Breadcrumb

Standard Sandbox Journey 2024

 

The Standard Sandbox Journey

The guidance provided in this section intends to provide interested applicants with a better general understanding of the criteria assessed by BNM to determine eligibility for participation in the Standard Sandbox and the overall application process.

Pre-Application Stage

Applicants who are interested to participate in the Standard Sandbox are responsible to adequately demonstrate eligibility in accordance with the criteria specified under Section 6 of BNM’s Regulatory Sandbox Framework. As a simple guidance, an applicant should minimally achieve the following:

BNM’s Regulatory Sandbox is intended as an avenue for BNM to consider granting regulatory flexibilities to facilitate the growth of innovative financial services with genuine value proposition that may otherwise be impeded from doing so due to regulations. As such, it is a necessary condition that regulatory impediments are identified clearly to be eligible for the Standard Sandbox. If an applicant is able to fully comply with existing regulations, it is not necessary to participate in the Standard Sandbox.

First and foremost, applicants should assess if its proposed business model is within the regulatory purview of BNM. The Standard Sandbox cannot provide regulatory flexibilities on requirements that originate from regulations beyond BNM’s regulatory ambit. A general guidance on the scope of activities and entities that are regulated by BNM is provided here.

Applicants are responsible to comprehensively assess the potential legal implications of the services they intend to offer vis-à-vis regulations administered by BNM or other regulators such as the Securities Commission Malaysia (“SC”). It is common practice to engage an appropriate legal consultant to conduct such an assessment where an applicant is not well positioned to do so. In respect of Islamic financial services, applicants must provide an attestation by an appointed Shariah committee or consultant that the proposed solution to be tested is consistent with prevailing Shariah ruling or is in line with Shariah principles in the event that there is no Shariah rulings made in relation to the solution.

For the avoidance of doubt, there is no exclusion for any specific technology to be tested in the Standard Sandbox given that BNM is technology neutral and agnostic. This is provided that the proposed solutions meet the relevant eligibility criteria as outlined in the Framework.

However, BNM understands that financial regulations may sometimes be challenging to navigate, particularly for new business models and fintech start-ups who may have limited experience. As such, applicants who may not have the necessary skills to adequately conduct the assessment on potential regulatory implications will also be provided general guidance on an informal basis.

The Standard Sandbox aims to enable innovative solutions to be deployed and tested in a live environment, within specified parameters and timeframes while catering to the innovation process. As such, rather than requiring upfront evidence on how an applicant’s proposed solution can address market gaps and insufficiencies at the point of application (e.g. completion of proof-of-concept), an applicant is expected to be able to demonstrate a semi-functional prototype within 3 months from the time of application. This at minimum shall meet the following expectations:

  • A medium fidelity level prototype to provide comprehensive and clear description as well as visualisation of the envisioned concept of the proposed solution;
  • May or may not be demonstrated using actual systems, protocols or technologies; and
  • Ability to demonstrate conceptually and clearly envisioned the:
    • User experience and/or customer journey;
    • End-to-end system workflows and all interactive components including systems integration; and
    • Flow of funds between transacting parties, where applicable.

In addition to the above, an applicant is also expected to demonstrate the following:

  • a realistic business plan that outlines the applicant’s readiness, including development timeline, to test the practical feasibility of the applicant’s solution;
  • indicative plans to secure the necessary resources to support the testing in the sandbox; and
  • strategies to operate as a sustainable business and for the deployment of the solution on a commercial scale in Malaysia, beyond the period of testing in the sandbox.

Applicants who are at the early stage of development (i.e. ideation or conceptual stage) in need of guidance may consider engaging our local fintech community (e.g. Fintech Association of Malaysia) and other accredited start-up accelerator programme providers.

The Standard Sandbox aims to provide greater room for applicants to develop and demonstrate their risk management capabilities to ensure proportionality and alignment with the innovation development process. At the eligibility assessment stage, the priority from a risk management standpoint is to ensure that an applicant demonstrates a fundamental ability to identify risks appropriately. Further scrutiny on the applicant’s comprehensive risk assessment and corresponding mitigation measures will instead be undertaken during the preparation stage.

