The Pros and Cons of Regulatory Sandboxes

Many fintech leaders in our Data Access Residency program ask whether they should apply to participate in a regulatory sandbox run by a state financial regulator. We asked Kimberly Monty Holzel, a Goodwin fintech partner. Here’s what she had to say:

Regulatory sandboxes can offer real benefits to early-stage startups: temporary license exemptions, access to strategic advisers and data, and a direct line to regulators. Companies can test products, services, and business models with a temporary exemption from normal licensing and regulatory requirements. But the benefits may not be as significant as they appear — and for many startups, there are better alternatives.

What to Consider

The application process to enter a regulatory sandbox frequently demands nearly as much work as obtaining a license from that same regulator. For many startups, once they appreciate that, the appeal fades. For those that proceed, three structural limitations are worth understanding.

• A sandbox exemption in Texas means nothing in Massachusetts — or any of the other 48 states. A company that wants to operate nationally must still obtain licenses everywhere else. And even within the sandbox state, the authority is narrow: it covers only the laws that regulator enforces, and only where there is no private right of action. That is a small fraction of a growing company’s actual regulatory exposure.
• Sandbox permissions are not a license. They can be revoked at any time. They are tied to specific facts and limited to a narrow set of requirements — change those facts, and the permission may no longer apply. When the sandbox period ends, the company steps into a fully regulated environment, often under the eye of a regulator that has spent months observing exactly how it operates.
• A sandbox offers no protection against lawsuits or the actions of other regulators. A green light from one authority does not bind another — federal regulators, out-of-state regulators, and private plaintiffs all retain their full rights to investigate, act, or sue.

Alternatives

Two other approaches can deliver as much or more value for less effort. For startups seeking resources — data, strategic advisers, investor introductions, enterprise connections — a privately run sandbox unaffiliated with any regulatory body typically offers the same or more, without the oversight. For those seeking to reduce their regulatory burden, the more common and durable path is a partnership with an existing bank or licensed financial company that performs the regulated activity on the startup’s behalf until it secures its own licenses or charter.

# # # 

Goodwin offers free office hours for Fintech Sandbox Data Access Residents! Book a 30-minute virtual session to get expert guidance on any legal issue or question you have.