A Fintech’s Guide to ASIC’s Enhanced Regulatory Sandbox

Introduction

For many Australian fintech startups, the journey to market can be slowed by the significant costs and complexities of obtaining a full Australian Financial Services (AFS) licence or Australian credit licence. To address this, the Australian Government introduced the Enhanced Regulatory Sandbox (ERS), an initiative administered by the Australian Securities and Investments Commission (ASIC) that allows businesses to test certain innovative financial services or credit activities for up to 24 months without a full licence. The ERS is designed to facilitate financial innovation by reducing these barriers to entry while ensuring that essential consumer protections remain in place.

Navigating this regulatory pathway, however, requires a clear understanding of the eligibility criteria, application process, and operational rules. This guide provides fintech innovators with a practical, step-by-step overview of the ERS, explaining how to prepare a strong notification, what you can and cannot do during the testing period, and how to plan for a successful transition out of the sandbox. By demystifying the process, this guide aims to empower founders to leverage the ERS as a strategic tool for responsible innovation.

Understanding the Enhanced Regulatory Sandbox & Its Purpose

What is the ASIC Enhanced Regulatory Sandbox

The ERS is a licensing exemption provided by ASIC. Introduced by the Australian Government on 1 September 2020, this framework allows businesses to test innovative financial services or credit activities without first obtaining a full AFS licence or Australian credit licence.

Key features of the ERS include:

• A testing period of up to 24 months
• A broader range of eligible financial services and credit activities
• A more practical pathway for fintech innovation

This enhanced version supersedes the previous, more limited regulatory sandbox that was administered by ASIC, offering significant improvements that make it more accessible and valuable for innovative businesses.

The Goal of the Fintech Regulatory Sandbox

The primary goal of the fintech regulatory sandbox is to facilitate financial innovation in Australia by reducing significant barriers to market entry. Many startups face substantial challenges related to:

• Time and cost associated with obtaining full licensing
• Regulatory complexity before a business concept has been proven
• Limited ability to test products in real market conditions

By providing this temporary exemption, the ERS enables innovative firms to test their financial products and services in a live market environment with real consumers. This valuable process allows businesses to:

• Validate their ideas
• Gather crucial data
• Refine their offerings

All of this can be accomplished without incurring the full expense and complexity of licensing from the outset, while still maintaining essential consumer protections that safeguard the public interest.

Who Is Eligible for the ASIC ERS Exemption?

Understanding the “Eligible Person” Criteria for the ERS

To qualify for the ERS, your fintech business must first be considered an ‘eligible person’. This status is available to both companies and individuals, including Australian citizens and permanent residents of Australia.

The criteria ensure that the ERS exemption is used for genuinely new testing rather than as a substitute for standard licensing. A business or individual is generally eligible if they are not already authorised to provide the specific financial services or credit activities they wish to test.

The ERS is open to:

• Unlicensed Australian businesses and locally registered foreign companies
• Existing holders of an AFS licence or Australian credit licence, but only if they are testing an entirely new service that their current licence does not authorise

Conversely, you are generally not eligible if you are already an authorised representative or credit representative for the same services you propose to test. Similarly, related bodies corporate of an existing licensee are typically excluded from testing services that their parent or sister company is already licensed to provide.

Passing ASIC’s Two Mandatory Tests

Beyond meeting the ‘eligible person’ criteria, your proposed financial service must pass two critical assessments outlined by ASIC in your notification. These tests ensure that the ERS is reserved for services that are genuinely innovative and beneficial to the public.

The two mandatory entry tests are:

Test Name	Description / Requirement
The Innovation Test	You must explain why your proposed financial service or credit activity is either genuinely new or a significant adaptation/improvement of an existing service. This requires clear evidence of novelty in delivery, technology, or the consumer problem being solved.
The Net Public Benefit Test	You must demonstrate that the exemption will likely result in a public benefit that outweighs any potential consumer detriment. This involves showing how the service might increase choice, reduce costs, or improve market efficiency.

When assessing these tests, ASIC considers your answers to specific questions in the notification form. For the net public benefit test, you may need to explain how you will manage key risks to consumers. For the innovation test, you will likely need to describe comparable services that are already available and detail what makes your proposal unique.

A Step-by-Step Guide to the ERS Application Process

Initial Consultation & Key Preparations

Before lodging a formal notification to enter the ERS, your fintech business is encouraged to contact ASIC’s Innovation Hub at innovationhub@asic.gov.au. This initial step allows you to receive informal assistance and guidance on your proposal, helping to clarify regulatory expectations and identify potential issues early.

