5 October, 2016
Since the UK proposed its regulatory sandbox regime in November 2015, APAC countries such as Australia, Malaysia and Singapore have been quick to follow pace with their own proposals for a similar regulatory "safe space". Hong Kong, although arguably late to the race, has caught up by having its sandbox regime come into effect from the day of announcement (6 September 2016) while other regulators in the APAC region are still going through the process of public consultation (Australia, Malaysia and Singapore).
CONTENTS
What is a regulatory sandbox and why introduce one?
What does Hong Kong's sandbox look like?
Apart from partnering with an AI, what avenues do non-AIs have to trial their Fintech offerings in Hong Kong? 02
How does Hong Kong's sandbox compare with those in other
countries?
However, unlike other sandbox regimes which aim to cater to a range of firms, the Fintech Supervisory Sandbox (FSS) launched by the Hong Kong Monetary Authority (HKMA) is only open to institutions authorised under the Banking Ordinance and already under the supervision of the HKMA, ie, licensed banks, restricted licence banks and deposit-taking companies.
In this briefing, we take a closer look at:
the different regulators' motivations for introducing a sandbox; how Hong Kong's sandbox for authorised institutions (AIs) operates – and what alternatives are available for non-AIs; and the different sandbox regimes in Australia, Malaysia, Singapore and the UK.
WHAT IS A REGULATORY SANDBOX AND WHY INTRODUCE ONE?
At the most basic level, a regulatory sandbox creates an environment for businesses to test products with less risk of being "punished" by the regulator. In exchange for more flexible regulatory standards (albeit for a limited duration), regulators tend to require applicants to incorporate appropriate safeguards in their business models. These safeguards range from customer protection measures (eg, requiring informed consent), financial limits (eg, limiting the amount of money that can be invested by a customer), and various risk controls (eg, fraud detection, cyber security etc).
Key drivers for a sandbox include facilitating innovation and competition. This was a common topic across the discussion papers released by the UK Financial Conduct Authority (FCA) and the Central Bank of Malaysia (BNM), and was also recognised by the Canadian Competition Bureau when launching its market study of the Canadian financial services sector (May 2016). The bureau pointed out that overregulation can restrain competition and that the effects could be 'exacerbated during periods of rapid innovation…as new business models [eg, fintech startups] challenge the status quo
[eg, banks]'.
By providing a "safe and conducive space to experiment… where the consequences of failure can be contained" (Monetary Authority of Singapore) (MAS), regulatory sandboxes have the potential to help society enjoy the benefits of innovative fintech offerings, while mitigating the risks the public is exposed to.
WHAT DOES HONG KONG'S SANDBOX LOOK LIKE?
It must be noted from the outset that the FSS is only available to initiatives carried out in Hong Kong by institutions which are authorised by the HKMA (ie, AIs, which include licensed banks, restricted licence banks and deposit-taking companies). A firm which is not regulated by the HKMA would therefore need to partner with an AI in order to enter the sandbox. In its circular of 6 September 2016, the HKMA sets out the principles that it will adopt when operating the FSS, which include the basis on which an AI is permitted to trial its initiative. Specifically, the management of AIs are required to ensure that certain conditions are fulfilled. Such conditions are only described in a general sense, for example:
- the scope, timing and termination arrangements are clearly defined;
- there are adequate customer protections and risk management controls in place;
- the initiative is ready for testing in the sandbox; and
- the initiative will be closely monitored during the trial.
In addition, the HKMA has made clear that it is willing to relax supervisory requirements within the FSS on a case by case basis. The two specific requirements the HKMA has cited as examples are: security-related requirements for electronic banking services and the timing requirement for the independent assessment of new technology services.
The FSS is available to fintech as well as other technology initiatives intended to be launched in Hong Kong by AIs.
APART FROM PARTNERING WITH AN AI, WHAT AVENUES DO NON-AIS HAVE TO TRIAL THEIR FINTECH OFFERINGS IN HONG KONG?
The HKMA also announced on the same day that it will launch a Fintech Innovation Hub in collaboration with the Hong Kong Applied Science and Technology Research Institute. See circulars issued to AIs and stored value licensees on 6 September 2016. Further details will be announced in the coming weeks, however, it is intended that this will be a facility geared to help AIs and other fintech players test their products and obtain early feedback from regulators. Among other things, the HKMA also anticipates that it will use the hub to explore with fintech firms the use of creative "regtech" (regulatory technology) to improve its regulatory work.
Non-AI firms should also consider the existing provisions in Hong Kong's regulatory framework, as well as participating in fintech-specific forums established by other regulators to investigate what rules could apply to them. These forums include the Fintech Contact Point by the Securities and Futures Commission (SFC) and the Fintech Liaison Team by the Office of the Commissioner of Insurance. Relying on exemptions for professional investors and small offers for crowdfunding activities is an example of how existing exemptions could be relied on in the absence of changes to existing legislation. In addition, the SFC has the discretion to relax licensing conditions on a case by case basis and prior engagement with the Fintech Contact Point could help parties become more informed before submitting an application.
