Skip to main content
Back Custom print Text Only Rich Text Print / Save as PDF

  • Regulatory Sandbox

    • Introduction

      ​About The Regulatory Sandbox: 

      To understand and assess the impact of new products, services, and technologies on the KSA's financial services (FS) market, and to support the development of the FinTech sector in the Kingdom, the Saudi Central Bank (SAMA) has designed a Regulatory Sandbox that welcomes both local and international firms to test new FinTech solutions in a live environment with a view to deploying successful solutions in the KSA market in the future 

      Description:

       The Regulatory Sandbox is a live testing environment that enables financial institutions and Fintech companies to test new business models and concepts in the market with real consumers within a defined period and controls. The Regulatory Sandbox is open throughout the year for Licensed Financial institutions and Start-ups to submit applications. We will assess your sandbox application against our eligibility criteria as set out in our Regulatory Sandbox Framework Document 

      Strategic Objectives: 

      SAMA's Sandbox directly connects with Saudi Vision 2030, which endeavors to reinforce economic growth and investment activities. The Vision has been further developed into 12 Executive Programs, which include the 'Financial Sector Development Program' (FSDP). The FSDP program seeks to develop the financial industry as a diversified and effective financial services sector to support the development of the national economy by stimulating savings, finance and investment, as one of the Financial Sector Development Program pillars is the FinTech strategy which contributes to facilitating business practices, increasing the percentage of private sector and small and medium enterprises contribution to the economy, attracting foreign direct investment, and developing the digital economy. To achieve this, SAMA's Regulatory Sandbox aims to attract local and International FinTech businesses that are looking to leverage existing or new technology in an innovative way to deliver new financial products or services to the KSA market. The target audience includes, but is not limited to, local and international Start-ups, FinTechs, established financial services firms and professional services companies partnering with or providing support to such businesses.​

    • Guidance Notes on Completing the Sama Regulatory Sandbox Application Form

      • Guidance Notes on SAMA Application Form

        The purpose of the below guidance notes is to assist applicants in completing the application form by providing sufficient and appropriate information that enables SAMA to perform its assessment. The guidance notes also provide applicants with a line-of-sight on the different stages of the Regulatory Sandbox environment.

        Please expect a response from SAMA in relation to the outcome of the application within Sixty (60) business days from the date of submission of the application form.

        Should you be successful in this initial stage of evaluation, SAMA will request additional information as part of its second stage of evaluation. Please refer to Stage 2 for more details.

        Should you have any questions about the Regulatory Sandbox or the application form, please contact us at Sandbox@sama.gov.sa

      • Overview of the Regulatory Sandbox Stages

        SAMA has updated its Regulatory Sandbox operating model and processes to give greater guidance to applicants on the stages and requirements to move between the different Sandbox stages.

        The new operating model gives applicants greater clarity on the different stages, the timeframes for stages and more transparency on the requirements to move from Stage 1 (Application Submission) to Stage 2 (Operational Readiness), and to Stage 3 (Regulatory Sandbox Live Testing).

         

        Stage (1) One: Application Stage “60 business days”

        Stage (2) Two: Operational Readiness “120 days”

        • The eligible innovators are informed of pre-go live requirements in the form of an Assessment Criteria (AC), which is based on the business model/concept.
        • The Regulatory Sandbox team will provide support in order to finalize the innovators operational readiness against the communicated AC through providing clarifications on the requirements.
        • Successful compliance with the AC within the specified period, will result in obtaining the temporary permission “LoA”

        Stage (3) Three: Testing phase “Up to 12 months”

        • Permitted innovators will test their solutions and products in the Regulatory Sandbox for a minimum period of six months and up to 12 months.
        • Upon successful testing SAMA will have issued and/or amended regulations, which would enable the Innovator to apply for a full Regulatory License.

        Stage (4) Four: Exit the Sandbox “Graduation”

        • Upon successfully accomplishing the objectives of the testing phase, the applicant will be eligible to graduate and exit the Regulatory Sandbox environment. And follow one of the mentioned paths: 
          • Apply for a full license and/or amend existing license.
          • Executing the exit plan without pursing a license.
          • SAMA confirms the product does not require a license/permission.

      • Stage 1: Application Form Completion - Initial Stage of Evaluation

        There are four sections to the Stage 1 Application Form:

        A– About Your Business: This section will give information about the company applying to the Regulatory Sandbox.
        B– About Your Innovation: This section will allow to assess the concepts’ suitability for the Regulatory Sandbox versus the other options like the licensing route (regulations are already available and license application can be made) and in some cases, whether the concept falls under SAMA’s regulatory perimeter.
        C–Minimum Viable Product and Technological Readiness: This section will allow to assess the technical readiness (testing MVPs).
        D– Your Background: This section will give information about the team you have formed and their experiences in relation to the Regulatory Sandbox application.

        • A. About Your Business

          • A1 Identification/Contact Details

            1. Please provide point of contact details including name, email and telephone of the company’s representative.

              Your answer should include the name and details of the Senior Executive/Founder or the contact point for communications with SAMA.

            2. Please provide your intended business name.

              Your answer should include the full name of the business/company and the use of any trade names.

            3. Please provide the country of incorporation.

              Your answer should specify the country of incorporation if existing operations exist elsewhere.

