Regulatory Sandbox

Framework
Saudi Central Bank (SAMA)

(Published 2018)
Modified August 2022
Contents
 Introduction 3

 Objectives of the Regulatory Sandbox 3

 Scope of SAMA’s Regulatory Sandbox 4

 Who can apply? 5

 Eligibility Criteria 6

 Types of Exemptions & Waivers 8

 Regulatory Sandbox Lifecycle Stages 9

 Stage 1 - Application Stage 10

 Stage 2 – Operational Readiness Stage 11

 Stage 3 - Testing Stage 12

 Stage 4 - Exiting Stage 13

2|P a g e
Introduction
The Ongoing digitalization of the financial services generate many opportunities to build inclusive and efficient
financial services as well as promoting economic development through fostering innovation and increasing
competitions while managing the associated risk. The Fintech ecosystem is evolving rabidly across the globe
and a number of factors including real-time data availability through API’s, increased smartphone penetration,
comfort and trust in digital transactions all coupled with stable and affordable infrastructure have all
contributed to rapid and significant changes being seen.

As part of ‘Vision 2030’ enablers, SAMA introduced its Regulatory Sandbox environment in early 2018 and
invited companies to apply with new business models and concepts for which there was no regulatory path to
launch to consumers. Having achieved success by contributing to the introduction of several completely new
and amended regulatory frameworks in diverse sectors, SAMA has now refreshed the Regulatory Sandbox
Framework to address the increasing demand being seen in the Saudi market by fintechs and existing regulated
entities with new innovative business models and concepts. This is in line with the Fintech strategy ambitious
agenda, which was approved by the Kingdom Ministerial Council No. “574” in 25th of May 2022 to transform
and inject new energy into the financial sector as well as attract and grow our fintechs ecosystem to be
amongst global leaders.

What is the Regulatory Sandbox?

The Regulatory Sandbox is a live environment that enables financial institutions and fintech companies to test
an innovative financial product and/or service in the market with real consumers within a defined period and
controls.
The Regulatory Sandbox is open throughout the year for applications for Licensed Financial institutions and
Start-ups.

Objectives of SAMA’s Regulatory Sandbox

Strategic Objectives

SAMA’s Regulatory Sandbox directly connects with ‘Vision 2030’, which endeavors to reinforce economic
growth and investment activities. The ‘Vision 2030’ has been further developed into several Executive
Programs, which includes the ‘Financial Sector Development Program’ (FSDP). The FSDP program seeks to
develop the financial industry as a diversified and effective financial services sector to support the
development of the national economy by stimulating savings, finance and investment by, inter alia, enabling
financial institutions to support private sector growth.

3|P a g e
Servicing Objectives

In addition, SAMA’s Regulatory Sandbox aims at delivering a number of direct or indirect benefits to all the
stakeholders:

Consumers Innovators SAMA

Facilitating the introduction of Helping Innovators within the Assess and collect evidence for
new products to the market that: financial services sector to innovative products in order to
 Meet consumers’ demands shorten their time-to-market and draft guidelines and regulations
and needs address legal and licensing for upcoming technologies
 Increases efficiency requirements. utilized in financial services.
 Increases quality of service

SAMA’s Regulatory Sandbox scope:

SAMA’s Regulatory Sandbox is open to:

 Innovators proposing new digital business models or concept: Innovators whose

proposed solution involves a digital business model or concept that is not currently
covered whether explicitly or implicitly under any existing SAMA regulations.
 Innovators proposing non-regulated technology: Innovators whose proposed solution
involves technologies, which are currently, not covered under existing SAMA regulations.

SAMA’s Regulatory Sandbox is not suitable for:

 Solutions that add little or no material value to similar solutions already deployed in the
Kingdom.
 Technologies proposed are not at sufficient stage of maturity.
 Testing plans that are not sufficiently developed: SAMA’s involvement in the finalization
of testing plans is exclusively focused on regulatory matters. Innovators must approach
SAMA with a clear idea about the objectives of their testing plan and how they intend to
achieve those.
In addition, SAMA’s Regulatory Sandbox cannot be used to:
 Circumvent legal and regulatory requirements.
 Test technology not intended to be subsequently deployed in the Kingdom.

