Regulatory sandboxes have become a fixture in the policy lexicon of financial innovation. The metaphor is tidy: a protected space where novel ideas can be tested under a regulator’s watchful eye, free from the full weight of compliance. It’s a comforting image, borrowed from childhood, and it suggests a kind of structured freedom. But the metaphor also hides a harder truth. Sandboxes are not miniature versions of the real world. They are deliberately simplified environments, and the very features that make them useful for early-stage testing also make their results stubbornly resistant to scaling.

Dr. Simone Ravel, a regulatory economist who has advised both central banks and fintech startups, has spent the better part of a decade studying what happens when sandbox graduates try to enter the broader market. Her conclusion is not that sandboxes fail. It’s that we misunderstand what they actually produce. “A sandbox is a learning tool, not a licensing shortcut,” she says. “When we treat it as a pipeline to full authorization, we set up both the firm and the regulator for disappointment.”

The Architecture of a Controlled Experiment

To grasp why scaling is so difficult, you first have to appreciate what a sandbox actually does. At its core, it’s a framework that lets a firm test an innovative product, service, or business model in a live market environment, but with specific safeguards and temporary regulatory relaxations. These relaxations are not exemptions from the law. They are conditional, closely monitored waivers of particular rules that would otherwise block the test entirely.

A typical sandbox cohort is small. A regulator might accept five to ten firms per cycle. Each firm operates under a tailored set of terms: a limited number of customers, a capped transaction volume, a defined geographic scope, and a fixed testing window, often six to twelve months. The regulator assigns a dedicated case officer who maintains near-constant contact with the firm. This intensive supervision is the sandbox’s real engine. It generates the qualitative data that both sides need to understand whether a novel business model can function within the existing regulatory perimeter, or whether the perimeter itself needs to shift.

This architecture is resource-heavy by design. It is not a mass-processing system. The United Kingdom’s Financial Conduct Authority, which pioneered the modern sandbox concept in 2016, has accepted fewer than 200 firms across all its cohorts. Other jurisdictions, from Singapore to Abu Dhabi, report similarly modest numbers. The constraint is not a lack of applicants; it’s the bandwidth of the regulator. Each sandbox entrant requires a bespoke testing plan, dedicated supervisory hours, and a detailed exit report. When policymakers ask how to “scale the sandbox,” they are often asking how to replicate this high-touch, low-volume model across an entire innovation ecosystem. The short answer is that you cannot—at least not without fundamentally changing what the sandbox is.

Why the Sandbox Model Resists Multiplication

The first barrier to scaling is the human factor. A sandbox officer at a financial authority is not a passive observer. She negotiates testing parameters, reviews real-time data, and makes judgment calls about consumer harm thresholds. This is skilled, senior-level work. A regulator with five sandbox firms might assign two or three full-time staff to the program. If the same regulator tried to accommodate fifty firms, the supervisory model would break. The quality of oversight would degrade, and with it, the sandbox’s legitimacy as a safe space for experimentation.

Second, the legal underpinnings of sandboxes are often fragile. In many jurisdictions, the regulator’s power to waive rules is limited, ambiguous, or subject to challenge. A sandbox operates within a narrow legal envelope, often relying on the regulator’s general discretion rather than a specific statutory mandate. Expanding that envelope requires legislative change, which is slow and politically fraught. Even where bespoke sandbox legislation exists, as in the UK’s Financial Services and Markets Act, the regulator must still justify each waiver as consistent with its statutory objectives. Scaling up means multiplying these justifications, each of which carries legal risk.

Third, the economics of sandbox participation do not favor mass adoption. For a startup, the sandbox offers a valuable signal: regulatory endorsement, investor confidence, and a structured path to market. But the process is also costly. Firms must dedicate significant time to application drafting, testing design, and ongoing reporting. For a regulator, the cost per firm is high. These costs are bearable when the goal is to learn about a new technology or business model. They become prohibitive if the sandbox is treated as a standard entry channel.

