How Can Fintechs Take Advantage of the Enhanced Regulatory Sandbox Program

For many fintech startups, obtaining an Australian Financial Services Licence (AFSL) before testing a new product can create significant cost and complexity. Australia’s Enhanced Regulatory Sandbox (ERS) provides a limited alternative by allowing eligible businesses to test specified financial services or credit activities without first obtaining an AFSL or Australian Credit Licence (ACL).

In this article, we explain how fintechs can use the ERS to test a product without first obtaining an AFSL, which services are eligible, how the application process works, and the conditions your business must satisfy while testing.

Interactive Tool: See If You Qualify for the Enhanced Regulatory Sandbox

What Is the Enhanced Regulatory Sandbox?

The Australian Government introduced the ERS on 1 September 2020, replacing the Australian Securities and Investments Commission‘s (ASIC) earlier regulatory sandbox. It expanded the range of financial services and credit activities that could be tested and increased the potential testing period to up to 24 months.

For financial services, the exemption operates under the Corporations (FinTech Sandbox Australian Financial Services Licence Exemption) Regulations 2020 (Cth) (‘ERS Regulations’). Section 6 of the ERS Regulations (Cth) exempts an eligible provider from the AFSL requirement in Section 911A(1) of the Corporations Act 2001 (Cth) (‘Corporations Act’) for the particular eligible financial service being tested where the statutory requirements are satisfied.

The key point for fintechs is that the ERS does not exempt the entire business from holding an AFSL. It exempts specified eligible financial services for the testing period.

What Financial Services Can a Fintech Test Under the ERS?

The ERS only covers particular financial services and products. ASIC’s current INFO 248 states that eligible financial services can include:

• personal and general financial product advice;
• dealing by issuing, varying or disposing of a non-cash payment facility;
• dealing in eligible financial products other than by issuing them; and
• providing a crowd-funding service.

The products that can be tested depend partly on whether the fintech serves retail or wholesale clients.

Fintechs Serving Wholesale Clients

For wholesale clients, eligible financial services can generally relate to financial products other than derivatives and margin lending facilities.

This can make the sandbox relevant to certain B2B fintechs, treasury platforms and investment technology providers developing products for wholesale customers.

Fintechs Serving Retail Clients

The range is narrower for retail customers. Eligible products include specified:

• ADI deposit products;
• non-cash payment facilities;
• general and life insurance products;
• superannuation products;
• interests in simple managed investment schemes;
• Commonwealth debentures, stocks or bonds;
• listed securities on specified Australian and overseas markets; and
• certain securities offered through crowd-funding services.

A fintech should therefore classify both the financial service and the underlying financial product before planning to rely on the sandbox.

Can Lending Fintechs Use the ERS?

Yes, certain consumer credit activities can also be tested under the separate credit sandbox framework. ASIC states that eligible credit contracts must generally:

• have a term of no more than four years;
• have a credit limit greater than $2,000 but less than $25,000;
• not be a reverse mortgage or small amount credit contract; and
• not be secured over specified household property.

This can make the ERS relevant to some innovative consumer lending models. However, the exemption only removes the requirement to hold the relevant credit licence for eligible testing. Other consumer credit obligations can continue to apply.

Is Your Fintech Eligible for the Enhanced Regulatory Sandbox?

Eligibility Criterion

For a fintech relying on the AFSL sandbox exemption, ASIC’s INFO 248 and the ERS Regulations (Cth) generally require that the business:

• is not already authorised under an AFSL to provide the same service it proposes to test;
• is not already an authorised representative for that same service;
• is not a related body corporate of a person authorised for that same service;
• has not previously received an ERS exemption for the same financial service and product;
• is not an operator of a financial market or clearing and settlement facility; and
• if it is a foreign company, is registered under Division 2 of Part 5B.2 of the Corporations Act (Cth).

