HKMA Fintech Supervisory Sandbox Application (Hong Kong)

A HKMA Fintech Supervisory Sandbox Application in Hong Kong supports an application to the relevant authority for the approval or registration sought.

HKMA Fintech Supervisory Sandbox (FSS) was launched in September 2016 as a core initiative of the HKMA's Fintech Facilitation Office (FFO), established to foster a conducive environment for the fintech ecosystem in Hong Kong. The FSS allows authorised institutions to conduct limited-scale live tests of new fintech products with real customers under controlled conditions, subject to HKMA close supervision, without the full regulatory requirements that would apply to a commercial launch. The sandbox approach enables both the AI and the HKMA to identify and address regulatory issues arising from the use of new technology before the product is deployed to the general public.

Hong Kong's fintech legal environment involves multiple authorities. The HKMA supervises banks and authorised institutions under the Banking Ordinance (Cap. 155), and Section 7 of Cap. 155 grants the HKMA broad supervisory powers over the business and risk management practices of every authorised institution. Stored value facilities (SVFs) are regulated under Section 19 of the Payment Systems and Stored Value Facilities Ordinance (Cap. 584), which requires SVF licensees to maintain minimum capital and safeguarding requirements. The Securities and Futures Commission (SFC) regulates securities and futures activities under the Securities and Futures Ordinance (Cap. 571) and licenses virtual asset service providers (VASPs) under Section 53ZRK of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). The Insurance Authority (IA) regulates insurance companies and intermediaries under the Insurance Ordinance (Cap. 41). Where a fintech product crosses regulatory boundaries — for example, a digital wealth management platform offering both banking and investment services — the cross-agency sandbox arrangement established in 2017 allows applicants to submit a single consolidated application to their primary regulator.

Key fintech product categories for which HKMA FSS applications are commonly made include artificial intelligence and machine learning applications in credit scoring and fraud detection, biometric authentication and remote digital onboarding under HKMA technology risk management guidelines, open banking implementations under the HKMA Open API Framework (Phase I through Phase IV), distributed ledger technology (DLT) solutions for cross-border payments and trade finance, and banking-as-a-service (BaaS) models offered by virtual banks licensed by the HKMA. The HKMA's Fintech 2025 strategy reinforces Hong Kong's position as a leading fintech regulatory sandbox jurisdiction in Asia. Related documents include a Non-Disclosure Agreement to protect confidential technology information shared with the HKMA during the sandbox assessment, and a Service Agreement governing the relationship between the AI and its fintech technology partner. Forms-legal.com provides a professionally drafted HKMA Fintech Supervisory Sandbox Application template covering the key elements the HKMA expects in a sandbox application.

HKMA Fintech Supervisory Sandbox Application in Hong Kong is needed whenever an authorised institution licensed under the Banking Ordinance (Cap. 155) wishes to test an innovative fintech product, service, or process that cannot be conducted within the full scope of existing regulatory requirements, or where the HKMA's prior engagement and supervisory input is sought before the product is launched commercially.

An AI developing a new artificial intelligence or machine learning-based product — for example, an AI-driven credit assessment model, a robo-advisory investment tool linked to a bank account, or a biometric identity verification system for customer onboarding — that involves departures from the HKMA's existing technology risk management guidelines or customer due diligence requirements under Cap. 615 should consider FSS participation. The sandbox allows the AI and its technology partner to test the product's reliability, security, and compliance features with a small pilot group before full deployment.

An AI partnering with a fintech firm to implement an open banking solution under the HKMA's Open API Framework — particularly at Phase III or Phase IV covering account information or transaction initiation — where the data sharing and consent mechanisms require regulatory confirmation before commercial launch, should submit an FSS application to engage the HKMA on the regulatory treatment of the specific implementation.

A virtual bank licensed by the HKMA under the Banking Ordinance that wishes to test a novel product feature — such as embedded insurance distribution, peer-to-peer lending functionality, or a new digital payment instrument — that may involve activities regulated by the IA or the SFC should apply under the cross-agency sandbox arrangement to obtain coordinated regulatory input from all relevant regulators.

