Regulatory Sandbox Guidelines

1.0 INTRODUCTION
1.1 The Financial Services Commission, Mauritius (‘FSC’) endeavours to encourage
the promotion of Fintech initiatives across the non-banking financial services sector of Mauritius in line with the country’s strategic vision to position itself as a leading Fintech hub in the region.
1.2 The provision of a regulatory environment that is conducive of the innovative use
of technology in the financial services sector is fundamental for the successful transformation of Mauritius into a smart International Financial Centre.
1.3 A regulatory sandbox regime is, in this respect, considered as a key enabler to
promote financial innovation in a timely and cost-effective manner. The Financial Services Act (‘FSA’) was effectively amended in 2021 to empower the FSC to grant regulatory sandbox authorisations (‘RSAs’). Licensees of the FSC as well as other body corporates are able, under this regime, to develop and experiment with new products, services and/or processes, in a simulated or live environment.
1.4 These Guidelines are being issued by the FSC, pursuant to its powers under
sections 7 (1) (a) and 14B (6) of the FSA, with the objectives of:
(a) Highlighting the main principles of the regulatory sandbox regime; (b) Providing guidance to prospective applicants on the application process for a RSA; and (c) Setting out the minimum ongoing obligations of any sandbox entity.
1.5 For ease of reference, a chart depicting the complete lifecycle of the regulatory
sandbox regime is enclosed at Appendix 1 to these Guidelines. The requirements set out in these Guidelines are not exhaustive. The FSC may request any additional information or document, as deemed necessary.
1.6 The Guidelines neither derogate nor restrict the powers vested upon the FSC by
statute and should be read together with the relevant Acts and such other guidelines, circulars, instructions or directives as may be issued by the FSC.

2.0 APPLICATION FOR A REGULATORY SANDBOX AUTHORISATION
2.1 An applicant, who has a fintech, regtech or other innovation-driven financial
services solution to be tested or experimented, may apply to the FSC for an RSA.
2.2 No fee shall be applied by the FSC for the submission and processing of an
application for an RSA.
2.3 The application shall be submitted electronically on the FSC One Platform. The
Cover Letter shall be uploaded, and be duly signed by an authorised signatory of the applicant and addressed to:
The Chief Executive
Financial Services Commission
FSC House
54 Cybercity Ebène
Mauritius
2.4 The applicant shall complete all the required sections of the online application form
as fully as possible and enclose supporting documents, where appropriate. If any question is not applicable or cannot be answered, the applicant is required to indicate same by marking ‘N/A’, with an explanation as to why it does not apply or cannot be answered at this stage. Failure to provide all the required information may result in delays in processing the application.
2.5 Any false or misleading information provided to the FSC in connection with an
application may lead to:
(i) the refusal of the application or cancellation of any RSA which has already been granted; and (ii) an offence being committed, and the person shall, on conviction, be liable to a fine not exceeding 500,000 rupees and to imprisonment for a term not exceeding 5 years in line with section 19 of the FSA.

2.6 Any queries or request for support may be addressed to the Fintech and Innovation
Department of the FSC by phone (+230 403 7000) or e-mail (finnovate@fscmauritius.org).
3.0 PROCESSING OF THE REGULATORY SANDBOX AUTHORISATION
3.1 The FSC shall assess the application based, inter alia, on the profile of the
applicant and the following eligibility criteria:
(a) Genuineness of innovation
The solution should be sufficiently innovative in terms of technology, product/service, and/or business model to add significant value to the offer of financial services in the non-banking financial services sector. (b) Genuine need for support and testing The applicant should have a genuine need for support and testing of the solution on real clients. Furthermore, the applicant should demonstrate that the solution does not fit in the existing regulatory framework and/or cannot be deployed without the exemption or relaxation of certain statutory requirements, if any, being sought. (c) Testing readiness The project should have reached a sufficiently mature stage, and the applicant should have the necessary resources to support testing in the regulatory sandbox and must demonstrate well-developed testing plans with clear objectives, parameters and success criteria. (d) Benefits to and protection of users/clients The solution should offer identifiable benefits (direct or indirect) to users/clients, investors, financial service providers and financial markets and the applicant shall ensure adequate protection of users/clients.

(e) Risks management
The solution should not pose any unnecessary risks to the soundness and stability of the financial system. In this respect, the applicant shall have a proper risk management strategy that incorporates appropriate safeguards to mitigate and control potential risks that may arise from the testing of the solution and shall propose appropriate safeguards to manage the risks and contain the consequences of failure. (f) Deployment post-testing The applicant should demonstrate the intention and ability to deploy the solution on a broader scale. To this effect, the applicant should submit a proposed regulatory sandbox exit and transition strategy.
3.2 A preliminary review of the application shall be done within 15 business days from
receipt thereof. The FSC shall then communicate to the applicant any outstanding information, request for clarification and/or information regarding the applicant’s potential suitability for an RSA or inform the applicant that the application cannot be entertained.
3.3 Upon submission of a complete application, the FSC shall assess the submissions
and aim to take a decision as to whether to grant the authorisation or reject the application, within 30 business days. The applicant shall be notified of the decision in writing.
3.4 The FSC will endeavour its best to meet the turnaround times, as specified in
paragraphs 3.2 and 3.3. However, the FSC shall not be held accountable for delays caused by any unforeseen circumstances or force majeure, which are beyond its control.
3.5 The FSC shall issue a communiqué on its website informing the public about the
grant of the RSA.