            4. Please provide the registered address, telephone and website URL of the business
            5. Your answer should:
              • Include a valid address and telephone number
              • Include the URLs of the business or company's websites, if applicable.
              • Please note that response to this question is optional and will not affect the evaluation of your application.

          • A2 Nature of financial services

            Please provide details as to whether your business belongs in the Financial Services industry and in particular in the: Banking Sector, Money Exchanges, Finance Sector, Payments Sector, Other (please specify)

            Your answer should:

            • Include whether your business belongs in the Financial services industry
            • Determine the sector to which the business belongs, in case the business does not fall under the financial services sectors mentioned above.
            • Please note that response to this question is optional and will not affect the evaluation of your application.

        • B. About Your Innovation

          • B1 Summary of the Idea

            1. Please provide a summary of your innovation.

              Your answer should:

            • Include an outline of the idea and the stage of its development (initial, intermediate, advanced) outlining the reasoning behind this, at the time of the application.

            • Please attach a brief description of the innovation, in the form of a presentation that includes a clear pictorial way that outlines the business model.

               

            1. Please describe what problem the idea is addressing and solving Your answer should:
            • Include a description of the problem and an explanation of how this can be addressed by the innovation.

             

            1. Please describe any benefits and returns of the idea for: consumers, other businesses, economy (quantifiable estimations if applicable)

              Your answer should:

            • Specify the type of benefits and returns of the idea for all stakeholders involved
            •  Include for example improvements in security, access to financial services, customer experience, cost efficiency, operational efficiency, or expansion into new market segments as well as others

            • Include quantifiable estimations of these benefits and returns of the project

               

            1. Please provide an outline of how innovation promotes effective competition

              Your answer should:

            • Include an explanation of how a competitive environment is promoted through the idea

            • Please note that your response to this question is optional and will not affect the evaluation of your application

               

            1. Please provide an outline of how the proposed innovation includes new or emerging technology or uses existing technology in an innovative / novel way

              Your answer should provide details on use of Distributed Ledger Technology, Hyper ledger, AI, ML, etc.

             

            1. Please provide an outline of key similarities and differences between the innovation and other ideas in the market

              Your answer should:

            • Detail key similarities and differences between the idea and other innovations/ideas that are currently in the market
            • Please attach the main similarities and differences between the proposed innovation and other ideas. (If possible).

             

          • B2 Business Plan

            1. Please specify which type of customers your idea is targeting

              Your answer should:

            • Provide details relating to customers that are expected to be targeted by the idea.

            • Specify whether the idea targets individuals, corporations, government, or others (if any).

               

            1. Please specify the size of the total expected customer base (market size)

              Your answer should:

              Provide an approximate numeric value of the expected customer base during the Regulatory Sandbox period.

            2. Please provide an explanation as to the main sources of income to be generated over a period of 3 years.

              Your answer should:

            • Specify which are the main sources of income and how these are expected to be generated.
            • Include an approximate total numeric estimation of the expected income - the value should be expressed in SAR and in the nearest 1,000s.
            • Include stage wise estimates for the testing stage (up to 12 months) and post completing the testing stage (beyond 12 months).
            • Be provided in the textbox using bullet points.

             

          • B3 Risk Management

            1. Please provide an outline of material risks that the innovation could incur, along with how each of these is assessed and mitigated

              Your answer should:

            • Include for example operational, cyber-security, AML, CFT, financial crime, conduct, technology, financial stability and legal risks.
            • It should be provided in a tabular format as provided in the example below.
            Risk AreaRisk DescriptionMitigation Plan
            Operational..........................................................
               

             

            1. Please provide an outline of potential frauds that the innovation could incur, along with how each of these are to be assessed and mitigated

              Your answer should:

            • Include a list of potential frauds that the consumers may be exposed to by using the innovation/solution, along with how each of these are assessed and mitigated.
            • Be provided in a tabular format as provided in the example below
            Potential FraudAssessment MethodMitigation Plan
            Operational..........................................................
               

             

             

          • B4 Genuine Need for Sandbox

            Please describe why you think you need to gain access to the sandbox i.e. why is it essential for your innovation to be tested in a live environment for its full development
            Your answer should include the need for testing the innovation in a live environment, along with how this will lead to the innovation’s full development in the future.

          • B5 Alignment with Vision 2030

            • Please demonstrate as to how the solution acts as an enabler towards any of the initiatives of Vision 2030.

              Your answer should:

              - Include an explanation of how the solution acts as a catalyst for Vision 2030 initiatives.
              - Please refer to the link below for more information and guidance on these initiatives Link: Vision 2030

        • C. Minimum Viable Product and Technological Readiness

          • C1 Readiness for Testing

            1. Do you have a Minimum Viable Product (MVP) ready for testing?

              Your answer should be provided as Yes or No.

            2. Have you integrated with any other entities in their development environment? If so, please provide information on which companies you have integrated with.
            • Your answer should be provided as Yes or No.

            • If the answer is yes, please specify the companies and provide information about them.

