Fintech Regulatory Sandboxes in the UAE 2026: DFSA ITL and FSRA RegLab

A regulatory sandbox is a restricted licence allowing a fintech company to test an innovative financial product with real customers in a controlled environment, without meeting every requirement of a full licence from day one.

The UAE has two separate, unrelated programmes: the DFSA Innovation Testing Licence (ITL) in the Dubai International Financial Centre (DIFC), launched in May 2017, and the FSRA RegLab in Abu Dhabi Global Market (ADGM) — the Middle East’s first regulatory sandbox, launched 31 August 2016, per the version stamp on FSRA’s original guidance document (VER01.31082016) — roughly 9 months ahead of the DFSA ITL launch.

The DFSA ITL testing period runs 6 to 12 months, extendable in exceptional cases; the FSRA RegLab runs up to 2 years, depending on the specific case.

Both programmes require migration to a full licence following successful testing, or cessation of the activity — a sandbox does not replace licensing, it defers part of the requirements to the testing period.

⚠ The DFSA ITL is not a separate licence category but a restricted version of a standard DFSA licence: an ITL holder appears on the DFSA public register alongside fully authorised firms, with its restricted status visible to clients and counterparties.

1. The Legal Basis

Both sandboxes operate within financial free zones with their own regulatory regime, separate from federal UAE legislation.

The FSRA RegLab is governed by ADGM’s own FinTech Regulatory Laboratory Guidance and falls under the Regulated Activity of Developing Financial Technology Services within the RegLab, per ADGM’s Financial Services and Markets Regulations (FSMR).

The DFSA Innovation Testing Licence is administered by the Dubai Financial Services Authority — DIFC’s independent regulator, operating under its own Rulebook, separate from the UAE’s federal financial regulators.

Need advice on choosing a jurisdiction for your fintech startup? UPPERSETUP company registration services →

2. DFSA Innovation Testing Licence: Eligibility

The DFSA sets four mandatory criteria for pre-application acceptance.

DFSA ITL eligibility criterion	Requirement
Innovation	A new product/service or the application of innovative technology to an existing service
Regulated activity	An activity that, if carried on in or from the DIFC, is a Financial Service
Readiness for testing	The applicant must be ready to start live-testing with real customers
Intent to scale	The applicant must intend to roll out the business fully in or from the DIFC after successfully completing testing

The applicant must confirm sufficient funding to meet the minimum capital requirements for the applied-for activity, along with a management team with a minimum of 2–3 years of experience in the relevant field.

3. How the DFSA Application Process Works

A DFSA ITL applicant first submits a preliminary form, then proceeds through a full review process.

1.     Submit the ITL Pre-application Form with basic information about the business model and the nature of the innovation.

2.     DFSA reviews the pre-application — typically within around two weeks.

3.     Develop a regulatory test plan describing the proposed business model, product, or service.

4.     DFSA conducts a full review of the application — a decision is typically issued within 10–12 weeks of a complete submission.

✅ Since 2025, the DFSA has accepted ITL applications on an open-window basis year-round — interested firms can apply as soon as their product is ready, without waiting for the next cohort intake.

4. What Happens After the Testing Period in DIFC

At the end of the testing period, the firm must demonstrate that it has met the agreed targets of the test plan and can meet the full DFSA authorisation requirements — upon meeting these conditions, the firm migrates to a full licence.

⚠ If a firm cannot confirm readiness for full authorisation once the testing period ends, it must cease the regulated activity within the DIFC — the sandbox does not renew automatically or become a permanent relaxed regime.

5. FSRA RegLab: Eligibility

The FSRA assesses a RegLab application against criteria of business-model innovation and technology deployment model, along with the applicant’s general track record.

The FSRA Authorisation Team assesses the applicant’s and its shareholders’ operational, financial, and regulatory track record, the fitness and propriety of senior management, and the entity’s resources, systems, and controls to ensure proper corporate governance.

ℹ Historically, FSRA RegLab has run through themed cohorts — for example, the 2022 5th cohort focused on DeFi and Web3. The current intake format should be confirmed directly with the FSRA.