HOW DOES HONG KONG'S SANDBOX COMPARE WITH THOSE IN OTHER COUNTRIES?
In the table below, we highlight the most distinctive qualities of the sandbox regimes in Australia, Malaysia, Singapore and the UK, compared against Hong Kong. We then go on to consider each regulatory regime and the tools available to regulators, on a country by country basis. We note that with the exception of the UK and Hong Kong, other countries discussed here are still in the process of finalising their sandbox arrangements and are not yet ready for entry. In addition, we expect regimes to change over time as a consequence of feedback from the public and participants.
JURISDICTION Australia
TIMING Consultation paper issued on 8 June 2016 and comments were due by 22 July 2016
The licensing exemption is expected to be finalised by December 2016
WHY WOULD THIS SANDBOX BE ATTRACTIVE? Businesses can rely on the licensing exemption following notification to ASIC (which may be less onerous than completing the application process to enter a sandbox). This model is more suitable for businesses who are not ready to conduct a full product launch or engage in wide-scale testing, but would still like to validate their business model.
ELIGIBILITY CRITERIA – Businesses would be able to rely on the Australian financial services (AFS) licensing exemption upon completion of the following:
notifying the Australian Securities and Investments Commission (ASIC) that it intends to rely on the exemption from a specified date; providing evidence of sponsorship from a sandbox sponsor (ie, a not-for-profit industry association or other Government-recognised entity, which has been approved by ASIC); and declaring that it has reasonable grounds to expect that it can operate its business for six months from the specified date.
Certain restrictions and conditions also apply in relation to client and exposure limits and consumer protections.
PERMITTED TIMEFRAME FOR TESTING Six months
JURISDICTION Hong Kong
TIMING Effective 6 September 2016 (for AIs only)
WHY WOULD THIS SANDBOX BE ATTRACTIVE? AIs can begin trials immediately subject to discussion with the HKMA and compliance with the required principles. The HKMA offers a high level of engagement with each participant, including relaxing supervisory requirements on a case by case basis.
ELIGIBILITY CRITERIA – The sandbox is only open to HKMA AIs who are launching fintech or other technology initiatives in Hong Kong. The conditions for conducting trials include the following:
the scope, timing and termination arrangements are clearly defined;
there are adequate customer protections and risk management controls in place;
the initiative is ready for testing in the sandbox; and
the initiative will be closely monitored during the trial.
PERMITTED TIMEFRAME FOR TESTING – No maximum time limit specified
JURISDICTION Malaysia
TIMING – Consultation paper issued on 29 July 2016 and comments were due by 30 August 2016
WHY WOULD THIS SANDBOX BE ATTRACTIVE?
The maximum duration for the testing period is relatively generous. In addition, priority will be given to applications from financial institutions or fintech firms that intend to collaborate with financial institutions.
ELIGIBILITY CRITERIA – The product is genuinely innovative; The product has clear potential to benefit Malaysia in certain ways; The applicant has assessed, and demonstrated, the usefulness and functionality of the product and understands the associated risks; The applicant has the necessary resources to participate, as well to mitigate and control potential risks and losses; The applicant intends to deploy the product on a commercial scale in Malaysia upon exit; and
The product cannot be offered to the market at present due to prohibitions under existing laws or regulations or incompatibility with applicable regulatory requirements.
PERMITTED TIMEFRAME FOR TESTING Uptoa maximum of 12 months
JURISDICTION – Singapore
TIMING Consultation paper issued on 6 June 2016 and comments were due by 8 July 2016
WHY WOULD THIS SANDBOX BE ATTRACTIVE? Applicants can expect to receive a relatively quick response (within 21 working days) on whether its proposal is suitable for entry into the sandbox. Requirements can be relaxed on a case-by-case basis.
ELIGIBILITY CRITERIA The product is technologically innovative or applied in an innovative way; The product addresses a significant issue or brings benefits to consumers or the industry; The applicant intends, and has the ability, to deploy the product in Singapore on a broader scale after exit The test scenarios and outcomes are clearly defined and the applicant will report to MAS on progress as agreed; The boundary conditions are clearly defined and will sufficiently protect the interests of consumers and maintain the safety and soundness of the industry; Major foreseeable risks arising from the product are assessed and mitigated; and The exit and transition strategy is clearly defined.
