Page 1 of 16 CIRCULAR eF.No.: 505/IFSCA-FTec0FTEF/1/2023 Date: March 16, 2026 To, All Applicants Applying Under the IFSCA FinTech Sandbox Framework Madam / Sir, Subject: IFSCA FinTech Sandbox Framework 1. Reference may be drawn to the Circular titled “Framework for FinTech Entity in the IFSCs", dated April 27, 2022 (“2…
Page 1 of 16
CIRCULAR
eF.No.: 505/IFSCA-FTec0FTEF/1/2023 Date: March 16, 2026
To, All Applicants Applying Under the IFSCA FinTech Sandbox Framework
Madam / Sir,
Subject: IFSCA FinTech Sandbox Framework
Reference may be drawn to the Circular titled “Framework for FinTech Entity in the IFSCs", dated April 27, 2022 (“2022 Framework”), whereby a framework for limited use authorization of FinTechs in IFSC was laid down.
Building on the outcomes and insights derived from the implementation of the above Circular, evolving global FinTech trends, feedback received from stakeholders, and considering the importance of financial technology products and solutions in promoting innovation, it has been decided to issue a fresh framework for an entity desirous of obtaining Limited Use Authorisation as FinTech Sandbox Entity, and accordingly this Circular is being issued.
This Circular aims to further support innovation by offering access to different kinds of sandboxes, viz., Regulatory Sandbox, Innovation Sandbox, Inter-Operable Regulatory Sandbox, and Overseas Regulatory Referral Mechanisms, across banking, capital markets, insurance, fund management, and other segments.
This Circular is issued in exercise of powers conferred by section 12 of the International Financial Services Centres Authority (IFSCA) Act, 2019, to develop and regulate the financial services market in the IFSCs and shall come into with immediate effect.
All provisions relating to Sandbox activities in IFSCs contained in any Circulars, Frameworks, Guidelines, Regulations, or other regulatory instruments issued by the Authority shall stand superseded with immediate effect from the date of this Circular. However, any actions taken under such instruments prior to the issuance of this Circular shall remain valid.
A copy of this circular is available on the website of IFSCA at www.ifsca.gov.in.
Sd/- (Joseph Joshy C J) Chief General Manager Division of FinTech Sandbox Department of Technology fe-sandbox@ifsca.gov.in
Page 2 of 16
Part I: General
A) Applicability
This Framework shall apply to all entities desirous of obtaining Limited Use Authorisation as a FinTech Sandbox Entity (FSE) from International Financial Services Centres Authority (IFSCA).
The entities which have a valid limited use authorisation issued under the 2022 Framework shall continue to be governed under the said Circular till the validity of their existing limited use authorisation.
B) Definitions
(a) ‘Act’ means the International Financial Services Centres Authority Act, 2019 (50 of 2019);
(b) ‘Applicant’ means an entity desirous of seeking a Limited Use Authorisation as a FinTech Sandbox Entity under this Framework;
(c) ‘Authority’ means the International Financial Services Centres Authority / IFSCA;
(d) ‘Boundary Conditions’ means the parameters or conditions, specified by the Authority in the Limited Use Authorisation letter, within which a FinTech Sandbox Entity shall operate , and which may, inter-alia, include restrictions on duration, customer type, transaction, and geographic scope;
(e) ‘Domestic FinTech’ means an entity that is not a ‘Foreign FinTech’;
(f) ‘Domestic Financial Sector Regulator’ means the Reserve Bank of India, the Securities and Exchange Board of India, the Insurance Regulatory and Development Authority of India, and the Pension Fund Regulatory and Development Authority;
(g) ‘Foreign FinTech’ means a non-resident entity, engaged in the FinTech activities, and established/incorporated outside India;
(h) ‘‘FinTech’ means financial technology ideas/ products/ solutions, and innovative technology ideas/ products / solutions, which either result in financial business models/ applications/ processes, or aid and assist activities, respectively, in relation to financial products, financial services and financial institutions regulated or likely to be regulated by the Authority;
Page 3 of 16
(i) ‘FinTech Sandbox Entity’/‘FSE’ means an entity which has been granted Limited Use Authorisation by the Authority under this Framework;
(j) ‘Final Application’ means an ensuing application, containing the complete set of requisite information, documents, and supporting materials, submitted by the Applicant to the Authority, through SWIT, seeking Limited Use Authorisation under this Framework.
