PDF Download 
Debajyoti Chakravarty, “Charting the Growth and Aspirations of India’s Fintech Regulatory Sandboxes,” ORF Issue Brief No. 827, Observer Research Foundation, August 2025.
Sandboxes have emerged as a crucial tool in fostering innovation while maintaining regulatory oversight in the rapidly evolving financial technology (or fintech) landscape. The need for such sandboxes stems from the unprecedented growth of the global fintech sector, which attracted US$95.6 billion[1] in investments globally in 2024 and is projected to become a US$1.5-trillion industry by 2030.[2] This growth is particularly pronounced in countries like India, with its fintech market expected to rise from US$689 billion in 2023[3] to US$2.1 trillion by 2030. Government initiatives, robust digital infrastructure such as Unified Payments Interface (or UPI, which on average processes over 500 million transactions daily[4]), and increasing institutional support have contributed to this growth. However, such rapid innovation brings with it challenges of regulation, consumer protection, and financial stability.
Recognising this reality, countries have begun to look for mechanisms to enable innovation while managing associated risks. The concept of a regulatory sandbox, first introduced by the United Kingdom’s (UK) Financial Conduct Authority in 2016 and soon adopted by Singapore, emerged as a solution.[5] With over 70 sandboxes operating in nearly 60 countries today, they have proven to be effective in enabling safe and responsible innovation while ensuring that regulations evolve in tandem with technological advancements.[6]
A regulatory sandbox serves as a vital instrument in the evolving financial ecosystem, offering a controlled environment[7] where fintech companies and financial institutions can test innovative products, services, and business models under the supervision of regulators. Sandboxes operate with temporary regulatory relaxations, allowing limited-scale experimentation without the burden of full compliance, which is especially beneficial for startups introducing disruptive technologies.[8]
The key elements of a sandbox include regulatory oversight, defined timeframes, clear entry and exit criteria, and structured feedback mechanisms. They enable regulators to assess the risks and benefits of new financial technologies before large-scale adoption. Furthermore, they play a significant role in addressing broader social objectives, such as enhancing financial inclusion by testing solutions tailored to underserved communities. By allowing real-world testing, sandboxes provide regulators and innovative companies with valuable insights, help mitigate risks like fraud and data breaches, and support the formulation of informed, future-ready regulations.
For India, where the fintech market is expected to grow at a Compounded Annual Growth Rate (CAGR) of 18 percent, sandboxes have become even more important. With its broader goal of growing to a US$5-trillion economy by 2028-2029,[9] regulatory sandboxes introduced by the RBI (Reserve Bank of India), SEBI (Securities and Exchange Board of India), IRDAI (Insurance Regulatory and Development Authority), and IFSCA (International Financial Services Centres Authority) play a critical role. They help achieve the dual goals of promoting responsible innovation while ensuring the policy objectives of boosting key sectors and enabling regulators to keep pace with fast-evolving technologies. This makes fintech sandboxes a catalyst for growth as well as a strategic necessity for India’s economic ambitions.
India’s fintech regulatory landscape has been shaped by the RBI[10] regulatory sandbox, the oldest among the country’s sandboxes. Subsequently, key regulators such as SEBI, IRDAI,[11] and IFSCA[12] have established their own sandboxes to promote responsible innovation. These frameworks have collectively fostered a conducive environment for fintech development, each adopting varied methods while maintaining broadly similar objectives. The earlier steps taken, especially by the RBI, have set the template and shaped much of the thinking around regulatory sandboxes in India. This foundational influence continues to guide newer sandbox models and policy approaches across regulatory institutions in the country.
The RBI’s Regulatory Sandbox is governed by the ‘Enabling Framework for Regulatory Sandbox’, first issued in August 2019 and subsequently updated, most recently, in February 2024. The journey toward this framework began with the establishment of the Inter-Regulatory Working Group on Fintech and Digital Banking in July 2016, which studied the impact of fintech solutions on financial markets[13] and recommended a sandbox approach in its 2017 report, which was released publicly in 2018. Drawing from the United Kingdom’s (UK) 2016 sandbox principles, the RBI’s framework provided India’s first regulated space for fintech innovations to be tested in a controlled environment.
This sandbox allows entities, such as companies, startups, banks, and Limited Liability Partnerships (LLPs) to experiment with new financial products or enhance existing ones under regulatory supervision. It adopts a cohort-based model focusing on themes like retail payments, regtech (Regulatory Technology), suptech (Supervisory Technology), and financial fraud. Amendments over time have included many enabling changes, like eligibility (e.g., the net worth requirement lowered to INR 10 lakh) and expanded features such as ‘on tap’ applications and extended testing durations. The framework balances innovation and regulation, encouraging the development of impactful fintech solutions while safeguarding market stability and consumer interests.