               

            1. Please provide a detailed description of three or four testing scenarios outcomes to remove uncertainty, which could be arising from regulatory technology or business model and could not be reasonably or effectively simulated in a test environment. Specifically for each testing scenario, include a detailed description of the following:
            • Testing objectives.
            • A thorough description of tests to be performed is required.
            • Relaxations/Waivers for any regulatory controls requested by SAMA to be used during testing.
            • Associated risks and suggested mitigation plan for each scenario.
            • Respective KRIs and KPIs for each testing need to be outlined as well as reference to threshold limits.
            • Customer Safeguards to be put in place (eg. compensation to customers for any losses etc.)
            • Please attach the testing scenarios (If possible).

          • C2 Partnerships

            Please provide details of the types of companies you expect to integrate with in order to go live and start operational activities in the Regulatory Sandbox.

            Your answer should:

            • Provide details of the following types of companies: other FIs, infrastructure providers, government entities, etc.
            • Outline the ways in which these partners are going to assist towards achieving the testing objectives as these were outlined in Section B1 of the Form.

            • Please note that your response to this question is optional and will not affect the evaluation of your application.

               

          • C3 Exit Strategy

            1. Please provide an exit and transition plan by including possible end-games of tests to be performed and the intended action for each end-game.

              Examples of possible end games are, for example:

            • test/s is/are completed successfully and results support deployment of technology at a larger scale;
            • test/s is/are completed successfully but results do not support the deployment of technology at a larger scale;

            • test(s) has/have to be discontinued due to a technological failure, operational failure, indication of consumer detriment, etc.

               

            1. Please provide evidence of a communications plan that would inform customers with:
            • The duration, boundary conditions and associated risks for participating in the Regulatory Sandbox.

            • Advance notification of the termination or when the proposed financial service can proceed to be deployed on a broader scale

               

            1. Please attach the exit strategy (If possible).

        • D. Your Background

          • D1 Background of the Team

            Please provide professional qualifications and experience of your Team relevant to your application and business model / concept.

            Your answer should:

            • Include the background (including professional qualifications and past experience) of the directors, shareholders, senior management (people responsible for key control functions) and key employees (being the most senior employees responsible for the day to day tasks of the business), as applicable.
            • Please attach the team information in a tabular format as provided below and limited to no more than 5 people.
            NameRoleQualificationsRelevant past experience
                
                

             

          • D2 Year(s) in Operation and Past Achievements

            Please provide the years the applicant has been in existence and any past achievements of the business, if applicable

            Your answer should:

            • If your company has been operating in other countries, please specify where and what the products/services are.
            • Specify the number of years your business/company has been in operation.
            • Use bullet points.
            • Please note that your response to this question is optional and will not affect the evaluation of your application.

          • D3 Access to Funding

            1. Please provide an outline of how the business will be funded until it becomes profitable

              Your answer should:

            • Indicate if you are self-funding, have investors ready or are planning to fund raise.

            • Please attach a summary of how the business will be funded.

               

            1. Please provide an outline of current shareholder structure (if applicable)

              Your answer should:

            • Attach an organogram (diagram) and shareholding structure (excel sheet) detailing all shareholders and their shareholding

               

            1. Please provide a copy of funding commitments evidencing that the business has sufficient access to funding (if applicable)

              Your answer should:

            • Provide a document of commitments provided to the company detailing access to funding.
            • Please attach the document of commitments (if applicable).

          • D4 Focus on Environmental, Social and Governance (ESG)

            • Please specify if the business places focus on any ESG goals.
            • Please note that your response to this question is optional and will not affect the evaluation of your application.

             

      • Stage 2: Operational Readiness

        Once the initial application has been screened and assessed for its suitability for the Regulatory Sandbox, there are two potential outcomes.

        • Outcome 1

          Your application is deemed suitable for the Regulatory Sandbox and you will be given a Regulatory Sandbox initial approval letter to proceed to Stage 2 of the evaluation, which is your readiness for operations.

          The letter will allow you to update/form your company at the Ministry of Commerce as a FinTech and will confirm to other stakeholders that SAMA has approved your Sandbox Concept and you are in the operational readiness stage.

          This letter does not permit you to commence operations.

          As part of the operational readiness stage, the Regulatory Sandbox team will assess your compliance with a number of specific requirements, which are detailed in the Regulatory Sandbox Operational Readiness Assessment Criteria (known as AC). The AC is reviewed and updated periodically, so please ensure you are using the latest version at the time of your completion of Stage 1 and not one which you have sourced from anywhere other than SAMA’s Regulatory Sandbox team or the SAMA website.
          The AC requirements are a list of minimum compliance requirements that FinTechs must meet prior to being permitted to go live with operations and onboarding their clients/customers. The Regulatory Sandbox has a Risk Management Unit consisting of technical resources to assess the Fintech’s compliance with the AC requirements and they will monitor and report completion through the Operational Readiness stage.