Please refer to the Regulatory Sandbox Framework.

Stage 1: Application

How do I apply? What response can I expect?

Applicants should submit a completed Standard Sandbox Application Form (Appendix II of the Regulatory Sandbox Framework) with relevant supporting documentation, to [email protected]

You should expect to receive an acknowledgment of your application within 1-2 working days.

Your application will be assessed against the eligibility criteria specified under section 6 of the Regulatory Sandbox Framework. This would typically involve several discussions to better understand your proposed business model.

BNM endeavours to provide a decision on your application within 15 working days from the date at which complete information is submitted to BNM.

Stage 2: Preparation

How should I prepare for testing?

Applicants who are eligible for the Standard Sandbox will work with BNM to prepare for live-testing. This will involve detailed discussions on several matters, including:

  • Demonstrating a fully-functional prototype of the proposed solution which shall meet the following expectations:
    • A high-level fidelity prototype to demonstrate readiness of the actual solution to be deployed for the Standard Sandbox;
    • Uses the actual systems, protocols and technologies including from the front-end to the back-end process; and
    • Ability to simulate the actual solution to demonstrate comprehensively and clearly the:
      • User experience/ customer journey
      • End-to-end system workflows and all interactive components including systems integration
      • Flow of funds between transacting parties, where applicable
  • Determining the appropriate testing parameters.
  • Ensuring adequate safeguards and robust risk management are put in place.
  • Setting key performance indicators (KPI) to measure success and failure of the test, including planning for potential next steps after the test.

Applicants who are near live-testing readiness may sometimes be granted a conditional approval to facilitate last-mile preparations before live-testing. Under such an arrangement, an applicant is subject to several requirements and terms of testing that must be complied within a stipulated timeframe before full approval is given.

Stage 3: Live testing

What should I expect during testing?

Applicants who have successfully completed preparations will be given approval to test the solution in the live market within a period not exceeding 12 months. Where necessary, exemptions from relevant regulations will be granted throughout the testing period.

During the live test period, applicants are expected to provide regular reports on the progress of the test. Applicants should also prepare for their next steps after the end of the test.

If the test is unsuccessful, applicants will need to ensure an orderly exit and minimise impact on customers it has acquired during the testing period.

Green Lane Sandbox Journey 2024

The Green Lane Journey

Pre-Application Stage

Applicants who are interested to participate in the Green Lane are responsible to adequately demonstrate eligibility in accordance with the criteria specified under Section 7 of BNM’s Regulatory Sandbox Framework. As a simple guidance, an applicant should minimally achieve the following:

The Green Lane aims to provide a simpler and quicker way for eligible financial institutions to continuously test innovative solutions that face regulatory impediments. As such, an applicant needs to ensure that it falls under the category of a financial institution that is applicable for the Green Lane, which refers to:

  • licensed banks, including licensed digital banks;
  • licensed Islamic banks, including licensed Islamic digital banks;
  • licensed investment banks;
  • prescribed development financial institutions;
  • licensed insurers, including professional reinsurers;
  • licensed takaful operators, including professional retakaful operators;
  • licensed money services business;
  • approved issuers of designated payment instruments; and
  • approved issuers of designated Islamic payment instruments.

Eligible applicants will be assessed by BNM based their risk management, compliance and governance capabilities based on existing track record to determine approval to participate in the Green Lane.

Applicants interested to apply to the Green Lane should have a clear idea of the types of solution that could potentially be tested in the Green Lane. This includes the regulatory impediments concerning the proposed solution as this is a necessary condition to be eligible to test in the Green Lane.

First and foremost, applicants should assess if its proposed business model is within the regulatory purview of BNM. Similar to the Standard Sandbox, the Green Lane cannot provide regulatory flexibilities on requirements that originate from regulations beyond BNM’s regulatory ambit. A general guidance on the scope of activities and entities that are regulated by BNM is provided here.

