Lessons from European FinTech sandboxes
A common reporting framework and joint thematic calls for innovation facilitators
Vilnius University
2026-09-28
Ten years in, the problem is evidence
The United Kingdom opened the first FinTech regulatory sandbox in 2016 (Marcelin 2026). Europe now has a crowded, uneven landscape of innovation facilitators.
- Every EEA country operates at least one innovation hub.
- Supervised live testing exists in roughly a third of jurisdictions.
- The instrument has spread into AI, energy, transport, and digital government.
The policy question is what these schemes produce and which lessons can travel.
The next wave makes the reporting gap urgent
- The AI Act introduces annual reporting duties for AI regulatory sandboxes (European Union 2024).
- Interoperability sandboxes must report every six months through a common portal (European Commission 2025).
- Member States reported 132 ongoing and completed sandboxes across sectors in 2025 (European Commission 2026).
FinTech has a decade of operational experience. Its reporting record shows what the next generation needs to establish earlier.
Europe is counting three different things
| Reported count | What is being counted | Source |
|---|---|---|
| 14 in 12 countries | Financial sandboxes under the ESAs’ inventory | European Supervisory Authorities (2023) |
| 11 of 30 jurisdictions | Supervised live testing with real customers | Hernández Sánchez (2026) |
| 132 across sectors | Member State self-report using broader definitions | European Commission (2026) |
Each figure answers a different question. None is a ranking of regulatory sophistication.
The sandbox label covers five designs
| Instrument | Core activity | Institutional form |
|---|---|---|
| Supervisory sandbox | Live testing with customers | Supervisor-run |
| Statutory testing space | Live testing with customers | Created in legislation |
| Advisory cohort | Time-bounded advice | No live-market test |
| Statutory exemption | Legal relief | No supervised testing process |
| Innovation hub | Dialogue and guidance | Continuing facilitation channel |
The first two involve supervised live testing. The others can still be useful, but they generate different evidence (Hernández Sánchez 2026).
Supervised live testing remains a minority choice
Non-adoption has the clearer institutional pattern
- Adoption recipes account for 46% of the eleven live-testing adopters; only the Latvia-Lithuania profile recurs.
- Non-adoption recipes account for 74% of the nineteen non-adopters, including established hubs, licensing and guidance, and ordinary supervision.
- Six adopters share their measured structural profile with at least one non-adopter.
The map records policy instrument choice as well as administrative capacity (Hernández Sánchez 2026).
Four low counts, four different diagnoses
| Observation | Operational context | Source |
|---|---|---|
| No completed live test in four years | Eligibility initially limited to authorised institutions | Interview 07, 2025 |
| Test environment never entered | Hub dialogue resolved every case | Interview 14, 2026 |
| Applications fell between cohorts | Procedures later simplified in legislation | Interview 09, 2026 |
| Two participants since launch | Entry rules were deliberately strict | Interview 16, 2026 |
A low participant count does not identify the problem
It may reflect demand, eligibility, burden, capacity, effective triage, or simply no case that requires live testing.
The missing context already exists locally
Authorities already hold the information needed to interpret participation:
- eligibility rules and how they changed;
- referrals between the hub and the sandbox;
- reasons applications lapse or tests end early;
- cases resolved through dialogue before testing;
- staffing, specialist access, and operating cost.
A common record would turn counts into evidence that another authority can read.
What happens to the learning?
When the Commission asked whether sandbox experience had influenced policymaking (European Commission 2026):
| Reported position | Member States |
|---|---|
| Concrete regulatory changes | 4 |
| Too early to tell | 17 |
| No impact identified | 3 |
Standardised reporting templates were reported in only four countries. In energy, the route from sandbox outcomes to regulatory change is rarely codified (Gangale et al. 2026).
Published reports still resist comparison
Narrative lessons are difficult to search, aggregate, compare, and reuse across schemes.
Officials describe value that current metrics miss
- Experts from AML, payments, crypto-assets, regulation, and supervision meet “all in one place” (Interview 16, 2026).
- Multi-authority schemes give participants access to data-protection and other specialist expertise (Interview 09, 2026).
- A thematic cohort accelerated a customer-due-diligence partnership between an incumbent bank and a small FinTech firm (Interview 11, 2026).
Cohort designs can build ties, trust, and shared understanding (Leonard et al. 2025). Application and graduation counts do not capture that work.
Operational context varies with the label
Resourcing
One scheme has an earmarked budget, a dedicated team, and an advisory board. Another relies on part-time staff from supervisory units where sandbox work can be deprioritised (Interviews 02 and 07, 2025).
Triage
Hubs and sandboxes can form a tiered system. One authority’s hub has resolved every case, while live testing remains available for the exceptional case (Interview 14, 2026).
Operating cost is also poorly documented (European Commission 2026).
Two measures can make the learning portable
1. Use a short common reporting framework
EFIF and the ESAs can agree a small shared core with instrument-specific modules.
| Component | Minimum content |
|---|---|
| Shared core | Mandate, design, resources, demand, selection, referrals, safeguards, documented learning, negative results |
| Live-testing module | Test plan, incidents, early termination, derogations, exit assessment |
| Innovation-hub module | Query volume, recurring themes, referrals, classification questions |
| Thematic module | Problem statement, participants, partnerships, published lessons |
Three rules keep the record useful
- Record learning as events: issue, method, finding, legal interpretation, regulatory implication, follow-up.
- Require negative and corrective results: early endings, triggered safeguards, inactive schemes, and changes made after weak demand (Cuello et al. 2025).
- Compare within modules: publish definitions and avoid a composite score or league table.
A short shared core with proportionate extensions follows established EU supervisory reporting practice (European Banking Authority 2021). Evaluation should be designed into the scheme (OECD 2025).
2. Organise calls around shared problems
The EU cross-border testing framework had not been used at the time of the ESAs’ 2023 review (European Supervisory Authorities 2023). Early-stage firms may not be ready for multi-country testing (Interview 12, 2026).
The regulatory problems already cross borders:
- financial-crime data sharing;
- AI in financial services;
- tokenised assets, digital identity, and open finance.
Thematic cohorts concentrate expertise, make resource needs visible, and help secure internal participation.
One thematic cycle
- EFIF agrees one or two shared problems in its annual work plan.
- Each authority invites and assesses projects under its own mandate and through the instrument it already operates.
- Participants report through the shared core and the relevant module.
- EFIF convenes a joint debrief and publishes lessons and unresolved legal questions.
The design stays within existing mandates
- No EU-wide authorisation and no new powers for EFIF.
- No automatic recognition of a national decision elsewhere.
- Aggregate reporting and anonymised themes protect confidential information.
- Published definitions and module-level comparison limit false precision.
- Common non-endorsement language separates participation from regulatory approval.
Participation would remain voluntary. The reporting burden and staff cost still need to be tested in practice.
The next EFIF cycle can establish the common record
Agree the facilitator vocabulary, pilot a one-page core with a small group of volunteers, and publish what the pilot changes before scaling it.