          The AC requirements consists of assessment and compliance requirements across:

          i.  Fit and Proper forms and approvals for management
          ii.  Shareholders’ approval
          iii.  Financial Model detailing 3 years projections for income statement, cash flow and balance sheet
          iv.  Strategy & Solution Architecture
          v.  Technology & Cyber Risk Management
          vi.  Governance & Operational Risk Matrix
          vii.  Vulnerability Assessment & Penetration Testing
          viii.  Cybersecurity, Policy, Standards and Processes
          ix.  Scalability Plans
          x.  Data Sovereignty
          xi.  Cyber Response and BCM Plans
          xii. Security monitoring & Incident Management
          xiii. Cybersecurity Regulatory Compliance
          xiv.  Corporate & Manpower Compliance
          xv.  Other SAMA Rules Compliance
          xvi.  Data Privacy Compliance
          xvii.  Functional and Non-Functional Testing
          xviii.  Change & Release Management
          xix. Performance Metrics
          xx. IT/Helpdesk Support

          Once the AC requirements have been met, the Regulatory Sandbox will issue a No Objection Letter for the Fintech to commence operations, which is Regulatory Sandbox Stage 3.

        • Outcome 2

          Your application is deemed unsuitable for the Regulatory Sandbox. Some examples of why your application would not be suitable could be one or a combination of the following:

          • Regulations have been issued for your business model/concept and you should apply directly for a License not for Regulatory Sandbox permissions.
          • Your business model/concept does not fall under the regulatory perimeter of SAMA, but may fall under a different regulatory authority.
          • Your business model/concept does not require regulatory oversight.

          The reasons will be communicated to you at the time you are notified.

    • Regulatory Sandbox Framework

      • Introduction

        The Ongoing digitalization of the financial services generate many opportunities to build inclusive and efficient financial services as well as promoting economic development through fostering innovation and increasing competitions while managing the associated risk. The Fintech ecosystem is evolving rabidly across the globe and a number of factors including real-time data availability through API’s, increased smartphone penetration, comfort and trust in digital transactions all coupled with stable and affordable infrastructure have all contributed to rapid and significant changes being seen.

        As part of ‘Vision 2030’ enablers, Saudi Central Bank introduced its Regulatory Sandbox environment in early 2018 and invited companies to apply with new business models and concepts for which there was no regulatory path to launch to consumers. Having achieved success by contributing to the introduction of several completely new and amended regulatory frameworks in diverse sectors, Saudi Central Bank has now refreshed the Regulatory Sandbox Framework to address the increasing demand being seen in the Saudi market by fintechs and existing regulated entities with new innovative business models and concepts. This is in line with the Fintech strategy ambitious agenda, which was approved by the Kingdom Ministerial Council No. “574” in 25th of May 2022 to transform and inject new energy into the financial sector as well as attract and grow our fintechs ecosystem to be amongst global leaders.

        What is the Regulatory Sandbox?

        The Regulatory Sandbox is a live environment that enables financial institutions and fintech companies to test an innovative financial product and/or service in the market with real consumers within a defined period and controls.

        The Regulatory Sandbox is open throughout the year for applications for Licensed Financial institutions and Start-ups.

      • Objectives of Saudi Central Bank’s Regulatory Sandbox

        Strategic Objectives

        Saudi Central Bank’s Regulatory Sandbox directly connects with ‘Vision 2030’, which endeavors to reinforce economic growth and investment activities. The ‘Vision 2030’ has been further developed into several Executive Programs, which includes the ‘Financial Sector Development Program’ (FSDP). The FSDP program seeks to develop the financial industry as a diversified and effective financial services sector to support the development of the national economy by stimulating savings, finance and investment by, inter alia, enabling financial institutions to support private sector growth.

        Servicing Objectives

        In addition, Saudi Central Bank’s Regulatory Sandbox aims at delivering a number of direct or indirect benefits to all the stakeholders: 

        ConsumersInnovatorsSaudi Central Bank

        Facilitating the introduction of new products to the market that:

        ■ Meet consumers’ demands and needs

        ■ Increases efficiency

        ■ Increases quality of service

        		Helping Innovators within the financial services sector to shorten their time-to-market and address legal and licensing requirements.Assess and collect evidence for innovative products in order to draft guidelines and regulations for upcoming technologies utilized in financial services.

      • Saudi Central Bank’s Regulatory Sandbox Scope

        Saudi Central Bank’s Regulatory Sandbox is open to: 
         
         √Innovators proposing new digital business models or concept: Innovators whose proposed solution involves a digital business model or concept that is not currently covered whether explicitly or implicitly under any existing Saudi Central Bank regulations.
         
         √Innovators proposing non-regulated technology: Innovators whose proposed solution involves technologies, which are currently, not covered under existing Saudi Central Bank regulations.
         
        Saudi Central Bank’s Regulatory Sandbox is not suitable for: 
         
         Solutions that add little or no material value to similar solutions already deployed in the Kingdom.
         
         Technologies proposed are not at sufficient stage of maturity.
         
         Testing plans that are not sufficiently developed: Saudi Central Bank’s involvement in the finalization of testing plans is exclusively focused on regulatory matters. Innovators must approach Saudi Central Bank with a clear idea about the objectives of their testing plan and how they intend to achieve those.
         
          In addition, Saudi Central Bank’s Regulatory Sandbox cannot be used to:
         
           ■Circumvent legal and regulatory requirements.
         
           ■Test technology not intended to be subsequently deployed in the Kingdom.
         

      • Who Can Apply to the Regulatory Sandbox?

