Payments & Banking
New payment models and open banking
"We test payment initiation, DLT-based reconciliation, biometric onboarding or alternative scoring under Bank of Spain supervision, with real safeguards for users."
Regulatory Sandbox in Spain
Comprehensive legal advice to get into the Spanish fintech sandbox (Law 7/2020): supporting report, testing protocol, user safeguards and going to market, before the General Secretariat of the Treasury, the Bank of Spain, the CNMV and the DGSFP.
Free sandbox consultation
We reply in less than 24 h
- Governing law
- Law 7/2020
- Access requirements
- Art. 5
- Applications received by
- Treasury
- Access checklist
- 10 steps
Services
Service catalog for the regulatory sandbox
Six areas of legal support to reach the sandbox with a solid application, pass the tests and go to market with authorization.
Access
Supporting report and cohort application
Drafting the sandbox entry dossier: project description, technology-based innovation, added value and compliance with Article 5 of Law 7/2020.
See more →
CohortReportTreasuryEntry point
Protocol
Negotiating the testing protocol
Support in designing the protocol with the competent supervisory authority: scope, duration, test groups, safeguards, monitoring and KPIs.
See more →
Bank of SpainCNMVDGSFPMonitoring
Users
Informed consent and safeguards
Drafting the participant’s express consent, pre-contractual information, withdrawal mechanisms and financial guarantees against damage.
See more →
GDPRConsumers
AML/GDPR
AML controls and data protection
AML/CFT plan tailored to the test, data protection impact assessment (DPIA), GDPR and data processing in controlled environments with the competent supervisor.
See more →
SEPBLACAEPD
Exit
Post-sandbox authorization
Preparing the authorization application after the test: sector-specific license, making use of the results and the simplified procedure.
See more →
LicenseAuthorization
Supervision
Monitoring and reporting
Managing periodic reports to the supervisor, interruption or extension of the test, incidents and the conclusions report at the end.
See more →
KPIsFinal report
Eligible projects
Fintech innovations that get into the sandbox
The regulatory sandbox is designed for technology-based innovation projects that add value: regtech, suptech, payments, DLT, artificial intelligence, digital identity or asset tokenization.
Securities & IIC
Tokenization, robo-advisors and post-trade
"We validate projects for the tokenization of instruments, automated advice and post-trade infrastructure before the CNMV."
Insurtech
Parametric insurance and actuarial AI
"We test dynamic insurance products, telematics or microinsurance with the DGSFP, safeguarding policyholder protection and regulatory compliance."
Regtech / Suptech
Automated compliance
"We work on AML solutions, enhanced KYC with biometrics, on-chain analytics and automated supervisory reporting as sandbox projects."
Consequences
Why get legal advice before entering the sandbox?
The sandbox is not a disguised authorization: it is an environment with limited time, required safeguards, continuous supervision and specific obligations. A weak application closes the door to future cohorts.
Rejection of the application for failing to demonstrate technology-based innovation, a minimum viable product or added value under Article 5 of Law 7/2020.
Interruption of the tests due to a breach of the protocol or the emergence of unmitigated risks for participants or the system.
Exposure to the sector-specific penalty regime if you keep operating without the corresponding authorization after the test ends.
Law 7/2020
Limited duration
Access to the sandbox does not grant authorization to carry on the activity indefinitely: the test has a defined scope and timeframe.
Guarantees
Promoter’s liability
The promoter must cover participants’ losses and damages with financial guarantees and insurance, sized to the project’s risk.
GDPR / AML
Enhanced protection
The law imposes special protection for data and users, and anti-money laundering requirements, during the tests, with no exceptions to the general regime.
Do you want to submit a project to the regulatory sandbox?
We help you with the supporting report, dealings with the Treasury and the competent supervisor, the testing protocol and going to market with final authorization.
Frequently asked questions
Regulatory sandbox: common questions
What is the Spanish regulatory sandbox?
The financial sandbox is a controlled testing environment governed by Law 7/2020 of November 13 for the digital transformation of the financial system. It allows technology-based innovation projects in the financial system to be put into practice fully within the legal and supervisory framework.
It lets fintechs test their model under the supervision of the competent authorities for a limited period, without this amounting to authorization to operate on a regular basis.
Which authorities are involved in the Spanish sandbox?
The entry point is the General Secretariat of the Treasury and International Financing. Then, depending on the project’s scope, the following act as supervisors: the Bank of Spain (banking, payments, credit), the CNMV (securities, collective investment schemes, financial instruments) and the DGSFP (insurance and pension plans).
Each authority signs with the promoter the testing protocol that governs its pilot project.
What requirements must a project meet to enter the sandbox?
Under Article 5 of Law 7/2020, projects must:
- Bring a technology-based innovation applicable to the financial system.
- Be sufficiently advanced (at least a minimum viable product).
- Provide added value in regulatory compliance, benefits for users, efficiency of institutions/markets or improvement of regulation and supervision.
How does the cohort system work?
The sandbox runs on a cohort system, with two semi-annual calls each year: in March and September.
Each cohort goes through the phases of application submission, preliminary assessment, protocol signing, testing and going to market with a conclusions report.
