FinTechRBI’s Framework on Regulatory Sandbox

INTRODUCTION

Disruptive technologies have paved the way for innovative advancements in the financial industry. Despite their effect on traditional banking, the Indian fintech market has grown remarkably in recent years, generating numerous opportunities for both businesses and consumers.

In July 2016, the Reserve Bank of India (hereinafter referred as “RBI”) established an inter-regulatory Working Group (hereinafter referred as “WG”) to examine and report on the detailed aspects of Fintech and its implications. The aim was to review the regulatory framework and adapt to the rapidly evolving Fintech landscape. The WG’s report was released for public comments on February 8, 2018.

Among its key recommendations was the introduction of a suitable framework for a Regulatory Sandbox (hereinafter referred as “RS”). This RS would operate within a clearly defined space and timeframe, where the financial sector regulator would offer the necessary regulatory guidance to enhance efficiency, manage risks, and create new opportunities for consumers.  Consequently, a comprehensive framework has been developed, outlining the principles and role of the proposed RS, including the rationale behind its establishment and the RBI’s expectations.

The RS offers several benefits, including practical learning opportunities for regulators and financial service providers, and a cost-effective way to test the viability of new products. It also promotes financial inclusion, enables regulatory decision-making based on solid evidence, and improves consumer outcomes by providing a wider range of product and service options.

However, there are risks and limitations to consider. The sandbox can reduce the flexibility and time available for innovators, and it requires careful handling of authorisations and regulatory relaxations. No legal waivers are provided by the RBI, and regulatory approvals are still necessary after sandbox testing. Additionally, there is the potential for legal issues arising from failed experiments and consumer losses.

ENABLING FRAMEWORK FOR REGULATORY SANDBOX

RBI released the Enabling Framework for Regulatory Sandbox on February 28, 2024, to foster innovation in the financial sector. This framework provides a structured environment for fintech companies to test new products and services under regulatory supervision, ensuring consumer protection while encouraging technological advancement.

Regulatory Sandbox “Cohorts” and On Tap applications

In the context of a RS, cohorts refer to distinct groups of entities that enter the sandbox at the same time to test their innovative products, services, or technologies. Each cohort operates within a defined timeframe and follows a structured process to ensure thorough evaluation and testing. The RS may conduct several cohorts, each involving a limited number of entities testing their products within a specified period. These cohorts will be theme-based, focusing on areas such as financial inclusion, payments and lending, and digital KYC.

However, there may also be theme-neutral cohorts, allowing innovative products, services, or technologies that span various functions within the RBI’s regulatory domain to apply. Each cohort may run for different durations but should typically be completed within nine (9) months from the receipt of complete and eligible applications, excluding the preliminary screening period.

To foster continuous innovation within closed themes, the RS may accept ‘On Tap’ applications for these themes. The RBI will communicate the details of themes open for ‘On Tap’ applications through its official website. All terms and conditions for participating in the ‘On Tap’ facility will remain consistent with those applicable under the RS.

Number of FinTech Entities to be part of a Cohort

The focus of the RS shall be narrow in terms of areas of innovation and limited in terms of intake. The RS shall begin the testing process with a few selected entities through a comprehensive selection process as detailed in the framework under ‘Fit and Proper criteria for selection of participants in RS’. The decision of the RBI on the application shall be final.

Fit and Proper Criteria for Selection of Participants in RS

By excluding products or services that lack new innovations and are like those already tested, the guidelines encourage a continuous flow of novel and unique solutions, prompting entities to present fresh ideas to the RS. Setting criteria for technological readiness and net worth aims to attract serious and well-prepared participants whose products and services are ready for broader market deployment. This focus on market-ready innovations ensures the RS remains a platform for impactful and scalable solutions.

Additionally, the cooling-off period for reapplication ensures the efficient use of the RS’s resources, allowing entities time to refine and enhance their offerings before applying again. The RBI introduced these guidelines to ensure a structured and efficient process for selecting participants in the RS.

Every applicant shall satisfy the following conditions:

1. It should be a company incorporated and registered in India or banks licensed to operate in India or Limited Liability Partnership (hereinafter referred as “LLP”) or Partnership firm registered in India. Further, financial institutions constituted under a statute in India would also be eligible.
2. The entity shall have a minimum net worth of Rs.10 lakh as per its latest audited balance sheet.
3. The entity, whose application for participation is rejected under the RS, will be eligible to apply again with same or similar product only after the completion of mandatory cooling period of six months.
4. The entity should demonstrate that the products/services are technologically ready for deployment in the broader market. The RBI shall not provide technology testbed and/or data for testing of the product/services/technology.
5. The entities may get into in-principal partnership arrangements, if any, with various stakeholders at the time of applying to the RS.
6. The entity should have robust IT infrastructure and managerial resources. The IT systems used for end-to-end sandbox processing shall provide end-to-end integrity of information processing.

The entities must also meet the following condition: if the proposed product or service is like one already tested under the RS and does not introduce any innovation, it may not be considered eligible for the RS.

The RS is a new regulatory initiative to foster responsible innovation in financial services, while carefully monitoring and containing their risks. The selection of entities for a cohort shall, inter-alia, be based on conformity to the fit and proper criteria. In case the number of applicants is large, the compliance with fit and proper criteria shall be a necessary condition and the final selection will be based on novelty of the innovation and the potential benefit which the product/service/ technology brings to the consumers/industry.

