European Supervisory Authorities (ESAs) publish 2023 joint report and recommendations on “Innovation Facilitators” – what next for Innovation Hubs and Regulatory Sandboxes?

RegCORE Client Alert | Banking Union | Capital Markets Union

QuickTake

In 2019 the ESAs (i.e., EBA, EIOPA and ESMA) published a first joint report (the 2019 Joint Report Available here.Show Footnote) on what it termed “Innovation Facilitators” i.e., Innovation Hubs and Regulatory Sandboxes. The 2019 Joint Report was published as part of the ESA’s mandate set out in the European Commission’s 2018 FinTech Action Plan Available here.Show Footnote and also led to the inauguration of the European Forum for Innovation Facilitators (EFIF) framework.

On 11 December 2023 the ESAs published the 2023 Joint Report Available here.Show Footnote, which provides a welcome update on the functioning of Innovation Facilitators in the intervening years and the COVID-pandemic’s impact on financial services and market participants.

Both of the Joint Reports set out observed best practices for Innovation Facilitators as well as specific recommendations for improvement. The best practices are intended to promote the (i) consistency of their design and operation across the Single Market, (ii) transparency of regulatory and supervisory policy outcomes from their use and (iii) cooperation between national (competent) authorities including consumer and data protection authorities (such authorities simplified herein as NCAs). These best practices are not only relevant for NCAs but how Innovation Facilitators can be used to test various traditional and crypto-asset based offerings.

This Client Alert assesses the findings and recommendations set by the ESAs in the 2023 Joint Report and what this means for traditional as well as digital asset-focused financial markets participants as users of Innovation Facilitators both in their documentation as well as day-to-day engagement with Innovation Facilitators and NCAs.

What are Innovation Facilitators anyway?

The ESAs use the overarching term “Innovation Facilitators” to encompass both (i) Innovation Hubs and (ii) Regulatory Sandboxes.

The ESAs define an “Innovation Hub” as “a dedicated point of contact for firms to raise enquiries with NCAs on FinTech related issues and to seek non-binding guidance on the conformity of innovative financial products, financial services or business models with licensing or registration requirements or regulatory and supervisory expectations.”

In turn, the ESA’s categorise a “Regulatory Sandbox” as “a scheme to enable firms to test, pursuant to a specific testing plan agreed and monitored by a dedicated function of the competent authority, innovative financial products, financial services or business models. Sandboxes may also imply the use of legally provided discretions by the relevant supervisor (with use depending on the relevant applicable EU and national law), although sandboxes do not entail the disapplication of regulatory requirements that must be applied as a result of EU law.” This would include the EU’s DLT Pilot Regime as a pan-EU regulatory sandbox for the use of digital ledger technology as well as the European Blockchain Sandbox and equally the upcoming artificial intelligence regulatory sandboxes. In most instances, a Regulatory Sandbox operates on a three-phases basis i.e., the (i) application phase, (ii) testing phase and (iii) exit/evaluation phase.

As at the date of the 2019 Joint Report, the ESAs noted that 21 EU Member States and 3 EEA Member States had established Innovation Hubs while 5 EU Member States already had Regulatory Sandboxes in operation. As of October 2023, there were 41 Innovation Hubs, with at least one in all 30 EEA countries, and 14 regulatory sandboxes in 12 EEA countries. The majority of Innovation Hubs were established between 2016 and 2019, while most of the Regulatory Sandboxes were launched between 2020 and 2021.

Despite this growth, noticeable differences (by type of Innovation Facilitator and equally by jurisdiction) remain in how financial services firms, as users of Innovation Facilitators, can access them and have their propositions accepted for testing – specifically for Regulatory Sandboxes, where the bulk of testing of propositions is carried out.

Some of the key requirements that a prospective user needs to demonstrate to the satisfaction of the Innovation Facilitator (against (usually) set, transparent and publicly available criteria criteria, that while dependent on individual Innovation Facilitators and Member State regimes) are that:

1. the scope of proposition to be tested is (a) innovative and (b) relates to regulated financial services or the provision of regulated financial services;
2. there are identifiable customer benefits (whether retail, institutional or wholesale) and a clear testing objective;
3. the firm evidences suitable readiness to test the proposition and that it has a developed business plan, suitable governance, operational and risk control framework generally and specifically with reference to the proposition to be tested; and
4. there is a tangible need for testing, i.e., where a proposition does not fit easily in the existing regulatory framework there is no alternative means of engaging with the NCA or achieving the testing objective in a live environment.