6. RegLab’s Special Status: Not a Category, a Bespoke Arrangement

Unlike the formalised ITL, an FSRA RegLab authorisation is shaped individually for each applicant.

ADGM RegLab is a bespoke, individually tailored regulatory framework rather than a fixed licence category — the scope of permitted activity, the testing duration, and the conditions imposed are negotiated between the FSRA and the applicant on a case-by-case basis.

✅ Per the primary text of the FinTech Regulatory Laboratory Guidance, the RegLab authorisation automatically expires at the end of its two-year validity period; the FSRA expressly reserves the right to refuse an extension at its discretion.

Per section 4.3 of the primary guidance text, a RegLab participant is required to establish a commercial presence directly in ADGM — this is a mandatory structural requirement, not an option.

Per section 4.12, exit from the RegLab can occur before the two-year mark if the size, scale, or progress of the FinTech Proposal warrants it — two years is a ceiling, not a guaranteed term. Under section 8.2, an extension application must be submitted at least three months before expiry.

⚠ The FSRA may cancel the authorisation (FSP) mid-testing under section 8.7 if the participant fails to satisfy the threshold conditions, breaches authorisation requirements, or contravenes the FSMR — the two-year period is not a guarantee of undisturbed participation until its end.

7. The ADGM Digital Lab

RegLab participants do not operate in isolation but within a dedicated technology environment maintained by the regulator.

The ADGM Digital Lab is a cloud-based environment established by the FSRA to promote collaboration between institutional players and startups and to monitor RegLab participants’ regulatory compliance in real time.

8. Comparing the Two Programmes

Parameter	DFSA Innovation Testing Licence (DIFC)	FSRA RegLab (ADGM)
Year launched	2017	The Middle East’s first regulatory sandbox (launched before the ITL)
Testing period	6–12 months, extendable in exceptional cases	Up to 2 years, depending on the specific case
Application format	Applications accepted year-round	Historically run through themed cohorts (e.g. the 2022 5th cohort focused on DeFi/Web3)
Decision timeline	Typically 10–12 weeks from a complete submission	Determined individually following FSRA assessment
Legal status of the licence	A restricted version of a full DFSA licence, listed on the DFSA public register	An individually negotiated bespoke authorisation, not a separate licence category

The key practical distinction is the degree of formalisation: the DFSA ITL is structured around clear timeframes (6–12 months) and a predictable review period, while the FSRA RegLab offers more flexibility on individual terms but with a less predictable decision timeline.

9. Obligations During the Testing Period

⚠ Neither sandbox eliminates regulation entirely: both programmes require participants to meet minimum capital requirements, pass fit-and-proper assessments for senior management, and comply with AML/KYC obligations already during the testing phase.

10. Step-by-Step Process for Choosing Between DIFC and ADGM

5.     Determine the nature of the product: a technology solution with no regulated financial activity may not need a sandbox at all and could fit a standard DIFC or ADGM technology licence instead.

6.     Assess the preferred testing timeline: the DFSA ITL suits a tighter hypothesis-testing cycle (6–12 months), while the FSRA RegLab suits longer-term testing of more complex models (up to 2 years).

7.     Prepare a regulatory test plan with clear, measurable testing objectives.

8.     Confirm the minimum capital and an experienced management team are in place for the chosen jurisdiction.

9.     Submit the application through the chosen regulator and be prepared for several rounds of follow-up questions.

10.  Plan the transition strategy to a full licence in advance — completing testing successfully does not guarantee automatic issuance of a full licence without further review.

11. Common Mistakes

•       Applying for a sandbox without a product ready for live testing. The DFSA explicitly requires readiness for testing with real customers as one of four mandatory eligibility criteria.

•       Treating the sandbox as a way to avoid full regulation indefinitely. Both programmes have a hard validity period and require migration to a full licence or cessation of activity once it expires.

•       Underestimating capital and management experience requirements at the sandbox stage. A restricted regime does not mean an absence of requirements — minimum capital and a fit-and-proper check on management are mandatory from the outset.