        Regulatory Sandbox applicants can fall into one of the following four categories: 
         
        i.Saudi Central Bank-licensed Innovators: Examples under this category include Banks, Payments, Remittance Centers, Insurance Groups, and Lending Companies.
         
        ii.Non-licensed local FinTechs / start-ups: Non-licensed firms developing a new FinTech solution with an ambition to deploy it in the market. Access to the Sandbox can be obtained through one of the following options:
         
          •Obtaining Regulatory Sandbox Permissions through a Letter of Acceptance.
         
          •Partnering with a fully licensed firm: The party accountable to Saudi Central Bank for the content of the application and execution of the testing will be the Saudi Central Bank-licensed firm. Saudi Central Bank will investigate the apportionment of responsibilities between the licensed and non-licensed firms.
         
        iii.Non-licensed international FinTechs: Non-licensed Innovators whom have already launched oversees or are seeking to make Saudi Arabia their first country of launch can utilize the Regulatory Sandbox to test their solution. Accessing the Sandbox can therefore be granted using two routes:
         
          •Directly: Innovators can apply directly to the Regulatory Sandbox and upon acceptance; they register with the Ministry of Investment of Saudi Arabia (MISA) and the Ministry of Commerce (MoC) as part of the requirements to setup a legal entity within Saudi Arabia.
         
          •Indirectly: Via partnership agreement between the overseas Innovator and a Saudi Central Bank-licensed firm. In this case, the latter will be the applicant to the Sandbox and will remain responsible for the submission of the application and the testing.
         

      • Regulatory Sandbox Eligiblity Criteria

        Innovators that wish to participate within the Regulatory Sandbox environment must meet the Regulatory Sandbox edibility criteria; there are four key sections of the eligibility criteria: 
         
        1.Genuine Innovation & Regulatory Environment.
         
        2.Benefits Stemming from the Idea.
         
        3.MVP & Technology Readiness for Testing.
         
        4.Exiting Plan.
         
        Genuine Innovation & Regulatory EnvironmentInnovation must demonstrate one of the following are true in regards to its proposed solution:
         
          ■Significantly differs from existing offerings in the KSA:
           √Innovator provides market research showing that there are few or no comparable offerings in the KSA.
          ■Offers a new use for existing technologies deployed in the KSA:
           √Innovator produces a comparison of the key features of its technology or operating methodology against competitors showing clear differences.
          ■Represents a significant scale-up in existing technologies deployed in the KSA.
         
        Benefits stemming for the ideaInnovator must produce sufficient evidence showing that:
         
          ■The innovation proposed offers an identifiable and direct benefit or indirect benefits to consumers:
           √(Research or simulation that shows potential security improvement, quality of service, lower prices, or increasing competition).
           √The innovator is able to demonstrate that the innovation has the potential to improve access to the financial services markets (i.e. increase financial inclusion).
          ■It has adequately identified and addressed any risks for consumers and markets resulting from its proposed innovation
           √The innovator is able to produce a comprehensive assessment of risk that the innovation can directly or indirectly pose to consumers as well as a mitigation plan to ensure consumers remain adequately protected throughout the testing.
          ■The innovator has sufficient resources in place to provide appropriate redress to consumers if required.
         
        MVP & Technology Readiness for TestingAs part of its application, the Innovator must produce a well-developed plan that at minimum contains:
         
          ■Timelines for execution including milestones for operational readiness and testing period:
           √Innovator produces a comprehensive operational readiness and testing plan that identifies key milestones, a timeline, and likelihood of achieving target outcomes.
          ■Innovator is able to produce results of previous lab simulations carried out on its technology proposed.
          ■Innovator can demonstrate that the resources required to start testing can be successfully mobilized shortly after receiving Saudi Central Bank’s LoA.
          ■Reporting schedule stating the format and content (e.g. KPIs) of the report that will be submitted to Saudi Central Bank throughout the testing:
           √Innovator proposes a schedule of periodic reports to be submitted to Saudi Central Bank during the test.
           √Innovator proposes a clear and sufficient format for those reports that specifies the key metrics and parameters to be used and methodology for their analysis.
          ■Clear methodology of the testing and controls required.
         
        Exiting PlanAs part of its exiting strategy the Innovator must include a description of the future, development and deployment of the solution tested, including an explanation of:
         
          ■Innovator produces an Exit Strategy that clearly identifies the various possible end games of the testing exercise.
           √How it intends to scale-up its innovation to a larger market should the testing be successful.
           √How it intends to ensure that consumers do not suffer detriment as a result of unsuccessful testing.
          ■The Innovator’s exiting strategy contains details on the extra-resources needed to scale-up the technology to serve a larger market, estimated timescales and, if appropriate, plans to form strategic alliances with other firms.
          ■Innovator’s exiting strategy includes adverse scenarios that can lead it to suspend or cancel the test and a plan to ensure consumers are placed in the same position as if the test had not taken place.