An AI or technology firm developing a distributed ledger technology (DLT) solution for trade finance, cross-border payment settlement, or digital bond issuance involving multiple financial institutions should consider FSS participation where the DLT network involves regulated activities requiring HKMA oversight or where new Stored Value Facility (SVF) licensing questions arise under the Payment Systems and Stored Value Facilities Ordinance (Cap. 584).

An international fintech firm seeking to enter the Hong Kong market with an innovative product already tested in another jurisdiction's sandbox — for example, the UK FCA sandbox, the MAS Fintech Regulatory Sandbox in Singapore, or the DFSA Innovation Testing Licence in Dubai — can apply to the HKMA FSS for a Hong Kong-specific live pilot, taking advantage of Hong Kong's bilateral fintech bridge agreements with partner regulators in those jurisdictions.

HKMA Fintech Supervisory Sandbox Application in Hong Kong should address the following key elements to give the HKMA the information it needs to assess the application and determine the appropriate sandbox parameters.

Applicant Identification: State the full legal name and HKMA licence number of the authorised institution (AI) making the application, together with the full legal name, Business Registration Number (BRN) under the Business Registration Ordinance (Cap. 310), and a description of the fintech firm co-applicant where applicable. The AI bears primary regulatory responsibility for the sandbox pilot, including all customer protection and compliance obligations under Section 7 of the Banking Ordinance (Cap. 155), which requires every authorised institution to conduct its business in a prudent manner.

Description of the Fintech Initiative: Explain in plain language what the product or service does, what technology it uses (AI, DLT, biometrics, open API, etc.), what customer need it addresses, and how it differs materially from the AI's existing products and services. The description should identify the relevant regulatory framework that normally applies — for example, technology risk management requirements under the HKMA's Supervisory Policy Manual (SPM), AML/CFT obligations under Section 5 of Cap. 615, or capital adequacy requirements under Section 97 of Cap. 155 — and explain why the pilot test requires a modified regulatory approach during the sandbox period.

Regulatory Issues and Requested Relaxation: For each regulatory requirement with which full compliance is not practicable during the pilot, identify the specific regulatory provision with reference to the relevant SPM module, circular, or statutory provision; explain why compliance is not practicable; and propose the alternative safeguard or modified approach to be adopted during the pilot. The HKMA does not grant open-ended exemptions — the relaxation is confined to the specific issues identified and the duration of the pilot.

Testing Parameters: Specify the proposed pilot start and end dates (typically 3 to 9 months); the maximum number of participating customers and the criteria for their selection; the transaction or volume limits applicable during the pilot; the geographic scope (Hong Kong only, or cross-border if applicable under Section 30 of Cap. 155 governing overseas activities); and the systems and infrastructure to be used for the pilot.

Customer Protection Measures: Describe the disclosure to be given to participating customers explaining that they are participating in a fintech pilot; the consent mechanism (written or electronic consent); the complaint handling procedure for pilot participants under the HKMA's Code of Banking Practice; the incident response and escalation protocol; and the exit and remediation plan if the pilot is discontinued or causes customer harm. Customer protection is the HKMA's primary consideration in assessing FSS applications.

Exit Criteria and Commercialisation Plan: State the criteria for declaring the pilot successful; the key performance indicators to be measured during the pilot; the regulatory steps required for full commercial launch (for example, HKMA approval, amendment of licence conditions, or issuance of new supervisory guidance); and the timeline for completing those steps after the pilot ends.

Supporting Technical Documentation: Append system architecture diagrams, data flow maps, independent security assessment reports, and any third-party technology assessments to demonstrate the adequacy of the AI's risk management framework for the pilot. The HKMA's Supervisory Policy Manual module on technology risk management (TM-G-1 and related modules) sets out the technical standards expected of HKMA-regulated entities. Forms-legal.com provides a complete HKMA Fintech Supervisory Sandbox Application template covering all these elements for Hong Kong authorised institutions and their fintech partners.