What documentation is submitted with the application?
A supporting report that explains the project and shows compliance with Article 5 of Law 7/2020, together with corporate documents, a business plan, a risk analysis, financial guarantees, a user protection plan and, where applicable, a DPIA.
It is filed through the electronic office of the General Secretariat of the Treasury.
What role does the testing protocol play?
The protocol is the individual document that governs the pilot project: scope, duration, maximum number of users, guarantees, KPIs, grounds for interruption, responsibilities and reporting obligations.
It is signed between the promoter and the competent supervisory authority. A breach may lead to the test being interrupted.
Does entering the sandbox mean getting a license?
No. Law 7/2020 is clear: access to the controlled testing environment is not equivalent to authorization to carry on a reserved activity indefinitely. After the test, the promoter must apply for the corresponding sector-specific license, possibly through a simplified procedure thanks to the knowledge gained.
Can a test be interrupted?
Yes. The supervisory authority may interrupt the test if the protocol is breached, if unmitigated risks arise for participants or the system, or if the promoter decides to withdraw voluntarily. In all cases, user protection and the return of any amounts owed are guaranteed.
Operational guide
Practical guide to accessing the regulatory sandbox in Spain
The sandbox rewards promoters who arrive with a mature project, monitor risks closely and document every step. A good application multiplies the chances of approval and shortens the later path to the license.
Applicable legislation
Law 7/2020 of November 13 for the digital transformation of the financial system; sector-specific rules (MiFID II, PSD2, Solvency II, LIIC); GDPR and LOPDGDD; Law 10/2010 (AML); MiCA for crypto-assets.
Entry point and cohorts
Filing through the Treasury’s electronic office; two cohorts a year (March and September); joint assessment with the competent supervisor; publication of the decision on admitted projects.
What makes the difference
A robust MVP, a realistic risk plan, clear metrics, sufficient guarantees and a post-sandbox strategy (license, EU passport) turn the test into a real business lever.
10-step checklist for submitting a project to the sandbox
- Regulatory diagnosis of the project: the financial service involved, its current regulatory fit and the gaps that prompt the application.
- Assessing fit with Article 5 of Law 7/2020: innovation, maturity (MVP) and added value.
- Identifying the competent authority: the Bank of Spain, the CNMV or the DGSFP, depending on the project’s main scope.
- Drafting the supporting report, with a technical, legal, risk and expected-benefits description.
- Designing the test group: users, selection criteria, express consent and participation limits.
- Risk plan and sufficient financial guarantees to cover any damage to participants.
- Data protection plan (GDPR, DPIA) and anti-money laundering plan (Law 10/2010).
- Filing the application through the Treasury’s electronic office within the cohort deadline.
- Negotiating and signing the testing protocol with the competent supervisory authority.
- Execution, periodic reporting, conclusions report and, where applicable, application for authorization to operate.
If the project involves managing collective investment schemes (IIC), see our SGIIC page; if it touches the governance of an investment firm (ESI), see independent director of an ESI or, for an external review, the external expert report.
The sandbox in practice
From application to product: the sandbox as a business lever
A sandbox project is not won with a good idea alone: it is won with a flawless technical-legal report, a tested MVP, a realistic risk plan and a clear strategy to move from the test to the license. This is the operational dashboard we work through with each promoter.
1) AccessDiagnosis + supporting report
Regulatory fit, evidence of innovation and added value, MVP, business plan and risk analysis. The report is your calling card before the Treasury.
- Law 7/2020 Art. 5
- Verifiable MVP
- Measurable added value
2) ProtocolProtocol with the Bank of Spain, CNMV or DGSFP
Scope, duration, test groups, guarantees, monitoring, KPIs, grounds for interruption, responsibilities and confidentiality.
- KPIs + metrics
- Proportionate guarantees
- Exit criteria
3) UsersUser and data protection
Informed consent, enhanced pre-contractual information, withdrawal, GDPR, DPIA and specific data processing rules in the testing environment.
- Express consent
- DPIA
- GDPR data subject rights
4) ExitFrom sandbox to market: sector-specific authorization
Preparing the license application (payment institution, investment firm, SGIIC, insurer, CASP), making use of the knowledge generated during the test and a possible simplified procedure.
Tip: starting the sector-specific license in parallel with the test significantly speeds up time-to-market once the sandbox ends.
Quick decisionPractical map: which supervisor applies to me?
Bank of Spain
Payments, credit, bank onboarding, open banking, alternative scoring, digital currencies.
CNMV
Securities, collective investment schemes, robo-advisors, tokenization, post-trade, market data, reporting.
DGSFP
Parametric insurance, microinsurance, actuarial AI, digital pension plans.
Sandbox playbook
The sandbox cycle in practice
1. Application
Online filing with the Treasury, with the supporting report and documents evidencing compliance with Law 7/2020 Art. 5.
Registration number, technical-legal report, corporate documents and business plan.
2. Assessment
Joint analysis by the Treasury + the competent authority (Bank of Spain, CNMV, DGSFP) of fit, added value and risks.