The Information Problem: What Sandboxes Actually Produce

Sandboxes generate two types of knowledge. The first is firm-specific: does this particular product work, and can this particular firm manage its risks? The second is systemic: what does this experiment reveal about the adequacy of the existing regulatory framework? The tension between these two knowledge types is at the heart of the scaling problem.

Firm-specific knowledge does not scale. The fact that one robo-advisory platform successfully navigated a sandbox tells you little about the next ten platforms, unless they are nearly identical. But the whole point of a sandbox is to accommodate novelty. Each new entrant brings a different technology, a different customer base, a different risk profile. The regulator cannot simply replicate the previous testing parameters; it must design a new set each time. This is not a process that benefits from economies of scale. It is, if anything, a process that becomes more complex as the variety of entrants increases.

Systemic knowledge, on the other hand, can scale. After testing several peer-to-peer lending platforms, a regulator may conclude that the existing disclosure rules are inadequate for this business model and propose a new, streamlined disclosure framework that applies to all P2P lenders, not just sandbox graduates. This is the sandbox’s true value: it generates the evidence base for regulatory adaptation. But this adaptation happens outside the sandbox, through traditional rulemaking processes. The sandbox itself does not scale; the lessons from it do.

The Exit Problem: From Sandbox to Market

Even when a sandbox test is successful, the transition to full authorization is rarely smooth. The sandbox environment, by design, limits the consequences of failure. Customer numbers are capped, transaction volumes are restricted, and the regulator is unusually accessible. When a firm exits the sandbox, these protections are removed. The firm must now comply with the full regulatory regime, often for the first time. It must scale its compliance infrastructure, its capital buffers, and its risk management frameworks to match its new, unrestricted operations.

This transition is not merely an administrative hurdle. It can reveal fundamental flaws in the business model that the sandbox conditions masked. A firm that thrived with 500 carefully selected customers may struggle to maintain the same risk controls with 50,000. A product that worked under daily regulatory check-ins may falter when left to quarterly reporting. The sandbox, in other words, does not prepare a firm for the market; it prepares the regulator to understand what the firm will need to survive in the market. The firm itself must do the heavy lifting of building a scalable compliance infrastructure, often with limited resources and under time pressure from investors who expect the sandbox “graduation” to trigger rapid growth.

This mismatch of expectations is a recurring source of friction. Regulators are sometimes accused of creating a “sandbox cliff,” where firms fall into a regulatory gap after their testing period ends. Some jurisdictions have responded with “green lanes” or transitional licensing regimes, but these are themselves complex to administer and risk creating a two-tier system that disadvantages firms outside the sandbox.

Cross-Border Sandboxes: A Coordination Challenge

One proposed solution to the scaling problem is the cross-border sandbox, where multiple regulators coordinate to test a firm’s product across jurisdictions. The logic is compelling: financial services are increasingly global, and a firm that wants to operate in several countries should not have to navigate a patchwork of separate sandbox regimes. In practice, however, cross-border sandboxes have proven exceptionally difficult to implement.

The Global Financial Innovation Network (GFIN), launched in 2019 with over 50 member regulators, has run several cross-border testing cohorts. The results have been modest. The primary obstacle is not technology but legal sovereignty. Each regulator remains bound by its own domestic laws, and the waivers granted in one jurisdiction have no force in another. A firm must still satisfy each regulator’s individual requirements, often with conflicting data privacy rules, consumer protection standards, and capital requirements. The sandbox becomes a multi-jurisdictional negotiation rather than a unified testing environment. The administrative burden on both the firm and the regulators multiplies, and the value of the “single test” diminishes.

In addition, cross-border sandboxes raise difficult questions about regulatory competition. If a firm can choose which regulator to approach first, it may gravitate toward the most permissive jurisdiction, using that sandbox’s endorsement as a bargaining chip with others. This dynamic can undermine the rigorous, learning-oriented ethos that makes domestic sandboxes valuable. Instead of a collaborative exploration of risks, the process becomes a race to the bottom in regulatory standards.