      • Types of Exemptions & Waivers

        Within the Regulatory Sandbox environment, Innovators may require relaxation/waivers of some of the usual requirements for license applications to facilitate the experiment phase. Examples of the types of exemptions and waivers previously granted, along with others, which are unlikely to be granted:
         

        Example of requirements that can be relaxed/waivedExamples of requirements that are unlikely to be relaxed/waived

         

        		■License fees

         

        		■Consumer data protection
        ■Capital and liquidity requirements■Anti-money laundering and countering the financing of terrorism
        ■Board composition / governance requirements■Individuals’ fitness and propriety
        ■Saudi Central Bank guidelines (non-requirements)■National and International laws.
           ■Requirements on consumer disclosures
           ■Requirements on cyber resilience and cyber security
         
         
        No Enforcement Action Clause (NAC): 
         
         NACs are written commitments made by Saudi Central Bank included in the Innovator’s LoA that it will not take disciplinary action against the Innovator for the duration of the test for as long as the Innovator adheres to the conditions and limitations agreed for the testing. Saudi Central Bank may use NACs in order to incentivize Innovators to be open and transparent in its dealings with them or where it is not possible to issue waivers or informal guidance, (e.g. there is a gap in the regulations in relation to the activities proposed).
         
         NACs can be granted without affecting Saudi Central Bank’s right to suspend or cancel the test should it identify consumer detriment. NACs only address the risk of Saudi Central Bank enforcement action and do not affect the Innovators’ potential legal liability to consumers.
         

      • Regulatory Sandbox Lifecycle

        The Sandbox process lifecycle is composed of (4) four stages, which are triggered sequentially and conclude at the Exiting/graduation stage: 
         
        Stage (1) One: Application Stage “60 days”
         
         ■Innovators complete and submit the application form. Guidance on how to complete the application form can be found by following this link: “GUIDANCE NOTES ON COMPLETING THE SAUDI CENTRAL BANK REGULATORY SANDBOX APPLICATION FORM”. Thereafter, Saudi Central Bank will assess the application form completeness against the “Eligibility Criteria” and revert to the innovator within the frame of 60 days with the final decision.
         
        Stage (2) Two: Operational Readiness “120 days”
         
         ■The eligible innovators are informed of pre-go live requirements in the form of an Assessment Criteria (AC), which is based on the business model/concept.
         
         ■The Regulatory Sandbox team will provide support in order to finalize the innovators operational readiness against the communicated AC within a period of 120 days.
         
         ■Successful compliance with the AC within the specified period, eligible innovators will obtain the temporary permission “LoA”
         
        Stage (3) Three: Testing phase “Up to 12 months”
         
         ■Permitted innovators will test their ideas in the Regulatory Sandbox for a minimum period of six months and up to 12 months.
         
         ■Upon successful testing Saudi Central Bank will have issued and/or amended regulations, which would enable the Innovator to apply for a full Regulatory License.
         
        Stage (4) Four: Exit the Sandbox “Graduation”
         
         ■Upon successfully accomplishing the objectives of the testing phase, the applicant will be eligible to graduate and exit the Regulatory Sandbox environment. And follow one of the mentioned paths:
         
          oApply for a full license and/or amend existing license.
         
          oExecuting the exit plan without pursuing a license.
         
          oSaudi Central Bank confirms the product does not require a license/permission.
         
         ■More information provided in page 13 (Life cycle stage 4)
         

      • Stage (1) Application form

        The objective of the Application Stage is to assess an Innovator’s proposal against the Sandbox Eligibility Criteria. Innovators will submit their application via the Regulatory Sandbox application form through Regulatory Sandbox application form 
         
        Upon submission of the application, Saudi Central Bank completes an initial vetting exercise based on the level of completion of the application pack. 
         
        If the application meets all the vetting criteria, Saudi Central Bank initiates the Assessment of the eligibility criteria. Else, Saudi Central Bank will inform the innovator that they are ineligible to participate within the Sandbox environment. 
         
        There are (4) four sections to the Stage one Application Form: 
         
         A - About Your Business
         
         B - About Your Innovation
         
         C - Minimum Viable Product and Technological Readiness
         
         D - Your Background
         
        Each section on the application form has multiple questions, each requiring sufficient answers (please refer to the “Guidance Notes” for application support). The objective of the Stage 1 Application is to help Saudi Central Bank confirm the business model is viable for the Regulatory Sandbox as well as understand your readiness to commence operations within the timeframes shown above on page 7. 
         
        There are four key sections for the eligibility criteria for considerations (detailed in page 6): 
         
         1.Genuine Innovation & Regulatory Environment.
         
         2.Benefits Stemming from the Idea.
         
         3.MVP & Technology Readiness for Testing.
         
         4.Exiting Plan.
         
        As part of its assessment of the eligibility criteria, Saudi Central Bank may contact the Innovator asking for further information and/or clarification on the innovation proposed. If the Innovator’s application is deemed to meet the above eligibility criteria the Innovator is informed that its application has progressed to the Operational readiness stage within 60 days from the date of submitting the application. 
         

      • Stage (2) Operational Readiness

        The Operational Readiness Evaluation Stage has a period of 120 days for Innovators to meet with the compliance requirements set out in the Regulatory Sandbox Assessment Criteria. 
         
        The key objectives of the operational readiness stage is to: 
         
         ↘Work with the Innovator and hold meetings in regular intervals to monitor progress and ensuring the Assessment Criteria are clearly understood and what format is required for compliance. (a baseline is provided in the guidance note document)
         
         ↘Review the progress being made within the Evaluation Stage by the Innovators towards meeting all the compliance requirements.
         
         ↘Supporting the Innovators on any 3rd party stakeholder engagement, which may be required.
         