Table 1: Milestones in RBI’s Fintech Sandbox Regulation
| Date | Intervention | Findings and Outcomes |
| 14 July 2016 | Inter-regulatory Working Group on Fintech and Digital Banking[14] | It aimed to evaluate the implications of fintech solutions on the financial system, identify suitable regulatory responses, and recommend a balanced framework that fosters innovation while managing associated risks. The Working Group submitted its report in November 2017. |
| 8 February 2018 | Report of the Working Group on FinTech and Digital Banking[15] | A key recommendation specified establishing a controlled environment (well-defined space)[a] for testing fintech innovations (Regulatory Sandbox), enabling the regulator to offer guidance while monitoring risks. |
| 13 August 2019 | Enabling Framework for Regulatory Sandbox[16] | The 2019 RBI framework established India’s first regulated testing space for fintech innovations (cohort/theme-based), enabling safe experimentation under supervision. It promoted early risk mitigation and sustainable innovation while setting a minimum net worth of INR 25 lakh to ensure the financial credibility of participants. |
| 16 December 2020 | Enabling Framework for Regulatory Sandbox[17] | A key change was to lower the minimum net worth of participants to INR 10 lakh to enable greater inclusion and participation of applicants who would have been previously discouraged due to a higher financial benchmark. |
| 8 October 2021 | Enabling Framework for Regulatory Sandbox[18] | The list of potential fintech products/services for sandbox testing was expanded to include regtech and suptech. This officially broadened and updated the list of innovative products/services from which applications could be invited (via notified cohorts) to align it with the global innovative landscape. |
| 28 February 2024 | Enabling Framework for Regulatory Sandbox[19] | The RBI broadened its indicative list of case-specific ‘regulatory relaxations’ to include ‘statutory restrictions’. It also, for the first time, introduced ‘theme-neutral’ as a potential cohort theme. This will allow eligible fintech innovation across all the “various functions in RBI’s regulatory domain” to access its sandbox simultaneously. |
Source: Author’s own, compiled from RBI notifications.
At its inception, the RBI sandbox stipulated that it would seek to promote certain ‘themes’. This cohort-based approach is presented in Table 2 and reflects its priority themes till date. This cohort/ theme-based approach has subsequently become ‘theme neutral’, allowing a broader spectrum of applications across multiple themes to be received.
Table 2: RBI’s Regulatory Sandbox Cohorts and Their Themes
| Sequence of Cohorts | Date of Announcement | Cohort Theme | Findings | Entities Selected |
| Cohort 1 | 4 November 2019 | Retail Payments[20] | The RBI’s adoption of Retail Payments as the theme of the 1st cohort aimed to intentionally drive innovation in digital payments, enhancing accessibility for unserved and underserved populations. By promoting digital transactions, the RBI sought to reduce the costs of a cash-based economy while ensuring a seamless, friction-free payment experience for consumers. This theme, along with its sub-themes,[21] fosters financial inclusion and strengthens India’s digital payments ecosystem, making transactions more efficient, secure, and widely accessible. | Out of the 32 entities that applied under this cohort, only 6 were selected for the Test Phase by the RBI.[22] |
| Cohort 2 | 16 December 2020[23] | Cross-Border Payments | The RBI’s second cohort under its regulatory sandbox, themed ‘Cross-Border Payments’, aimed to drive innovation in remittance and forex transactions. With India being the largest recipient of remittances, this initiative sought to leverage new technologies for a low-cost, secure, efficient, and transparent payments system. It was expected to enhance the speed and reliability of cross-border transactions, reshaping the payments landscape for businesses and individuals alike. | Out of the 27 applications from 26 entities received, 8 had been selected for the test phase[24] from which 4 have completed the same and were deemed fit for adoption by ‘Regulated Entities’.[25] |
| Cohort 3 | 16 December 2020[26] | MSME Lending | Out of the 22 applications received by the RBI, 8 entities were selected[27] for the test phase. From this, 5 products successfully passed the test scenarios and generated the “expected outcomes”,[28] and were deemed fit for adoption by Regulated Entities. | |
| Cohort 4 | 8 October 2021[29] | Prevention and Mitigation of Financial Frauds[30] | The RBI’s 4th cohort aimed to enhance fraud governance in digital payments. Given the challenges of financial fraud affecting user trust and bank retention, this initiative sought to leverage Fintech innovations/solutions to reduce fraud response time and detection lag. Strengthening security measures would safeguard consumer interests, foster confidence in digital payments, and support India’s vision of a safe and efficient payment ecosystem. | Out of the 9 applications received, 6 entities were selected for the test phase.[31] Of this, three products successfully passed the ‘test scenarios’[32] and were deemed fit for adoption by Regulated Entities. |
| Cohort 5 | 5 September 2022[33] | Theme-Neutral[34] | Out of the 22 applications received, five entities were selected for the test phase.[35] |
Source: Author’s own, compiled from RBI notifications.
If this present theme-neutral focus is retained in the future, it may further contribute towards accelerating fintech innovation as a whole. While the years 2019-2021 focused on a particular theme-based cohort, there was hope that applications representing other closed themes would also receive due consideration through the “on-tap” mechanism of applications. The theme application criteria in this sandbox further boost the process of broader and continuous innovation in various fintech areas under the domain of the RBI.[36]
Fintech companies participating in the RBI’s Regulatory Sandbox, however, may face certain data localisation challenges due to overlapping legal frameworks. Clause 6.2[b]]< and 8.2[c]]< of its Enabling Framework for Regulatory Sandbox[37]]< (2024) mandate compliance with data privacy norms, specifically the Digital Personal Data Protection Act (DPDPA), 2023. While the DPDPA does not impose strict data localisation,[38]]< it adopts a ‘whitelist-blacklist’ mechanism allowing data transfers between countries, unless restricted by the government. However, Section 16 permits sector-specific regulations to override its provisions.[39]]<
This flexibility clashes with the RBI’s 2018 Directive on ‘Storage of Payment System Data’,[40]]< which requires that all payment data,[41]]< such as end-to-end transaction details[d]]< be stored within India. Though limited exceptions exist for cross-border transactions where data copies may be stored abroad, the core requirement enforces domestic data storage.[42]]<
This dichotomy may create significant hurdles for sandbox participants developing cross-border payments solutions. While the sandbox aims to foster innovation and financial inclusion, participants must navigate strict RBI localisation norms that may hinder increased testing of globally-integrated fintech solutions. The lack of harmonisation between the sector-specific RBI directives and the broader DPDPA complicates compliance, inevitably increasing such costs, especially for startups without the now mandatory infrastructure for dual data storage. Consequently, while the DPDPA appears progressive, the RBI’s stringent data localisation requirements limit the operational flexibility needed in sandbox experiments, thereby posing a regulatory bottleneck for fintech innovation in the cross-border space.
