
Where a Participant intends to make any change(s) relating to any information provided in its application, it must notify and request approval from the Central Bank at least one (1) month before it intends to make such changes along with a copy of the reasons for making such change(s) and the proposed date from which the change(s) will take place (such date to be at least one month after notification to the Central Bank). The Central Bank will review the proposed change and provide its decision within fourteen (14) working days of the date on which the Participant notifies the Central Bank of the proposed change. The Participant may continue operating within its existing approval during such period whilst the Central Bank makes its determination on the proposed change. The Central Bank may request additional information and documentary evidence that supports the requested change. 8-8
For the purpose of transparency and provision of information to Consumers, relevant information of all approved Regulatory Sandbox applications such as the name of the Participant, and the start and expiry date of the testing (to the extent determined by the Central Bank), shall be published on the Central Bank’s website. 9. Safeguards
9-1
As defined by the Central Bank, the fundamental safeguards to mitigate the inherent risks in innovative financial technologies focus on two key areas: Consumer protection and protection of the financial system. 9-2
The Participant shall have the following minimum safeguards in place: (a)
adequate Consumer complaint(s), compensation and dispute resolution mechanisms communicated to the participating Consumer(s); (b)
Consumers’ funds and / or assets shall be segregated from the Participant’s funds and entrusted to banks licensed by the Central Bank through an escrow account arrangement; (c)
adequate data handling, management and protection mechanism; (d)
restrictions on the Consumers that may be served, including the obtaining of express and informed, written Consumer consent as described in 7.1(b)(vii) for any Consumers that are served; (e)
ensuring the on-going fitness and propriety of any individuals connected to the Participant identified in 7.1(b)(vi) and (f)
necessary measures to prevent money laundering and to counter the financing of terrorism in accordance with all applicable anti-money laundering and counter-terrorist financing legislation and regulations. 9-3
The Central Bank shall review the Participant’s ongoing compliance with these safeguards and any other safeguards it requests of the Participant, both on an ad hoc basis and as part of the reporting obligations agreed with the Participant in 12. 10. Exit Routes
10-1
Participation in the Regulatory Sandbox can terminate in two possible scenarios: expiry of the testing period or discontinuation of testing. 10-2
Expiry of the testing period: the Participant shall submit a report to the Central Bank prior to expiry of the testing period. The contents of the report and the timing for submission of the report will be directed by the Central Bank to the Participant. The Participant will have to ensure that the timing of the report submission will not interfere with its activities while it is in the Regulatory Sandbox. The Central Bank will review the report to evaluate whether the Participant can apply to the Central Bank for a Licence for market wide deployment of its product, service or solution. The Central Bank may expedite the Participant’s request to obtain a Licence subject to the Participant, at a minimum, adhering to the following: (a)
comply with all the relevant legal, regulatory and supervisory requirements; (b)
fulfil all its obligations to its Consumers; and (c)
have a defined transition strategy for market wide deployment. 10-3
In the event that the Central Bank does not deem that the Participant is able to apply for a Licence, the Participant shall cease the activity that formed the basis of its Regulatory Sandbox application and must comply with 10.6. 10-4
Discontinuation of testing: the testing can be discontinued either during the testing phase or after its completion, when one of the following are met: (a)
the testing has not achieved its intended purpose, based on, amongst other things, the defined test scenarios, outcomes, and schedules; (b)
the risks of the proposed innovative product or service outweighs the benefits, and these risks cannot be mitigated during the testing phase; (c)
there is an incidence of breach of any of the requirements imposed by the Central Bank; (d)
the Participant decides to exit the Regulatory Sandbox at its own discretion; or (e)
the testing period lapses. 10-5
In all circumstances, the Central Bank can require the Participant to cease providing its services and discontinue its business immediately. The Central Bank will discuss the wind-down mechanics with the Participants. 10-6
The Participant must execute the defined exit strategy upon discontinuation of its participation in the Regulatory Sandbox. This includes, but is not limited to, informing the testing termination to Consumers, fulfilling all its obligations to Consumers (e.g., compensation), reporting to the Central Bank on the implementation of the exit strategy (at such intervals and in such manner agreed with the Central Bank), and securely disposing of Consumer information in accordance with the regulatory requirements. 11. Regulatory Sandbox Duration
11-2
The Regulatory Sandbox testing period may run between six (6) to twelve (12) months. This will facilitate adequate insight for the Central Bank with regard to the innovation and its impact on Consumers and the financial market and enable both the Central Bank and the Participant to understand the viability of the innovation. 11-2
Any extension of the testing period shall be determined only on a case-by-case basis. A Participant must submit a request to the Central Bank with the rationale for an extension no later than thirty (30) calendar days before the expiry of the testing period. 12. Testing and Reporting
12-1
The Participant(s) shall periodically report the testing information. This requires the Participant(s) to document information during the Regulatory Sandbox testing phase and maintain detailed records to support regular reviews by the Central Bank. 12-2
The Participant’s chief executive officer or equivalent shall validate all reports produced by the Participant during the testing period. 12-3
The Central Bank will assist and agree with the Participant in defining the frequency and specific details of the interim reports based on the duration, complexity, scale, and risks associated with the test. 12-4
During the testing phase, the Participant shall submit interim reports to the Central Bank on the testing progress. This may include information such as, but not limited to: (a)
performance indicators, milestones, other statistics; (b)
key issues (e.g. fraud) or operational incident reports; (c)
compliance with regulatory safeguards implemented; and (d)
actions taken to address key issues. 12-5
During the testing stage, a representative from the Licensing team at the Central Bank will participate as a stakeholder in meetings between the Regulatory Sandbox team and the Participant's team. The Licensing team will also receive all periodic reports submitted by the Participant. The Licensing team’s responsibility will be to assist the Participant in comprehending the general licensing requirements and ensuring that they initiate preparations for their licensing application in a well-organized and timely manner, once agreed. Once the Central Bank issues the specific regulatory requirements, the Participant may proceed to complete their full licensing application. The Central Bank may introduce or revise additional criteria on a case-by-case basis. 12-6
On completion of testing activity, the Participant shall submit a report to the Central Bank in accordance with 10.2. 13. Financial Implications
13-1
Participation in the Regulatory Sandbox is not subject to any regulatory fees. 14. Supervision and Examination
14-1
The Central Bank reserves the right to examine the activities of the Participant at any time to ensure adherence to the law and the Conditions set out in this Regulation. 15. Enforcement and Sanctions
15-1
Violation of any provision of the Conditions set out in this Regulation may subject the Participant to supervisory or other action as deemed appropriate by the Central Bank. 16. Interpretation
16-1
The Regulatory Development Department of the Central Bank shall be the reference for interpretation of these Conditions. 17. Publication and Application
17-1
The Conditions shall be published in the Official Gazette and shall come into effect on the date of publication. Khaled Mohamed Balama
Governor of the Central Bank of the UAE