Explanation.– For removal of doubt, it is clarified that only an Applicant whose Preliminary Application has been accepted, and who has received a communication from the Authority confirming such acceptance, shall be eligible to submit a Final Application;
(k) ‘IFSCA FinTech Innovation Sandbox (FIS)’ refers to a testing environment wherein a FinTech Sandbox Entity can develop and/ or test its innovative idea(s) / product(s) / solution(s), in isolation from the live market, which may add value to the financial products or financial services offered in IFSCs, based on market related data made available to them by Financial Institutions operating in IFSCs;
(l) ‘IFSCA FinTech Regulatory Sandbox (FRS)’ refers to a controlled live testing environment with a limited set of real customers for a limited timeframe, wherein a Fintech Sandbox Entity may be granted certain exemptions / relaxations from applicability of certain regulatory provisions for the purpose of experimenting the proposed product(s)/ solution(s);
(m) ‘Inter-Operable Regulatory Sandbox’ or ‘IORS’ refers to a mechanism to facilitate testing of innovative hybrid financial products/ solution falling within the regulatory ambit of more than one Domestic Financial Sector Regulator;
(n) ‘Limited Use Authorisation’ means the authorisation granted by the Authority to a FinTech Sandbox Entity for developing and/or testing innovative financial idea(s) / product(s) / solution(s), as the case may be, within a controlled environment under this Framework;
(o) ‘Overseas Regulatory Referral’/‘FinTech Bridge’ refers to a co-operation mechanism between the Authority and an overseas financial sector regulator for facilitating the FinTech Sandbox Entities desirous of operating in each other’s jurisdiction;
(p) ‘Preliminary Application’ means an initial application submitted by an Applicant to the Authority, through SWIT, for the purpose of assessment, by the Authority, of the suitability of the proposed idea(s)/ product(s)/ solution(s);
(q) ‘Single Window IT Systems (SWIT)’ refers to an online platform designed by the Authority, inter-alia, to facilitate the processing of applications submitted by the Applicants under this Framework;
Page 4 of 16
(r) ‘Testing Stage’ means the specified period during which a FinTech Sandbox Entity may develop and/ or test the proposed idea(s)/ product(s)/ solution(s) in a sandbox, under regulatory oversight of the Authority, within the Boundary Conditions;
(s) ‘Testing Partner’ means an entity which – (i) is engaged in rendering financial service(s) in respect of any financial product(s), or (ii) directly or indirectly aids, or assists activities relating to financial products, financial services or financial institutions, and with whom the Applicant has a Memorandum of Understanding (MoU), Letter of Intent, or a similar arrangement for the purpose of developing and/or testing its proposed idea/product /solution in sandbox;
Page 5 of 16
C) Eligibility
(i) The Applicant shall propose the use of innovative technology: a) in its core product or service, business model, distribution model or methodology to provide financial products or financial services regulated or likely to be regulated by the Authority; or b) products and/or solutions which directly or indirectly aid and assist activities in relation to financial products, financial services and financial institutions regulated or likely to be regulated by the Authority.
(ii) The proposed FinTech idea(s)/ product(s)/ solution(s) shall have the potential to significantly enhance existing financial services or products and there must be a genuine need for testing the idea(s)/ product(s)/ solution(s) in a controlled environment.
(iii) An Applicant from India, including IFSC shall be: a) an entity incorporated as a company under the Companies Act, 2013, or as a Limited Liability Partnership (LLP) under the Limited Liability Partnership Act, 2008, or as a partnership firm under the Indian Partnership Act, 1932, or a ‘Branch’ thereof or a ‘Branch’ of an Indian company, LLP, or partnership firm in IFSC; or b) an entity registered with Department for Promotion of Industry and Internal Trade (DPIIT) as a start-up entity relating to FinTech; or c) an entity which is regulated by a Domestic Financial Sector Regulator; or d) an individual or a group of individuals affiliated with duly recognised research or academic institution(s), incubator(s), or accelerator(s) established in India.