3.6 The FSC may, pursuant to section 14B (4) of the FSA exempt a sandbox entity
from any applicable regulatory requirement.
3.7 As a condition of the RSA, the sandbox entity may be required to implement the
following non-exhaustive safeguards:
(a) providing adequate disclosure of the potential risks to clients and any other significant stakeholders participating in the regulatory sandbox, and receiving confirmation that they fully understand and accept the risks; (b) limiting the number and profile of clients participating in the regulatory sandbox and/or the aggregate value or frequency of transactions; (c) limiting the duration of the testing period; (d) providing a client protection or redress mechanism, including the possibility for financial compensation claimable against the sandbox entity under clearly specified circumstances; (e) committing adequate and competent resources to undertake the testing and implementing risk mitigation measures that have been proven to be effective in containing the consequences of failure; and (f) maintaining records of transactions effected during the testing period.
4.0 TESTING STAGE
4.1 Upon authorisation, the sandbox entity shall proceed towards the testing of its
solution.
4.2 The duration of the regulatory sandbox testing shall be a maximum of twelve (12)
months, and extendable upon request of the sandbox entity and subject to the approval of the FSC.

4.3 During the testing stage, the sandbox entity shall obtain the prior approval of the
FSC before effecting any material changes to the proposed solution.
4.4 Each sandbox entity shall assign a contact person to liaise with the FSC for
reporting and monitoring purposes during the testing period.
5.0 REPORTING REQUIREMENTS
5.1 During the testing period, the sandbox entity shall be required to submit to the FSC
information relating to the test and such other information, as may be required. Interim reports
5.2 The sandbox entity shall submit interim reports to the FSC on the progress of the
test that shall inter alia include the following:
(a) key performance indicators, key milestones and statistical information; (b) key issues arising - including from fraud, cyber/IT related and other operational incident; and (c) actions or steps taken to address the key issues referred to in paragraph (b) above.
5.3 The frequency and specific details to be included in interim reports shall be agreed
between the FSC and the sandbox entity, considering the duration, complexity, scale and risks associated with the test, and the specificities of the solution being tested. Final report
5.4 The sandbox entity shall submit a final report within 20 business days, prior to the
expiry of the testing period or renewed testing period, containing the following information to the FSC:

(a) key outcomes and key performance indicators against agreed measures for the success of the test; (b) full account of all incident reports and resolution of complaints. Where such complaints have not been resolved, the plan put in place to resolve them; and (c) in the case of a failed test, reasons for the failure.
6.0 OBLIGATIONS OF THE SANDBOX ENTITY TOWARDS USERS/CLIENTS
6.1 The sandbox entity shall disclose in clear terms:
(a) the nature and complexity of the products/services being proposed for testing to its users/clients; (b) whether the users/clients shall be compensated for any losses incurred during the regulatory sandbox testing period; and (c) that the FSC shall not be liable for any loss incurred by the users/clients during the testing period or afterwards.
6.2 The sandbox entity shall seek the formal and informed consent of the users/clients
before their on-boarding during the testing period.
6.3 The sandbox entity shall have in place appropriate and effective procedures (such
as comprehensive register or log) for the handling of complaints from users/clients.
6.4 The sandbox entity shall implement and maintain measures for preserving the
integrity and confidentiality of information for its users/clients in compliance with the applicable data protection laws, during and after the expiry of the testing period.

7.0 REQUEST FOR RENEWAL OF RSA AND EXIT FROM THE REGULATORY
SANDBOX
7.1 The sandbox entity shall, at least 20 business days prior to the expiry of the testing
period, either:
(a) request the approval of the FSC for its exit from the regulatory sandbox, and accordingly submit its exit plan and the report as specified at paragraph 5.4; or (b) apply to the FSC for the renewal of its RSA and provide the full rationale, thereof.
7.2 Where the FSC is satisfied with the request of the sandbox entity under paragraph
7.1 (b), it shall renew the RSA for such period as it may deem fit and advise the
sandbox entity accordingly.
7.3 At the end of the testing or renewed testing period, the RSA granted to the sandbox
entity and any exempted or relaxed regulatory requirements, shall expire. The sandbox entity shall accordingly ensure that the exit process has been duly completed prior to the expiry of the testing period or renewed testing period.
7.4 Where the FSC is satisfied with the successful completion of testing, the sandbox
entity shall have the following options upon exit from the regulatory sandbox:
(i) apply for a relevant licence or authorisation from the FSC; or (ii) deploy the solution on a wider scale if/when no new licence or authorisation is required in accordance with the laws of Mauritius.
7.5 Notwithstanding paragraph 7.1, the FSC may, at any point in time (i.e during the
testing period) grant its approval following a written request from a sandbox entity to exit the regulatory sandbox. Prior to granting its approval, the FSC shall ensure that the sandbox entity has satisfactorily implemented its exit plan and also surrendered its RSA to the FSC.

7.6 The FSC shall not grant approval to a sandbox entity for exit from the regulatory
sandbox unless it is satisfied that the interests of users/clients are safeguarded, and that all conditions of its exit have been complied with.
7.7 The FSC shall issue a communiqué on its website informing the public about the
exit of the sandbox entity from the regulatory sandbox.
8.0 VARIATION OF CONDITIONS OF REGULATORY SANDBOX
AUTHORISATION
8.1 The FSC may amend, vary or cancel any of the conditions under which the RSA
has been granted, or impose new conditions. Prior to amending or varying any conditions, the FSC will provide the holder of authorisation an opportunity to make representations.
9.0 NON-COMPLIANCE WITH THE GUIDELINES
9.1 Non-compliance with these Guidelines will expose the sandbox entity to regulatory
actions which may include a direction issued under section 7 the FSA.
9.2 These Guidelines may be subject to review and may be amended by the
Commission from time to time.