On 15 December 2016, ASIC unleashed its long-awaited regulatory sandbox, which allows innovative businesses who use technology to provide financial and credit services to test their product and service offerings for up to 12 months without a licence.
It’s called a Concept Validation Licensing Exemption and, unlike regulatory sandboxes in other places (UK, Abu Dhabi, Singapore, Hong Kong, to name a few), there’s no need to apply to ASIC for approval to participate.
Instead, you simply tell ASIC that you’re going to, and 14 days later you’re good to go – unless, that is, ASIC tells you that you can’t participate.
ASIC can do this at any time during the 12 months if you’re not innovative enough, don’t use technology, have previously engaged in misconduct or you don’t meet one of the conditions imposed on sandbox businesses.
There’s also an additional catch-all – if ASIC has concerns about poor conduct, it can evict you from the sandbox at any time.
Who can use the sandbox?
All this flexibility comes with a downside – only a limited range of services can be tested in the sandbox, and only for 100 retail clients – although there’s no limit on wholesale clients.
*NB: No licence is required for business lending or finance broking.
Only very limited types of products can be tested in the sandbox. Transaction limits apply to retail clients – see below – with a total maximum exposure of $5 million to retail clients during the testing period.
While the transaction and client number limits don’t apply to wholesale clients, the product limits do. This significantly limits the scope of the sandbox.
That’s not the end of it though – a considerable number of existing exemptions may mean innovative businesses don’t need a licence. To name a few:
- Some payment products e.g.;
- Non cash payments <$1,000 per transaction and $10 million in total at any one time (including crypto payments)
- Most EFTs issued by ADIs or payment system operators where there’s no standing arrangement between payer and payee
- Products that only enable payment to one person
- Forex transactions that settle immediately; and
- Cryptocurrency wallets - but not crypto payment services.
How long?
Although innovative businesses can operate in the sandbox for up to 12 months, they must obtain their AFS or credit licence within that period.
Fintech licence applications are currently taking a minimum of six months, and in some cases up to 12 months, meaning that businesses will need to apply almost as soon as they start testing.
This kind of defeats the purpose – which was to facilitate testing and validation to proof of concept stage before needing to settle on what type of licence, if any, will be needed.
ASIC does say it will allow extra time of up to 12 months in exceptional cases on application, but you’d need to have applied for your licence in good time.
What else?
Not surprisingly, testing businesses will need to tell their clients that they don’t hold a licence, are testing their service under the fintech licensing exemption and that some of the protections of dealing with a licensed business won’t apply.
Far from being an ‘invitation to shonks and sharks to rip off consumers’ that the, perhaps predictable, overreactions of consumer advocates would have us believe, all the important consumer protections of the AFS and credit licensing regimes will apply to testing businesses. For example:
- Disclosure – the information normally contained in Financial Services Guide’s credit guides, quotes and proposals;
- Best interests duty and responsible lending;
- Professional indemnity insurance of up to $1 million (and run-off cover if available); and
- Internal dispute resolution procedures and membership of an EDR (during and for 12 months after testing).
The notification requirement and their web and app-based delivery platforms ensure testing businesses are highly visible to ASIC. If anything, it’s easier for ASIC to keep an eye on fintech businesses than those that deliver services through humans! As we’ve seen.
How to apply
Write to the Innovation Hub to tell them you intend to rely on the exemption and provide the following information:
- Key contact person;
- Name, ABN and contact details of the business – address, website, contact person’s phone number;
- Whether the business is a foreign registered company;
- Names, DOB, bankruptcy check and criminal check (scanned copies <12 months old) for all directors and ‘controllers’;
- Names of any experts assisting the business;
- Short description of the innovation and the business model – focusing on your services and delivery processes;
- Proof of EDR membership and who is responsible for dealing with the EDR scheme; and
- Confirmation of PI insurance arrangements.
ASIC will publish information about your business and its testing period on their website so consumers can confirm whether you are validly operating under the exemption.
What happens at the end?
Testing businesses will need to provide a short report to ASIC within two months of the end of the testing period providing certain information and statistics to help ASIC review the effectiveness of the sandbox.
How does it compare?
ASIC’s approach is certainly ahead of the game in not imposing any limits on the numbers of sandbox participants, and providing what is effectively an ‘opt-in’ for innovative businesses, permitting them to self-assess and test without the need to interact with the regulator.
Start-ups would be well advised to meet with ASIC’s Innovation Hub before doing so to smooth the way, regulators tend not to like surprises!
However, the restrictive limits on the products and services that can be tested on an opt-in basis, particularly for wholesale clients, will mean that many start-ups will not be eligible, or their testing will be so confined that it will be of little use.
It may enable technology to be tested, but seems unlikely to achieve even rudimentary testing of business model viability.
What’s the alternative?
Businesses who don’t qualify to use the sandbox or want to extend the sandbox’s limits can apply to ASIC for an individual ruling enabling them to test for a period.
Unfortunately, unlike the other jurisdictions mentioned above, there’s no clear guidance on the criteria that ASIC would apply to such applications.
This could easily be fixed if, for businesses that don’t automatically qualify, ASIC adopted the approach taken by other global regulators.
For example, the UK sandbox, which is probably the most advanced, has published detailed policies about what businesses are in scope and the criteria that it will apply to determine whether to admit applicants to the sandbox.
It’s interesting that of the UK’s first cohort of sandbox participants, only two of the fifteen who would need to be licensed in Australia would automatically qualify for our sandbox, although the six payments businesses could facilitate payments of <$1,000 without a licence – if that fitted their business model.
It’s a bit early to tell whether the sandbox will attract a significant number of participants.
At the moment it’s effectively limited to digital advice on non-super investments (which excludes SMSFs), limited general insurance, white labelled bank payments products and personal loan broking. The fintech ecosystem is a lot wider than that!
Claire Wivell Plater is the managing director of The Fold.
