Requirements for an effective Sandbox in Spain

Introduction

The Spanish banking industry supports the establishment of a national regulatory testing environment, or sandbox, as a necessary instrument to foster innovation in financial services.

The regulatory sandbox can be a very powerful tool for both the private sector and the Spanish financial authorities, insofar as it enables mutual learning about the risks and opportunities of applying new technologies and developing new business models, while also benefiting consumers and society at large.

One of the main challenges facing the design of a regulatory sandbox relates to the tools that the supervisory authorities of the testing environment must have in order for it to be implemented successfully. These tools must be ambitious, but also proportionate and supported by an appropriate legal framework.

The functions of the sandbox authority should include:

Providing regulatory flexibility or certainty to projects accepted into the sandbox, through:

• Case-by-case guidance on how to interpret and apply the existing regulatory framework;
• Commitments not to take enforcement action during the testing period, provided that the company complies with the conditions agreed in advance;
• Temporary approvals during the testing period;
• Temporary exemption from, or modification of, non-critical rules;
• Monitoring innovation performance in the sandbox to ensure compliance with the agreed parameters and to understand its risks and benefits.

In addition, in the sandbox, the innovative company and the competent authorities must work shoulder to shoulder to define risk-mitigation mechanisms and consumer safeguards for those participating in the tests.

Types of projects

Experience to date in other countries provides extensive information on the nature of projects that can be tested in existing testing environments. A distinction can therefore be made between projects that involve testing the application of new technologies in traditional business, and others that entail changes to business models.

Among the former, it is worth highlighting the use of distributed ledger technologies (DLTs) for international payments, biometric technologies for identification methods, the use of online platforms to provide certain banking services, or the use of mobile applications to improve access and the experience of the most vulnerable consumers (savings, payment of basic utilities, receipt of social benefits, debt management, etc.). In fact, of the 41 products/services that have been assessed or are currently being tested in the UK sandbox, 17 are based on DLTs.

Among the latter, projects developing automated financial advice services (robo-advice) stand out, as do others involving new forms of collaboration between large companies and fintech start-ups to share data in order to offer new tools to customers and improve their experience. Tests of new methods for calculating insurance premiums in the insurance sector, based on the additional information provided through the use of new technologies, also stand out.

The UK experience can inspire us to draw some conclusions on how the regulatory framework can become more flexible and provide certainty in the context of a sandbox. We believe these conclusions could also inspire a future sandbox in Spain.

Practical considerations

• In general, experience in the United Kingdom shows that the aim of most projects is to test the application of new technologies in existing businesses, where such use is not envisaged or recognised in the regulations.
• In these same cases, measures to protect the customer sample are as important as, if not more important than, the regulatory flexibility granted by the Sandbox authority. For example, applying new technologies such as blockchain or artificial intelligence to new banking services may not require specific regulatory flexibility, but it does require a rigorous protection scheme for the customer sample participating in the project.
• For many projects, joint participation or cooperation between several supervisory agencies is the most relevant part of the project and is precisely what provides the necessary “regulatory certainty”. For example, for projects involving biometric-based solutions, coordination between SEPBLAC and the AEPD would be of interest, and for projects involving financial tools using external big data analytics, coordination between the banking supervisor and the AEPD would be advisable.

Regulatory certainty

For certain projects, it is already valuable simply for a sandbox to be able to provide regulatory certainty to innovative companies wishing to test the application of certain innovations. In many cases, certainty will be needed due to the absence of a legal regime, and in others because it is unclear how the existing legal regime applies. Therefore, among the tools available to the supervisory authority of the sandbox to provide regulatory certainty may be those already being applied in other jurisdictions with testing environments in place, such as:

• Case-by-case guidance on how to interpret and apply the existing regulatory framework.
• Commitments not to take enforcement action during the testing period, provided that the company complies with the conditions agreed in advance.

Licence exemption regime or temporary licences

From international experience we know that the sandbox is used largely by start-ups (as opposed to banks or incumbents), many of which do not have prior authorisation or an operating licence from the supervisor. Therefore, one of the tools made available to the national sandbox authority could consist of a system of temporary exemptions to operate without a licence, or the granting of temporary licences restricted to a specific activity and to a defined duration and volume of activity. This would be subject to simplified requirements, with the aim of testing the viability and commercial acceptance of a new innovative product or one with clear benefits for the consumer.

In any event, the national sandbox should consider on equal terms all applications for licence exemption or temporary authorisation submitted by companies without an operating licence, regardless of whether or not those companies belong to companies or corporate groups that already hold licences enabling them to carry out that activity. This is important because, in the case of banks, developing innovative products through new companies entails multiple advantages that foster innovation: greater flexibility in internal procedures (for example, in supplier contracting), the possibility of developing projects jointly with other partners (for example, start-ups), and isolation of risks from the rest of the institution.

“Exemption” regime or temporary modification of the rule

Although in many cases applying a new technology in financial services may not require a change to, or exemption from compliance with, any specific rule, the reality is that in other cases it may be a convenient measure. Therefore, it is necessary to provide the supervisory authority with sufficient flexibility to assess the possible proportionate application of any legal provision in force.

It is therefore important that, within the framework of the testing and innovation procedures established at national level, the authorities have the power to authorise, on a temporary basis, innovative (and proportionate) ways of complying with the spirit of the rules. This, however, must be conditional on:

• appropriate protection schemes being defined for the customers in the sample, and
• the objective being set to identify and promote the market implementation of those solutions that provide a clear benefit to the consumer or the market in general. To this end, after the testing period in the sandbox ends, the authorities should identify any relevant regulatory changes and address the measures needed to implement them.

Conclusions

In summary, the banking industry understands that, for the regulatory sandbox to realise its full potential in our market, several premises must be met:

• The purpose of this instrument must be to facilitate innovation in financial services, with the aim of improving the market and enabling supervisory and regulatory activity to adapt to new technological challenges.
• The authorities must be equipped with a set of flexible tools and sufficient legal backing to be able to accept and supervise innovative projects. The greater the capacity and resources available, the broader the range of projects tested and the lessons learned by all participants, including the authorities.
• There must be a commitment from all those participating in the testing environment: companies must commit to ensuring that their projects comply with the established rules, including measures to protect the consumer sample, and the authorities must proactively receive the results and take the necessary steps so that the project can become a reality in the national market, or where appropriate, in the European market.