Narmin Nahidi – Written Evidence (RSB0005)
Regulatory sandboxes in UK financial services: innovation, market selection, regulatory learning and emerging AI risks
Written evidence submitted to the House of Lords Financial Services Regulation Committee
Submitted by Dr Narmin Nahidi, Assistant Professor in Finance, University of Exeter Business School
I submit this evidence in a personal academic capacity, drawing on research and teaching in financial technology, corporate finance and financial markets. The central argument is that regulatory sandboxes have become a significant component of the UK's financial innovation infrastructure, but the evidence used to assess them has not developed at the same pace as the sandbox model itself.
The first FCA Regulatory Sandbox opened for applications in June 2016. Since then, the UK framework has expanded considerably. It now encompasses the FCA Regulatory Sandbox, the Digital Sandbox, specialist AI testing initiatives and, jointly with the Bank of England, the Digital Securities Sandbox (DSS). These instruments differ materially in purpose. Some provide supervised live-market testing; others provide data, computing infrastructure or technical support; and the DSS can operate through a temporarily modified legal and regulatory framework.
This distinction matters. A sandbox should not be judged simply by the number of firms admitted or tests completed. Its public value depends on whether it generates innovation that would otherwise have been impeded, improves consumer or market outcomes, produces useful regulatory knowledge and does so at a proportionate cost without creating undue advantages for selected firms.
1. What purposes do regulatory sandboxes serve, and has their role changed?
The original FCA Regulatory Sandbox addressed a relatively specific problem: innovative firms could face substantial regulatory uncertainty before establishing whether a new proposition was commercially or legally viable. Controlled testing offered a mechanism for reducing that uncertainty while maintaining regulatory oversight.
That role has broadened.
The contemporary UK sandbox architecture performs at least four distinct functions:
The change over the past decade is therefore significant. The sandbox has moved from being primarily a firm-facing innovation tool towards becoming, in some settings, an element of experimental regulatory policymaking.
This evolution is important because the appropriate evaluation standard changes with it. If the purpose is merely to assist firms, firm-level outcomes may be sufficient. If sandbox evidence is used to shape regulation affecting an entire market, the evidential threshold should be considerably higher.
2. What has been the impact of sandboxes, and has the long-term impact been sufficiently assessed?
There is credible evidence of beneficial firm-level effects, although considerably less evidence on long-term market-wide effects.
The FCA's early assessment of its first two cohorts reported that sandbox participation could reduce the time and cost of bringing innovative propositions to market, assist access to finance and allow consumer safeguards to be incorporated during product development.[1] Those findings were useful, but they were primarily programme-level observations rather than a counterfactual evaluation.
More persuasive evidence comes from Cornelli, Doerr, Gambacorta and Merrouche (2024), published in the Review of Finance. Using the staggered admission of firms to the UK sandbox, they find that sandbox entry was associated with approximately a 15% increase in capital raised and a 50% increase in the probability of raising capital, alongside positive effects on survival and patenting.[2] Their evidence is consistent with two mechanisms: reduced regulatory uncertainty and reduced information asymmetry between innovative firms and potential investors.
These findings are economically meaningful. They also illustrate an important point: a sandbox can affect financing conditions even where the regulator provides no finance itself.
However, they do not settle the broader policy question.
Much of the strongest causal evidence concerns the earlier FCA cohorts and firms observed during the formative period of UK fintech. The structure of the sandbox has subsequently changed. The FCA moved from cohorts to rolling applications, while Digital Sandbox, AI-focused services and the DSS create substantially different forms of intervention.
Long-term assessment therefore remains incomplete.
An effective evaluation programme could follow firms for at least five years after participation and examine:
The final category is particularly important. Without an appropriate counterfactual, it is difficult to establish how much observed success is caused by participation and how much reflects the fact that regulators selected relatively promising firms.
3. Have sandboxes improved innovation and competition?
The evidence supports a more confident conclusion on innovation than on competition.
The capital-raising and patent evidence is consistent with sandboxes reducing barriers to innovation. The FCA's Digital Sandbox also reports that almost six in ten SME participants in its earlier pilots made positive progress through outcomes including funding, partnerships, product launches or industry recognition.[3] This is encouraging, although it is not a causal estimate.
Competition is harder to establish.
Supporting new entrants can increase competitive pressure on incumbents. At the same time, selective participation creates a potential certification effect. Admission may be interpreted by investors, customers or commercial partners as evidence that a firm is more credible, notwithstanding the distinction between regulatory supervision and regulatory endorsement.
The Cornelli et al. findings themselves are consistent with a signalling channel: sandbox entry appears particularly valuable where information asymmetries are greater.[2] That may be beneficial because it corrects a market failure. It may also mean that selection decisions influence capital allocation.
The relevant competition question is therefore not simply whether participating firms perform better. It is whether the sandbox improves the functioning of the wider market.
4. Do sandboxes provide wider public benefit and value for money?
The available evidence does not yet permit a strong conclusion on value for money.
Potential public benefits are substantial: faster financial innovation, improved consumer products, regulatory learning, greater financial inclusion, more effective compliance technologies and improved UK attractiveness to innovative financial firms.
