Sep 2, 2026·By Ablola, Saribong & Gueco Law Offices · researched and citation-checked against the firm's law library

Regulatory Sandbox Philippines: How Fintechs Test Products with the BSP

The BSP Regulatory Sandbox lets fintechs test new financial products in a controlled, time-bound environment. Here is how the framework works.

The Bangko Sentral ng Pilipinas (BSP) operates a Regulatory Sandbox — a controlled, time-bound, live testing environment where firms can pilot new financial products or services under the regulator's supervision, sometimes with certain requirements relaxed. It was institutionalized under BSP Circular No. 1153, Series of 2022, which incorporated the framework into the Manual of Regulations for Banks and the Manual of Regulations for Non-Bank Financial Institutions. The sandbox is open to BSP-supervised financial institutions, their third-party service providers, other BSP-registered institutions, and new players. Testing may last three to twelve months. It is not a way to bypass existing laws.

What the Regulatory Sandbox is — and what it is not

The framework defines the Regulatory Sandbox as a controlled, time-bound, live testing environment that may feature regulatory waivers at the regulator's discretion, with limits or parameters within which participants must operate. The BSP adopted it under a "test-and-learn" approach to allow a more active, evidence-based, and results-driven assessment of new and emerging financial solutions.

The policy statement in Circular No. 1153 is explicit: the sandbox is not intended and cannot be used to circumvent existing laws and regulations under the guise of proposing new and innovative products or services. If a proposed innovation falls within the scope of existing regulations, it will instead be evaluated under the established registration or licensing regimes.

Who may apply

Under the coverage of the framework, the sandbox applies to BSP-Supervised Financial Institutions (BSFIs), third-party service providers of BSFIs, other BSP-registered institutions, and new players that intend to offer or use an emerging or new technology to deliver financial products or services falling under the BSP's regulatory purview.

An Applicant is an entity that intends to test its financial solution within the framework. Once assessed as eligible, it becomes a Participant.

Eligibility standards

To qualify, an applicant's financial solution must either use new or emerging technology (or use existing technology in an innovative manner), or bridge a market gap in the delivery of financial products or services — both supported by justification such as business case or market research.

The applicant must also demonstrate the capability to deploy the solution through a roll-out plan; provide an initial test plan with test case scenarios and expected outcomes; identify significant risks (including money laundering and terrorist financing, IT and cybersecurity, data integrity and data privacy, market acceptability, consumer protection, and project implementation risks) and the corresponding safeguards; identify Key Performance Indicators; and provide an acceptable exit and transition strategy regardless of the outcome.

The four-stage process

Each regulatory sandbox undergoes a four-stage process: Application, Evaluation, Testing, and Exit.

Application. Applicants submit to the BSP, at a minimum: a Letter of Intent signed by the president or an officer of equivalent rank; a corporate secretary's certificate on board approval; an accomplished Regulatory Sandbox Application Form; an Eligibility Self-assessment Checklist; and a Test Plan.

Evaluation. The BSP evaluates the documents for completeness, correctness, and suitability based on the eligibility standards. It reserves the right to reject an application on the merits. Applicants who do not meet the standards are notified of the reasons, without prejudice to a new application after a cooling-off period of six months from release of the result.

Testing. Eligible applicants proceed to testing, which has two phases: the testing design phase and testing implementation. In the design phase, the Participant presents the proposed innovation, and the BSP approves the test plan and issues a Letter to Proceed with the Test Implementation. Testing duration can range from three to twelve months from the go-live date, depending on the complexity of the solution. Extensions may be requested at least 30 calendar days before expiration and should not exceed 12 months; no further extension is allowed after the initial one.

Exit. A final report is prepared by the Participant detailing the end-to-end results and the exit scenario, which the BSP must approve.

Conditions of approval

A Participant must oversee sandbox activities through an appropriate top-level committee; integrate the sandbox into its overall strategic plan; ensure compliance with anti-money laundering and counter-terrorism financing requirements; comply to the extent possible with regulations on payments, IT risk management, electronic products and financial services, business continuity management, and consumer protection; implement the sandbox for no longer than twelve months from the go-live date; submit a report after the sandbox period; provide customer assistance; and submit any enhancements or changes to services within 30 calendar days prior to roll-out.

Consumer protection and data privacy

Customers must be informed that the product or service is under the regulatory sandbox platform and that their availment is part of the pilot implementation, and must be told of all possible risks. They must also be informed of complaints handling and dispute resolution procedures. All sandbox experimentation must follow the rules on data sharing, data privacy, and data protection, and customers should be informed that they own the data collected and processed, with all rights under Republic Act No. 10173, the Data Privacy Act of 2012.

How the sandbox relates to the National Payment Systems Act

Many fintech products touch payment systems, which the BSP oversees under Republic Act No. 11127, the National Payment Systems Act. The law recognizes that payment systems are crucial parts of the country's financial infrastructure and directs the State to promote their safe, secured, efficient, and reliable operation through the Bangko Sentral. Under Section 6, the BSP may designate a payment system and require its operators to secure prior authority, and it may issue rules through the Monetary Board. A sandbox pilot that involves payments therefore sits alongside this supervisory regime rather than replacing it.

Frequently asked questions

Who can join the BSP regulatory sandbox? BSFIs, third-party service providers of BSFIs, other BSP-registered institutions, and new players intending to offer or use an emerging or new technology to deliver financial products or services within the BSP's regulatory purview.

How long does a regulatory sandbox run in the Philippines? Testing can range from three to twelve months from the go-live date. An extension may be requested, subject to BSP evaluation, but should not exceed 12 months, and no further extension is allowed after the initial one.

What happens if the BSP rejects a sandbox application? The applicant is notified of the reasons and may file a new application after a cooling-off period of six months from release of the result.

Practical takeaways

The sandbox is a controlled, time-bound, live testing environment — not a shortcut around existing regulations.
Eligibility turns on genuine innovation or bridging a market gap, plus demonstrable capability, risk identification, KPIs, and an exit strategy.
Applications require a Letter of Intent, board approval, the application form, a self-assessment checklist, and a test plan.
Testing runs three to twelve months, with one extension possible; a final report and BSP-approved exit scenario close the exercise.
Successful pilots may be issued an authority to operate, but the BSP retains discretion to approve or disapprove public launch.

Primary sources

The rules discussed above are drawn from the following primary sources. Where the firm's library holds the document as a PDF it is embedded here in full; the rest are cited by title.

Regulatory Sandbox FrameworkOpen in Law Library Download PDF