Applicants are responsible to comprehensively assess the potential legal implications of the services they intend to offer vis-à-vis regulations administered by BNM or other regulators such as the Securities Commission (“SC”). In respect of Islamic financial services, applicants must provide an attestation by an appointed Shariah committee that the proposed solution to be tested is consistent with prevailing Shariah ruling or is in line with Shariah principles in the event that there are no Shariah rulings made in relation to the solution.

For the avoidance of doubt, there is no exclusion for any specific technology to be tested in the Green Lane given that BNM is technology neutral and agnostic. This is provided that the proposed solutions meet the relevant eligibility criteria as outlined in the Framework.

As applicants are able to test more than one solution at any given point in time in the Green Lane, applicants are expected to provide key information of all the proposed solutions to be tested in the Green Lane at the point of application and this includes:

  • A short description of the business model, target segment and planned date for testing of each of the proposed solution
  • A list of potential regulatory impediments concerning each of the proposed solution
  • An assessment of the aggregate cap of expected financial losses for all solutions to be tested supported by an attestation of the applicant’s CEO and CRO.

In addition to the above, applicants must also consider the following:

  • The potential direct financial losses related to its solution that all customers and entities may risk losing and provide appropriate recompense should such a risk materialise.
  • Take practical measures to limit offering its proposed solution to no more than 20,000 unique customers throughout the testing period that shall not exceed 12 months.
Stage 1: Qualification at the institutional level

How do I apply? What response can I expect?

Applicants should submit a completed Green Lane Application Form (Part A of Appendix V of the Regulatory Sandbox Framework) with relevant supporting documentation, to [email protected]

You should expect to receive an acknowledgment of your application within 1-2 working days.

Your application will be assessed against the eligibility criteria specified under section 7 of the Regulatory Sandbox Framework. This would typically involve several discussions to better understand your proposed business model.

BNM endeavours to provide a decision on your application within 20 working days from the date at which complete information is submitted to BNM.

Stage 2: Registration of solutions

How do I register for testing? What response can I expect?

Applicants approved for the Green Lane, known as Green Lane participating institutions, should submit a completed Application Form for Registration of Individual Solution (Part B of Appendix V of the Regulatory Sandbox Framework) with relevant supporting documentation to [email protected]. This should be submitted within 15 working days before planned testing date.

You may register more than one solution to be tested in the Green Lane throughout the year and should expect to receive an acknowledgment of your registration within 1-2 working days.

Where BNM does not express concern or specifically prohibits a solution that has been duly registered within the timeline, you may proceed with the testing of the registered Green Lane project on the planned testing date upon receiving notification from BNM.

Stage 3: Live testing

What to expect during testing?

During the live test period, applicants are expected to provide regular reports on the progress of the test. Applicants should also prepare for their next steps after the end of the test.

If the test is unsuccessful, applicants will need to ensure an orderly exit and minimise impact on customers it has acquired during the testing period.

