Notice - General Regulatory Sandbox Guidance Note (2021-11-25)

Summary

This is a draft consultation guidance note in which the Bermuda Monetary Authority (BMA) sets out how it intends to administer its General Regulatory Sandbox (GRS) across regulatory acts beyond the existing Insurance and FinTech sandbox. It explains the eligibility criteria, application and approval process, and exit/extension rules for companies wanting to test innovative financial products, services or delivery mechanisms in a controlled environment. The BMA is inviting industry comments on the proposals before finalising the guidance.

• Who can apply: Financial institutions already licensed under Bermuda regulatory acts, start-ups whose business model does not clearly fit an existing licensing framework, and applicants that may need dual licences.
• Eligibility criteria: Applicants must show an innovative product or business model, prior research and risk mitigation planning, clear testing objectives with commitment to report to the BMA, understanding of risks with an exit/transition strategy, and the resources to deploy the solution after exiting the sandbox.
• Application process: Applicants submit an application with the required fee by email to sandbox@bma.bm; applications are reviewed weekly by the Authorisation and Licensing Committee (ALC), which decides to approve, defer or decline and notifies applicants of applicable modified legal/regulatory requirements.
• Proof-of-concept phase: Typically lasts six to twelve months, during which the company must give regular progress updates, notify clients they are dealing with a sandbox product, obtain written client acknowledgement of risks, and maintain a complaints log.
• Deployment or exit: On completion, the company submits a final report on testing outcomes; the BMA decides whether the company may operate outside the sandbox or must apply for a full licence. Companies may also be required to extend or exit early, including in cases of breach of conditions, unviable results, misrepresentation, or unresolved risk flaws.
• AML/ATF compliance: GRS participants must comply with AML/ATF obligations under the Proceeds of Crime Act 1997, the Anti-Terrorism (Financial and Other Measures) Act 2004, the Proceeds of Crime (AML/ATF) Regulations 2008 and applicable international sanctions.

Because this is a consultation draft, the requirements described are proposed rather than final; the BMA asked stakeholders to submit comments by 31 December 2021 before the guidance is settled.

Key obligations

• Sandbox applicants must submit an application (with the required fee) to sandbox@bma.bm demonstrating how they meet the eligibility criteria.
• Approved GRS companies must notify clients that products/services are being tested in a sandbox and disclose associated key risks.
• Approved GRS companies must obtain written client acknowledgement that risks have been read and understood.
• Approved GRS companies must maintain a client complaints log available to the BMA upon request.
• Approved GRS companies must provide regular progress updates/reports to the BMA during the proof-of-concept phase.
• Any material changes to agreed testing parameters or requests to extend the testing period must be approved by the BMA in advance.
• A company seeking an extension of its sandbox period must apply and pay the extension fee at least one month before the expiration date, providing reasons and supporting documents.
• Upon completion of the proof-of-concept phase, the company must submit a final report to the BMA on testing outcomes, including client feedback.
• GRS participants must comply with applicable AML/ATF legislation and international sanctions requirements.
• Companies exiting the GRS must fully extinguish existing and future obligations to clients before exiting.
• Interested parties wishing to comment on the draft guidance must submit views to policy@bma.bm by 31 December 2021.

Applies to

Financial institutions licensed under Bermuda regulatory acts, Start-up companies seeking licensing, Companies requiring dual licences, Financial Services/Technology (FST) hybrid companies, Digital Asset Business (DAB) sector entities

Deadlines

• 31 December 2021: Deadline for industry and interested parties to submit comments on the draft General Regulatory Sandbox guidance to policy@bma.bm.
• at the latest one month before the expiration date: Deadline for a sandbox company to apply for an extension of its GRS period, with payment of the applicable extension fee.
• six to 12 months: Typical duration of the proof-of-concept phase within the sandbox.
• within two weeks of initial contact: Timeframe within which the Authority typically responds to an applicant after initial contact, prior to the ALC meeting.