Central Bank of the UAEchapter by chapter

5.25. Regulatory Sandbox Framework

Licensed financial institutions are barred from joining the regulatory sandbox, and innovative testing outside their authorised activities must be discussed with the Central Bank before market deployment.

7.1(a)-(c)7. Eligibility Criteria

Applicants for the CBUAE sandbox must meet eligibility criteria, show ongoing financial soundness and Fit and Proper compliance, and commit in writing to comply with all Central Bank conditions.

7.1(b)(vii)7. Eligibility Criteria

Before admitting any consumer to the Sandbox, a Participant must obtain the consumer's express, informed, written consent, disclose all risks, and explain the consumer protection regulatory protections being waived.

7.2(a)-(h)7. Eligibility Criteria

The Sandbox application must include specific scenarios, operational plans, client communication strategies, risk assessments, and consumer disclosures.

8.68. Application Process

Applicants approved for the Central Bank's Regulatory Sandbox must notify their consumers that the financial services or products they provide are part of the Regulatory Sandbox.

8.78. Application Process

A sandbox participant must notify the Central Bank and obtain approval at least one month before changing any information in its application, giving reasons and effective date.

9.2(a),(c),(d),(e)9. Safeguards

Sandbox participants must maintain consumer complaint, compensation and dispute-resolution mechanisms, data protection controls, limits on which consumers may be served, and ongoing fit and proper checks on key individuals.

9.2(b)9. Safeguards

Sandbox participants must segregate consumers' funds and assets from their own funds and hold them through an escrow arrangement with a Central Bank-licensed bank.

9.2(f)9. Safeguards

The Participant must implement measures to prevent money laundering and counter terrorism financing, in line with all applicable AML/CFT legislation and regulations.

10.210. Exit Routes

Participants in a regulatory sandbox must submit a report to the Central Bank before testing ends, supporting its evaluation of whether they may apply for a market-wide deployment licence.

10.610. Exit Routes

On Sandbox exit, the Participant must follow its exit strategy: notify Consumers, meet all Consumer obligations, report to the Central Bank, and securely dispose of Consumer information.

11.211. Regulatory Sandbox Duration

Participants seeking to extend their regulatory sandbox testing period must submit a rationale request to the Central Bank 30 days before the current period expires.

12.1-12.212. Testing and Reporting

Sandbox Participants must periodically report testing information, document testing-phase information and keep detailed records for Central Bank review, with all reports validated by the Participant's CEO or equivalent.

12.412. Testing and Reporting

Sandbox participants must submit interim reports to the Central Bank during testing covering performance milestones, key issues such as fraud, operational incidents, safeguard compliance and actions taken.

7.1(b)(vii)-retRecord Retention — Consumer written consent and risk disclosure records

Records of consumer written consent and risk disclosure must be retained from the date of consent; duration is unspecified.

10.6-retRecord Retention — Consumer information collected during testing (for secure disposal on exit)

Consumer information collected during regulatory sandbox testing must be securely disposed of on sandbox exit or discontinuation, under applicable data protection and AML-CFT retention rules; no specific retention period is stated.

12.1-retRecord Retention — Detailed testing records and periodic/interim reports documenting Regulatory San

Sandbox participants must retain detailed testing records and periodic or interim reports for the sandbox participation period plus any post-exit Central Bank review period.