PERMITTED TIMEFRAME FOR TESTING No maximum time limit specified, however, a request for an extension should be made at least 1 month before the expiration date
JURISDICTION United Kingdom
TIMING – Consultation paper issued on 10 November 2015. Applications to be part of the first sandbox cohort were open from 9 May to 8 July 2016. The second round of applications will be accepted from November to mid-January 2017
WHY WOULD THIS SANDBOX BE ATTRACTIVE? Acceptance of only a limited number of firms means each firm is likely to receive individualised attention from the FCA (similar to an accelerator programme). This dynamic may foster collaboration and lead to greater understanding of both parties' objectives and the regulatory changes needed to facilitate innovation.
ELIGIBILITY CRITERIA The firm is in scope (ie, is the firm looking to deliver innovation which is either regulated business or supports regulated business in the UK financial services market?); The idea is a genuine innovation; There is a consumer benefit; There is a need for sandbox testing (eg, there is no alternative means of releasing the innovation to customers); and The firm is ready for testing, in other words is the firm in a sufficiently advanced stage of preparation to mount a live test.
PERMITTED TIMEFRAME FOR TESTING No maximum time limit specified, however, the FCA's guidance on default standards suggests that it considers 3 to 6 months to be an appropriate duration
A. UK
The FCA is the frontrunner for introducing a regulatory sandbox regime. Applications for the first cohort were open from 9 May to 8 July 2016 and the second round of applications is expected to run from November to mid-January 2017. The FCA plans to initially run two cohorts a year so as to facilitate a high level of engagement between itself and firms.
The FCA has recently announced that of 69 applications in the first cohort, 24 were accepted towards testing, leading them to expand their team to meet demand. The FCA has also offered assistance via Project Innovate or other colleagues to 40 of the applicants, in some cases to prepare for the next cohort of the sandbox.
The demographic of applicants and the range of sectors covered was broad. From the applications accepted, four came from retail banking, four from insurance firms, three covering advice and profiling and three related to IPO. Seven applications also came from payment firms, including blockchain firms. The FCA are in the process of agreeing details of testing, timelines and consumer safeguards and they will update on this over the coming weeks and publish a full list of all the firms taking part in trials.
For entry into the sandbox, an applicant must demonstrate that it meets the following eligibility criteria:
- the applicant is in scope (ie, is the firm looking to deliver innovation which is either regulated business or supports regulated business in the UK financial services market?);
- the idea is a genuine innovation; there is a consumer benefit;
- there is a need for sandbox testing (eg, there is no alternative means of releasing the innovation to customers); and
- the applicant is ready for testing, in other words is the firm in a sufficiently advanced stage of preparation to mount a live test.
The sandbox is suitable for (i) firms who need to become authorised to trial their products and services, (ii) authorised firms, and (iii) technology firms that provide outsourced services to such firms.
In relation to unauthorised businesses, the FCA has set up a tailored authorisation process. Successful firms will be granted restricted authorisation that only allows them to test their ideas. These firms will still need to apply for authorisation and meet threshold conditions but only for the limited purposes of the sandbox test. This restricted authorisation option is not available to firms looking for a banking licence (these firms should contact the FCA and Prudential Regulation Authority's joint New Bank Start-up Unit).
The sandbox may also be useful for authorised firms looking for clarity around applicable rules before testing an idea that does not easily fit into the existing regulatory framework. The FCA has developed the following options:
- Individual guidance – The FCA can issue individual guidance to firms setting out how it interprets relevant rules in respect of testing activities the firms may be carrying out. Complying with this guidance will be taken as compliance with the aspects of the rules that the guidance relates to.
- Waivers or modifications to rules – To the extent it is within their power to do so, the FCA can waive or modify particular rules for sandbox firms. A waiver or modification would allow what would otherwise be a temporary breach of the FCA's rules. However, the FCA is limited in what it can waive by EU legislative requirements and this is not an option for firms not regulated under the Financial Services and Markets Act 2000 (eg, payment institutions).
No enforcement action letters (NALs)
– Where the FCA is not able to make use of the above tools, the FCA can issue a NAL stating that no FCA enforcement action will be taken against testing activities provided that the firm deals with the FCA openly, keeps to the agreed testing parameters and treats customers fairly. The FCA's commitment not to take enforcement action applies until the testing is completed or closed by the FCA. It is important to note that the NAL would not limit businesses liability to their customers.
B. SINGAPORE
The MAS was the second regulator in the world to release a consultation paper (6 June 2016) on the introduction of a regulatory sandbox regime. In contrast to the FCA, the MAS proposes to accept applications on a rolling basis (with a response time of 21 working days).
The MAS proposes to provide regulatory support by relaxing, on a case by case basis for each applicant, specific legal and regulatory requirements which the applicant would otherwise be subject to. Examples of these requirements are set out in Annex A of the consultation paper and are separated into two categories: (i) 'To Maintain' requirements (eg, confidentiality of customer information) and (ii) 'Possible to relax' requirements (eg, cash balances, management experience etc). However, the examples listed are not intended to be exhaustive, and the MAS has sought through the
consultation process suggestions for what other forms of support it could offer.