A crucial part of your preparation involves gathering the necessary probity documents for all key personnel. These checks must be no more than 12 months old at the time of your application and include:

• A national criminal history check (also known as a police check)
• A bankruptcy check

Since obtaining these documents can take time, it is essential to apply for them well in advance of lodging your notification with ASIC.

Completing & Lodging the ASIC Notification Form

Entry into the ERS is based on a notification process rather than a formal approval. To begin, you must complete and lodge the correct prescribed form with ASIC, depending on the nature of your innovative financial service:

Service Type	Required Notification Form
Financial Services	Notification to use the enhanced regulatory sandbox exemption to test eligible financial services
Credit Activities	Notification to use the enhanced regulatory sandbox exemption to test eligible credit activities

These forms require comprehensive information about your business, including detailed explanations of how your service satisfies both the innovation test and the net public benefit test. Once completed, the notification form must be emailed directly to ersnotifications@asic.gov.au, not to, the Innovation Hub.

The 30-Day Assessment Period

After you have lodged your notification, ASIC has a 30-day period to assess your submission. During this time, they will review the information to ensure it is complete and that your proposed service meets all the eligibility requirements for the ERS exemption.

If ASIC does not raise an objection or otherwise respond within this 30-day window, your exemption to test the financial service or credit activity automatically commences on the 31st day. Although ASIC aims to provide a written response within the assessment period, the exemption takes effect regardless, allowing you to begin your 24-month testing period.

Operating in the Sandbox: What Your Fintech Can & Can’t Do

ERS Testing Limits & Duration

Operating within the ERS provides your fintech business with a temporary licensing exemption, but this comes with strict limitations on the duration and scale of your testing activities. The ERS exemption is available for a maximum period of 24 months for each innovative financial service or credit activity you test. This timeframe is fixed and cannot be extended, paused, or reset, making it essential to have a clear exit strategy from the outset.

To manage consumer risk, ASIC imposes firm financial caps on your operations. Breaching these limits will result in the automatic cessation of your ERS exemption.

The key financial limits include:

Limit Type	Description & Applicability
Individual Retail Client Exposure Limit	Each retail client is limited to a maximum commitment of $10,000. This cap applies to services involving simple managed investment schemes, Commonwealth bonds, listed securities, crowdfunding securities, and any non-cash payment facilities issued.
Aggregate Total Exposure Limit	A cumulative cap of $5 million applies across all activities. This limit applies to all clients (retail and wholesale), all financial services and credit activities, and any related entities that also utilise an ERS exemption.

Conduct & Disclosure Obligations

While the ERS exempts you from holding a full AFS licence or credit licence, it does not exempt you from fundamental conduct and disclosure obligations. You are required to comply with specified rules as if you were a licensed entity, ensuring a high standard of consumer protection throughout the testing period.

Several key conditions must be met to maintain your exemption:

Obligation	Requirement
Client Disclosure	You must clearly inform all clients before providing a service that you are operating under a regulatory exemption, do not hold a full licence, and that some normal consumer protections may not apply.
Dispute Resolution	Your business must maintain an internal dispute resolution procedure and hold a membership with the Australian Financial Complaints Authority (AFCA) to ensure clients have access to an independent complaint body.
Compensation Arrangements	You must have adequate arrangements in place to compensate clients for loss or damage, which typically requires holding Professional Indemnity (PI) insurance with minimum coverage of $1 million.
Specific Conduct Rules	You must comply with other key obligations relevant to your service. For example, providing a Statement of Advice (SOA) for personal advice or adhering to responsible lending obligations for credit activities.

Your ERS Readiness Toolkit

Your Sandbox Readiness Checklist

A successful application for the ERS depends on thorough preparation. Before lodging a notification with ASIC, your fintech business should ensure all foundational compliance and strategic elements are in place.

Key preparations for a strong submission include:

Checklist Area	Action / Requirement
Innovative Value Proposition	Clearly define what makes your service new or a significant improvement, explaining how it solves a consumer problem and satisfies the innovation and net public benefit tests.
Risk Management Plan	Establish and document internal controls and policies to identify, mitigate, and manage the main risks your service poses to consumers.
Legal Prerequisites	Arrange membership with the AFCA for external dispute resolution and secure adequate compensation arrangements, such as PI insurance with at least $1 million in cover.
Governance and Personnel	Obtain mandatory probity documents (including national police checks and bankruptcy checks) for all directors and key officers, ensuring they are no older than 12 months.
Client Disclosures	Draft all client-facing materials to include prominent disclosures stating that you are operating under a regulatory exemption and do not hold a full licence.
Financial and Operational Planning	Ensure your business model can operate within the strict ERS financial limits ($10,000 individual retail client cap and $5 million aggregate total cap).
A Clear Exit Strategy	Plan your transition out of the sandbox from day one, outlining steps to either apply for a full licence, become an authorised representative, or wind down operations.