(iv) An Applicant from outside India shall be: a) based or incorporated in, or operating from, a jurisdiction that is not identified by the Financial Action Task Force as ‘High-Risk Jurisdictions subject to a Call for Action’; and b) a legal person, or an individual or a group of individuals affiliated with duly recognised research or academic institution(s), incubator(s), or accelerator(s).
Page 6 of 16
D) Permissible Activities
E) Application Process
The Applicant shall submit a Preliminary Application through the SWIT portal. The Preliminary Application shall be examined by the Authority within thirty (30) days for the purpose of assessing the suitability of the proposed FinTech idea(s)/ product(s)/ solution(s) under this Framework.
The Applicant shall be eligible to submit a Final Application through the SWIT portal, after receipt of communication from the Authority confirming acceptance of the Preliminary Application.
The Applicant, while submitting the Final Application, shall pay the applicable application fee in accordance with the IFSCA Fee Circular dated April 08, 2025, as amended from time to time.
F) Evaluation Criteria
Page 7 of 16
risks; j) Clarity on consumer protection mechanisms, responsible data management practices and mitigation of systemic risk; k) Intent and feasibility to deploy the proposed FinTech idea(s)/ product (s)/ solution(s), post testing; l) The deployment and monitoring strategy post testing (in the event the sandbox tests are successful) or the exit strategy (in the event the sandbox tests are unsuccessful); m) Demonstration of the Applicant’s intent to undertake market-exploration activities within the IFSC; n) Any other factors considered relevant by the Authority.
G) Regulatory Relaxations/ Exemptions
H) Approval Process
After examining the Final Application, if the Authority is satisfied that the said Final Application fulfills the conditions for granting Limited Use Authorisation, the Authority may grant an “In-Principle Approval” to the Applicant within a period of sixty (60) days.
The Applicant to whom “In-Principle Approval” is granted shall fulfill such conditions as may be specified in the “In-Principle Approval”, before the grant of Limited Use Authorisation, within a period of thirty (30) days, unless extended by the Authority. One of the conditions of the "In-Principle Approval" may require the Applicant to have at least one Testing Partner.
The grant of Limited Use Authorisation to an Applicant who has been issued “In-Principle Approval” shall be at the discretion of the Authority. If the Applicant fails to fulfill the specified conditions, the Authority may revoke the “In-Principle Approval” after providing the Applicant an opportunity of filing written submissions.
The Authority may, on being satisfied that the Applicant has complied with the conditions of “In-Principle Approval”, grant a Limited Use Authorisation as FinTech Sandbox Entity (FSE) to the Applicant, to develop and/or test the proposed idea (s)/ product(s)/ solution(s) in sandbox, subject to such Boundary Conditions, and other terms and conditions, as it may deem fit.
I) Testing Stage
Upon obtaining the Limited Use Authorisation, the FinTech Sandbox Entity shall proceed to the Testing Stage, during which it shall operate within the Boundary Conditions and other terms and conditions specified by the Authority.
The FinTech Sandbox Entity shall disclose to its users the idea(s) /product(s) /solution(s) being tested within the sandbox and shall also inform them in writing about the potential key
Page 8 of 16
risks involved. The FinTech Sandbox Entity shall obtain acknowledgment from users, confirming that they have read and understood the associated key risks. The Testing Stage may also involve FinTech Sandbox Entity testing any developed products in financial services market in IFSC.
The FinTech Sandbox Entity shall ensure that, prior to onboarding, users have read, understood, and acknowledged the associated risks of using the idea(s)/ product(s)/ solution(s) in the sandbox. The FinTech Sandbox Entity shall disclose whether any compensation will be provided for potential losses during the sandbox testing stage, along with the applicable protection and compensation terms, and obtain express consent in writing from the users before engaging them in the sandbox testing.