4|P a g e
Who can apply to the Regulatory Sandbox?

Regulatory Sandbox applicants can fall into one of the following four categories:

i. SAMA-licensed Innovators: Examples under this category include Banks, Payments, Remittance
Centers, Insurance Groups, and Lending Companies.

ii. Non-licensed local FinTechs / start-ups: Non-licensed firms developing a new FinTech solution with
an ambition to deploy it in the market. Access to the Sandbox can be obtained through one of the
following options:
 Obtaining Regulatory Sandbox Permissions through a Letter of Acceptance.
 Partnering with a fully licensed firm: The party accountable to SAMA for the content of the
application and execution of the testing will be the SAMA-licensed firm. SAMA will investigate
the apportionment of responsibilities between the licensed and non-licensed firms.

iii. Non-licensed international FinTechs: Non-licensed Innovators whom have already launched
oversees or are seeking to make Saudi Arabia their first country of launch can utilize the Regulatory
Sandbox to test their solution. Accessing the Sandbox can therefore be granted using two routes:
 Directly: Innovators can apply directly to the Regulatory Sandbox and upon acceptance; they
register with the Ministry of Investment of Saudi Arabia (MISA) and the Ministry of Commerce
(MoC) as part of the requirements to setup a legal entity within Saudi Arabia.
 Indirectly: Via partnership agreement between the overseas Innovator and a SAMA-licensed
firm. In this case, the latter will be the applicant to the Sandbox and will remain responsible
for the submission of the application and the testing.

5|P a g e
Regulatory Sandbox Eligiblity Criteria:
Innovators that wish to participate within the Regulatory Sandbox environment must meet the Regulatory
Sandbox edibility criteria; there are four key sections of the eligibility criteria:

1. Genuine Innovation & Regulatory Environment.

2. Benefits Stemming from the Idea.

3. MVP & Technology Readiness for Testing.

4. Exiting Plan.

Genuine Innovation & Innovation must demonstrate one of the following are true in regards
Regulatory Environment to its proposed solution:

 Significantly differs from existing offerings in the KSA:

 Innovator provides market research showing that there are
few or no comparable offerings in the KSA.
 Offers a new use for existing technologies deployed in the KSA:
 Innovator produces a comparison of the key features of its
technology or operating methodology against competitors
showing clear differences.
 Represents a significant scale-up in existing technologies deployed
in the KSA.

Benefits stemming for the Innovator must produce sufficient evidence showing that:
idea  The innovation proposed offers an identifiable and direct benefit
or indirect benefits to consumers:
 (Research or simulation that shows potential security
improvement, quality of service, lower prices, or increasing
competition).
 The innovator is able to demonstrate that the innovation has
the potential to improve access to the financial services
markets (i.e. increase financial inclusion).
 It has adequately identified and addressed any risks for consumers
and markets resulting from its proposed innovation
 The innovator is able to produce a comprehensive assessment
of risk that the innovation can directly or indirectly pose to
consumers as well as a mitigation plan to ensure consumers
remain adequately protected throughout the testing.
 The innovator has sufficient resources in place to provide
appropriate redress to consumers if required.

6|P a g e
Regulatory Sandbox Eligiblity Criteria Cont:

MVP & Technology Readiness As part of its application, the Innovator must produce a well-developed
for Testing plan that at minimum contains:

 Timelines for execution including milestones for operational

readiness and testing period:
 Innovator produces a comprehensive operational readiness
and testing plan that identifies key milestones, a timeline, and
likelihood of achieving target outcomes.
 Innovator is able to produce results of previous lab simulations
carried out on its technology proposed.
 Innovator can demonstrate that the resources required to start
testing can be successfully mobilized shortly after receiving SAMA’s
LoA.
 Reporting schedule stating the format and content (e.g. KPIs) of the
report that will be submitted to SAMA throughout the testing:
 Innovator proposes a schedule of periodic reports to be
submitted to SAMA during the test.
 Innovator proposes a clear and sufficient format for those
reports that specifies the key metrics and parameters to be
used and methodology for their analysis.
 Clear methodology of the testing and controls required.