Case Study: A Crypto Payments Startup in the ERS

To illustrate the sandbox process in practice, consider the real-world example of ByteFederal Australia Pty Ltd. The company proposed an innovative financial service that involves a comprehensive point-of-sale (POS) system, allowing businesses to accept cryptocurrency as a form of payment, a common scenario where a crypto business need an Australian Financial Services (AFS) licence.

ASIC granted ByteFederal an ERS exemption to test its service, which includes dealing by issuing, varying, or disposing of a non-cash payment facility. The exemption allows the fintech to operate with both retail and wholesale clients for a 24-month period, from 20 August 2024 to 19 August 2026.

During this time, ByteFederal can refine its technology and business model in a live market with real transactions. This case demonstrates how a fintech founder can use the ERS to pilot a novel service.

By operating under sandbox conditions—including adhering to financial caps, providing client disclosures, and maintaining AFCA membership—ByteFederal can gather crucial data and establish a robust compliance track record. This experience provides proof of concept and valuable consumer feedback, smoothing the path toward obtaining a full AFS licence after the testing period concludes.

Exiting the Sandbox & Planning Next Steps

Planning Your Exit from Day One

The ERS is a temporary pathway, not a permanent licensing solution. Your exemption comes with strict limitations:

• Maximum duration of 24 months
• Cannot be extended, paused, or reset

Therefore, planning your exit strategy is a critical part of the process that should begin well before your fintech business even enters the sandbox.

An exit plan is an essential component of your initial notification to ASIC. This plan must outline:

• How your business will transition before the exemption expires
• Procedures for either continuing operations legally or winding down in an orderly manner
• Arrangements to ensure existing clients don’t experience any detriment or service interruptions when testing concludes

Comparing ERS & Authorised Representative Pathways

Once your testing phase is complete, your fintech business has several options to continue operating. The two primary pathways are:

1. Obtaining your full AFS licence or Australian credit licence
2. Becoming an Authorised Representative (AR) of an existing licensee

Each path has distinct implications for liability, autonomy, and cost, highlighting the importance of understanding the difference between obtaining an AFSL vs. becoming an authorised representative.

To help you make an informed decision, the table below outlines the key differences between operating as an AR and the initial ERS testing phase:

Feature	ERS (Testing Phase)	Authorised Representative (AR)
Licensing Status	Operates under an ASIC Exemption (your startup is unlicensed).	Operates under the Licensee’s Australian Financial Services Licence (AFSL)/Australian Credit Licence (ACL) (your startup is a legal extension of the licensee).
Duration	Up to 24 months (finite testing period).	Indefinite (ongoing operational status, subject to your agreement).
Product Scope	Must be new or innovative and fit within the strict ERS limits.	Must fit within the authorisations of the Licensee’s existing AFSL.
Liability	Your startup is directly accountable to ASIC for all conduct and compliance.	The Licensee holds the ultimate legal and financial liability to ASIC.
Autonomy	High flexibility for product testing within the ERS constraints.	Limited to moderate autonomy, depending on the Licensee’s internal controls.
Cost & Time	High initial setup costs, followed by the full licensing cost after 24 months.	Faster setup with lower initial legal costs, but with ongoing fees paid to the Licensee.

Obtaining a Full Licence, Post-ERS

If your innovative financial service proves successful within the regulatory sandbox, applying for a full AFS or credit licence is the logical next step for scaling your business. It is crucial to begin this process well in advance, as ASIC recommends allowing six to nine months for your application to be assessed before your ERS exemption expires.

While there is no official “fast-track” for ERS graduates, the data and compliance track record gathered during the 24-month testing period serve as powerful evidence of your firm’s organisational competence. The detailed reports on performance, risk management, and complaint handling provide ASIC with a demonstrable history of your ability to operate responsibly, which can significantly strengthen your application and streamline the assessment process.

Conclusion

The ASIC ERS provides a strategic pathway for fintech innovators to test new financial services or credit activities for up to 24 months without a full licence. Successfully navigating this framework requires careful planning, a firm commitment to compliance, and a clear exit strategy to transition from testing to a sustainable market presence.

Navigating this complex regulatory process requires specialised guidance to ensure your innovative financial service meets all of ASIC’s requirements. For trusted expertise in preparing your ERS notification and planning a successful transition, contact the expert AFSL lawyers at AFSL House today to turn your regulatory challenges into strategic opportunities.

Frequently Asked Questions (FAQ)