However, this differs from global best practices. In the UK’s[e] fintech regulatory sandbox[43] by the Financial Conduct Authority (FCA),[44] firms may process data after establishing a clear legal basis, such as consent[45] or legitimate interest, along with compliance with privacy protection norms, such as mandatory breach notification and accountability requirements, among others. International data transfers are allowed under ‘adequacy decisions’[46] of the UK with respective countries (e.g., EU[f]-UK adequacy agreement[47]) or by implementing ‘mechanisms’[48] under Article 46. like ‘Standard Contractual Clauses’, in its absence.[g] There is no requirement to store data within UK borders, allowing for cross-border fintech innovation while maintaining high privacy standards.
Similarly, for Singapore’s sandbox overseen by the Monetary Authority of Singapore[49] (MAS), all data transfer is compliant with the Personal Data Protection (Amendment) Act, 2020[50] (PDPA).[51] Sandbox participants only need to ensure strong data protection without localisation.[52] Valid consent,[53] data security, and breach reporting within three[54] days form the basis for data processing in Singapore. Cross-border data transfers[55] are allowed if the receiving party ensures protections[56] comparable to the PDPA.
Both jurisdictions focus on accountability, security, and privacy by design, enabling secure international data flows. In contrast, India’s sector-specific mandates, like the RBI’s payment data localisation rule, limit data mobility despite the broader flexibility of the Digital Personal Data Protection Act, 2023. The UK and Singapore thus promote innovation through flexible, principles-based data governance without rigid localisation.
Table 3 illustrates the differences between the RBI and the other succeeding sandboxes of India. While the RBI set the template and the path ahead for the emergence of further sandboxes under other regulators, namely SEBI, IRDAI, and IFSCA, it has brought into relief distinct challenges of its own.
Table 3: Sandboxes in India: Key Differences
| Findings | RBI | SEBI | IRDAI | IFSCA |
| Mandatory Provisions | The RBI’s sandbox is accessible to fintech companies, banks, and LLPs that have a minimum net worth of INR 10 lakh and fulfil the ‘Fit and Proper’ criteria. | SEBI’s Innovation Sandbox is for entities that are not under its regulation, and its Regulatory Sandbox for SEBI-registered firms, both aimed at innovations in the securities sector. | IRDAI limits participation to insurers and intermediaries who meet the specific net-worth requirements set by the authority. | IFSCA stands out by allowing participation from both Indian and foreign entities. Indian entities must be registered with DPIIT or meet equivalent compliance requirements, while foreign entities need to be incorporated in FATF(Financial Action Task Force)-compliant jurisdictions. Through its frameworks like the IoRS and Fintech Bridges, it facilitates cross-border financial innovation, giving it a unique global focus. |
| Focus Area | Live testing of financial technologies is conducted within specific cohorts or themes that are pre-determined by the RBI. | Securities genre-based innovation: · Market data provided for offline testing in its Innovation sandbox · Live testing in the securities market through the regulatory sandbox | IRDAI promotes fintech innovation in the insurance sector through its regulatory sandbox that provides temporary regulatory relaxations. | With a global perspective, IFSCA drives fintech innovation in India’s IFSC through various sandbox initiatives such as the IFSCA, the FinTech Regulatory Sandbox (FRS), and the IFSCA FinTech Innovation Sandbox (FIS). It also supports international partnerships via the IFSCA Overseas Regulatory Referral Mechanism and ‘Fintech Bridges’, while enabling domestic inter-regulatory cooperation through the Inter operable Regulatory Sandbox (IoRS), where the IFSCA acts as the Principal Regulator. |
| Time Frame | 9-month participation cycle | Innovation sandbox: 24 months, Regulatory sandbox: 12 months | IFSCA Regulatory sandbox: 12 months (may be extended for another 6 months upon application) | |
| Consumer Protection | The RBI requires testing fintech companies to inform test users about potential risks and provide compensation if needed, and adhere to data privacy regulations. | The SEBI ensures that test users have rights equivalent to regular market consumers and mandates the use of the SEBI Complaint Redressal System for addressing grievances, and requires fintech firms to publish detailed risk management plans. | The IRDAI emphasises maintaining data confidentiality and holds applicants fully accountable for any risks posed to consumers. | The IFSCA’s Regulatory Sandbox mandates the disclosure of compensation schemes upfront and requires users to give informed consent regarding disclosed risks. Its Innovation Sandbox does not have these requirements. In contrast to other regulators, IFSCA uniquely enforces pre-established compensation structures to ensure participant protection. |
Source: Author’s own, compiled from notifications.
