Beyond the Sandbox
Why Regulatory Sandboxes and Innovation Hubs Must Build Capability—not Just Run Pilots
Financial innovation is often narrated as a technology story. Artificial intelligence, tokenisation, digital assets, embedded finance, open finance, digital identity, cloud infrastructure, and next-generation payment systems all promise to reshape how financial services are designed and delivered.
Yet technology alone rarely determines whether a fintech innovation succeeds. A solution can be technically sophisticated, commercially attractive and successful in a limited pilot, but still fail to achieve responsible market adoption. It may encounter unclear regulatory requirements, weak digital infrastructure, institutional resistance, fragmented data, customer mistrust, inadequate consumer safeguards, or misalignment among the organisations needed to make the solution work.
This is why regulatory sandboxes and innovation hubs deserve to be understood differently. They are not merely programmes through which fintech firms seek guidance or test products. At their best, they are strategic learning infrastructures: mechanisms through which regulators, innovators, financial institutions and wider ecosystem participants develop the knowledge, relationships and capabilities needed to turn technological possibility into trusted and durable value.
“The sandbox is not the innovation. Its real value lies in whether it helps institutions and ecosystems become better able to respond to innovation.”
Financial innovation is an ecosystem outcome
A useful starting point is that responsible fintech adoption is a system outcome. It depends on the interaction of technology, regulatory enablement, institutional capability, infrastructure, trust and ecosystem collaboration.
Technology creates new possibilities. It can reduce transaction costs, improve speed and convenience, expand access, enhance transparency, support new business models, or enable more personalised financial products. But technical viability does not automatically create public value.
Regulatory enablement provides clarity on the rules of the game. It helps innovators understand expectations around licensing, consumer protection, operational resilience, data use, cybersecurity, anti-money-laundering controls, conduct, market integrity and prudential safety. Good regulation is not the absence of regulation. It is regulation that is proportionate, risk-based, transparent and able to evolve as markets change.
Institutional capability is equally important. Banks, regulators, insurers, payment providers and public bodies need relevant skills, data, governance arrangements, supervisory tools, decision processes and leadership commitment. A fintech innovation cannot be integrated at scale if an institution lacks the operational, technical or risk-management capacity to adopt it.
Trust is the decisive factor that is sometimes overlooked. Financial services involve people’s money, identities, savings, creditworthiness and personal data. Customers, firms, investors and regulators need confidence that a new solution is reliable, understandable, secure, fair and accountable.
Finally, fintech is inherently collaborative. A digital-finance proposition may depend on banks, fintech firms, regulators, central banks, payment operators, telecoms providers, cloud providers, digital-identity systems, cybersecurity specialists, investors, universities and customers. The ability to coordinate this ecosystem is often more important than the novelty of the technology itself.
The regulator’s innovation dilemma
Financial regulators operate under a difficult but necessary dual mandate. They must allow useful innovation to emerge while protecting consumers, market integrity, fair competition, data privacy, operational resilience and financial stability.
The dilemma is real. Excessive caution can slow beneficial change, discourage responsible market entry, and leave regulators with limited insight into how emerging technologies are being used. Excessive permissiveness can expose consumers and markets to poorly understood risks. Neither extreme is effective.
The policy objective, therefore, is not deregulation. It is adaptive regulation: an approach that preserves essential safeguards while using evidence, dialogue and structured experimentation to understand innovation before it becomes widespread.
This is where innovation hubs and regulatory sandboxes can play a valuable role.
An innovation hub generally provides a structured channel through which regulated and unregulated firms can engage with an authority, seek clarification on regulatory questions and obtain non-binding guidance. A regulatory sandbox is usually a more intensive and time-bound environment in which an eligible innovation can be tested under defined conditions, safeguards and oversight.
The two mechanisms are different, but complementary. An innovation hub is usually the front door: it enables dialogue, regulatory navigation, early engagement and market intelligence. A sandbox is one potential pathway for innovations that need controlled testing. It should not become the entire regulatory innovation strategy.
Beyond the pilot trap
The conventional sandbox journey is often presented as a simple sequence: application, admission, testing and exit.
This sequence is necessary, but it is not sufficient.
A sandbox may produce well-managed pilots without creating meaningful policy change. It may help an individual firm test a proposition but leave the wider market without clarity on authorisation, standards, data access, interoperability or consumer-protection expectations. It may reveal recurring issues but fail to transfer lessons from the sandbox team to the legal, supervisory, licensing, consumer-protection and policy functions of the authority.
This is the pilot trap: activity is mistaken for institutional progress.
The number of applications received, firms admitted, cohorts launched or events held may show that a programme is active. They do not show whether the regulator is learning, whether financial institutions are becoming more capable, whether customers are better protected, or whether responsible innovations can move beyond a limited test.
A pilot is an event. Institutional learning is a capability.
