DFSA

DFSA Innovation Testing Licence (Fintech Sandbox)

2026-03-23 · 6 min read · By Aureus Worldwide

The DFSA Innovation Testing Licence (ITL) is the Dubai Financial Services Authority's regulatory sandbox, a restricted, time-limited authorisation that lets a fintech firm test an innovative financial product or service on real customers in or from the Dubai International Financial Centre (DIFC) under specially tailored rules. Operating since 2017, the DFSA Innovation Testing Licence bridges the gap between an untested idea and full authorisation, giving genuine innovators a controlled runway without the full weight of the rulebook from day one. This guide explains who qualifies, how the test is structured, and how a firm graduates to a full Licence.

Why a sandbox exists

Financial regulation is built for established business models, and applying it unchanged to a novel proposition can be disproportionate, a firm may not yet know its customer volumes, its risk profile or even whether the model works. The ITL answers this by letting the DFSA and the firm agree a bespoke, temporary regime for a live but limited test. The firm gets to prove its concept with real customers and real data; the DFSA gets to understand the innovation and shape appropriate safeguards before it scales. Crucially, the ITL is a form of authorisation, not an exemption from regulation, the firm is supervised throughout, just under rules calibrated to a controlled test.

Who is eligible

The ITL is not a lighter route to a Licence for a conventional business. The DFSA looks for:

• Genuine innovation, a product, service or business model that is new or significantly different from what the market offers, often technology-driven.
• Consumer or market benefit, a credible case that the innovation benefits DIFC consumers or improves the market, for example through better access, lower cost or greater efficiency.
• A DIFC nexus and intent, a real intention to carry on the activity in or from the DIFC after a successful test, not merely to badge a foreign operation.
• Readiness to test, the firm is far enough developed to test with live customers, with the resources and people to do so safely.
• A workable exit, a clear plan to either scale up under full authorisation or wind down without harming customers.

An idea still on the drawing board, or a business that is simply seeking cheaper authorisation, will not fit. The sandbox is for propositions ready to meet real customers under supervision.

The Regulatory Test Plan

The heart of an ITL is the Regulatory Test Plan (RTP), the individually negotiated agreement between the firm and the DFSA that defines the test. The RTP typically sets:

• The scope of the activity being tested and the specific regulated financial services it touches.
• The duration of the test, commonly in the range of six to twelve months, with the possibility of extension.
• Limits and safeguards, caps on customer numbers, transaction sizes or total exposure, plus disclosures so customers understand they are dealing with a firm in test.
• The rules that are modified or waived for the test, and those that continue to apply in full.
• The exit arrangements, how the firm will either migrate to full authorisation or wind down.

Because the RTP is bespoke, two ITL firms can operate under quite different conditions. The plan is the firm's operating licence for the duration of the test, and staying within it is a core obligation.

What is relaxed, and what is not

The tailoring is the point of the sandbox, but it has limits. During the test the DFSA may modify requirements that would be disproportionate for a small, controlled pilot, for example, adjusting capital requirements to reflect the limited exposure, applying reduced fees, or waiving rules designed for scale.

What generally does not get switched off:

• Anti-money-laundering and counter-terrorist-financing controls, customer due diligence, monitoring and suspicious-activity reporting continue, as explained in our DFSA AML/CTF obligations guide.
• Core consumer protections, honest communications, fair treatment and clear disclosure that the firm is testing.
• Client-asset safeguards, where the model involves holding customer money or assets.

The sandbox reduces the regulatory burden proportionately; it does not create a rules-free zone. A firm that treats it as the latter will fail the test, and its authorisation.

From test to full authorisation

An ITL is a starting point, not a destination. As the test period draws to a close, one of three things happens:

1. Migration to full authorisation, the test has demonstrated a viable, compliant model, and the firm applies to convert its restricted permission into a full Financial Services Permission, meeting the standard capital, systems and controls, and personnel requirements in full.
2. Extension, the firm needs more time or data, and the DFSA agrees to extend the RTP.
3. Orderly wind-down, the model has not worked or the firm chooses not to proceed, and it exits under the pre-agreed exit plan, returning customer money and closing positions cleanly.

The migration path is where many founders under-plan. Full authorisation reintroduces the full base capital, expenditure-based minimum, mandatory Authorised Individuals and prudential reporting that the standard authorisation process demands. Building the finance and governance function during the test, rather than after it, is what turns a successful pilot into a durable licensed business.

How the ITL compares to other routes

To position the ITL correctly, it helps to see the alternatives:

The wider DIFC ecosystem, including its fintech accelerator programme, supports innovators alongside the ITL, and the DFSA's approach sits within a regional trend that also includes the FSRA's RegLab sandbox in ADGM. Choosing between jurisdictions and routes is a structuring decision best taken early, with regulatory and finance advice in parallel.

Practical preparation for an ITL application

Founders who approach the DFSA well-prepared move faster. Before you engage:

• Articulate the innovation and the consumer benefit in plain terms, the DFSA must understand what is new and why it matters.
• Map your activity to the specific Financial Services it involves, so the right rules can be tailored.
• Propose sensible test limits yourself, realistic customer caps and safeguards signal maturity.
• Draft a credible exit plan for both success and failure.
• Stand up at least a basic finance function so you can evidence resources and produce clean records from day one.

How Aureus Worldwide can help

Aureus Worldwide is a Dubai-based accounting and CFO-outsourcing firm. We are not DFSA-authorised, we do not provide regulated financial services, and we cannot submit your ITL application, but we build the financial substance a sandbox applicant and a graduating firm both need. That includes the financial projections and resource evidence behind your test plan, a lightweight but audit-ready accounting function during the test, and a scaled-up outsourced CFO capability, including the capital modelling and reporting, as you migrate to full authorisation, all coordinated with your legal, compliance and DIFC advisory teams. To get the finance side of your fintech launch right, contact our team.

Talk to our chartered accountants →