Regulatory sandboxes: what a small market learns from the first generation

A decade of precedent

The UK Financial Conduct Authority opened its regulatory sandbox in 2016. The Hong Kong Monetary Authority launched its Fintech Supervisory Sandbox on 6 September 2016, open only to banks authorised under the Banking Ordinance. The Australian Securities and Investments Commission consulted in 2016 and introduced its fintech licensing exemption in December 2016, allowing eligible businesses to test specified services for up to 12 months with up to 100 retail clients. The Monetary Authority of Singapore launched its FinTech Regulatory Sandbox in 2016. This count covers the four regimes with documented 2016 launches.

Singapore has since added options. Sandbox Express arrived in 2019 as a faster route for firms testing in pre-defined environments, and Sandbox Plus took effect on 1 January 2022 with wider eligibility. A regime does not stay fixed once it works. It grows new lanes for different risks.

The strongest lesson is a technical one

On 1 August 2023 the FCA made its Digital Sandbox permanent, after awarding NayaOne the tender to build and operate it in April 2023. At launch it offered more than 200 synthetic, public or anonymised data sets and over 1,000 application interfaces to enable testing and validation of technology solutions, including payments and transactions data, social media data and credit data. The point is practical. A firm without real customers is unable to show how its product behaves, and a regulator is unable to ask for evidence it has no place to produce.

A legal waiver without a test environment leaves a gap. A firm is allowed to try, but there is nothing on which to prove its system survives a timeout, an expired consent or a duplicate request. The regimes to copy first are the ones which close this gap.

What Namibia has today

The Bank of Namibia’s FinTech Innovations Regulatory Framework, dated September 2022, runs a four-stage analysis: identification, regulatory status, risk assessment and a decision. The Bank then admits an innovation to Allow-and-See or to the Regulatory Sandbox. The applicant does not choose. The sandbox runs for a minimum of six months and a maximum of eighteen, there are no participation fees, and rules on anti-money laundering are never relaxed. Five outcomes are possible: designation, exemption, a letter of no objection, denial of access, or new or amended regulation. A firm which fails is allowed to reapply six months later.

NAMFISA runs a seven-stage guidance note for its microlending cohort: application, selection, testing agreement, testing and monitoring, progress reports, a final report and exit. Its decision on admission is final, and the guidance note says a successful exit confers no special status.

Both are careful documents. Both describe who decides and what a firm must submit. Neither describes a place to run code against test data or an interface to test against, so a firm still arrives at supervision with a slide deck and a promise.

Design choices which matter more than size

CGAP and the World Bank published a practical guide for policy makers in 2020, written by Ivo Jeník and Schan Duff. It draws on more than thirty frameworks and interviews with regulators, and a 2019 survey of 31 regulators found three to five staff adequate in most cases. The lesson for a small supervisor is clear. Sandbox design is a set of decisions about eligibility, governance, timing, test limits, exit and capacity, and each decision is recorded in policy before it is built.

Our position follows from the comparison. A small market should avoid building three separate technical environments when its supervisors already share products across mandates. It should also keep decision rights with each supervisor, and treat the output of a test as evidence for a decision, never as a licence.

How the two Namibian processes work in detail

The Bank’s framework sets conditions which differ between its two programmes. Allow-and-See runs long enough to produce statistically relevant data, with no limit on the number of customers initially and no transaction or balance limits, though the Financial Intelligence Act and exchange control limits still apply. Security tests are encouraged and not required. The Regulatory Sandbox runs from six to eighteen months, extendable. The number of customers, the transaction limits and the market segment are agreed with the applicant. The applicant must present vulnerability and penetration test reports, with a scope the Bank agrees, where relevant, and must submit monthly progress reports covering indicators, operational and technical incidents with mitigating controls, internal audits, and customer satisfaction or complaints.

Documents matter in the sandbox. Participants submit communications protocols, a marketing plan, a customer complaints and dispute resolution procedure and an exit plan. The Bank bears no liability for the innovator’s operations. It publishes non-confidential information about participants and a list of admitted firms on its website. A firm licensed elsewhere must keep its licence and its good standing throughout, or it is removed. When the programme ends, relaxed requirements expire, and the firm must report on its experience, including incidents and how they were resolved, customer queries and next steps.

NAMFISA applies two tests at selection. The Innovation Test asks whether the product or business model is a true innovation, considering how it differs from what the market already offers. The Net Public Benefit Test asks whether the innovation has a material positive effect on consumers and the public, for example by addressing a current problem, increasing choice, reducing costs or improving experience. NAMFISA treats non-public information from applicants as confidential and proprietary to them, and is permitted to disclose counts of applicants, admissions, refusals and successful and unsuccessful tests. Applicants are responsible for protecting their own intellectual property.

What the comparison does not show

Counting regimes tells a policy maker little about quality. The CGAP guide stresses a sandbox is one tool among several, and alternatives such as innovation offices and licensing exemptions are sometimes better suited. Singapore’s later additions, Sandbox Express in 2019 and Sandbox Plus from 1 January 2022, show a regime adding lanes as evidence arrives, and Australia’s exemption model shows a regime replacing a bespoke process with a standing rule for low-risk cases.

Hong Kong’s sandbox shows a different design choice: it is open only to banks already supervised by the HKMA, so the supervisor is testing the pilots of institutions it already knows. The UK’s digital layer sits alongside, and not inside, its regulatory process. A small market choosing among these models should ask which problem it is trying to solve: admission of newcomers, supervised pilots by incumbents, evidence for rule changes, or a testing place for vendors and banks. The answer decides the design.

What this means for organisations in Namibia

A fintech preparing an application should assemble technical evidence early, even when no regulator requires it: a test plan, a fault list and records showing how the product behaves when a partner fails. This evidence will strengthen any file under the Bank’s framework or NAMFISA’s note.

A supervisor planning a sandbox should read the CGAP guide before drafting policy, and should decide first who owns the technical layer, who pays for it and who sees the evidence.