The duration of the Testing Stage shall be a maximum of twelve (12) months, which may be extended for a further period of six (06) months at the discretion of the Authority, upon receipt of a written request from the FinTech Sandbox Entity in this regard.
During the Testing Stage, the FinTech Sandbox Entity shall take prior written approval from the Authority to affect any material changes which may have a bearing on the Limited Use Authorisation granted to it.
J) Submission of Test Related Information
During the Testing Stage, the FinTech Sandbox Entity shall submit monthly status report duly affirmed by its authorised representative before the 10th day of the succeeding month.
The FinTech Sandbox Entity shall submit the following information or interim reports, duly affirmed by its authorised representative: (i) Key performance indicators, milestones and statistical information; (ii) Key issues arising as observed from fraud or operational incident reports; (iii) Actions or steps taken to address the key issues identified above; and (iv) Such additional information or reports as may be specified by the Authority.
The FinTech Sandbox Entity shall submit a final report, affirmed by its authorised representative, to the Authority, within thirty (30) days from the expiry of the Testing Stage. The report shall include the following information: (i) Key outcomes, key performance indicators against agreed measures for the success or failure of the test and findings of the test; (ii) A full account of all incident reports and resolution of user complaints, if any; (iii) Key learnings from the test; and (iv) Such additional information as may be specified by the Authority.
The FinTech Sandbox Entity shall ensure that proper records of the tests conducted by it are duly maintained, for review by the Authority. The FinTech Sandbox Entity shall maintain such records for a period of seven years from the date of its exit from the sandbox.
The FinTech Sandbox Entity shall furnish details of any order passed by any regulatory authority, restraining, prohibiting, or debarring the FinTech Sandbox Entity from accessing, providing, or dealing in financial products or services, or any other order having a material bearing on the financial services market, within fifteen (15) days from the date of receipt of such order.
Page 9 of 16
K) Maintenance of Books of Accounts, Records and Documents
L) Sandbox Exit
The Limited Use Authorisation granted by the Authority under this Framework, including the legal and regulatory exemptions/ relaxations granted, shall expire at the end of the Testing Stage.
The FinTech Sandbox Entity may, with reasons to be detailed in writing, apply to the Authority for exiting the sandbox prior to completion of the duration of the sandbox. The FinTech Sandbox Entity shall be allowed to exit the sandbox only if so permitted by the Authority.
The FinTech Sandbox Entity shall ensure that all existing obligations to the users of the FinTech innovation(s) in the sandbox are fully complied with or addressed before exiting the sandbox or discontinuing testing.
M) Revocation of Limited Use Authorisation
Page 10 of 16
with the idea(s)/ product(s)/ solution(s); vi. is subjected to an order for initiation of insolvency or liquidation process that has been passed against it or its parent; vii. compromises the digital security and integrity of the financial services market in IFSC; viii. carries on business in a manner detrimental to users or the public at large; ix. fails to effectively address technical defects or vulnerabilities in the idea/product/ solution which gives rise to recurring service disruptions or fraudulent activities; x. fails to implement any directions given by the Authority; or xi. fails to comply with any of the requirements under this Framework and/or any other applicable laws.
Before revoking the Limited Use Authorisation, the Authority shall give the FinTech Sandbox Entity prior notice and provide an opportunity to file written submissions.
Notwithstanding anything contained in clause 33, if the Authority is of the opinion that in the interest of the financial services market or the public in general, it is necessary or expedient to do so, it may, as an interim measure, suspend the Limited Use Authorisation at any point of time without prior notice, and later give an opportunity to the FinTech Sandbox Entity to make its written submissions.
In case the Authority decides to revoke the Limited Use Authorisation, the same shall be communicated to the FinTech Sandbox Entity in writing. On receipt of such communication, the FinTech Sandbox Entity shall: i) immediately implement its exit plan and discontinue the usage of the idea(s)/ product(s)/or solution(s) by all users; ii) notify its users about its exit plan and their rights of grievance redressal, as applicable; iii) comply with obligations imposed by the Authority, the obligations under the agreement signed with the users, and also under any other applicable law; iv) dispose of all confidential information including user’s personal information collected during testing; v) submit a report to the Authority on the actions taken regarding its exit plan, within thirty days from the revocation; and vi) comply with any other directions of the Authority.