        Once the Regulatory Sandbox team has assessed the innovator met compliance requirements, a Letter of Acceptance “LoA” (temporary permission) will be issued with guidelines, customers safeguards, operational parameters and further compliance requirements to be met post commencement of operations. 
         
        Deployment of Customer Safeguards 
         
        Safeguards are a set of limitations and conditions that Saudi Central Bank may ask the Innovator to put in place in order to ensure an appropriate degree of customer protection, as well as the integrity and soundness of the financial services market throughout the test. 
         
        The measures are bespoke to each test, will depend on the nature of the risks identified, and will be proportionate to the impact and probability of those risks occurring or causing consumer detriment. Examples of these are described below although the list is not exhaustive: 
         
         ■Limitations on the number and type of consumers that will participate in the test.
         
         ■Limitations on the type and size of transactions.
         
         ■Requirement to carry out system penetration simulations.
         
         ■Additional capital requirements such as ring-fencing funds to ensure redress to consumers should the test result in consumers suffering a financial detriment. Etc.
         
          A list of Innovators, which have a Letter of Acceptance from Saudi Central Bank, will be published on the Saudi Central Bank website under the Regulatory Sandbox section, which can be found at:
         
           Regulatory Sandbox permitted fintechs
         

      • Stage (3) Testing

        Once the innovator obtain the LoA “temporary permission” it can proceed with its testing plan as detailed and agreed during the Lifecycle Stage (2) and in accordance with the terms contained in the LoA. Innovators have a minimum of (6) six months and a maximum of (12) twelve months from the receipt date of the LoA to complete their test.

        During the testing stage, the Innovator will provide Saudi Central Bank with the results of their monitoring activity.

        The purpose of the Innovators’ reports is to inform Saudi Central Bank on the status of its adherence to the terms of the LoA, as well as to notify them of any non-foreseen events that may impair its ability to complete the test or result in consumer detriment.

        Throughout the Testing Stage, a member of the relevant Licensing team will be a stakeholder in meetings between the Regulatory Sandbox team with the Innovator’s team and will also be a recipient of all the periodic reports submitted by the Innovator. Their role is also to support the Innovator in understanding the general licensing requirements to ensure the Innovator commences preparation for their licensing application in an orderly and timely manner. Once Saudi Central Bank issues the specific regulatory requirements, the Innovator can complete the full licensing application and/or amend their existing license.

        In cases where Saudi Central Bank believes that the Innovator has failed to adhere to the terms of the LoA, it can request the Innovator to temporarily discontinue the test until the matters in question are fully clarified. In cases where Saudi Central Bank finds indications of potential or actual consumer detriment it can ask the Innovator to terminate its testing exercise and present an Exiting plan that may include a remediation plan. In this case, Saudi Central Bank will communicate to the Innovator that its LoA has been withdrawn.

        Similarly, Innovators may encounter unexpected technical or non-technical difficulties beyond their control that may lead them to suspend the test until these are fully resolved. As a result of that, Innovators may find themselves in a situation where the test cannot be completed within the dates stated in their LoA. In these exceptional circumstances, Innovators can submit a written request for an extension of the Testing Stage. Saudi Central Bank will look at each case on its own merits.

        The Testing Stage would automatically end twelve months from the date of the LoA and it is expected the Innovator will transition to one of the paths identified in Stage 4 “Exiting the Regulatory Sandbox”.

      • Stage (4) Exit the Regulatory Sandbox

        The outcome of the assessment within the Regulatory Sandbox period is likely to lead to one or a combination of the following outcomes: 
         
          1.A new regulatory framework being developed to include Licensing, Supervision and Enforcement guidelines
         
          2.Amendments to one or more parts of existing regulatory frameworks.
         
          3.Amendments to one or more existing rules or instructions.
         
          4.Confirmation the business model/concept will not require regulatory approval by Saudi Central Bank.
         
        Upon that, Innovators’ exiting strategies may vary according to their commercial needs and experience within the Regulatory Sandbox Testing Stage. 
         
         For example, they may choose to:
         
          ■Cease business at the end of the Sandbox testing stage;
         
          ■Sell and transfer the solution tested to any clients and other Saudi Central Bank licensed firm;
         
          ■Partner up with other Saudi Central Bank licensed firms in order to reach out a larger target market;
         
          ■Deploy their own solution directly to consumers.
         
        Exiting the Regulatory Sandbox would be through one of the following (3 three paths: 
         
        Path 1: For those Innovators selecting to deploy their proposition to the full market, they will have applied for a full license and/or amend current license following the requirements as issued by Saudi Central Bank. 
         
        For Path 1, there is a dependency on Saudi Central Bank to have issued guidance in the form of new or updated regulatory frameworks, which provide details of the specific licensing requirements for the business model/concept being deployed by the Innovator. Saudi Central Bank will aim to provide clarity on the licensing requirements within 12 months of any new business model/concept being first reviewed and accepted by the Regulatory Sandbox team. 
         
        Path 2: If the Innovator has chosen not to continue with a full license application, during or at the end of the testing period, the Innovator will submit a final report to Saudi Central Bank describing: 
         
        ↘The overall results of the test so that Saudi Central Bank can fully assess the potential impact of the technology tested in the regulatory environment.
         
        ↘Details on the Exiting strategy that will be implemented.
         