India’s evolving regulatory sandbox ecosystem, featuring the RBI, SEBI, IRDAI, and IFSCA, reflects a promising yet diverse approach to fostering fintech innovation. While each regulator maintains distinct sectoral mandates, such as IRDAI focusing on insurance and RBI and SEBI emphasising sector- and cohort-specific innovations, this diversity also opens up opportunities for targeted growth. Notably, the IFSCA stands out for its inclusive and globally-oriented strategy, integrating enabling features from other sandboxes and welcoming both Indian and international fintech entities. Initiatives like the IFSCA FinTech Regulatory Sandbox, the FinTech Innovation Sandbox, and mechanisms such as Fintech Bridges and the Overseas Regulatory Referral Mechanism showcase its commitment to global collaboration. The development of the IoRS with IFSCA as the Principal Regulator−with work underway for forming another[57] between RBI, SEBI, IRDAI, IFSCA, and PFRDA[58]−signals growing momentum towards inter-regulatory synergy.
Nonetheless, with multiple regulators, each overseeing distinct sectors, navigating compliance requirements may prove cumbersome for nascent firms, particularly those with cross-sectoral innovations. RBI and SEBI impose stringent participation criteria and focus on sector-specific innovations, while IRDAI restricts its sandbox to the insurance sector, and IFSCA allows participation from both Indian and foreign entities.
A harmonised framework could, thus, further amplify this progressive growth trajectory by streamlining compliance, encouraging cross-sector experimentation, and accelerating the adoption of innovative fintech solutions.
There are clear and meaningful contrasts between the technical capacities offered and required in Indian fintech sandboxes. Some of the international best practices particularly the regulatory sandboxes of certain European Union (EU) member states, are worth noting. The Indian sandbox framework, particularly the RBI’s Regulatory Sandbox, is designed primarily as a regulatory flexibility mechanism and not a technical testing environment. The RBI does not provide any shared infrastructure such as testing platforms, data access, or API environments. The guidelines explicitly state that the RBI “shall not provide technology testbed and/or data for testing of the product/services/technology”,[59] leaving the technical deployment responsibility to the applicant. Applying entities need to possess a robust IT (Information Technology) infrastructure, technological readiness for real-world deployment, secure transaction capabilities, and compliance with requirements related to local data storage, customer privacy, and KYC (Know Your Customer)/AML (Anti-Money Laundering) norms.
SEBI’s dual sandbox framework shows a slight divergence. Its Innovation Sandbox, intended for unregulated entities, provides access to anonymised historical market data[60] via APIs, as well as virtual machines mimicking live environments, thereby constituting a limited technical test bed. However, the Regulatory Sandbox (for SEBI-regulated firms) mirrors the RBI’s model, allowing experimentation with real users under regulatory oversight but without infrastructural support.[61]
In contrast, the EU’s sandbox ecosystems offer a more mature and technically supportive environment to its participating entities. According to its 2023 report titled ‘Update on the Functioning of Innovation Facilitators: Innovation Hubs and Regulatory Sandboxes’,[62] several National Competent Authorities (NCAs) have built dedicated digital infrastructures for enterprises to test their products and services, besides providing a controlled regulatory environment.
For example, Poland’s Financial Supervision Authority (UKNF) operates a Virtual PSD2 Sandbox and a Virtual DLT Sandbox, both of which provide full-fledged technical environments that simulate payment systems and blockchain networks, respectively. These sandboxes offer participants access to real-time feedback tools, testbeds based on open-source technologies like the Hyperledger (HLF) Fabric platform for HLF blockchain solutions, and secure environments with identity verification and smart contract monitoring. EU regulators are also encouraged to develop harmonised test planning support, chatbot-based interfaces for engagement, and even internal testing teams to assist fintech companies in preparing their applications. All of these are signs of operational maturity.
India’s sandboxes emphasise compliance and imply the need for a high degree of self-sufficiency, given the limited provision of testing tools. Applicants are expected to have near-market-ready products and must furnish their own testing capabilities. In contrast, European sandboxes, especially in countries like Poland, France, and Portugal, aim to serve as technical incubators that lower the infrastructure burden on startups by providing controlled virtual environments, expert testing assistance, and real-time monitoring tools. This support is particularly beneficial for early-stage startups or those based in academic and research institutions, which tend to lack prior regulatory experience. The EU’s approach also actively facilitates cross-border learning through collaborative forums, hackathons, and partnerships with universities.
Even as India works towards strengthening its domestic sandbox systems, it has begun to enter into collaborations with certain foreign regulators. The objective of these partnerships is to promote joint innovation, share knowledge, and provide access to potential new markets for startups and fintech entities.
The fintech-focused cooperation between Singapore and India has evolved from state-level engagements to a comprehensive national framework. This reflects a deepening of the bilateral relationship between the two states’ fintech sectors. Beginning with the 2016 agreement between MAS and the Government of Andhra Pradesh, followed by the 2018 Memorandum of Understanding (MoU) with Maharashtra, the focus was on encouraging responsible innovation, capacity building, and local ecosystem development in cities like Visakhapatnam and Mumbai. These early initiatives laid the groundwork for broader collaboration through the pan-India MoU between MAS and the Department of Economic Affairs, which institutionalised a Joint Working Group to align digital strategies and foster fintech innovation. The 2022 agreement between MAS and IFSCA marked a significant milestone by enabling cross-border regulatory sandboxes[63] testing, allowing fintech firms to operate and scale across jurisdictions.