Since the 2019 Joint Report, Innovation Hubs in the EEA have generally undergone improvements in their operations while maintaining their focus on enhancing firms’ understanding of the regulation and supervisory expectations. Regulatory Sandboxes have offered the FinTech sector a safe environment to test their business ideas and allowed NCAs to stay abreast of emerging innovations in the financial sector and to better identify cases where a (re)assessment of regulatory perimeters may be needed. Accordingly, the ESAs put forward a number of recommendations based on the findings and key takeaways from the 2023 Joint Report. These aim to ensure that Innovation Hubs and Regulatory Sandboxes as well as the EFIF continue to deliver a well-functioning framework that fosters innovation in light of new technologies reshaping the delivery of financial services in the EU’s (digital) Single Market.

The EFIF – a framework and forum for NCAs

The EFIF provides a framework of principles and best practices as well as an informal forum See EFIF’s Terms of Reference – i.e., one of its key constitutive documents – available here.Show Footnote for NCAs to regularly share experiences from their engagement with financial services firms using Innovation Facilitators, to exchange technological expertise and to reach common views on the regulatory treatment of innovative products, services and business models.

The EFIF was established following the 2019 Joint Report’s publication, which identified the need for greater coordination and cooperation between Innovation Facilitators to support the scaling up of FinTech across the EU Single Market.

Members of the EFIF include representatives of each Innovation Hub and Regulatory Sandbox established by national and European supervisors within the EEA. Accordingly, the EFIF unites representatives from all EU-27 Member States and the 3 EEA countries and therefore covers the banking/payments, insurance and securities/markets sectors.

If and assuming the European Commission is committed to further developing and advancing the pace of delivery of a more digital Single Market, the EFIF, as the 2023 Joint Report suggests, should receive a more prominent role. Such a move would reinforce the targeted recommendations set out in the Joint Report 2023 as well as the European Commission’s separate guidance on what it views as key attributes in the set-up and operation of Regulatory Sandboxes See ‘TOOL #69. Emerging methods and policy instruments’, pages 599-604 – available here.Show Footnote.

Key takeaways from the 2023 Joint Report

The ESAs’ analysis in the 2023 Joint Report states that Innovation Hubs and Regulatory Sandboxes continue to be the main types of solutions preferred by regulators and supervisors in facilitating innovation in the financial sector across the EEA. However, there are differences between the two namely for:

• Innovation Hubs, the 2023 Joint Report concludes that their construction and functioning in the EEA has reached a certain level of maturity and that the FinTech industry views Innovation Hubs as favourably contributing to regulatory and supervisory clarity as well as an indicator that the jurisdictions’ regulators and supervisors are progressive, technology-friendly, and receptive to financial innovation. At the same time, the 2023 Joint Report concludes that NCAs still face challenges in the operation of innovation hubs, such as the perception of risk(s) of misalignment between the expectations of the FinTech sector and the purpose of the Innovation Hubs, or the NCAs' inability to provide prompt and precise responses to the queries they receive; and
• Regulatory Sandboxes, the 2023 Joint Report states that the major benefits in their use for NCAs are increased awareness of new emerging innovations in the financial industry and the identification of cases where a reconsideration of the appropriate regulatory perimeter may be required. Furthermore, the ESAs remark that Regulatory Sandboxes incorporate consumer protection safeguards and that NCAs have the authority to discontinue testing if a firm fails to comply with the agreed-upon testing plan or testing limits. As a result, the ESAs note that the vast majority of NCAs operating Regulatory Sandboxes believe that their cost-benefit perception justifies the continuance of their operations and activities.

Overall, the ESAs findings in the 2023 Joint Report state that NCAs consider reputational and legal concerns to be the most significant hazards of operating Innovation Facilitators. The ESAs also highlight that, notwithstanding the benefits of Innovation Facilitators, NCAs continue to encounter limits in their ability to keep up with financial innovation advancements and demands of industry users of Innovation Facilitators for new features. In the 2023 Joint Report (notably in Annex 2 thereto), the ESAs describe new emerging activities and features, for example, virtual sandboxes, hackathons/TechSprints, or discussion forums with representatives of the FinTech sector.