But these benefits need to be compared with both the direct resources devoted to sandbox programmes and the opportunity cost of intensive regulatory engagement with selected firms.
A rigorous value-for-money assessment would ideally distinguish:
Additionality: Would the innovation have occurred without sandbox participation?
Displacement: Does support for selected firms reduce opportunities for competitors?
Spillovers: Do non-participants benefit from regulatory clarification or knowledge generated through sandbox testing?
Regulatory learning: Has sandbox evidence led to identifiable changes in rules, guidance or supervision?
Consumer outcomes: Has innovation generated measurable improvements in price, access, service quality or protection?
Cost: What is the full regulatory cost per participant and per successful market outcome?
This would be closer to the distinction in HM Treasury's evaluation framework between process evaluation, impact evaluation and value-for-money evaluation.[4]
The comparison should also include lower-cost alternatives such as regulatory guidance, innovation offices, technical workshops and ordinary supervisory engagement.
5. Why do firms choose to participate or not participate?
The design of the FCA sandbox suggests several clear benefits to applicants: access to regulatory expertise, the possibility of testing with real consumers, greater clarity concerning applicable rules and, where appropriate, temporary regulatory permissions.
The Digital Sandbox offers a different proposition, including access to datasets, APIs, technical infrastructure and an innovation community.
Participation may nevertheless impose meaningful costs. Applicants need sufficiently developed propositions, testing plans, resources and consumer safeguards. The FCA currently assesses Regulatory Sandbox applications against five criteria: scope, genuine innovation, consumer benefit, readiness and need for support.[5]
For some firms, especially small firms, preparing and conducting a supervised test may therefore consume scarce managerial and technical resources.
There is surprisingly little systematic evidence on firms that considered applying but did not do so. This is an important omission. Surveys of non-applicants and unsuccessful applicants could identify whether firms are deterred by application costs, confidentiality concerns, uncertainty about eligibility, lack of internal regulatory expertise, expected delays or a perception that sandbox participation is unnecessary.
6. How well do eligibility criteria and selection processes operate?
The existing FCA criteria are broadly coherent with the purpose of the programme. Two elements nevertheless deserve particular attention: "genuine innovation" and "need for support".
Both involve judgment. Such judgment is unavoidable, but when admission itself may produce financing or reputational consequences, transparency around that judgment becomes important.
The sandbox has also become selective. FCA figures show that 578 applications were received and 168 accepted from inception through the end of 2022. In the 2025/26 financial year, 142 applications were received and 14 accepted, although the FCA notes that some applications can remain pending because assessments operate on a rolling basis.[6]
These figures should not be interpreted as evidence that selection is either too strict or too permissive. They demonstrate instead why evaluation of the selection mechanism matters.
Useful publication could include anonymised statistics on applicant and participant characteristics, reasons for rejection, firm size, business model, geography and technology. This would allow external assessment of whether particular types of firm systematically gain or lose access to the programme.
7. Effects on participants, non-participants, investors and the wider market
Sandbox participation can generate effects beyond the individual firm.
For participating firms, regulatory engagement may reduce uncertainty and help identify compliance problems earlier. For investors, sandbox participation can provide information about regulatory preparedness. For regulators, it provides visibility over technologies that might otherwise emerge with limited prior supervisory exposure.
But these benefits create a potential regulatory halo.
Participation should not be interpreted as regulatory approval of the commercial viability, investment quality or eventual compliance of a firm. The stronger the signalling effect of sandbox admission becomes, the more important that distinction is.
There may also be positive spillovers to non-participants when sandbox findings produce clearer regulation, technical standards or publicly available knowledge. The public return on a sandbox is therefore likely to be substantially greater where lessons are disseminated rather than retained within bilateral regulator-firm relationships.
8. What role should sandboxes play in developing regulation?
This is potentially one of their most valuable functions.
The DSS provides a particularly clear example. The Bank of England and FCA describe it not only as an environment for firms to test distributed-ledger-based market infrastructure, but also as a means of testing whether regulatory or legislative changes may be required. Firms move through defined gates, with live activity permitted only after the relevant approval, and experience within the DSS is intended to inform a possible future permanent regime.[7]
This represents a significant innovation in regulatory design.
There is nevertheless a distinction between learning from experiments and making policy from selected experiments.
Participants are not necessarily representative of the market. Technologies tested within a sandbox may also behave differently when deployed at scale. Regulators therefore need mechanisms to distinguish lessons that are specific to an individual test from lessons capable of supporting general regulatory change.
For major sandboxes, a structured learning framework could record:
Publishing this information, subject to legitimate confidentiality constraints, would materially improve accountability and allow the wider market to benefit from regulatory experimentation.
9. How effectively are risks to consumers and markets managed?
Risk containment is integral to the sandbox model.
The FCA requires applicants to demonstrate readiness, appropriate consumer safeguards and the ability to provide redress where relevant.[5] The DSS adopts a more formal gated structure. Participants cannot conduct live activity merely by passing its initial stage; approval is required before live activity, and scaling is subject to further regulatory requirements and limits.[7]
This is sensible because experimentation does not eliminate regulatory responsibility.