N) Compliance With Other Requirements
The FinTech Sandbox Entity shall pay the applicable fees and charges in accordance with the IFSCA’s Fee Circular dated April 08, 2025, as amended from time to time.
The FinTech Sandbox Entity shall authorise a person for representing it before the Authority and for ensuring compliance with the applicable regulatory requirements.
Page 11 of 16
The Authority may, as and when required, call for any information, documents or records, as it may deem necessary, from the FinTech Sandbox Entity.
The FinTech Sandbox Entity shall, at all times, comply with the applicable and relevant regulatory obligations.
Part II : IFSCA FinTech Regulatory Sandbox (FRS)
Provided that the FinTech Sandbox Entity shall be required to establish its physical presence in the International Financial Services Centre where the testing involves the holding of customer’s fund that necessitates the opening of a bank account with an International Financial Services Centre Banking Unit, or in such other use cases as the Authority may so direct.
Part III: IFSCA FinTech Innovation Sandbox (FIS)
The FinTech Sandbox Entity intending to operate under the IFSCA FinTech Innovation Sandbox (FIS) may remotely undertake the testing of its proposed idea(s) / product(s) / solution(s) without establishing its physical presence in the International Financial Services Centre.
Part I, except for clause 20 and clause 28, of this Framework shall also apply to the Fintech Sandbox Entity intending to operate under IFSCA FinTech Innovation Sandbox.
Part IV: Inter-operable Regulatory Sandbox (IoRS) with IFSCA as Principal Regulator
Domestic FinTechs having global ambitions and Foreign FinTechs seeking entry into India may be considered for the testing under IoRS where the entity has financial technology product(s) / solution(s) and its business models / activities / features fall within the remit of one or more Domestic Financial Sector Regulator and IFSCA. IFSCA shall serve as the Principal Regulator for all such applications, while the concerned domestic financial sector regulator(s) shall function as the Associate Regulator(s) under the IoRS.
The application received by IFSCA from Co-ordination Group of IoRS, where IFSCA is the Principal Regulator shall be subjected to the same application and screening process, for entry into IoRS, as mentioned under Part II of this Framework.
IFSCA reserves the right to the admissibility of the hybrid product(s)/solution(s) as per this Framework and shall accordingly communicate its decision to the Applicant.
Page 12 of 16
Post successful exit from the IoRS, the entity shall approach IFSCA and/or the Associate Regulator(s), as the case may be, for authorisation and seeking regulatory dispensation before launching the product(s)/ solution(s) in the market.
The whole process shall be in compliance with Standard Operating Procedure (SOP) as specified by co-ordination group for IoRS (under the aegis of Inter Regulatory Technical Group on FinTech). The said SOP may be accessed at https://ifsca.gov.in/CommonDirect/GetFileView?id=d09c93fc98191af1801a5914f30e6192&fileName=standard-operating-procedure-for-inter-operable-regulatory-sandbox-iors-12102022043007.pdf&TitleName=Legal.
Part V: Overseas Regulatory Referral Mechanism /FinTech Bridges of IFSCA
Part VI: Miscellaneous
Power to remove difficulties, specify procedures and issue clarifications
Page 13 of 16
Appendix – 1
The proposed FinTech ideas(s)/ product(s)/ solution(s) shall be directly or indirectly linked to the following activities regulated by the Authority: -
i. Capital Markets including but not limited to Corporate Finance, Sustainable Finance, Market Infrastructure Institutions, Investment Funds; ii. Banking including but not limited to Finance Company, Aircraft or Ship Leasing, Payment Services (PSs) and Payment & Settlement Systems (PSSs); iii. Insurance or Re-Insurance; iv. Pension; v. Metals and Commodities; vi. Foreign University; vii. Financial Support Services as per the Appendix – 2; viii. Compliance and supervision of the areas mentioned from (i) to (vii); or ix. Any other area permitted by the Authority.