Exiting Plan As part of its exiting strategy the Innovator must include a description
of the future, development and deployment of the solution tested,
including an explanation of:

 Innovator produces an Exit Strategy that clearly identifies the

various possible end games of the testing exercise.
 How it intends to scale-up its innovation to a larger market
should the testing be successful.
 How it intends to ensure that consumers do not suffer
detriment as a result of unsuccessful testing.
 The Innovator’s exiting strategy contains details on the extra-
resources needed to scale-up the technology to serve a larger
market, estimated timescales and, if appropriate, plans to form
strategic alliances with other firms.
 Innovator’s exiting strategy includes adverse scenarios that can
lead it to suspend or cancel the test and a plan to ensure
consumers are placed in the same position as if the test had not
taken place.

7|Page
Types of Exemptions & Waivers
Within the Regulatory Sandbox environment, Innovators may require relaxation/waivers of some of the
usual requirements for license applications to facilitate the experiment phase. Examples of the types of
exemptions and waivers previously granted, along with others, which are unlikely to be granted:

Example of requirements that can be Examples of requirements that are unlikely to be

relaxed/waived relaxed/waived

 License fees  Consumer data protection

 Anti-money laundering and countering the
 Capital and liquidity requirements
financing of terrorism
 Board composition / governance
 Individuals’ fitness and propriety
requirements
 SAMA guidelines (non-requirements)  National and International laws.
 Requirements on consumer disclosures
 Requirements on cyber resilience and cyber
security

NACs are written commitments made by SAMA included in the Innovator’s LoA that it will not take
disciplinary action against the Innovator for the duration of the test for as long as the Innovator
adheres to the conditions and limitations agreed for the testing. SAMA may use NACs in order to
incentivize Innovators to be open and transparent in its dealings with them or where it is not possible
to issue waivers or informal guidance, (e.g. there is a gap in the regulations in relation to the activities
proposed).

NACs can be granted without affecting SAMA’s right to suspend or cancel the test should it identify
consumer detriment. NACs only address the risk of SAMA enforcement action and do not affect the
Innovators’ potential legal liability to consumers.

8|Page
Regulatory Sandbox Lifecycle:
The Sandbox process lifecycle is composed of (4) four stages, which are triggered sequentially and conclude
at the Exiting/graduation stage:

: Application Stage “60 days”

 Innovators complete and submit the application form. Guidance on how to complete the
application form can be found by following this link: “GUIDANCE NOTES ON
COMPLETING THE SAMA REGULATORY SANDBOX APPLICATION FORM”. Thereafter,
SAMA will assess the application form completeness against the “Eligibility Criteria” and
revert to the innovator within the frame of 60 days with the final decision.

: Operational Readiness “120 days”

 The eligible innovators are informed of pre-go live requirements in the form of an Assessment
Criteria (AC), which is based on the business model/concept.

 The Regulatory Sandbox team will provide support in order to finalize the innovators operational
readiness against the communicated AC within a period of 120 days.

 Successful compliance with the AC within the specified period, eligible innovators will obtain the
temporary permission “LoA”

: Testing phase “Up to 12 months”

 Permitted innovators will test their ideas in the Regulatory Sandbox for a minimum period of six
months and up to 12 months.

 Upon successful testing SAMA will have issued and/or amended regulations, which would enable
the Innovator to apply for a full Regulatory License.

: Exit the Sandbox “Graduation”

 Upon successfully accomplishing the objectives of the testing phase, the applicant will be eligible
to graduate and exit the Regulatory Sandbox environment. And follow one of the mentioned paths:

o Apply for a full license and/or amend existing license.

o Executing the exit plan without pursing a license.

o SAMA confirms the product does not require a license/permission.