Table 4: Singapore’s Fintech Engagement with India
| State-Level Engagements | Central-Level Engagements |
| The Fintech Cooperation Agreement[64] between MAS and the Government of Andhra Pradesh (2016) | The MoU between the Department of Economic Affairs, Government of India, and the MAS to create a Joint Working Group[65] |
| An MoU[66] between MAS and the Government of Maharashtra (2018) | Fintech Cooperation Agreement[67] between MAS and the International Financial Services Centres (IFSCA) in 2022 |
The key focus areas of cooperation have included joint innovation projects, digital payments, blockchain, big data, and fintech education (through state-level engagements), and regulatory harmonisation through the pan-India entities. This partnership highlights the power of phased, multi-level cooperation, leveraging regulatory alignment and talent development to foster innovation. The model offers a replicable blueprint for other nations by demonstrating how bilateral cooperation can build global competitiveness, encourage responsible innovation, and create scalable fintech ecosystems through shared regulatory infrastructure and joint experimentation frameworks like the envisioned Global Regulatory Sandbox.[68]
The India-UAE (United Arab Emirates) Comprehensive Economic Partnership Agreement[69] (CEPA) of 2022 showcases a progressive vision for digital trade and financial integration, with a strong emphasis on fintech collaboration. A key highlight is the promotion of fintech innovation through the use of regulatory sandboxes, enabling controlled environments for testing new financial technologies. This facilitates safer experimentation and faster deployment of cutting-edge solutions. Article 9.17[70] further encourages competition by supporting non-bank digital payment systems. The agreement’s flexibility to adapt to evolving digital trends makes it a robust model for international cooperation, fostering inclusive, efficient, and secure financial ecosystems through digital connectivity and innovation.
India's rapidly evolving fintech sector holds significant promise for global leadership, but it faces several structural, regulatory, and strategic challenges that need to be addressed to realise this potential. The following recommendations aim to foster international collaboration, streamline domestic regulatory frameworks, and enhance transparency to create a more innovation-conducive fintech ecosystem.
To mitigate these systemic issues, an overarching uniform regulatory framework[82] could be devised, which might enable a coordination mechanism/body consisting of all extant regulatory sandboxes, i.e., the RBI, SEBI, IRDAI, and IFSCA, to streamline sandbox testing for cross-sectoral innovations, implementing minimum uniform criteria for regulatory sandboxes, including eligibility, duration, consumer protection measures, and compliance exemptions, while allowing sector-specific flexibility. This may reduce uncertainty and encourage greater participation from startups and investors. Furthermore, it may proactively enable partnerships between Indian regulators and global regulatory bodies to facilitate international sandbox testing in line with the international collaborations envisaged and built by the IFSCA. It may also establish an information-sharing framework among regulators to derive insights from sandbox testing and track the progress of all sandboxes, thereby guiding evidence-based policy reforms in the sector.
India’s fintech ecosystem holds immense potential for growth and expansion. This could take place through a combination of domestic reforms, on one hand, and strategic international collaborations, on the other. Partnerships with fintech hubs like Singapore, the UAE, the UK, Australia, and South Korea offer models for regulatory harmonisation, cross-border data governance, and sandbox interoperability. These alliances can drive innovation and talent mobility. However, India faces internal barriers, including data localisation mandates that counter the integrated aspirations of the DPDPA, fragmented regulatory sandboxes, and inconsistent frameworks across sectors. These issues may hinder startups and cross-border fintech initiatives.
To overcome this challenge, India could adopt a unified principles-based data governance model while allowing temporary localisation exemptions within regulatory sandboxes, and providing early-stage compliance assistance. Establishing a consolidated inter-regulatory body with standardised sandbox frameworks to enable streamlined cross-sector testing is essential. Transparent tools such as whitepapers and progress reviews would enhance credibility and improve policy outcomes. Through these reforms, India could develop a resilient, inclusive, and globally competitive fintech ecosystem.
[a] The ‘Report of the Working Group on FinTech and Digital Banking’ (2018) does not explicitly chalk out the avenues of sandbox-guided innovation nor the duration of such sandboxes. However, it is based on this report’s recommendation for a sandbox-aided and guided innovation in certain areas of fintech, applicable for a certain duration of time, that RBI has adopted its system of ‘cohorts’ (genres of innovation) in which innovators may apply to get their fintech product/solution market ready and opt for adoption within a set period.
[b] “6.2 Regulatory Requirements/Relaxations for Applicants: … the requirements that shall mandatorily be complied with by the applicants are given below:
[c] 8.2 The sandbox entity must process all the data in its possession or under its control concerning RS testing, under the provisions of Digital Personal Data Protection Act, 2023.
[d] 2(i) All system providers shall ensure that the entire data relating to payment systems operated are stored in a system only in India. This data should include the full end-to-end transaction details / information collected / carried / processed as part of the message / payment instruction. For the foreign leg of the transaction, if any, the data can also be stored in the foreign country, if required.
[e] The UK General Data Protection Regulation (GDPR) and Data Protection Act (DPA), 2018 govern personal data handling in the UK fintech regulatory sandbox (FCA).
[f] At present, India is not included among the countries with whom EU enjoys adequacy agreements.
[g] The UK government designates countries/jurisdictions as “adequate” which is then reviewed periodically, renewed or revoked by the same. If there is no formal adequacy decision in place for a jurisdiction, other mechanisms set out in the UK GDPR and the DPA 2018 may be relied upon to transfer personal data out of the UK. These include, among others, using Article 46 “mechanisms” ensuring that the data controller or processor provides “appropriate safeguards” regarding data subject rights and legal remedies for the same.