Innovation Test

ASIC must be satisfied that the financial service is new, or a new adaptation or improvement of another financial service. Section 8 of the ERS Regulations (Cth) allows ASIC to decide that the ERS exemption is unavailable if that requirement is not met.

The regulation requires the fintech to explain:

• what is new or different about the proposed service; and
• what comparable products or services already exist in Australia.

Simply placing an existing financial product inside a new app or changing its branding may therefore be insufficient without genuine innovation in the underlying service or delivery model.

Net Public Benefit Test

The fintech must also demonstrate that exempting the proposed service is likely to produce a public benefit that outweighs the potential public detriment.

ASIC asks applicants to address matters such as whether the fintech:

• solves an existing consumer or market problem;
• increases consumer choice;
• reduces costs;
• improves user experience;
• improves efficiency;
• creates risks for customers and how those risks will be controlled; and
• has a plan to protect customers if the fintech does not obtain a licence when testing ends.

For a fintech founder, the ERS application therefore needs to explain both why the product is innovative and why allowing it to be tested without a licence is justified.

What Limits Apply While a Fintech Is in the Sandbox?

Maximum 24-Month Testing Period

Section 7 of the ERS Regulations (Cth) provides a 24-month testing period for an eligible financial service. The exemption cannot be extended, paused or reset.

The testing period generally starts on the 31st day after ASIC receives the notification where ASIC has not advised that the exemption is unavailable.

$10,000 Retail Client Exposure Limit

Section 12 of the ERS Regulations (Cth) imposes a $10,000 limit per retail client for specified financial products acquired as a result of services provided under current and previous ERS exemptions. Certain products, including specified insurance, superannuation, ADI deposit and ADI non-cash payment products, are excluded from that particular limit.

$5 Million Total Exposure Limit

Section 13 of the ERS Regulations (Cth) imposes an aggregate $5 million exposure limit across relevant financial services and credit activities.

This calculation extends across retail and wholesale clients, related entities and current and previous uses of the ERS exemption. A fintech must monitor these limits continuously. Exceeding them can cause the exemption to cease automatically.

How Does a Fintech Apply for the ERS?

Step 1: Speak to ASIC’s Innovation Hub

The ERS operates through a notification process, rather than an ordinary AFSL application. ASIC currently urges businesses to contact its Innovation Hub for informal assistance before lodging an ERS notification. The Hub can be contacted at [email protected].

This can help the fintech identify whether its proposed product and activities appear to fit within the sandbox framework before preparing the formal notification.

Step 2: Prepare the Prescribed Notification

The required form depends on whether the fintech wants to test financial services or credit activities. For a financial services ERS notification, Section 16 of the ERS Regulations (Cth) requires information including:

• the provider’s details;
• each financial service and relevant product proposed to be tested;
• why the exemption would produce a net public benefit;
• why the service is new or an adaptation or improvement;
• relevant significant decision-makers;
• fit and proper person information; and
• proposed dispute resolution and compensation arrangements.

ASIC also requires relevant officers, controllers and significant decision-makers to provide fitness and propriety information. Current INFO 248 requires national criminal history and bankruptcy checks that are no more than 12 months old.

Step 3: Submit the ERS Notification to ASIC

ERS notifications must be emailed directly to [email protected], not to the Innovation Hub.

The notification needs to be complete and unambiguous. ASIC will not ordinarily request further information during its assessment, so missing or unclear information can materially affect the application.

Step 4: ASIC Has 30 Days to Assess the Notification

ASIC has 30 calendar days to assess the notification. If ASIC decides the fintech cannot rely on the exemption, it will provide reasons.

If ASIC does not respond within the 30-day period, the exemption is taken to commence on the 31st day after the notification was lodged.

What Obligations Apply While a Fintech Uses the ERS?

Client Disclosure Requirements

Section 17 of the ERS Regulations (Cth) requires the fintech to clearly tell clients before providing an exempt financial service that:

• it does not hold an AFSL authorising the service;
• it is not an authorised representative for that service;
• it is relying on the ERS exemption; and
• some protections normally associated with an AFSL holder will not apply.