To further improve the operation of Innovation Facilitators and to enhance the experience for participating firms, the NCAs were invited, as part of the 2023 Joint Report’s targeted recommendations, to:

• improve their understanding of the concerns and interests of participating firms;
• broaden the scope of innovations captured, including at the cross-sectoral level;
• ensure an effective collaboration among NCAs and closer cooperation within the EFIF;
• continuously evaluate the functioning of Innovation Hubs and Regulatory Sandboxes;
• assess how the operation of Innovation Facilitators will (or will need to) change to adapt to forthcoming EU-wide initiatives (including the DLT Pilot Regime but also artificial intelligence regulatory sandboxes); and
• further adopt the best practices set out in both the 2019 and 2023 Joint Reports.

Through the EFIF framework, the ESAs can provide their own recommendations for future EU-wide initiatives that focus on experimentation. To improve the functioning of this framework the 2023 Joint Report recommends that ESAs should:

• re-evaluate the procedural framework for cross-border testing established by the EFIF in 2021 Available here.Show Footnote. This framework facilitates a common basis on which firms and NCAs may rely upon when sharing testing-related information in a structured manner across the Single Market; and 
• formalise the EFIF’s process to raise co-legislators’ attention to issues identified via Innovation Hubs or Regulatory Sandboxes.

While the 2023 Joint Report provides a timely and insightful stocktake of how individual Member States and NCAs have approached the design, deployment and further development of “their” Innovation Facilitators in light of national or cross-border constraints, there are also some joint challenges and opportunities. The 2023 Joint Report also highlights that NCAs are only equipped with the specific tools as available to them in the own national mandates. This remains the case despite the EFIF’s existing efforts to improve knowledge sharing and establish best practices, especially as these (unfortunately) still stop short of a pan-EU harmonised toolkit and ruleset being made available.

As a result of this realisation, the ESAs propose in the 2023 Joint Report that the European Commission, as one of the key drivers of developing a more digital Single Market framework, undertake a comprehensive reflection on the EU-wide strategy to support financial innovation and the operation of Innovation Facilitators, in particular Regulatory Sandboxes.

A recap on the ESAs’ Best Practices for Innovation Facilitators

Annex 1 of the 2023 Joint Report sets out the ESA’s best practices – officially “observed practices in running Innovation Facilitators”. These apply to both building of new and to revising existing practices and their application is framed by the ESAs as being very situation dependent.

The ESAs have identified and recommended the following best practices from NCAs in respect of Innovation Hubs when:

• NCAs add a dedicated Innovation Hub element to their website landing page to increase visibility and inquiries. The Joint Report 2023 observed that some NCAs consider that there is still room for increasing awareness of firms about the existence of the Innovation Hub as a direct communication channel.
• NCAs automate and standardise general query responses and triaging more specific questions. Access to FAQs, guidance on general queries and other relevant information on the internet can reduce the amount of inquiries that require NCAs' professional analysis and feedback. Using a chatbot can eliminate general inquiries that can be answered on the website and deliver immediate replies without human participation. Some NCAs employ templates to manually respond to general or simple queries, using the Innovation Hub site or related FAQs or activities summaries. NCAs often schedule sessions for more specific queries requiring specialists.
• NCAs request firms supply documentation in advance to prepare for meetings and inviting experts.
• NCAs clearly convey engagement guidelines, innovation hub restrictions, and expectations. Pre-defined inquiry contact forms assist clarify the business concept or proposal. It helps participants prepare for the first hub meeting and lets them share materials (including, if possible, the initial legal examination of the proposed business model).
• NCAs facilitate an informal point of contact (email, online form, phone call, online meeting) with regulators outside of official regulatory processes. This centres the relationship on cooperation rather than control and surveillance. It also clarifies the rules of engagement to eligible candidates and helps NCAs understand innovative enterprises' business models and industry concerns and expectations in a faster timeframe, boosting financial innovation and emphasising industry face-to-face engagement.
• NCAs record queries in knowledge management systems for record-keeping and effective follow-up. This is used as a workflow tool to address all inquiries and a recording tool to classify queries by topic, technology, and entity. Some NCAs keep records on bilateral meeting questions and answers. Internally, the insights can be utilised to assess use case trends and determine regulatory activity.
• NCAs offer a greater amount of innovation webinars and seminars, which may help authorisation and supervisory teams. Market players benefit from webinars with authority specialists, notably before the transfer from a national system to a European framework (MiCAR).
• NCAs share aggregated data externally, which helps NCAs hosting Innovation Hubs communications with industry. Annual reports or aggregated findings on NCA websites promote communication and knowledge of Innovation Hubs' work. 