There is, however, an unavoidable trade-off. If safeguards reproduce all the requirements and costs of ordinary market entry, the sandbox loses much of its purpose. If protections are relaxed too far, consumers may effectively bear part of the cost of regulatory experimentation.
Evaluation should therefore include not simply whether tests were completed, but the incidence and severity of consumer harm, complaints, compensation, operational incidents and tests that regulators paused or terminated.
10. Agentic AI
Agentic AI changes the sandbox problem in an important way.
FCA innovation programmes are already examining advanced AI use cases. The first Supercharged Sandbox cohort included the use of machine learning and agentic systems in financial-crime applications. Its second cohort includes work on safer agent-led payments and commerce, AI governance and accountability. The FCA's second AI Live Testing cohort also includes applications using agentic AI.[8]
Agentic systems differ from many earlier fintech technologies because the system may not merely generate a prediction or recommendation. It may plan, select tools, execute multi-stage actions and interact with other systems with a degree of operational autonomy.
That introduces several additional risks:
Agentic-AI sandbox testing therefore requires more than conventional model validation.
Relevant controls include strict tool permissions, transaction and exposure limits, complete action logs, human override mechanisms, adversarial testing, testing of abnormal and out-of-distribution scenarios, clear allocation of accountability and post-deployment monitoring.
Perhaps most importantly, AI sandboxes need to test behaviour over time, rather than relying predominantly on benchmark accuracy at the point of entry.
11. International comparison
The UK's model is notable for having developed several different sandbox instruments rather than relying on a single programme.
Singapore, for example, operates a conventional regulatory sandbox alongside Sandbox Express, designed for lower-risk activities with predefined requirements, and Sandbox Plus, which combines regulatory assistance with wider forms of support.[9]
Australia's Enhanced Regulatory Sandbox takes a different approach. Eligible firms can test specified financial services or credit activities under licensing exemptions for periods of up to 24 months, subject to conditions and exposure limits.[10]
The EU's DLT Pilot Regime provides another useful comparison because it resembles the UK's DSS in using a legislative framework to permit experimentation by financial market infrastructures. Uptake was initially limited: ESMA reported that only three DLT market infrastructures had been authorised by 31 May 2025.[11] This illustrates an important point. Creating a legally sophisticated sandbox does not itself guarantee industry participation.
The UK's comparative advantage may therefore lie less in having a sandbox per se—many jurisdictions now have one—and more in its ability to combine regulatory supervision, live testing, technical infrastructure and experimentation with the regulatory framework itself.
International comparisons should consequently focus on measurable outcomes rather than the number of sandbox programmes announced.
Conclusion
After ten years, regulatory sandboxes are no longer experimental additions to UK financial regulation. They have become part of the institutional architecture through which regulators engage with technological change.
There is credible evidence that the FCA sandbox has reduced regulatory and information frictions for participating firms. The evidence is particularly strong in relation to access to finance and some measures of innovation. The evidence is much weaker on long-term competition, consumer welfare, system-wide additionality and value for money.
That asymmetry matters.
The next stage of sandbox policy would benefit from treating evaluation itself as part of sandbox design. Every major sandbox could begin with measurable objectives and a credible counterfactual, collect comparable information on participants and non-participants, track outcomes beyond the testing period and publish evidence linking sandbox experience to subsequent regulatory decisions.
For emerging technologies such as agentic AI, this becomes still more important. The policy question is no longer simply whether regulators can create a safe space in which firms can experiment. It is whether sandbox experimentation generates sufficiently robust evidence to support innovation while preserving accountability, competition, consumer protection and market integrity.
References
[1] Financial Conduct Authority (2017), Regulatory Sandbox Lessons Learned Report.
[2] Cornelli, G., Doerr, S., Gambacorta, L. and Merrouche, O. (2024), “Regulatory Sandboxes and Fintech Funding: Evidence from the UK”, Review of Finance, 28(1), 203–233, doi:10.1093/rof/rfad017.
[3] Financial Conduct Authority, Digital Sandbox, updated 5 August 2026.
[4] HM Treasury (2026), The Green Book: Central Government Guidance on Appraisal and Evaluation.
[5] Financial Conduct Authority, Regulatory Sandbox Eligibility Criteria, updated 24 July 2026.
[6] Financial Conduct Authority (2026), FOI2026/00771, Information on number of sandbox applications received from 2021–2025.
[7] Bank of England and Financial Conduct Authority, Digital Securities Sandbox: Guidance on the operation of the Digital Securities Sandbox, updated 30 June 2026.
[8] Financial Conduct Authority, Supercharged Sandbox; AI Lab; and FCA announcements concerning the second AI Live Testing cohort, 2026.
[9] Monetary Authority of Singapore, Overview of Regulatory Sandbox.
[10] Australian Securities and Investments Commission, Enhanced Regulatory Sandbox.
[11] European Securities and Markets Authority (2025), Report on the Functioning and Review of the DLT Pilot Regime.
29 September 2026