Sandbox Tips & Myths 2024

Tips and Myths About the Regulatory Sandbox
Tips When Applying to the Regulatory Sandbox
Be thorough in your planning and due diligence. Ensure that your business model is practical and realistic. Make sure you have the necessary resources (e.g. financial resources, human capital) to carry out the test. Conduct an appropriate risk assessment and put in place a reasonable risk management framework. Identify the potential regulatory impediments clearly.
  • Applicants should regard BNM’s Regulatory Sandbox team as your partners when discussing your participation and journey in the Regulatory Sandbox.
  • Applicants are encouraged to support your application with as much information as possible on key areas required in the application form. Withholding information from the Sandbox team will slow down the assessment process and cause unnecessary delays in processing an application.
  • Avoid using a marketing pitch styled language as they add little value to the assessment of an application. Be factual, accurate and detailed in describing your business model.
  • Ideally, you should include a detailed process flow diagram in your application. That will be helpful for the Regulatory Sandbox team to better understand your business model.
  • Describe the key value propositions of your business model from a customer’s perspective.
Common Misconceptions About the Regulatory Sandbox
Approval to test in the Regulatory Sandbox may be viewed as a ‘learner’s permit’. A full licence or approval is not necessarily guaranteed after the test and will be subject to meeting full requirements of the applicable licensing, approval or registration criteria under the FSA, IFSA and MSBA, as the case may be.
The most common reasons applicants are not eligible for the Regulatory Sandbox are as follows:
  • Applicant did not clearly identify regulatory impediments
  • Applicant wrongly identified regulatory impediments, such as specifying regulations that are outside BNM’s purview
  • Applicant did not demonstrate a clear value proposition.
  • Applicant is not at an adequate state of readiness. Some applicants are at an ideation stage and has yet to determine commercial feasibility of their business model
  • Applicant did not show basic risk management awareness and capability
  • BNM endeavours to provide a response within 15 working days upon receiving complete information from an applicant interested to apply in the Standard Sandbox, and 30 working days upon receiving complete information from an applicant interested to apply in the Green Lane.
  • Most applicants are not at a sufficient state of readiness to test in the Regulatory Sandbox at the time of application. Often, information that are required for assessment may not be readily available.

Sandbox FAQ 2024-02-29

Sandbox FAQs 

Early Stages

The Regulatory Sandbox Framework is introduced to encourage innovation and the delivery of financial services by granting regulatory flexibilities for solutions with genuine value proposition to be experimented in a production or live environment. Such flexibilities will be accompanied by appropriate safeguards to preserve financial stability and fair treatment to consumers.

Read more about the Sandbox here

Interested applicants may refer to the table below to determine their eligibility for the Standard Sandbox and Green Lane.

The Regulatory Sandbox is open to all regulated entities of BNM and fintech companies including those without any existing presence in Malaysia, but are interested to offer their services in the Malaysian market.

There is no strict limit to the number of participants in Regulatory Sandbox, BNM will consider the number of participants that can be effectively supported at any given time.

No, the Sandbox is also open to all fintech companies. However, fintech companies that collaborate with FIs could gain added advantages from guidance and support provided by a partner FI.

No, at this juncture the Green Lane is only applicable to financial institutions as defined in paragraph 5.2 of the Framework. This is given that the Green Lane assessment is primarily based on an applicant’s past record of compliance, which is not applicable to a fintech company.

However, a fintech company may participate in the Green Lane by way of partnership with a financial institution where the financial institution must initiate the application, own the solution to be tested and be accountable for the safeguards.

Alternatively, a fintech company can also opt to apply to the Standard Sandbox for standalone applications, which has been simplified to better cater to a fintech solution innovation cycle.

The Sandbox team can be contacted via email at [email protected]

Pre-Application

Standard Sandbox

  • You should expect to receive an acknowledgment of your application within 1-2 working days.
  • Your application will be assessed against the eligibility criteria specified under section 6 of the Regulatory Sandbox Framework. This would typically involve several discussions to better understand your proposed business model.
  • BNM endeavours to provide a decision on your application within 15 working days from the date at which complete information is submitted to BNM.
  • The pace at which you progress through the application stage is dependent on the completeness of information you provide and your readiness to test the solution in a live environment.

Green Lane

  • You should expect to receive an acknowledgment of your application within 1-2 working days.
  • Your application will be assessed against the eligibility criteria specified under section 7 of the Regulatory Sandbox Framework.
  • BNM endeavours to provide a decision on your application within 30 working days from the date at which complete information is submitted to BNM.
  • The pace at which you progress through the application stage is dependent on the completeness of information you provide.

You should refer to the application guidance here for further information.

You may refer to the Regulations page for a comprehensive list of regulated activities.

Financial institutions are subjected to prior written approval of BNM in accordance with sections 14, 15 and 16 of the Financial Services Act 2013 and the Islamic Financial Services Act 2013 in order to carry on an Islamic financial business. This includes any collaboration or partnership with fintech companies to offer solutions for Islamic financial services via the Regulatory Sandbox.

