Consultation Paper - General Regulatory Sandbox Guidance Note

Summary

This is a Bermuda Monetary Authority consultation paper setting out draft guidance for its General Regulatory Sandbox (GRS) and Innovation Hub, explaining how financial institutions and start ups can apply to test innovative products, services and technology under a modified regulatory regime.

• Who can use it: Licensed financial institutions, start-ups whose business model does not clearly fit an existing regulatory framework, and entities that may require dual licences.
• Application process: Eligible companies submit an application with the requisite fee to sandbox@bma.bm, which is reviewed weekly by the Authorisation and Licensing Committee (ALC), leading to approval, deferral or decline.
• Proof of concept phase: Once approved, companies test their product for roughly six to twelve months under agreed parameters, must disclose sandbox risks to clients and obtain written client acknowledgement, and provide regular progress reports to the BMA.
• Exit and licensing: On completion, a final report on testing outcomes must be submitted; the Authority then decides whether the company may deploy the solution outside the sandbox and apply for a full licence.
• Extensions and termination: Extension requests (with fee) must be made at least one month before the sandbox period expires; the Authority can terminate participation for breaches, unviable results, misrepresentation, unaddressed risks, loss of fitness and propriety, or inability to meet licensing criteria, with no right of appeal.
• Innovation Hub: A separate, less formal channel for dialogue with fintech and regtech participants not otherwise directly regulated by the BMA, intended to support firms that may later apply for a GRS licence.

As a consultation paper, this document is a draft guidance note open for stakeholder comment via the BMA's discussion/consultation comment form sent to policy@bma.bm; it does not yet have final regulatory force.

Key obligations

• Sandbox applicants must submit an application together with the requisite fee to sandbox@bma.bm, addressing the eligibility criteria and minimum content in Appendix I
• Companies in the GRS must notify clients that products/services are operating in a sandbox, disclose associated key risks, and obtain written client acknowledgement of understanding those risks
• Companies must maintain a client complaints log available to the Authority upon request
• Companies must provide regular progress updates/reports to the BMA during the proof-of-concept phase at an agreed frequency
• Any material changes to agreed testing parameters, or requests to extend the testing period, must be approved by the Authority in advance
• Companies seeking an extension must apply and pay the applicable extension fee at least one month before the sandbox expiration date, giving reasons and supporting documents
• Upon completion of the proof-of-concept phase, companies must submit a final report to the Authority on testing outcomes, including client feedback
• Companies must fully extinguish all existing and future obligations to clients before exiting the GRS
• Companies must comply with applicable AML/ATF legal requirements under the Proceeds of Crime Act 1997, Anti-Terrorism (Financial and Other Measures) Act 2004, and related regulations while operating in the sandbox

Applies to

financial institutions licensed under Bermuda regulatory acts, start-ups seeking licensing, dual-licence applicants, Financial Services/Technology (FST) hybrid companies, fintech and regtech industry participants (Innovation Hub)

Deadlines

• at the latest one month before the expiration date: Deadline for a sandbox company to apply for an extension of its GRS testing period, together with the applicable fee
• six to 12 months: Typical duration of the proof-of-concept phase within the sandbox
• within two weeks of initial contact: Typical BMA response time to an applicant after initial contact during the review stage