 More information provided in page 13 (Life cycle stage 4)

9|P a g e
 Regulatory Sandbox Lifecycle

Stage (1) application form:

The objective of the Application Stage is to assess an Innovator’s proposal against the Sandbox Eligibility
Criteria. Innovators will submit their application via the Regulatory Sandbox application form through
Regulatory Sandbox application form

Upon submission of the application, SAMA completes an initial vetting exercise based on the level of
completion of the application pack.

If the application meets all the vetting criteria, SAMA initiates the Assessment of the eligibility criteria. Else,
SAMA will inform the innovator that they are ineligible to participate within the Sandbox environment.

There are (4) four sections to the Stage one Application Form:

A – About Your Business

B – About Your Innovation

C – Minimum Viable Product and Technological Readiness

D – Your Background

Each section on the application form has multiple questions, each requiring sufficient answers (please refer to
the “Guidance Notes” for application support). The objective of the Stage 1 Application is to help SAMA confirm
the business model is viable for the Regulatory Sandbox as well as understand your readiness to commence
operations within the timeframes shown above on page 7.

There are four key sections for the eligibility criteria for considerations (detailed in page 6):

1. Genuine Innovation & Regulatory Environment.

2. Benefits Stemming from the Idea.
3. MVP & Technology Readiness for Testing.
4. Exiting Plan.

As part of its assessment of the eligibility criteria, SAMA may contact the Innovator asking for further
information and/or clarification on the innovation proposed. If the Innovator’s application is deemed to meet
the above eligibility criteria the Innovator is informed that its application has progressed to the Operational
readiness stage within 60 days from the date of submitting the application.

10 | P a g e
 Regulatory Sandbox Lifecycle ....

Stage (2) Operational Readiness:

The Operational Readiness Evaluation Stage has a period of 120 days for Innovators to meet with the
compliance requirements set out in the Regulatory Sandbox Assessment Criteria.

The key objectives of the operational readiness stage is to:

 Work with the Innovator and hold meetings in regular intervals to monitor progress and ensuring
the Assessment Criteria are clearly understood and what format is required for compliance.
(a baseline is provided in the guidance note document)
 Review the progress being made within the Evaluation Stage by the Innovators towards meeting
all the compliance requirements.
 Supporting the Innovators on any 3rd party stakeholder engagement, which may be required.

Once the Regulatory Sandbox team has assessed the innovator met compliance requirements, a Letter of
Acceptance “LoA” (temporary permission) will be issued with guidelines, customers safeguards, operational
parameters and further compliance requirements to be met post commencement of operations.

Safeguards are a set of limitations and conditions that SAMA may ask the Innovator to put in place in order to
ensure an appropriate degree of customer protection, as well as the integrity and soundness of the financial
services market throughout the test.

The measures are bespoke to each test, will depend on the nature of the risks identified, and will be
proportionate to the impact and probability of those risks occurring or causing consumer detriment. Examples
of these are described below although the list is not exhaustive:

 Limitations on the number and type of consumers that will participate in the test.
 Limitations on the type and size of transactions.
 Requirement to carry out system penetration simulations.
 Additional capital requirements such as ring-fencing funds to ensure redress to consumers should the
test result in consumers suffering a financial detriment. Etc.

A list of Innovators, which have a Letter of Acceptance from SAMA, will be published on the
SAMA website under the Regulatory Sandbox section, which can be found at:

Regulatory Sandbox permitted fintechs

11 | P a g e
 Regulatory Sandbox Lifecycle ....

Stage (3) Testing:

Once the innovator obtain the LoA “temporary permission” it can proceed with its testing plan as detailed
and agreed during the Lifecycle Stage (2) and in accordance with the terms contained in the LoA. Innovators
have a minimum of (6) six months and a maximum of (12) twelve months from the receipt date of the LoA to
complete their test.

