A sandbox is a legal device for suspending, temporarily and conditionally, rules that would otherwise prevent an untested product from reaching customers. GIFT IFSC’s version was rebuilt in March 2026. The IFSCA FinTech Sandbox Framework, issued by circular dated 16 March 2026, supersedes all previous sandbox provisions in IFSCA’s circulars, frameworks, guidelines and regulations, while preserving actions taken under them and allowing entities with a valid limited use authorisation under the 2022 FinTech Entity Framework to continue under that framework for its remaining validity.

Four Doors, One Authorisation

The framework offers access to four testing routes across banking, capital markets, insurance, fund management and other segments:

• FinTech Regulatory Sandbox (FRS): a controlled live testing environment with a limited set of real customers for a limited time, in which specified regulatory provisions may be relaxed or disapplied for the purpose of the experiment;
• FinTech Innovation Sandbox (FIS): a testing environment isolated from the live market, in which an entity develops or tests ideas using market-related data made available by financial institutions operating in IFSCs;
• Inter-Operable Regulatory Sandbox (IoRS): a mechanism for testing hybrid products falling within the remit of more than one domestic financial sector regulator, being the RBI, SEBI, IRDAI and PFRDA; and
• Overseas Regulatory Referral, or FinTech Bridge: a co-operation mechanism between IFSCA and an overseas regulator to help sandbox entities operate in each other’s jurisdictions.

Entry to any of them is through a single instrument: a Limited Use Authorisation granted to a FinTech Sandbox Entity (FSE).

Who May Apply

Indian applicants, including from the IFSC, may be a company under the Companies Act, 2013, an LLP, a partnership firm, or a branch of any of these in the IFSC; a DPIIT-registered fintech start-up; an entity regulated by a domestic financial sector regulator; or an individual or group of individuals affiliated with a recognised research or academic institution, incubator or accelerator in India.

Foreign applicants must be based, incorporated or operating in a jurisdiction not identified by the FATF as a “High-Risk Jurisdiction subject to a Call for Action”, and must be a legal person or individuals affiliated with a recognised research or academic institution, incubator or accelerator.

Substantively, the applicant must propose the use of innovative technology in its core product, service, business model, distribution model or methodology for financial products or services regulated or likely to be regulated by IFSCA, or in products that aid or assist such activities. The idea must have the potential to significantly enhance existing financial services and there must be a genuine need to test it in a controlled environment. The proposal must set out direct benefits to users or the ecosystem and adequate risk management strategies.

One practical instruction deserves emphasis: before applying, an applicant must explore whether the IFSCA (TechFin and Ancillary Services) Regulations, 2025 apply to its product or solution. The sandbox is not a substitute for an available authorisation route.

The Application Path

1. Preliminary Application through the SWIT portal. IFSCA examines it within thirty days to assess suitability.
2. Final Application, permitted only after IFSCA communicates acceptance of the preliminary application, with the fee under the applicable IFSCA fee circular.
3. Evaluation against criteria including the applicant’s profile, the innovation, identified benefits, test scenarios and expected outcomes, risk-graded testing conditions, disclosure and user protection, clearly defined user rights and grievance redressal, prior user confirmation of risks, consumer protection and responsible data management, feasibility of deployment after testing, the post-testing deployment and monitoring strategy or exit strategy, and the applicant’s intent to undertake market exploration within the IFSC.
4. Regulatory relaxations must be specified and supported in the application; IFSCA may grant, refuse or modify them.
5. In-Principle Approval within sixty days if the application satisfies the conditions. The applicant then has thirty days, unless extended, to satisfy the specified conditions, one of which may be having at least one Testing Partner.
6. Limited Use Authorisation, granted at IFSCA’s discretion, subject to Boundary Conditions which may restrict duration, customer type, transactions and geographic scope.

The Testing Stage

Testing runs for a maximum of twelve months, extendable by a further six months at IFSCA’s discretion on written request.

During testing, the FSE must:

• disclose to users what is being tested and inform them in writing of potential key risks, obtaining acknowledgment that the risks have been read and understood;
• disclose whether compensation will be provided for potential losses, with the applicable protection and compensation terms, and obtain express written consent before engaging users;
• obtain prior written approval for any material change bearing on the authorisation;
• submit a monthly status report by the 10th of the succeeding month, together with key performance indicators, milestones and statistics, key issues from fraud or operational incident reports, and remedial actions;
• submit a final report within thirty days of expiry of the testing stage, covering outcomes, incident reports and complaint resolution, and key learnings;
• maintain records of tests for seven years from exit; and
• disclose within fifteen days any order of a regulatory authority restraining, prohibiting or debarring it, or otherwise having a material bearing on the financial services market.

On money and books: the FSE must transact only in the foreign currencies specified in the First Schedule to the IFSCA (Banking) Regulations, 2020, may maintain an INR account for administrative expenses, must keep records and accounts in a declared freely convertible currency other than INR, must report financial information in US dollars, and must furnish certified audited annual financial statements within thirty days of finalisation, with sandbox-specific financials or an independent professional’s certificate.

Exit and Revocation

The Limited Use Authorisation, and the relaxations granted with it, expire at the end of the testing stage. An FSE may apply to exit early with written reasons, but may exit only if permitted, and must ensure that all existing obligations to users are fully complied with or addressed before exiting or discontinuing testing.

IFSCA may revoke the authorisation before completion where the FSE obtained it on incomplete or wrong information, fails to put in place risk mitigating measures, submits false, misleading or inaccurate information, contravenes statutory or regulatory requirements in a way that adversely affects its functioning in the IFSC, or suffers a loss of reputation likely to affect user engagement, among other grounds.

What the Framework Does and Does Not Give

It gives a time-limited, condition-bound permission to test, with the possibility of specific regulatory relaxations, supervisory contact and a defined reporting cadence. It does not give a licence. An FSE that wants to continue after testing must obtain the authorisation that its activity requires, whether under the fund management, capital market intermediary, payment services, banking, insurance or TechFin and ancillary services frameworks.

That is the correct way to plan a sandbox application: not as a route to market, but as a structured way to answer the regulatory questions that will arise when the real application is made.

The post Testing Before Licensing: The IFSCA FinTech Sandbox Framework, 2026 appeared first on Bhatt & Joshi Associates.