You may direct your query to [email protected].

Application

Standard Sandbox: You can download the Sandbox Application Form and email it to [email protected]

Green Lane: You can download the Green Lane Application Form and email it to [email protected]

Before you submit your application, you should ensure that you have read and understood the application guidance here in detail.

Standard Sandbox

Your application will be assessed against the eligibility criteria specified under section 5 of the Regulatory Sandbox Framework. This would typically involve several discussions to better understand your proposed business model. You should refer to the application guidance here for further information.

Green Lane

Your application will be assessed against the eligibility criteria specified under section 7 of the Regulatory Sandbox Framework. You should refer to the application guidance here for further information.

BNM expects all applicants to be adequately capitalised for the business it undertakes, with adequacy typically guided by BNM's existing risk-based capital requirements, where relevant. Nevertheless, the specific regulatory treatment and flexibilities may be calibrated on a case-by-case basis, based on merits of the application.

Compliance with RMiT PD during live testing does not form part of the criteria for both the Regulatory Sandbox approval. Notwithstanding, there are non-negotiable safeguards for cyber and technology risk that form baseline requirements for all proposed solutions in the Regulatory Sandbox. These requirements will be set on a case-by-case basis depending on the proposed solutions. Generally, these include, but are not limited to, the following:

  • customer data confidentiality and information security;
  • comprehensive penetration testing by accredited third party on applicants’ internal and external facing applications and network infrastructures; and
  • high availability and scalability of cloud infrastructures, if any, including strong recovery, resumption capabilities and retained ownership, control and management of all data pertaining to customer and counterparty information, proprietary data and services hosted on the cloud.

Notwithstanding, upon graduation from the Regulatory Sandbox or scaling up prior to wider commercial launch, participants will be expected to conduct a comprehensive RMiT compliance gap assessment and indicate efforts as well as action plans to address identified gaps.

An applicant with proposed solutions for Islamic financial services involving straight forward Shariah contracts that are within the existing Shariah ruling are required to submit information to BNM covering:

  •  
  • product description, including name and features;
  • product structure, including transaction flows;
  • types of Shariah contract(s) used; and
  • assessment of compliance against the relevant SAC ruling and/or Shariah requirements relating to the product structure;

Yes. For a proposed solution for Islamic financial services where there is no existing Shariah rulings, BNM may consider allowing it to be tested in the sandbox subject to the applicant demonstrating the following:

Standard Sandbox

  • In Stage 1, a clear business plan and timeline for Shariah committee/ consultants to be appointed in order to deliberate and issue a ruling on areas without existing Shariah ruling, supported by solid justifications and rationales; and
  • In Stage 2, an attestation by the appointed Shariah committee/ consultants that the proposed solution is in line with Shariah principles, supported by accurate and detailed documentations on minutes of meeting with Shariah committee/ Shariah consultants, which include, among others, records of decisions or advice, key deliberations, rationale for each decision or advice made, and any significant concerns and dissenting views. The attestation and supporting documentations may also be provided early to the Bank during Stage 1, if available.

Green Lane

  • An attestation by the participating financial institution’s Shariah Committee that the new solution to be tested is in line with Shariah principles. Similar to the Standard Sandbox, this shall be supported by accurate and detailed documentations on minutes of Shariah committee meetings, which record the decisions or advice, the key deliberations, rationale for each decision or advice made, and any significant concerns and dissenting views.

Notwithstanding the above, the Bank will not consider an application if the proposed solution for Islamic financial services is deemed in contravention to any existing Shariah ruling.

