SAMA's Regulatory Sandbox: Testing Permission and Its Limits

What the sandbox is

The Saudi Central Bank's (SAMA) regulatory sandbox enables testing of innovative financial products and services in a live environment under SAMA's supervision. It is designed for firms that want to test a financial innovation that does not fit neatly within the existing regulatory framework, or that want to test a new approach to a regulated activity before seeking full authorisation.

The sandbox is not a route to avoid regulation. It is a supervised testing environment with defined parameters, and participation does not constitute general authorisation to conduct financial services business in Saudi Arabia.

The framework: four stages

SAMA's sandbox framework describes four stages: application, operational readiness, testing and exit. Each stage has specific requirements and SAMA's involvement at each stage reflects the supervised nature of the process.

The application stage requires the firm to describe the proposed innovation, explain why it cannot be tested within the existing regulatory framework and set out a proposed test design. SAMA assesses applications against its eligibility criteria, which include requirements about the firm's readiness, the nature of the innovation and the potential benefits and risks.

The operational readiness stage involves SAMA assessing whether the firm has the systems, controls and governance in place to conduct the test safely. This is not a formality: SAMA may require changes to the test design or the firm's controls before approving the move to the testing stage.

Testing parameters and their significance

SAMA's FAQ explains that tests operate within predefined parameters. These parameters may include limits on customer numbers, transaction volumes or values, the duration of the test and the geographic scope. The parameters are agreed between SAMA and the firm at the application stage and are specific to each test.

The parameters matter for two reasons. First, they define the scope of what the firm is permitted to do during the test: activity outside the parameters is not covered by the sandbox and may constitute unauthorised financial services activity. Second, they define the evidence base that the test will generate: a test with very limited parameters may not produce sufficient evidence to support a full authorisation application.

When designing the test, consider whether the proposed parameters will generate the evidence needed to demonstrate that the innovation works safely at scale. A test that is too constrained may need to be repeated or extended before SAMA has sufficient confidence to consider full authorisation.

Preparing a strong application

For an applicant, the task is to explain the proposed innovation clearly and design a test that can be supervised. The application should describe the customer journey in detail: who are the customers, how do they interact with the product, what are the risks they face and how are those risks managed? It should also describe the controls the firm will apply during the test, the success criteria and the exit approach.

Assess the application against SAMA's current eligibility framework before submitting. The framework specifies the types of innovation the sandbox is designed to support and the conditions that applicants must meet. An application that does not address the eligibility criteria clearly is unlikely to progress.

Engage with SAMA's published guidance and, where appropriate, seek pre-application engagement with SAMA to understand whether the proposed innovation is suitable for the sandbox. SAMA has published detailed guidance on the application process and the criteria it applies.

Communications and regulatory status

Communications about sandbox participation — to customers, investors and the public — should describe the firm's actual regulatory status and permitted testing scope accurately. Sandbox participation is not a general claim that every product or activity is authorised. A firm in the sandbox is conducting a supervised test within defined parameters; it is not a fully authorised financial services provider.

This distinction matters for customer communications, marketing materials and investor presentations. Describing sandbox participation as "regulatory approval" or "authorisation" is inaccurate and may attract regulatory attention. Describe the status accurately: the firm is participating in SAMA's regulatory sandbox and conducting a supervised test of a specific innovation.

Planning the exit

The exit stage is as important as the testing stage. Before planning a full commercial launch, establish what permissions and conditions apply after testing. The sandbox does not automatically convert into full authorisation: the firm must apply for the relevant licence or authorisation through the standard process, supported by the evidence generated during the test.

Plan the exit from the sandbox in parallel with the test. Identify the authorisation pathway, the evidence requirements and the timeline. A firm that completes a successful sandbox test but has not planned the authorisation pathway may face a gap between the end of the test and the start of full commercial operations.