Risk and governance
Who is accountable, how risk is identified and accepted, and how the board oversees the test.
Governance
Startups · Readiness
Sandbox applications that answer the regulator's real questions
For fintech, data and AI startups applying to a Gulf regulatory sandbox: we write the risk, data protection, cyber security, AI oversight and exit sections regulators scrutinise hardest.
The sections founders find hardest to write
Gulf regulators run sandboxes so that new fintech, data and AI products can be tested under supervision before full licensing. The application is usually strong on the product and weak on everything the regulator worries about: how customer data is protected, what happens when the test goes wrong, how AI decisions are overseen, and how the test ends safely.
Those are exactly the sections we write with you, in the regulator's own vocabulary.
Programmes we prepare for
Each has its own form and criteria; we work to the current version on the regulator's site at the time you apply.
- DFSA Innovation Testing Licence (DIFC)
- FSRA RegLab (ADGM)
- Central Bank of the UAE sandbox programmes
- SAMA Regulatory Sandbox (Saudi Arabia)
- SDAIA Data Regulatory Sandbox, including its personal data protection track opened in October 2026
- Qatar Central Bank regulatory sandbox
What you receive
Data protection
The data protection impact assessment, lawful basis, consent design and data residency position for your test.
DPIA
Cyber security
The controls in place for the test, proportionate to its size, and how they will scale to full licensing.
Controls
AI oversight
Where your product uses AI: how decisions are explained, overseen and challenged, and how model changes are controlled.
AI
Customer safeguards
Test limits, disclosures, complaints, compensation and the incident plan for test customers.
Safeguards
Exit plan
How the test ends, or transitions to a full licence, without harm to the customers in it.
Exit
What it costs
One fixed fee, paid in advance. Includes one round of responses to regulator questions on the sections we wrote.
Sandbox application support
One programmeProduct without AI decisioning
The risk, data protection, cyber security, safeguards and exit sections, and a review of how they fit your business plan.
From AED 12,000≈ USD 3,268. Excludes VAT and other taxes.
Sandbox application support: AI products
One programmeAI decisioning or data-intensive testing
Everything in Standard, plus the AI oversight section and a deeper data protection impact assessment.
From AED 20,000≈ USD 5,446. Excludes VAT and other taxes.
Outside this service
Admission decisions, which rest with the regulator. Business plans, financial projections, legal opinions and licensing advice, which need your own advisers. We tell you early if your product looks unsuited to the programme you have chosen.
The firewall
This is readiness work. We will not later assess, or issue an AI Trust Passport on, the controls we helped you describe.
Questions
Which sandbox should we apply to?
It depends on your product, your customers and where you want to be licensed in the end. We give you a straight view on the scoping call, including when a sandbox is not the right route.
How long does it take?
Usually two to three weeks from receiving your product information, depending on the programme's form and your answers.
Tell us the product and the programme
We will tell you whether the programme fits and fix the scope and fee.