During the testing stage, the Innovator will provide SAMA with the results of their monitoring activity.

The purpose of the Innovators’ reports is to inform SAMA on the status of its adherence to the terms of the
LoA, as well as to notify them of any non-foreseen events that may impair its ability to complete the test, or
result in consumer detriment.

Throughout the Testing Stage, a member of the relevant Licensing team will be a stakeholder in meetings
between the Regulatory Sandbox team with the Innovator’s team and will also be a recipient of all the
periodic reports submitted by the Innovator. Their role is also to support the Innovator in understanding the
general licensing requirements to ensure the Innovator commences preparation for their licensing
application in an orderly and timely manner. Once SAMA issues the specific regulatory requirements, the
Innovator can complete the full licensing application and/or amend their existing license.

In cases where SAMA believes that the Innovator has failed to adhere to the terms of the LoA, it can request
the Innovator to temporarily discontinue the test until the matters in question are fully clarified. In cases
where SAMA finds indications of potential or actual consumer detriment it can ask the Innovator to
terminate its testing exercise and present an Exiting plan that may include a remediation plan. In this case,
SAMA will communicate to the Innovator that its LoA has been withdrawn.

Similarly, Innovators may encounter unexpected technical or non-technical difficulties beyond their control
that may lead them to suspend the test until these are fully resolved. As a result of that, Innovators may find
themselves in a situation where the test cannot be completed within the dates stated in their LoA. In these
exceptional circumstances, Innovators can submit a written request for an extension of the Testing Stage.
SAMA will look at each case on its own merits.

The Testing Stage would automatically end twelve months from the date of the LoA and it is expected the
Innovator will transition to one of the paths identified in Stage 4 “Exiting the Regulatory Sandbox”.

12 | P a g e
 Regulatory Sandbox Lifecycle

Stage (4) Exit the Regulatory Sandbox:

The outcome of the assessment within the Regulatory Sandbox period is likely to lead to one or a combination
of the following outcomes:

1. A new regulatory framework being developed to include Licensing, Supervision and Enforcement
guidelines
2. Amendments to one or more parts of existing regulatory frameworks.
3. Amendments to one or more existing rules or instructions.
4. Confirmation the business model/concept will not require regulatory approval by SAMA.

Upon that, Innovators’ exiting strategies may vary according to their commercial needs and experience within
the Regulatory Sandbox Testing Stage.

For example, they may choose to:

 Cease business at the end of the Sandbox testing stage;
 Sell and transfer the solution tested to any clients and other SAMA licensed firm;
 Partner up with other SAMA licensed firms in order to reach out a larger target market;
 Deploy their own solution directly to consumers.

: For those Innovators reviewed and accepted by the detriments to customers. There
selecting to deploy their Regulatory Sandbox team. should also be neutral or positive
proposition to the full market, they If the Innovator has chosen outcomes for staff and suppliers
will have applied for a full license not to continue with a full license wherever possible.
and/or amend current license application, during or at the end of
If at any time during the
following the requirements as the testing period, the Innovator
Testing Stage, SAMA has
issued by SAMA. will submit a final report to SAMA
confirmed there is no regulatory
For Path 1, there is a dependency describing:
oversight required for the
on SAMA to have issued guidance
 The overall results of the test Innovators business
in the form of new or updated
so that SAMA can fully assess model/concept, the Innovator can
regulatory frameworks, which
the potential impact of the end their involvement in the
provide details of the specific
technology tested in the Regulatory Sandbox and continue
licensing requirements for the
regulatory environment. with their business operations
business model/concept being
 Details on the Exiting strategy without further periodic reporting
deployed by the Innovator. SAMA
that will be implemented. to SAMA. SAMA will issue a
will aim to provide clarity on the
suitable letter confirming the
licensing requirements within 12 The Innovator must execute their
business model/concept has no
months of any new business Exit Strategy with remediation and
requirements of permission to
model/concept being first safeguards to their registered
operate from SAMA.
customers ensuring there are no

13 | P a g e