Page 14 of 16
Appendix – 2
Financial Support Services permitted as per International Financial Services Centres Authority (TechFin and Ancillary Services) Regulations, 2025
List of permitted Ancillary Services in IFSCs :-
i. Actuarial services; ii. Advisory services; iii. Assets management support services; iv. Auditing services; v. Business process outsourcing; vi. Compliance management support services covering assessment of internal control system, integrated reporting, financial reporting, non-financial reporting, corporate sustainability reporting, board reporting, annual report, and other regulatory reporting; vii. Customer care support services; viii. Enterprise governance-related support services, viz., assessment of corporate governance principles, assessment of board effectiveness, board processes, board committees, preparation and review of corporate policies and disclosures, performance evaluation of board and management, review of related party transactions, and execution of shareholders’ rights; ix. Fund administration services including fund accounting; x. Human resource and payroll processing; xi. Insolvency professional services and liquidation-related support services; xii. Knowledge process outsourcing; xiii. Legal process outsourcing; xiv. Legal services; xv. Management consulting services; xvi. Marketing support services; xvii. Outsourced services that are not covered in this Schedule but are permitted to be outsourced by an entity regulated by any financial sector regulator of its home jurisdiction; xviii. Risk management-related services, namely support services for risk identification, risk analysis, risk measurement, risk mitigation, risk elimination, internal audit support, risk audit, and risk-related disclosures; xix. Secretarial services; xx. Broking services for leasing activities permitted in the IFSC; xxi. Supply chain management support; xxii. Trusteeship services including facility agent functions, except debenture trustee services permitted under the International Financial Services Centres Authority (Capital Market Intermediaries) Regulations, 2025; xxiii. Valuation services; xxiv. Voice broking for banking services; xxv. Family office support services; xxvi. Global mobility services (immigration support services) for students and
Page 15 of 16
employees of foreign countries intending to study and work in the IFSC; xxvii. Centre of excellence / offshore development centre / financial capability centre to provide research and development support services (excluding technology R&D), skill development, training, and certification services to employees working in the IFSC and individuals/entities from foreign countries; and xxviii. Any other services as may be permitted by the Authority from time to time.
List of permitted TechFin Services in IFSCs:
i. Accelerators; ii. Agri-tech; iii. Big data and analytics; iv. Climate, green and/or sustainable tech; v. Cloud computing services; vi. Cyber security, cyber security architecture, and cyber risk management services; vii. Application development and maintenance; viii. Automation and robotic process automation; ix. Enterprise resource planning (ERP) systems; x. Implementation of enterprise governance, risk and compliance (eGRC) software platforms; xi. Information technology infrastructure and cloud insurance; xii. Management of IT infrastructure and technology services associated with the payment system ecosystem; xiii. Outsourced services that are not covered in this Schedule but are permitted to be outsourced by an entity regulated by any financial sector regulator of its home jurisdiction; xiv. Regulatory tech; xv. Services and operations related to data centres; xvi. Solutions or services leveraging: a) Artificial Intelligence or Machine Learning b) Biometrics or chatbots c) Digital identity / KYC / AML / CFT d) Fraud detection / prevention e) Distributed Ledger Technology (DLT) f) Internet of Things (IoT) g) Longevity finance h) Metaverse, including augmented reality (AR) and/or virtual reality (VR) i) Quantum tech j) Web 3.0 xvii. Space tech; xviii. Supervisory technology; xix. Technology solutions aiding trade finance; xx. Technology solutions supporting digital banking;
Page 16 of 16
xxi. Technology solutions including IT-related development, enhancement, maintenance, and support services; xxii. Tokenization support services; xxiii. Centre of excellence, offshore development centre, or technology capability centre to provide technology-related R&D support; and xxiv. Any other services as may be permitted by the Authority from time to time.
Research the source law
This record is not yet linked to a specific provision. Browse the law library, choose the affected provision and ask against the exact statutory text.
Browse source laws