Overview & Objectives

Building upon CySEC’s ongoing dialogue with market participants and experts since the launch of the Innovation Hub, CySEC has proceeded with the establishment of its Regulatory Sandbox. CySEC seeks to strike a balance between technological innovation, investor protection, and market integrity. CySEC seeks to achieve this through the launch of the controlled testing environment of CySEC’s Regulatory Sandbox.

The Regulatory Sandbox aims to:

build a transparent channel of cooperation between entities developing technology-based solutions in the financial services falling within CySEC’s supervisory mandate and CySEC,
ensure that the regulatory landscape evolves in line with the technological developments in the financial services.

The CySEC Regulatory Sandbox is designed for both regulated and unregulated firms to test with CySEC their technologically innovative solutions and/or products related to financial activities which are subject to CySEC’s supervision. The testing of pioneering products, services, and business models within a controlled, time-bound, testing environment will enhance CySEC’s understanding of innovative technologies and facilitate continuous regulatory adaptation to new market developments.

Why join?

Sandbox participants will be provided with the unparalleled opportunity of small-scale testing their innovative products and services within a controlled environment. With CySEC’s close monitoring and guidance, eligible participants will receive constructive feedback on how the regulatory framework applies to their innovation.

Eligibility criteria

The CySEC Regulatory Sandbox welcomes regulated entities as well as unregulated entities engaging in financial innovation through the deployment of technology, where such innovation relates to a service or product, regulated by CySEC. Unregulated entities can participate by:

obtaining prior CySEC authorisation corresponding to the regulated services they purport to engage in; or
testing innovative solutions solely with entities within their corporate group or by availing of any other exemption provided for under the applicable framework; or
by performing demo services; or
entering into a collaboration agreement with a CySEC-regulated entity.

For the avoidance of any doubt, the Sandbox does not provide a space of “light touch” regulation and supervision. Any unregulated entities whose innovations involve the provision of regulated services must obtain a CySEC authorisation as stated above, prior to participating in the Sandbox.

In addition, the applicants’ proposed innovative solution must

directly or indirectly facilitate activities within CySEC’s supervisory scope,
introduce authentic innovation in terms of product, service or business model,
showcase readiness for testing (i.e. that the proposed innovation is mature enough to be tested in a production environment) , and
benefit the financial services industry.

The four phases of the Sandbox

Application phase

During the application phase, interested firms will complete the application form (available here) for Sandbox participation and submit it to CySEC via email regulatory.sandbox@cysec.gov.cy. CySEC will assess the application forms received, in accordance with the eligibility criteria set out therein, and inform applicants about the result of the assessment via email, within 6-8 weeks from the date of receipt of a duly complete application.

Preparation phase

The Preparation phase commences following CySEC’s assessment that an application is successful for testing on the Sandbox. During this phase, the successful applicant will closely collaborate with CySEC to agree on specific testing parameters that must be followed during the testing phase. Such testing parameters shall be incorporated in a testing agreement to be signed by the participant. CySEC will assign a dedicated case officer that will guide the participant throughout the testing phase, and a thorough communication/reporting plan will be scheduled and agreed between the two parties.

Testing phase

During the testing phase, which typically lasts for 6 months, participants will be able to conduct small-scale testing of their proposed innovative solution within a controlled environment monitored by CySEC. Throughout this stage, CySEC via its designated sandbox officers will provide guidance to the participant. The latter will be responsible, among others, for submitting interim reports in order for the CySEC to track the participant’s progress and compliance with the agreed testing parameters.

Evaluation/Exit phase

The Evaluation/Exit phase commences immediately following conclusion of the testing phase. Exiting participants must prepare a comprehensive self-assessed exit report analysing, among others, the test’s milestones and key performance indicators, and whether these have been achieved. Exit reports represent the personal views of participants about their innovation’s testing and are solely prepared for CySEC’s internal assessment purposes. Relevant feedback may be provided by CySEC in relation to the exit report.