        The Innovator must execute their Exit Strategy with remediation and safeguards to their registered customers ensuring there are no detriments to customers. There should also be neutral or positive outcomes for staff and suppliers wherever possible. 
         
        Path 3: If at any time during the Testing Stage, Saudi Central Bank has confirmed there is no regulatory oversight required for the Innovators business model/concept, the Innovator can end their involvement in the Regulatory Sandbox and continue with their business operations without further periodic reporting to Saudi Central Bank. Saudi Central Bank will issue a suitable letter confirming the business model/concept has no requirements of permission to operate from Saudi Central Bank. 
         

    • Regulatory Sandbox FAQ

      •This Frequently Asked Questions (FAQ) document has been issued to help parties wishing to apply to SAMA’s Regulatory Sandbox.
       
       It aims to provide clarifications to some of the most asked and general questions we receive, from interested parties. The FAQ’s will be reviewed and updated on a regular basis.
       
      •What is the purpose of the Regulatory Sandbox?
       
       The Regulatory Sandbox allows new business models/concepts to be launched into the market for testing in a live environment within predefined parameters, provided that they are not regulated or covered by existing rules..
       
       These parameters includes, but not limited to, the number of clients, volume of transactions, value of transactions, etc...
       
      •What are the benefits of the Regulatory Sandbox?
       
       SAMA seeks to achieve a number of benefits through the Regulatory Sandbox including launching innovative business models/concepts, products, services which are not regulated or covered by existing rules. Besides, it will enable the Regulator to observe, analyze and identify potential risks related to new business models prior to the official launch.
       
      •Which entity is empowered to give consultation to applicants wishing to provide innovated services?
       
       Interested parties should reach out to the Advice Team within SAMA at (sandbox@sama.gov.sa) who can discuss this with you prior to a formal submission.
       
      •How do I apply to the Regulatory Sandbox?
       
       Applicants should use the latest version Regulatory Sandbox Application Form available at the Regulatory Sandbox page on the SAMA website.
       
      •Do I have to submit my application by a specific date?
       
       SAMA’s Regulatory Sandbox has now changed to an Always Open Model. Applicants can prepare their documentation as per the requirements and submit their application at their convenience.
       
      •I have applied to the Regulatory Sandbox previously, can I apply again?
       
       The Regulatory Sandbox will look at new application requests based on the business model/concept being proposed.
       
       Applicants may apply for a new request, given that they have prepared new application
       
      •What exemptions will I receive if I apply to the Regulatory Sandbox?
       
       Each application is looked at on its merits, new products and services. The Regulatory Sandbox Framework document on the SAMA website provides guidance on the types of exemptions that can be considered during the Sandbox testing period.
       
      •There are already regulations available for my proposition; can I still apply to the Regulatory Sandbox?
       
       The Regulatory Sandbox is exclusive for new business models/concept where no regulatory framework or licensing requirements exist. If there is already an exist path to licensing, then applications would not be accepted.
       
      •Can I carry on tests with banks and other financial institutions before acceptance to the Regulatory Sandbox?
       
       Banks and other financial institutions can only allow testing in their development environments with dummy data.
       
       No live data usage or testing in the production environment is permitted for use by any company, which is not permitted by SAMA.
       
      •Once my application is approved, can I launch my products and services in the market?
       
       The Regulatory Sandbox is made up of 3 stages:
       
       Stage 1 - Application,
       
       Stage 2 - Ready to Testing,
       
       Stage 3 - Testing.
       
       Once an application is deemed suitable for the Regulatory Sandbox, the applicant will work closely with the Risk Management Unit to ensure they meet the Assessment Criteria requirements. Once these requirements are met, they will be provided with the Letter of Acceptance (LoA) to commence operations with live customers and data.
       
      •How will I be able to inform customers and other entities that I have been accepted into the Sandbox so we can commence with integration testing?
       
       At application acceptance stage, SAMA will issue a formal No Objection Letter (NOL) to the applicant which can be used as confirmation they have been approved to commence to the Regulatory Sandbox Stage 2 - Operational Readiness. This will give confirmation to relevant parties they may connect their systems with the applicant and commence integration testing into a development environment using dummy data. No access will be granted at this stage to live customer data or the production environment.
       
      •How long can my proposition test with live customers in the Regulatory Sandbox?
       
       The Testing Stage lasts for a minimum period of 6 months and up to 12 months.
       
      •What does successful testing mean?
       
       Each applicant will define testing requirements for their business model/concept.
       
       In addition, SAMA will add requirements, which will include user satisfaction, resilience, stability, scalability amongst others.
       
      •If my testing is successful in the Regulatory Sandbox, will I automatically be granted a full license?
       
       During Stage 2 - Readiness, applicants will be provided a list of general licensing requirements and a high- level roadmap with milestones to work towards during Stage 3 Testing stage.
       
       Once the specific licensing requirements are issued for the new business model/concept, applicants will need to fulfil these requirements and then submit their license application to the relevant functional team at SAMA.
       
       The Licensing Team will then review and assess the application on its merits against the compliance requirements set out in the licensing application.
       
      •At what stage do I apply for a full license?
       
       SAMA expects the licensing process to commence after a minimum period of 6 months and by month 9 of the Testing stage.
       

    • Archive