To escape the pilot trap, a sandbox must be designed from the beginning with a pathway from experimentation to a meaningful outcome. That outcome may be a clearer route to authorisation or market entry, a partnership with a regulated financial institution, improved controls and consumer safeguards, better guidance for the wider market, a change in supervisory or licensing processes, a policy review, or a well-evidenced decision not to proceed.
Even a test that does not result in commercial scale can generate valuable public learning—provided that its lessons are captured, shared and translated into institutional action.
Sandboxes as learning infrastructure
A mature sandbox should be understood as a strategic learning infrastructure rather than a standalone programme.
First, it enables structured experimentation. It produces evidence about a proposition’s real-world demand, operational feasibility, risks, customer experience and control environment.
Second, it enables regulatory learning. That learning should be translated into guidance, licensing approaches, supervisory practice, policy reform, or clearer expectations for the wider market.
Third, it develops institutional capability. Authorities need people with the right skills, cross-functional governance, data and analytical tools, technology awareness, and mechanisms for making timely decisions.
Fourth, it develops networks. A trusted relationship between a regulator and innovator can be valuable, but the wider network must also include banks, technology providers, investors, researchers, legal experts and consumer voices.
Finally, it should create credible adoption pathways. A test should end with clear options: authorisation, partnership, further development, revised controls, a policy response, or closure.
The real cycle is therefore not merely application, test and exit. It is experimentation, learning, capability development, policy adaptation and responsible adoption.
World Bank guidance similarly cautions policymakers not to assume that a sandbox is automatically the right intervention. Authorities should define the policy objective, assess market and institutional conditions, identify risks, choose an appropriate response and measure outcomes.
Overcoming regulatory path dependency
The concept of path dependency from innovation management is highly relevant to financial regulation and supervision. Institutions often develop rules, workflows, skills and decision-making processes that are well suited to established markets and familiar business models. These arrangements may remain valuable, but they can become difficult to adapt when technology changes the structure of the market.
Path dependency can appear through regulatory frameworks designed for earlier business models, legacy supervisory and licensing processes, fragmented mandates, internal silos, limited technical or data capability, and risk cultures that favour “approve or prohibit” over structured learning.
It can also appear through incentives that treat innovation as peripheral to core institutional work. When that happens, lessons from innovators may remain isolated in one unit, while the systems that determine authorisation, supervision, consumer protection, data governance and operational resilience continue unchanged.
The challenge is not to discard regulatory principles. Consumer protection, financial stability, integrity, fair treatment, accountability and resilience remain central. The leadership challenge is to ask whether the tools used to achieve these objectives remain fit for purpose.
Innovation hubs and sandboxes can create a controlled setting in which regulators test assumptions, engage directly with innovators, observe real risks and refine their understanding. They can help authorities determine which issues require regulatory change, which require clearer guidance, which require better supervision, and which require market participants to strengthen their controls.
In this sense, a sandbox can function as an instrument for overcoming path dependency. It gives institutions a controlled way to learn before making wider changes.
Hidden champions in the fintech ecosystem
Formal governance is essential. Innovation mechanisms require a clear mandate, accountability, eligibility criteria, safeguards, decision rights, documentation and oversight. But formal structures alone do not make an innovation ecosystem work.
Progress often depends on hidden champions: people who may sit outside formal project hierarchies but can connect different perspectives, translate complex ideas, build trust and maintain momentum.
In a fintech-policy environment, a hidden champion might be a policy lead who turns market insight into institutional priorities. It may be a supervisory or legal specialist who translates regulatory requirements into practical guidance. It may be an innovation manager who connects technology, risk, compliance, licensing and consumer-protection teams. It may also be a trusted convenor who brings regulators, banks, fintechs, investors and researchers into constructive dialogue.
These actors are boundary spanners. They help people with different mandates, incentives and technical languages develop a shared understanding of the problem.
This matters because a financial innovation can easily fail through misalignment. A fintech may be focused on speed and user experience. A financial institution may be focused on operational integration and risk. A regulator may be focused on legal authority, consumer protection and system-wide risk. A hidden champion helps bridge these perspectives before they become barriers.
Leaders should therefore identify, empower and connect boundary spanners. If the learning generated by a hub or sandbox remains dependent on a small group of individuals, it will remain fragile. The aim should be to embed their insights into institutional routines, systems and capabilities.
Building dynamic regulatory capabilities
The strategic value of innovation hubs and sandboxes can also be understood through the lens of dynamic capabilities: the ability of an organisation to sense change, seize opportunities and transform itself in response.
To sense change, regulators need mechanisms to identify technology trends, market developments, consumer needs, innovation barriers and emerging risks early. Innovation hubs can provide valuable intelligence because they create recurring dialogue with market participants before formal applications, authorisations or enforcement issues arise.
To seize opportunities, authorities must select an appropriate response. A sandbox is not always the correct tool. Depending on the challenge, the better response may be non-binding guidance, bilateral engagement, a thematic working group, an accelerator, a policy consultation, a cross-border collaboration, a licensing clarification, or supervisory capability development.