Additional disclosures apply to retail clients under Section 18 of the ERS Regulations (Cth), including information about remuneration, relevant relationships and available dispute resolution systems.

Complaints Handling & AFCA

Section 20 of the ERS Regulations (Cth) requires a fintech providing exempt financial services to retail clients to maintain an internal dispute resolution procedure and AFCA membership.

These arrangements must continue for at least 12 months after the testing period ends.

Professional Indemnity Insurance

For retail financial services, Section 20 of the ERS Regulations (Cth) also requires adequate compensation arrangements, including adequate professional indemnity insurance unless ASIC approves an alternative arrangement.

ASIC currently considers PI insurance with at least $1 million cover for any one claim and in aggregate to be adequate. The compensation arrangements generally need to continue for 12 months after the exemption ends.

Financial Services Conduct & Disclosure Obligations

Depending on what the fintech provides, ERS conditions can also require compliance with obligations relating to:

• Statements of Advice for personal advice;
• client money;
• financial product disclosure; and
• ASIC make-good orders.

For eligible credit activities, ASIC also requires compliance with applicable responsible lending obligations, specified credit fee and charge limits and other consumer protection provisions.

Which Laws Still Apply Outside the ERS?

The ERS is a licensing exemption, not a comprehensive regulatory exemption.

ASIC expressly identifies other laws that may continue to apply, including:

• misleading or deceptive conduct and unconscionable conduct provisions;
• design and distribution obligations;
• AML/CTF requirements; and
• privacy requirements.

For fintechs, this is particularly important. A payments or virtual asset business relying on the ERS for its AFSL position may still be a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). Similarly, handling customer data can still trigger obligations under applicable privacy laws.

The sandbox should therefore form one part of the fintech’s regulatory analysis, rather than being treated as permission to launch without considering other regimes.

What Happens When the 24-Month Sandbox Period Ends?

A fintech cannot remain in the ERS indefinitely. Before the exemption ends, the business must decide whether it will:

• stop providing the tested service;
• obtain its own AFSL or credit licence; or
• move to another lawful authorisation structure.

ASIC recommends allowing six to nine months for the licensing process where a fintech intends to continue operating after the sandbox period.

Fintech founders should therefore develop the licensing strategy well before the end of testing, rather than waiting until month 24.

ASIC also asks ERS users to provide a short report within two months after testing ends, covering matters such as customer numbers, complaints, issues identified during testing and regulatory barriers encountered.

Practical Steps Before Your Fintech Enters the ERS

Before lodging an ERS notification, a fintech should:

• map every financial service and financial product involved;
• confirm that each proposed activity falls within ERS scope;
• assess the innovation and net public benefit tests;
• identify retail and wholesale customer groups;
• model the $10,000 and $5 million exposure limits;
• establish required disclosure and complaints processes;
• arrange AFCA membership and applicable PI insurance;
• determine whether AML/CTF, privacy or other regulatory regimes apply; and
• prepare a licensing or exit strategy before testing begins.

As a practical matter, fintechs should also retain clear records demonstrating how they monitored ERS limits, disclosures, complaints and material product changes. ASIC expressly expects ERS users to monitor applicable limits, and these records can help demonstrate that the business remained within the conditions of its exemption.

Conclusion

The Enhanced Regulatory Sandbox can give eligible fintechs a valuable opportunity to test innovative financial services without first obtaining an AFSL. However, it is a limited statutory exemption, not a general licence-free pathway for fintech businesses.

AFSL application lawyers for fintechs at Click Legal can help fintech businesses assess ERS eligibility, map their proposed services against the sandbox regulations, prepare the regulatory analysis supporting an ERS notification and develop the AFSL or authorisation strategy required for long-term operation.

Frequently Asked Questions