The ESAs have identified and recommended the following best practices from NCAs in respect of Regulatory Sandboxes and set these out according to the stages of engagement i.e., the (i) application phase, (ii) testing phase and (iii) exit/evaluation phase:

• Related to the application phase, the ESAs consider the following to be best practices:
  • Defining and publishing clear requirements, eligibility criteria, the main purpose of the Regulatory Sandbox and what can be achieved when participating in it.
  • Ensuring applicants understand (i) the entry/acceptance criteria, (ii) the Regulatory Sandbox rules/framework, and (iii) the documentation to be submitted. NCAs should have clear regulations or guidelines specifying such rules/framework. This can be achieved through a clear public communication and guidance (e.g., on the website), as well as through preliminary informal dialogues/consultations with firms. This would benefit NCAs, who may get a better understanding of the project, as well as applicants to ensure they choose the most appropriate cooperation channel and model with the regulator/supervisory authority. The ESAs noted that it may also be useful for firms to receive direct feedback from the NCA, also in the cases where a project is rejected.
  • Ensuring applicants/participants are able to correctly identify the NCA for the project, especially when more than one authority and/or area inside a supervisor is involved. Establishing a central coordinator could facilitate the filtering of the projects, determining the relevant authority/area for each project and standardising the application of the acceptance/entry criteria procedures, while at the same time maintaining a global vision for the sandbox.
  • Supporting firms in the establishment of a proper testing plan prior to the application confirmation. NCAs could support applicants in preparing a testing plan, by establishing an internal testing team to provide expert input when negotiating the testing plan earlier in the process, before the application is confirmed. NCAs would also benefit from a good collaboration with a Regulatory Sandbox’s advisory board (if one exists) or with the different authorities to provide a coordinated and harmonised response to applicants.
  • Managing expectations both of firms participating in sandbox testing and supervisors in terms of time commitment and resources necessary to run projects in testing.
  • Providing feedback to all applicants, also to those that are rejected. NCAs should not limit feedback to that provided in the follow-up reports after the testing phase.
• Related to the preparation phase, the ESAs consider the following to be best practices of NCAs in:
  • Setting goals and the related timeline and establish/identify appropriate KPIs. Regulatory Sandboxes should identify: (i) the appropriate quantitative and qualitative KPIs in order to set them consistently with some project characteristics, (ii) the potential risks of the projects in the testing phase and (iii) safeguard measures (for example, financial guarantees) to protect the participants in the tests. This would help to understand whether the firm can commit to the criteria specified by the NCA for the testing phase and to make sure that the testing scope is realistic, the testing protocol is thorough and comprehensive, and that the applicant has the appropriate resources in place prior to the testing period.
  • Organising as many preparatory meetings between the firm and the NCA as necessary to speed up the preparation phase, as well as regular ongoing meetings where goals are set and progress is monitored. The ESAs note that such meetings can be used also for the provision of regular feedback to participants.
  • Ensuring participating firms do not use the Regulatory Sandbox as a marketing tool to misleadingly imply that their innovative product, service or business model has been certified as compliant, validated or licensed by the NCA. This can be done, for example, by maintaining ongoing communication with firms, ensuring contractual clauses on their participation are clear and a closer supervision of their marketing communications before, during and after the testing period.
  • Ensuring information exchanged between the firm and the NCA during the preparation phase is well protected, by using safe communication channels for information sharing.
  • Ensuring there is a proper coordination (i) with the applicants, (ii) within the authority, especially in the case of new legal matters arise, and (iii) with external authorities (for example, data protection authority, AML/CFT authority) to ensure they are involved in the Regulatory Sandbox process where needed.
• Related to the testing phase, the ESAs consider the following to be best practices when NCAs:
  • Ensure regular and frequent communication with firms to identify potential problems in a timely manner, and to receive and provide them with continuous feedback.
  • During these meetings monitor that agreed goals, milestones and testing conditions are fulfilled. Meetings can be as frequent as needed, for example, weekly meetings if appropriate.
  • Ensure proper communications for each of the test cases to avoid misleading Regulatory Sandbox participants and their clients on what the testing in the Regulatory Sandbox means. Some NCAs find it important to allow firms to test their innovations with real users – this may help in ensuring that the testing results in a minimum viable product.
• Related to the exit/evaluation phase, the ESAs consider the following to be best practices:
  • Both firms and NCAs should produce a comprehensive “lessons learned” report. Firms’ reports would help the authority to improve the way the Regulatory Sandbox is run. It can be reasonably be expected that this is an area that NCAs will look to prioritise over the 2024 supervisory cycle and beyond.
  • NCAs’ reports should be based on the data and information obtained in the testing phase and may instead be useful to document the knowledge gained during a Regulatory Sandbox testing procedure. Sharing it with the relevant experts would help build knowledge within the organisation.
  • Publishing annual reports and making information about the Regulatory Sandboxes’ operation publicly available. This helps establish a good communication and feedback channel between the NCA running the regulatory sandbox and the industry.