To transform, learning must lead to institutional change. This may involve improving policy, supervisory processes, staff skills, data tools, risk-assessment methods, governance arrangements, coordination across agencies or public–private partnerships.
The cycle is simple but demanding: sense, seize, transform—and repeat. A sandbox that supports only testing is incomplete. A sandbox that helps an authority sense, seize and transform becomes part of an adaptive regulatory capability.
Designing for institutional adoption
The design of an innovation hub or sandbox should start with strategy rather than branding. Before launching a programme, policymakers should be clear about the public-policy problem they want to solve and whether an innovation facilitator is the most appropriate response.
First, define the purpose. Is the objective to improve financial inclusion, enable secure digital payments, understand AI-related risks, support responsible open finance, develop a response to digital assets, or address another clearly defined market need?
Second, establish a clear mandate. The authority needs the legal powers, institutional ownership and accountability needed to engage with the market and make decisions.
Third, determine the scope. Policymakers should be clear about the innovations, sectors, risks and user groups that are within the mechanism’s remit.
Fourth, put governance in place. There must be clarity about who decides, who supervises, who manages risk, who escalates issues and who captures institutional learning.
Fifth, use disciplined eligibility criteria. A sandbox should not become a general accelerator for all startups. It should focus on cases that demonstrate genuine innovation, possible public value, material regulatory uncertainty, testing readiness and a credible need for controlled experimentation.
Sixth, design safeguards. Testing must protect customers, data, market integrity and financial stability through appropriate limits, disclosures, consent, reporting, monitoring and remediation arrangements.
Seventh, define the data and evidence required. Authorities should know in advance what information will be gathered during and after the test and how it will support decision-making.
Eighth, build partnerships intentionally. Meaningful testing may require financial institutions, infrastructure providers, telecoms operators, cloud providers, cybersecurity specialists, investors, researchers or consumer representatives.
Ninth, design the exit and scale pathway from the start. The conclusion of a test should be clear: authorisation, partnership, further development, policy clarification, revised controls, a transition to ordinary regulatory processes, or closure.
Finally, embed institutional learning. The mechanism should have a deliberate process for translating outcomes into better guidance, supervision, policy, skills, governance and ecosystem engagement.
International guidance on sandbox design similarly emphasises the importance of objectives, feasibility, governance, eligibility, testing safeguards, exit procedures and measurable outcomes. [web:20][web:24]
Measuring what matters
Traditional programme metrics are easy to collect but can be misleading. Counting applications, participants, pilots and events may indicate activity, but it does not necessarily indicate success.
A stronger evaluation approach asks whether the mechanism has improved regulatory learning. Has it resulted in clearer guidance, better policy, stronger supervisory tools or a more informed view of emerging risks?
It should examine institutional capability. Have staff developed relevant skills? Has collaboration improved across licensing, policy, risk, consumer-protection, data and technology teams? Has the authority strengthened the tools it uses to understand new business models?
It should examine responsible adoption. Have firms gained clearer routes to authorisation, partnership or market entry? Have testing insights improved products, controls or customer safeguards?
It should assess public value. Has the mechanism supported inclusion, affordability, usability, transparency, resilience or better outcomes for SMEs and underserved customers?
It should also assess ecosystem trust. Are firms receiving clearer expectations? Are authorities gaining better market intelligence? Are public and private actors more willing and able to collaborate constructively?
Success is not simply whether every participant scales. Responsible innovation sometimes means identifying risks early, changing a business model, delaying deployment, or deciding that a proposition should not proceed. A credible innovation mechanism treats those outcomes as learning—not failure.
The leadership imperative
The future of finance will be shaped by emerging technologies, but it will be determined by institutions and ecosystems that can respond to them intelligently. The leadership challenge is to make innovation both ambitious and responsible: ambitious enough to address persistent problems in access, cost, efficiency, resilience and inclusion; responsible enough to protect consumers, markets and public trust.
Innovation hubs and regulatory sandboxes can support this ambition when they are designed as more than administrative mechanisms. They can become platforms for better intelligence about technological and market change, more proportionate and informed regulation, stronger supervisory and institutional capability, trusted public–private relationships, clearer pathways from experimentation to adoption, and a more resilient and inclusive financial-innovation ecosystem.
The ultimate output is not the sandbox, the cohort, the pilot or the innovation event.
It is a regulator and ecosystem that are better prepared to learn, adapt and guide change.
“When a fintech innovation remains stuck in pilot mode, the most important question may not be whether the technology works. It may be whether the institutions, relationships and trust required for responsible adoption are ready.”
Closing reflection
For regulators, financial institutions and innovators, the strategic question is no longer whether fintech will change the financial system. It already is.
The more important question is whether our institutions can create the conditions in which innovation becomes trusted, inclusive, well-governed and scalable.
That is the real promise of an effective innovation hub or regulatory sandbox: not merely to test the future, but to build the capacity to govern and adopt it responsibly.