[1] KPMG, Pulse of Fintech H2’24Global Analysis of Fintech Funding, February 2025, 2025, https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2025/02/pulse-of-fintech-h2-2024.pdf
[2] BCG, Fintech Projected to Become a $1.5 Trillion Industry by 2030, May 2023, New York, Boston Consulting Group, 2023, Fintech Projected to Become a $1.5 Trillion Industry by 2030
[3] PWC ASSOCHAM, Fintech – Powering India’s USD 5 Trillion Economy by Fostering Innovations, Enabling Inclusion and Building a Sustainable Future, July 2024, New Delhi, PWC ASSOCHAM, 2024, FinTech – powering India’s USD 5 trillion economy by fostering innovations, enabling inclusion and building a sustainable future
[4] Paytm UPI, “RBI Aims to Increase Daily UPI Transactions by 50%,” https://paytm.com/blog/payments/upi/rbi-upi-target-1-billion-cbdc-testing/#:~:text=UPI%20Transactions%20Set%20to%20Reach%201%20Billion,to%20the%20National%20Payments%20Corporation%20of%20India
[5] World Bank, Global Experiences From Regulatory Sandboxes Finance, Competitiveness & Innovation Global Practice Fintech Note No. 8, Washington DC, World Bank Group, 2020, https://documents1.worldbank.org/curated/en/912001605241080935/pdf/Global-Experiences-from-Regulatory-Sandboxes.pdf
[6] Samir Saran and Anirban Sarma, GeoTechnoGraphy: Mapping Power and Identity in the Digital Age (New Delhi: Penguin Viking, 2025).
[7] Mohamed Kamal Zaraba, “Regulatory Sandboxes: Fostering Innovation,” Infomineo, October 26, 2023, https://infomineo.com/technology-telecommunication/regulatory-sandboxes-fostering-innovation/
[8] World Bank, Ivo Jeník and Schan Duff, How to Build a Regulatory Sandbox A Practical Guide For Policy Makers, Washington DC, World Bank Group, 2020, https://documents1.worldbank.org/curated/en/126281625136122935/pdf/How-to-Build-a-Regulatory-Sandbox-A-Practical-Guide-for-Policy-Makers.pdf
[9] Saubhadra Chatterji and Rajeev Jayaswal, “Finance Ministry Charts Path To $5 Trillion By FY29,” Hindustan Times, January 11, 2025, https://www.hindustantimes.com/india-news/finance-ministry-charts-path-to-5-trillion-by-fy29-101736535106237.html#:~:text=In%20its%20note%2C%20the%20finance,be%20achieved%20by%202028%2D29
[10] FinTech Department, “Enabling Framework for Regulatory Sandbox,” Reserve Bank of India, https://www.fidcindia.org.in/wp-content/uploads/2019/06/RBI-ENABLING-FRAMEWORK-FOR-REGULATORY-SANDBOX-28-02-24.pdf.
[11] Gazette of India, “IRDAI (Regulatory Sandbox) Regulations 2025,” IRDAI, https://irdai.gov.in/document-detail?documentId=6541188 .
[12] IFSCA Circular, “Framework For FinTech Entity in the International Financial Services Centres (IFSCs),” IFSCA, https://www.ifsca.gov.in/Document/Legal/fe-framework_27-04-202227042022122844.pdf .
[13] Reserve Bank of India, Government of India, https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=37493
[14]Reserve Bank of India, Government of India, https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=37493
[15] RBI, Report of the Working Group on FinTech and Digital Banking, Mumbai, Reserve Bank of India, 2018, https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&ID=892
[16] RBI, Enabling Framework for Regulatory Sandbox, Mumbai, Reserve Bank of India, 2019, https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&ID=938#5
[17] “Enabling Framework for Regulatory Sandbox”
[18] “Enabling Framework for Regulatory Sandbox”
[19] “Enabling Framework for Regulatory Sandbox”
[20]Bhumika Indulia, “Reserve Bank Announces the Opening of First Cohort Under the Regulatory Sandbox,” SCC Times, November 5, 2019, https://www.scconline.com/blog/post/2019/11/05/reserve-bank-announces-the-opening-of-first-cohort-under-the-regulatory-sandbox/
[21] Reserve Bank of India, Government of India, https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=48550
[22] Reserve Bank of India, Government of India, https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=50665
[23] Reserve Bank of India, Government of India, https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=50814
[24] Reserve Bank of India, Government of India, https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=52218
[25] Reserve Bank of India, Government of India, https://www.rbi.org.in/scripts/BS_PressReleaseDisplay.aspx?prid=54057
[26] Reserve Bank of India, Government of India, https://fintech.rbi.org.in/FS_PressRelease?prid=52219&fn=2765
[27] Reserve Bank of India, Government of India, https://fintech.rbi.org.in/FS_PressRelease?prid=53813&fn=2765
[28] Reserve Bank of India, Government of India, https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=56638
[29] Reserve Bank of India, Government of India, https://fintech.rbi.org.in/FS_PressRelease?prid=52371&fn=2765
[30] Reserve Bank of India, Government of India, https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=53814
[31] Reserve Bank of India, Government of India, https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=54996
[32] Reserve Bank of India, Government of India, https://rbi.org.in/scripts/BS_PressReleaseDisplay.aspx?prid=58117
[33] Reserve Bank of India, Government of India, https://fintech.rbi.org.in/FS_PressRelease?prid=54315&fn=2765
[34]Reserve Bank of India, Government of India, https://rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=56637
[35] Reserve Bank of India, Government of India, https://rbi.org.in/scripts/BS_PressReleaseDisplay.aspx?prid=58377
[36] Reserve Bank of India, Government of India, https://fintech.rbi.org.in/FS_PressRelease?prid=54315&fn=2765
[37] “Enabling Framework for Regulatory Sandbox”
[38] Anahad Narain, “The Future of Cross-Border Data Transfers Under the DPDP Act,” Leegality, July 10, 2024, https://www.leegality.com/consent-blog/cross-border-data-transfer#:~:text=upcoming%20DPDP%20Rules.-,Sector%2DSpecific%20Laws,the%20foreign%20country%20if%20necessary