•       Confusing the DIFC Innovation Licence (for non-regulated tech firms) with the DFSA Innovation Testing Licence (for regulated financial activity). These are two different products for different applicant categories — choosing the wrong one leads to a rejected application.

12. Who This Fits

•       Fintech startups with a product ready for live testing in a regulated financial services area. Both programmes are built specifically for this category — testing an unready product does not meet the eligibility bar.

•       Companies working with tokenisation, DeFi, or other new financial models needing flexible testing terms. The FSRA RegLab has historically focused on such areas through themed cohorts.

13. Who This Does Not Fit

•       Technology companies not conducting a regulated financial activity. A standard DIFC or ADGM technology licence suits such companies better than a financial sandbox.

•       Companies expecting indefinite relaxed regulation. Both programmes are strictly time-limited and require migration to full licensing.

14. When Professional Verification Is Essential

Self-assessment is worth supplementing with specialist advice when: choosing between the DFSA ITL and FSRA RegLab for a specific business model; drafting a regulatory test plan that meets the chosen regulator’s requirements; and planning the transition from the testing period to a full licence.

FAQ

How long is the DFSA ITL testing period?

6 to 12 months, extendable in exceptional cases at the DFSA’s discretion.

How long is the FSRA RegLab testing period?

Up to 2 years, depending on the specific case; the authorisation automatically expires at the end of that period.

Can a company keep operating without a full licence after the sandbox ends?

No, if the company cannot confirm it meets full authorisation requirements, it must cease the regulated activity in the relevant jurisdiction.

Is minimum capital required to join a sandbox?

Yes, both programmes require confirmation of sufficient funding to meet minimum capital requirements for the applied-for activity, already at the testing stage.

Key Takeaways

•       The UAE has two separate sandboxes: the DFSA Innovation Testing Licence (DIFC, since 2017) and the FSRA RegLab (ADGM).

•       Testing period: 6–12 months for the DFSA ITL, up to 2 years for the FSRA RegLab.

•       The DFSA ITL is a restricted version of a full licence, listed on the DFSA public register; the FSRA RegLab is an individually negotiated authorisation.

•       Both programmes require migration to a full licence or cessation of activity once the testing period ends.

•       Minimum capital and a fit-and-proper check on management are mandatory already at the testing stage.

•       Since 2025, the DFSA has accepted ITL applications year-round, without cohort timing.

Summary

The UAE has two regulatory sandboxes for fintech companies: the DFSA Innovation Testing Licence (ITL) in the Dubai International Financial Centre, launched in May 2017, with a testing period of 6 to 12 months, and the FSRA RegLab in Abu Dhabi Global Market — the Middle East’s first regulatory sandbox, with a testing period of up to 2 years. The DFSA ITL is a restricted version of a full DFSA licence, listed on the regulator’s public register; the FSRA RegLab is an individually negotiated authorisation, not a separate licence category. Both programmes require minimum capital and a fit-and-proper check on management already at the testing stage, and do not waive AML/KYC requirements. At the end of the testing period, the company must migrate to a full licence or cease the regulated activity. Since 2025, the DFSA has accepted ITL applications year-round, with a decision typically issued within 10–12 weeks of a complete submission.

Sources

• Abu Dhabi Global Market (ADGM) — FinTech Regulatory Laboratory Guidance, official document (assets.adgm.com)

• Abu Dhabi Global Market (ADGM) — FinTech, official section (adgm.com)

• Dubai Financial Services Authority (DFSA) — DFSA launches Innovation Testing Licence for FinTech Firms, official press release (dfsa.ae)

• Dubai Financial Services Authority (DFSA) — DFSA launches Innovation Testing Licence explainer guide (dfsa.ae)

• Dubai Financial Services Authority (DFSA) — DFSA Expands FinTech Innovation Testing Programme (dfsa.ae)

Disclaimer

This material is for informational purposes only and does not constitute legal, tax, financial, investment, or consulting advice. Exact requirements and fees are updated regularly — request current requirements directly from the DFSA or FSRA before applying. Information is accurate as of June 2026.