The proposed eligibility criteria is summarised as follows:
- the product is technologically innovative or applied in an innovative way;
- the product addresses a significant issue or brings benefits to consumers or the industry;
- the applicant intends, and has the ability, to deploy the product in Singapore on a broader scale upon exit;
- the test scenarios and outcomes are clearly defined and the applicant will report to MAS on progress as agreed;
- the boundary conditions are clearly defined and will sufficiently protect the interests of consumers and maintain the safety and soundness of the industry;
- major foreseeable risks arising from the product are assessed and mitigated; and
- the exit and transition strategy is clearly defined.
There is no proposed time limit on the duration of a sandbox, however, requests for an extension must be made at least one month before expiration with reasons to support the extension.
C. AUSTRALIA
ASIC released a consultation paper titled "Further measures to facilitate innovation in financial services" two days after the MAS issued the above discussed consultation paper. The proposed measures included a conditional, industry-wide exemption to allow new Australian businesses to test certain financial services for six months without holding an AFS licence (the industry-wide regulatory sandbox exemption). The proposed exemption would only apply to: (i) giving financial advice in relation to listed or quoted Australian securities, simple managed investment schemes and deposit products; or (ii) arranging for other persons to deal with these products. Existing AFS licensees are not eligible to rely on the exemption.
Certain restrictions and conditions also apply in relation to client and exposure limits and consumer protections (including the requirements to maintain adequate compensation arrangements and to be a member of an ASIC-approved external dispute resolution scheme).
Unlike other regimes discussed here which require an entity to apply to enter a sandbox, a business can rely on the industry-wide regulatory sandbox exemption by:
- notifying ASIC that it intends to rely on the exemption from a specified date;
- providing evidence of sponsorship from a sandbox sponsor (ie, a not-for-profit industry association or other Government-recognised entity, which has been approved by ASIC); and
- – declaring that it has reasonable grounds to expect that it can operate its business for six months from the specified date.
- At the end of the testing period, the business must provide a short report to ASIC about its test.
Applicants should bear in mind that the proposed exemption will co-exist alongside other powers ASIC already has to encourage fintech innovation. Notably, similar to the FCA's tools discussed above, ASIC has powers to exempt persons or products from the laws it administers as well as powers to modify how the laws apply. This means that even if an activity falls outside the scope of the industry-wide regulatory sandbox exemption, a business could apply for an individual exemption relating to its own circumstances.
D. MALAYSIA
Malaysia's consultation process for a regulatory sandbox ran from 29 July 2016 and closed most recently on 30 August 2016. In the consultation paper, the Central Bank of Malaysia stated that it would give priority to applications from financial institutions and fintech firms which intend to collaborate with financial institutions.
The proposed eligibility criteria is summarised as follows:
- the product is genuinely innovative;
- the product has clear potential to benefit Malaysia in certain areas;
- the applicant has assessed and demonstrated the usefulness and functionality of the product, and understands the associated risks;
- the applicant has the necessary resources to participate, as well to mitigate and control potential risks and losses;
- the applicant intends to deploy the product on a commercial scale in Malaysia upon exit; and
- the product cannot be offered to the market at present due to prohibitions under existing laws or regulations or incompatibility with applicable regulatory requirements.
Applicants must also fulfil certain minimum standards and requirements in relation to its governance and risk management arrangements. In particular, where an innovation relates to Islamic financial services, an applicant may need to obtain the views of Shariah experts.
CONCLUDING THOUGHTS
A regulatory sandbox is especially helpful for parties who want to bring their fintech products to the market but are grappling with regulatory uncertainty. Furthermore, entering into a sandbox offers potential opportunities to engage with regulators who in turn may use their increased insight and knowledge to create a more favourable environment for fintech firms. The benefits sandboxes could provide firms may also lead to better outcomes for consumers through, for example, an increased range of products and services, reduced costs and improved access to financial services.
However, sandboxes are yet to be implemented in Australia, Singapore and Malaysia, and the Hong Kong FSS regime is limited to AIs (although, as mentioned above, there may be more opportunities for non-AIs under the existing regulatory regime than meets the eye).
Given the differing approaches to sandboxes, in particular in relation to eligibility criteria and trial length, we recommend that firms take the time now to assess the different regimes. This will ensure firms are ready to act once regulators in Singapore and Malaysia finalise their sandbox regimes and applications open or, in the case of Australia, once the exemption commences.
After all, it isn't just the regulators who are racing to get ahead in the fintech space.
For further information, please contact:
William Hallatt, Partner, Herbert Smith Freehills
William.Hallatt@hsf.com