[39] Anchal Chhallani, “Data Localisation Laws in India,” TeamLease, February 28, 2025, https://www.teamleaseregtech.com/blogs/119/data-localization-laws-in-india/#:~:text=The%20DPDP%20Act%20forms%20the,to%20certain%20countries%20or%20territories
[40] Reserve Bank of India, Government of India, https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11244&Mode=0
[41] “RBI’s New Data Localisation Directive for the Financial Industry,”Leegality, July 29, 2025, https://www.leegality.com/blog/https-leegality-com-blog-rbis-new-data-localisation-directive-for-the-financial-industry
[42] Agama Law Associates, “Data Localization Laws in India: Balancing Compliance With Global Business Operations,” Mondaq, March 6, 2025, https://www.mondaq.com/india/data-protection/1594030/data-localization-laws-in-india-balancing-compliance-with-global-business-operations
[43] David Brennan, Sushil Kuner and Samantha Holland, “Fintech Laws and Regulations 2024 – United Kingdom,” Global Legal Insights, September 10, 2024, https://www.globallegalinsights.com/practice-areas/fintech-laws-and-regulations/united-kingdom/
[44] Financial Conduct Authority, “Regulatory Sandbox,” https://www.fca.org.uk/firms/innovation/regulatory-sandbox
[45] David Shoneand David Ives, “Fintech Laws and Regulations United Kingdom 2024-2025,” ICLG, July 2, 2025, https://iclg.com/practice-areas/fintech-laws-and-regulations/united-kingdom
[46] Department for Science, Innovation and Technology, “Guidance: The UK Approach to International Data Transfers,” GOV.UK, https://www.gov.uk/government/publications/uk-approach-to-international-data-transfers/international-data-transfers-building-trust-delivering-growth-and-firing-up-innovation
[47] European Commission, European Union, https://ec.europa.eu/commission/presscorner/detail/en/ip_21_3183
[48] Information Commissioners Office, “A Guide To International Transfers,” https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/
[49] Lim Chong Kin and Benjamin Gaw, “Fintech Laws and Regulations 2024 – Singapore,” Global Legal Insights, September 10, 2024, https://www.globallegalinsights.com/practice-areas/fintech-laws-and-regulations/singapore/
[50] Government Gazette, Republic of Singapore, https://sso.agc.gov.sg/Acts-Supp/40-2020/
[51] “PDPA: The Personal Data Protection Act of Singapore Explained,” Perforce, January 1, 2021, https://www.perforce.com/blog/pdx/personal-data-protection-act-singapore-pdpa
[52] Wendy Wysong and Ali Burney, “Singapore Data Protection: Considerations For Data Driven Compliance Activities,” Steptoe, February 1, 2021, https://www.steptoe.com/en/news-publications/singapore-data-protection-considerations-for-data-driven-compliance-activities.html.
[53] Linklaters, “Data Protected- Singapore,” https://www.linklaters.com/en/insights/data-protected/data-protected---singapore
[54] Kenneeth Pereire and Lin Ying Xin, “Fintech Laws and Regulations Singapore 2024-2025,” ICLG, July 7, 2025, https://iclg.com/practice-areas/fintech-laws-and-regulations/singapore
[55] Anas Baig, Salma Khan and Aman Rehan, “An Overview of Singapore’s Personal Data Protection Act (PDPA) of 2012,” Securiti, August 16, 2024, https://securiti.ai/what-is-pdpa-singapore/
[56]DLA piper, “Transfer in Singapore,” DLA Piper Intelligence, https://www.dlapiperdataprotection.com/?t=transfer&c=SG
[57] Pension Fund Regulatory and Development Authority, Government of India, https://www.pfrda.org.in/WriteReadData/Links/IORS%20SOP%202bb80ec0d-22a4-4d9a-a43f-1d1732c99a6f.pdf
[58] Debajyoti Chakravarty, “Powering Fintech: The Case for Unified Regulatory Sandboxes in India,” Observer Research Foundation, April 16, 2025, https://www.orfonline.org/expert-speak/powering-fintech-the-case-for-unified-regulatory-sandboxes-in-india
[59] “Enabling Framework for Regulatory Sandbox”
[60] Securities and Exchange Board of India, “Framework for Innovation Sandbox,” Securities and Exchange Board of India, https://www.sebi.gov.in/legal/circulars/may-2019/framework-for-innovation-sandbox_43027.html
[61]Securities and Exchange Board of India, “Revised Framework for Regulatory sandbox,” Securities and Exchange Board of India, https://www.sebi.gov.in/legal/circulars/jun-2021/revised-framework-for-regulatory-sandbox_50521.html
[62] European Securities and Market Authority, Update on the Functioning of Innovation Facilitators- Innovation Hubs and Regulatory Sandboxes (European Securities and Market Authority, 2023), https://www.esma.europa.eu/sites/default/files/2023-12/ESA_2023_27_Joint_ESAs_Report_on_Innovation_Facilitators_2023.pdf
[63]Ian Hall, “Singapore and Indian Authorities Look To Boost Cross-Border Fintech Innovation,” Global Government Fintech, September 27, 2022, https://www.globalgovernmentfintech.com/singapore-and-indian-authorities-look-to-boost-cross-border-fintech-innovation/
[64]Monetary Authority of Singapore, Government of Singapore, https://www.mas.gov.sg/news/media-releases/2016/singapore-and-the-government-of-andhra-pradesh-ink-fintech-cooperation-agreement
[65] Monetary Authority of Singapore, Government of Singapore, https://www.mas.gov.sg/news/media-releases/2018/singapore-and-india-advance-in-fintech-cooperation
[66] Monetary Authority of Singapore, Government of Singapore, https://www.mas.gov.sg/news/media-eleases/2018/closerfintechcooperationbetweenmaharashtraandsingapore
[67] Monetary Authority of Singapore, Government of Singapore, https://www.mas.gov.sg/news/media-releases/2022/mas-and-ifsca-to-pursue-cross-border-fintech-innovations
[68] Vinod Rai, “MAS-IFSCA Cooperation Agreement: Landmark Partnership in FinTech,” National University of Singapore, September 23, 2022, https://www.isas.nus.edu.sg/papers/mas-ifsca-cooperation-agreement-landmark-partnership-in-fintech/
[69] Ministry of External Affairs, Government of India, “Comprehensive Economic Partnership Agreement between the Government of the Republic of India and the Government of the UAE,” https://www.moec.gov.ae/documents/20121/1347101/Final+Agreement_UAE+India+CEPA.pdf.