Preliminary assessment, requests for information and decision on admission or non-admission.
3. Protocol
Signing the protocol with the supervisor: scope, duration, guarantees, KPIs and monitoring.
Signed protocol, guarantee policies, template consent forms and DPIA.
4. Testing
Execution with continuous monitoring by the supervisor and periodic reporting by the promoter.
Periodic reports, metrics, recorded incidents and monitoring minutes.
5. Exit
Conclusions report and, where applicable, application for sector-specific authorization through a simplified procedure.
Final report, regulatory recommendations, sector-specific license application.
Red flags during testing
Indicators that require you to review the protocol, inform the supervisor or even interrupt the test.
- Material deviations from the MVP described in the report, or unauthorized use of third parties.
- Complaints from participants about damage, insufficient information or improper data processing.
- Unforeseen systemic risks, especially in projects with effects on payments or markets.
- Operating outside the scope of the protocol: expanding users, geographies or services without authorization.
- Failure to meet the agreed KPIs or repeated failures in reporting to the supervisor.
Operational glossary
Key concepts of the regulatory sandbox
If your fintech project is considering entering the sandbox, these terms appear in Law 7/2020, in the testing protocol and in the reports the supervisor will ask for. Mastering them saves time and avoids mistakes at every stage.
Law 7/2020Core law
The sandbox law
Law of November 13 for the digital transformation of the financial system, which creates and regulates the Spanish controlled testing environment.
Law-protocol structure.
PromoterApplicant
The project promoter
Any natural or legal person, financial institution or technology company, research center or any other interested party that submits the project to the sandbox.
Law 7/2020 Art. 3(h).
CohortCall
Semi-annual access window
Admission system: two calls a year (March and September) managed by the General Secretariat of the Treasury.
Source: Spanish Treasury.
ProtocolLaw-protocol
Testing protocol
Bilateral document between the promoter and the supervisor that governs the pilot project: scope, duration, guarantees, monitoring and KPIs.
A breach may suspend the test.
MVPMaturity
Minimum Viable Product
The project must present at least an MVP that makes it possible to verify its usefulness and future viability in real conditions with users.
Requirement under Law 7/2020 Art. 5.
TreasuryEntry point
General Secretariat of the Treasury
Single financial entry point for filing sandbox access applications and for coordination with the Bank of Spain, the CNMV and the DGSFP.
Electronic office at tesoro.es.
BdE · CNMV · DGSFPSupervision
Competent authorities
The Bank of Spain (banking/payments), the CNMV (securities and collective investment schemes) and the Directorate-General for Insurance and Pension Funds (insurance and pensions) supervise each test according to its scope.
Continuous monitoring.
GuaranteesLiability
Cover for damage to participants
The promoter must have sufficient financial guarantees to cover any losses and damages arising from the test.
Insurance or bank guarantee.
ExitPost-sandbox
Post-test regime
Conclusions report and the option to apply for the corresponding sector-specific authorization through a simplified procedure based on the sandbox experience.
It is not an automatic license.
Contact
Book a call
Tell us about your fintech project and we will explain how to prepare the sandbox application, the protocol and the path to the final license.
Legal framework of the regulatory sandbox in Spain: Law 7/2020 and the law-protocol structure
The Spanish financial sandbox is built on Law 7/2020 of November 13 for the digital transformation of the financial system, which brings into Spanish law the two main innovation facilitators: the controlled testing environment (regulatory sandbox) and innovation hubs. The model closely follows the UK FCA’s approach.
Purpose and scope of the law
The law regulates a controlled testing environment that allows technology-based innovation projects in the financial system to be put into practice fully within the legal and supervisory framework, always respecting the principle of non-discrimination. It seeks to reconcile innovation with consumer protection, financial stability and market integrity, without ever granting an exemption from anti-money laundering rules.
Law-protocol structure
The regulatory framework consists of Law 7/2020 (general regime, rights and obligations) and the testing protocol signed between the promoter and the competent authority (Bank of Spain, CNMV or DGSFP). The protocol is not sector-specific legislation, but a breach can lead to the tests being interrupted and, potentially, to penalties.
Access requirements (Art. 5)
Projects may enter the sandbox if they (i) bring a technology-based innovation applicable to the financial system, (ii) are sufficiently advanced (MVP) and (iii) provide added value in regulatory compliance, benefits for users, efficiency of institutions and markets, or improvement of regulation and supervision.
Semi-annual cohorts and single entry point
The General Secretariat of the Treasury and International Financing runs the single entry point. There are two calls a year (March and September), with phases of application, preliminary assessment, protocol signing, testing and exit with a conclusions report. Access to the sandbox does not grant indefinite authorization to operate.
User protection, data and AML
The law guarantees user protection (express consent, enhanced information, financial guarantees), compliance with the GDPR and full application of anti-money laundering rules (Law 10/2010). The promoter must size its liability guarantees to the project’s risk.
Fintech and sandbox services
Related regulated projects
Resources and blog
Official sources
Key legislation, linked to the official text:
- Law 7/2020 of November 13 for the digital transformation of the financial systemBOE · consolidated text
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
Legislation and links reviewed in .