What Sandboxes Can and Cannot Do

Given these constraints, it’s worth stating plainly what sandboxes are good for and what they are not. A well-run sandbox excels at three things. First, it reduces the time and cost for a regulator to understand a genuinely novel business model. Instead of waiting for a full license application and then spending months deciphering the technology, the regulator learns alongside the firm in a controlled setting. Second, it provides a structured pathway for dialogue between innovators and supervisors, building mutual understanding that can inform future rulemaking. Third, it offers a limited safe harbor for firms whose activities fall into regulatory gray zones, allowing them to test without the existential threat of enforcement action.

What sandboxes cannot do is serve as a mass-processing system for innovation. They cannot replace the need for clear, proportionate regulatory frameworks that apply to all market participants. They cannot, on their own, solve the problem of regulatory fragmentation across borders. And they cannot guarantee that a successful sandbox test will translate into a viable, compliant business at scale.

Policymakers who wish to support innovation at scale would do better to focus on the broader regulatory environment. This means simplifying licensing processes for low-risk activities, issuing clear guidance on how existing rules apply to new technologies, and investing in the supervisory technology that allows regulators to monitor more firms with fewer resources. Sandboxes can inform these efforts, but they are not a substitute for them.

Frequently Asked Questions

What is the primary purpose of a regulatory sandbox?

A regulatory sandbox is designed to allow firms to test innovative products or services in a controlled environment with temporary regulatory relaxations. Its primary purpose is to enable regulators and firms to learn about new technologies and business models, assess their risks, and determine whether existing regulations need to be adapted, all while protecting consumers from harm.

Why can’t sandboxes simply accept more firms to scale up?

Scaling a sandbox is not a matter of increasing the number of participants. Each sandbox test requires intensive, bespoke supervision from experienced regulatory staff, tailored legal waivers, and detailed reporting. The resource demands on the regulator grow disproportionately with each additional firm, and the quality of oversight would degrade if the model were simply expanded without a corresponding increase in regulatory capacity and legal authority.

What happens to a firm after it graduates from a sandbox?

After a sandbox test, a firm must apply for full authorization to operate in the market. This transition can be challenging because the firm must now comply with all regulatory requirements without the sandbox’s protections, such as customer number caps or close supervisory support. The firm needs to scale its compliance infrastructure, and the regulator must assess whether the business model remains viable under full regulatory conditions.

Can sandboxes work across multiple countries?

Cross-border sandboxes are theoretically appealing but practically difficult. Each regulator operates under its own legal framework, and waivers granted in one jurisdiction do not apply in another. Coordinating testing parameters, data-sharing rules, and consumer protection standards across borders adds significant complexity. While initiatives like the Global Financial Innovation Network attempt to address this, the results have been limited so far.

The Quiet Work of Regulatory Adaptation

There is a temptation, in policy circles, to treat the sandbox as a kind of regulatory technology itself—a tool that can be optimized, scaled, and exported. This framing misses the point. A sandbox is not a machine; it is a conversation. Its value lies in the depth of the exchange between a regulator and a firm, the granular understanding that emerges from months of close observation, and the trust that is built through repeated interaction. These are inherently human, inherently slow processes. They do not scale in any straightforward way, and attempts to force them to do so risk hollowing out the very qualities that make them useful.

Dr. Ravel often points to a less visible but more consequential trend: the quiet integration of sandbox insights into mainstream supervisory practice. Regulators who have run multiple cohorts develop a sharper intuition for the risks of new technologies. They update their guidance, train their frontline staff, and adjust their data requirements. These changes are incremental and unglamorous, but they affect the entire market, not just the handful of firms that passed through the sandbox. “The real impact of a sandbox,” she says, “is not measured by the number of firms that graduate. It is measured by how much the regulator learns, and how quickly that learning changes the rules for everyone.”

This is a less satisfying metric for politicians and industry associations that want to see tangible outputs: firms authorized, products launched, investments attracted. But it is a more honest one. The sandbox is a research tool, not a production line. Its success should be judged by the quality of the knowledge it generates and the speed with which that knowledge is translated into better regulation. By that standard, many sandboxes are performing well. The challenge is not to scale them, but to protect the conditions that allow them to keep learning.