[70] Ministry of External Affairs, Government of India, “The India-UAE Comprehensive Economic Partnership Agreement,” https://www.moec.gov.ae/documents/20121/1347101/EN_Ministry+of+Economy+Handbook_FINAL.pdf
[71] FinTech Australia, “What is Fintech?,” https://www.fintechaustralia.org.au/what-is-fintech
[72] Archana Rao, “Australia’s Strategic Investments in India’s Fintech, Space Sectors,” India Briefing, December 23, 2024, https://www.india-briefing.com/news/australias-strategic-investments-in-indias-fintech-space-sectors-35530.html/#:~:text=Australia%20has%20established%20itself%20as,Unified%20Payments%20Interface%20(UPI).
[73] Australian Government, “Fintech Our fintech innovators Are Global Contributors,” https://international.austrade.gov.au/en/do-business-with-australia/sectors/technology/fintech#:~:text=Australia’s%20unique%20success,-Australians%20are%20great&text=Our%20A%2445%20billion%20fintech,%2410%20trillion%20financial%20services%20sector
[74] Ministry of Commerce & Industry, Government of India, https://www.pib.gov.in/PressReleasePage.aspx?PRID=2019643#:~:text=The%20JCM%20meeting%20also%20addressed%20certain%20critical,agreements%20in%20professions%20like%20nursing%20and%20dentistry.&text=Overall%2C%20the%20JCM%20reaffirmed%20the%20commitment%20of,enhanced%20cooperation%20and%20prosperity%20for%20both%20nations
[75] Julie Choi, “Fintech In South Korea: An Intro To The Country’s Fintech Scene,” Tenity, June 17, 2024, https://www.tenity.com/blog/fintech-korea
[76] Hannah Dobson, “Pulse of Fintech– UK Perspective,” KPMG, 2025, https://kpmg.com/uk/en/insights/fintech/pulse-of-fintech-h2-2024.html#:~:text=UK%20fintech%20investment%20hits%20four,provider%20Zepz%20in%20H2’24.
[77] “RBI Selects 5 Entities Under Its Regulatory Sandbox Scheme,” The Economic Times, July 26, 2024, https://economictimes.indiatimes.com/news/economy/finance/rbi-selects-5-entities-under-its-regulatory-sandbox-scheme/articleshow/112047076.cms?from=mdr
[78] Financial Conduct Authority, “Regulatory Sandbox Accepted Firms,” Government of UK, https://www.fca.org.uk/firms/innovation/regulatory-sandbox/accepted-firms
[79] Shubhangi Pathak and Priya Mishra, “Differences Between Regulatory Sandbox Provision Of IRDAI, SEBI and RBI,” Mondaq, August 20, 2019, https://www.mondaq.com/india/financial-services/838320/differences-between-regulatory-sandbox-provision-of-irdai-sebi-and-rbi
[80] Reserve Bank of India, Government of India, https://www.rbi.org.in/Scripts/bs_viewcontent.aspx?Id=4196.
[81]Team Finserv, “Inter-Operable Regulatory Sandbox: A Playground For Fintechs ?,” Vinod Kothari Consultants, June 19, 2023, https://vinodkothari.com/2023/06/inter-operable-regulatory-sandbox-a-playground-for-fintechs/#_ftn2
[82] Shehnaz Ahmed and Krittika Chavaly, “How Do We Boost Technological Innovation in Financial Services?,”Vidhi, March 6, 2020, https://vidhilegalpolicy.in/research/blueprint-of-a-fintech-regulatory-sandbox-law-textit-recommends-that-india-shouldand-participate-in-an-inter/
The views expressed above belong to the author(s). ORF research and analyses now available on Telegram! Click here to access our curated content — blogs, longforms and interviews.
Debajyoti Chakravarty is a Research Assistant at ORF’s Center for New Economic Diplomacy (CNED) and is based at ORF Kolkata. His work focuses on the use ...
Read More +
PREV