Fintech companies may consult an accredited Shariah advisory firm or qualified Muslim individuals (either Malaysian or non-Malaysian) who possess relevant qualifications, skills, knowledge and experience as Shariah consultants. For the appointment of an individual as a consultant, fintech companies shall assess whether the person fulfils the following:

  • is a Muslim individual;
  • has been assessed to have met the requirements specified in the policy document on Fit and Proper Criteria on a continuous basis;
  • holds, at minimum, a bachelor’s degree in Shariah, which includes study in Usul Fiqh (principles of Islamic jurisprudence) or Fiqh Muamalat (Islamic transaction/commercial law);
  • possesses solid knowledge in Shariah with reasonable Islamic finance knowledge and experience of the relevant industry; and
  • demonstrates strong proficiency and knowledge in written and verbal Arabic, with good command in the preferred language of either Bahasa Melayu or English language.

Standard Sandbox

  • No, applicants may only test one solution at any given point of time in the Standard Sandbox.

Green Lane

  • Yes, the Bank allows testing of multiple solutions for the purposes of the Green Lane. Therefore, a Green Lane participating institution can either choose to test the solutions concurrently or stagger them across the year.
  • Notwithstanding, Green Lane participating institutions must provide an overview of the solutions proposed to be tested in the Green Lane, which must include a short description of the business model, target segment, list of potential regulatory impediments and planned date for testing as stipulated in paragraph 7.8 (a) of the Framework.

When an application is rejected, you should expect a correspondence detailing reasons for the rejection. You can also reach out to the Regulatory Sandbox team if you need any further clarification on our response.

Yes, all information submitted to BNM for the purpose of the Regulatory Sandbox will be treated confidentially.

Testing
  • During the live test period, applicants are expected to provide regular reports on the progress of the test. Applicants should also prepare for their next steps after the end of the test.
  • Applicants are expected to also prepare for their exit from the Sandbox depending on the success or failure of the test.
  • The initial testing period provided is subject to a maximum of 12 months for both the Standard Sandbox and Green Lane. Extensions to the testing period may be considered and will be assessed on a case-by-case basis.
  • To extend the testing period, a written application must be submitted by the participants to BNM no later than 30 calendar days before the expiry of the testing period. The application should state the additional time required and clearly explain reasons for requiring the extension.
  • If an applicant experiences significant issues during testing and needs to stop its operations, the Regulatory Sandbox team should be informed as soon as possible.
  • The applicant will have to ensure an orderly exit from the Regulatory Sandbox (either the Standard Sandbox or the Green Lane) and minimise impact on customers.

Applicants who have not managed to achieve the KPIs of a test will need to assess reasons for the failure and determine its next appropriate step, which may include winding down operations in an orderly manner, or considering changes to the business model and alternative business arrangements.

Approval to test in the Regulatory Sandbox may be viewed as a learner's permit. A full licence or approval is not necessarily guaranteed after the test.

An approval to participate in the Regulatory Sandbox and any regulatory flexibility accorded will automatically expire, unless prior written approval has been sought from BNM to extend the testing period.

Upon completion of the testing, BNM will decide whether to allow the product, service or solution to be introduced in the market on a wider scale. Where allowed, participating fintech companies intending to carry out regulated businesses will be assessed based on applicable licensing, approval and registration criteria under the FSA, IFSA and MBSA, as the case may be.

Learn More--Regulatory Sandbox 2024

Learn More About the Sandbox

Understanding Regulations

Learn about regulations and BNM's role in the financial sector.

Visit the page

Application Guidelines

Learn about the Standard Sandbox and Green Lane application and assessment process. Visit the page

See also:
Standard Sandbox Application Form
Green Lane Application Form

The Sandbox Story

Learn a bit more about the history of the Regulatory Sandbox.

Read

Standards and Guidelines

List of standards and guidelines issued by BNM pertaining to the Regulatory Sandbox are available for public reference.

Visit the page

Frequently Asked Questions

If you have more questions about the Regulatory Sandbox, you may find the answers on this page.

Visit the page

FAOM Sandbox Pre-Screening and Mentorship Programme

Learn more about the Fintech Association of Malaysia’s (FAOM) Sandbox Pre-Screening and Mentorship Programme.

Visit the page