Outlook

The 2023 Joint Report, while a welcome reading and a good first step signalling a path for further improvements, falls short of pushing for precise principles that the European Commission could, following its “comprehensive reflection” on the relevant recommendations and the Annex 1 of best practices, translate into a legislative proposal. For users of Innovation Facilitators, the work of the ESAs in both Joint Reports remains highly relevant. Nevertheless, there are a number of legal and practical issues that are not addressed in the Joint Reports, but which firms should still consider, namely that they:

1. clearly define roles, responsibilities, and expectations among participants, NCAs and any third-party service providers involved in the Regulatory Sandbox trial;
   
2. assess the need for insurance coverage to mitigate risks associated with the Regulatory Sandbox activities and potential liabilities.
3. critically assess whether their current Innovation Facilitator channel and their engagement therewith remains fit for design and purpose of their business operating model and testing environment – and if not, how to expand, amend or alternatively transition to another Innovation Facilitator (including pan-EU) and how the access methodology and testing environment may differ;
4. establish clear termination and exit as well as portability strategies in case testing or trials in one Regulatory Sandbox are unsuccessful or needs to be terminated and how to ensure a smooth transition and resolution of obligations can be advanced to not lose time on trials;
5. review data protection and privacy compliance when testing in a particular Regulatory Sandbox, or when working across Innovation Facilitators; and
6. establish effective communication channels and protocols among stakeholders, ensuring transparency and adherence to regulatory reporting requirements including when transitioning to new Innovation Facilitators.

About us

PwC Legal is assisting a number of financial services firms and market participants in forward planning for changes stemming from relevant related developments. We have assembled a multi-disciplinary and multijurisdictional team of sector experts to support clients navigate challenges and seize opportunities as well as to proactively engage with their market stakeholders and regulators.

Moreover, we have developed a number of RegTech and SupTech tools for supervised firms, including PwC Legal’s Rule Scanner tool, backed by a trusted set of managed solutions from PwC Legal Business Solutions, allowing for horizon scanning and risk mapping of all legislative and regulatory developments as well as sanctions and fines from more than 1,500 legislative and regulatory policymakers and other industry voices in over 170 jurisdictions impacting financial services firms and their business.

Moreover, in leveraging our Rule Scanner technology, we offer a further solution for clients to digitise financial services firms’ relevant internal policies and procedures, create a comprehensive documentation inventory with an established documentation hierarchy and embedded glossary that has version control over a defined backward plus forward looking timeline to be able to ensure changes in one policy are carried through over to other policy and procedure documents, critical path dependencies are mapped and legislative and regulatory developments are flagged where these may require actions to be taken in such policies and procedures.

If you would like to discuss any of the developments mentioned above, or how they may affect your business more generally, please contact any of our key contacts or PwC Legal’s RegCORE Team via de_regcore@pwc.com or our website.