Extending or Exiting the RS

The sandbox testing will be discontinued any time at the discretion of the RBI:

1. if the sandbox entity has submitted false, misleading or inaccurate information, or concealed material facts in its application to RS.
2. if there is any breach in the data security/ failure to address technical defects, if any, failure to develop or implement safeguards, the entity goes into liquidation or has regulatory license cancelled.
3. if the sandbox entity is unable to start the testing or get into the required partnerships.

REGULATORY SANDBOX: PROCESS AND ITS STAGES AND TIMELINES

The Fintech Department (hereinafter referred to as “FTD”), guided by the Inter Departmental Group (hereinafter referred to as “IDG”), oversees a detailed and systematic process for evaluating and testing Fintech innovations. This structured approach ensures consistency and transparency in assessing new products and services.

The application assessment and shortlisting phase rigorously evaluates innovation, technology, and security, ensuring that only the most promising and secure solutions progress. The indicative timelines for each stage provide a clear framework, ensuring timely achievement of objectives, while allowing the FTD the flexibility to adapt to changing circumstances, maintaining an efficient and effective evaluation process.

End-to-End Sandbox Process

A detailed end-to-end sandbox process, including the testing of the products/innovations by Fintech entities, shall be overseen by the FTD of RBI under overall guidance of the IDG on RS of RBI with participation of representatives of various regulatory departments of RBI and other domain experts.

Each cohort of the RS shall have the following five stages and timeline:

1. Preliminary Screening

The applications received by the FTD shall be evaluated to shortlist applicants meeting the eligibility criteria and the objectives of RS. This phase may last ordinarily for one month from the submission of complete application form by the applicant and further information, as desired by FTD, necessary for the screening and due diligence. This period is outside the overall RS Cohort timeline of nine months.

2. Application Assessment and Shortlisting

The FTD shall vet the applications to evaluate innovation, technology aspects, security etc. The regulatory relaxations, if any, requested by the applicant will be considered on a case-by-case basis in consultation with the regulatory department concerned. The shortlisted applicants will present their product/service/technology before the IDG, based on which they will be shortlisted for Testing Phase. This stage may last for up to one and a half month.

3. Formulation of Test Design and Integration Phase

The FTD shall finalise the test design through an iterative engagement with the applicants and identify outcome metrics for evaluating evidence of benefits and risks associated with the products/services/technology. Further, the shortlisted entities shall integrate with their partners, if any, and be ready to start the testing of the product/ service / technology. This phase may last for one and a half month.

4. Testing Phase

 This phase may last for a maximum of five months. The entities will report the test results on a fortnightly basis and the FTD shall assess the test results by close monitoring.

5. Evaluation Phase

The FTD shall assess the outcome reports of the test both quantitatively and qualitatively and decide on whether the product/service is viable and acceptable under the RS. The outcome of the testing of product/service/technology as per the expected parameters shall be confirmed by the RBI. This phase may last for one month from the submission of complete test results and further supplementary information as desired by FTD.

STATUTORY AND LEGAL COMPLIANCE  

Mandating full regulatory compliance upon exiting the RS ensures innovations are ready for real-world application within the existing legal framework, preventing misuse to bypass regulations. Requiring sandbox entities to notify customers and de-board them after testing ensures transparency and protects consumers from uncertainties. Overall, these guidelines balance innovation with accountability, data protection, and regulatory compliance, creating a secure environment for testing new financial technologies while safeguarding consumer interests and maintaining the financial system’s integrity.

1. Upon approval, the applicant becomes the sandbox entity responsible for operating in the RS. The RBI will provide the appropriate regulatory support by relaxing specific regulatory requirements (which the sandbox entity will otherwise be subject to), where necessary, for the duration of the RS. The RBI shall bear no liability arising from sandbox process and any liability arising from the experiment will be borne by the applicant as a sandbox entity.
2. The sandbox entity must process all the data, in its possession or under its control regarding RS testing, in accordance with the provisions of Digital Personal Data Protection Act, 2023. In this regard, the sandbox entity should have appropriate technical and organisational measures to ensure effective compliance of the provisions of the Act and rules made thereunder. Further, the sandbox entity should ensure adequate safeguards to prevent any personal data breach.
3. Upon successful experimentation and on exiting the RS, the sandbox entity must fully comply with the relevant regulatory requirements. The applicant should clearly understand the objective and principles of the RS. It must be emphasized that the RS is not intended and cannot be used to circumvent legal and regulatory requirements.
4. At the end of the sandbox period, the sandbox entity must notify the customers of the completion of the sandbox testing, de-board the customers and exit the RS.

AMLEGALS REMARKS

In conclusion, the Enabling Framework for Regulatory Sandbox by the RBI marks a significant step towards modernizing the financial sector. By providing a controlled environment for fintech innovation, it balances technological progress with consumer protection, paving the way for a more inclusive and efficient financial ecosystem.

This initiative positions India at the forefront of global fintech innovation, promising a more dynamic and secure financial ecosystem for all stakeholders.

– Team AMLEGALS assisted by Mr. Devansh Sethi (Intern)

For any queries or feedback, please reach out to mridusha.guha@amlegals.com or liza.vanjani@amlegals.com