Fintech Regulation in Malaysia: The BNM and SC Regulatory Sandboxes

Build a new payment app or a tokenised-securities platform in Malaysia and you hit the same wall: the rules were written before your idea existed. The regulatory sandbox is the door through that wall — a supervised space to test a live product before you hold a full licence. Malaysia has two of them, and which one you knock on depends on what you are building.

Who runs which sandbox?

Two regulators, two mandates.

Regulator	Sandbox	Covers
Bank Negara Malaysia (BNM)	Financial Technology Regulatory Sandbox	Payments, banking, insurance, takaful, money services
Securities Commission (SC)	Regulatory Sandbox	Capital-market products — investing, alternative financing, tokenised securities

BNM’s sandbox is the older of the two, launched in October 2016. The SC’s capital-market sandbox is far newer, running its first cohort in 2025.

How does BNM’s sandbox work?

BNM refreshed its framework with an enhanced version that took effect on 29 February 2024. It now has two tracks:

• Standard Sandbox — the general route, with a simplified eligibility (Stage 1) assessment. BNM aims to respond to applications within 15 days.
• Innovation Green Lane — a fast track for licensed institutions with a strong record in risk management, governance and compliance. Approved once, an institution can register each new solution through a lighter process, with BNM targeting approval within 30 working days.

The catch for founders: the Green Lane is not open to fintech startups directly. Eligible applicants are banks, development financial institutions, insurers, takaful operators and money services businesses. A startup can still take part — by partnering with one of those institutions, subject to BNM’s approval.

Testing carries real conditions. A Green Lane solution typically covers up to 20,000 customers and runs up to 12 months, and the institution must register a new solution at least 15 days before testing begins. Since its 2016 launch, the framework had facilitated more than 110 applications as of the 2024 update.

How does the SC’s capital-market sandbox work?

The SC’s sandbox targets products that do not fit its existing rules — think alternative real-estate investment, secondary-market platforms and tokenised securities. To qualify, a solution must be genuinely new, not already available in Malaysia, and demonstrably useful to the Malaysian capital market. The applicant must be fit and proper, with a testing plan and an exit strategy in place.

The process starts with a compulsory pre-consultation with the SC before any formal submission. For the first cohort, applications ran from 15 April to 31 May 2025. Successful firms get 12 months — or a duration the SC approves — to test, entering in batches.

That first cohort selected six firms across three focus areas: alternative real-estate investments, secondary-market solutions, and alternative financing. Priority themes the SC has flagged include financial inclusion, Islamic finance, sustainability and retirement solutions.

What happens when testing ends?

A sandbox is a runway, not a destination. At the end of the test window, a firm either graduates — moving to full authorisation and deploying at commercial scale — or exits, winding the product down under the plan it filed at the start. Regulators use what they observe to refine future policy, which is why an exit strategy is a condition of entry, not an afterthought.

What’s next

• Match the regulator to the product first. Money movement, lending and insurance go to BNM; anything capital-market goes to the SC. Applying to the wrong one wastes a cycle.
• Budget for the pre-work. The SC requires a pre-consultation; BNM’s Green Lane needs a partner institution. Neither is a same-week process.
• Check the current window. Application rounds open periodically — the SC by cohort, BNM’s Green Lane on a set schedule — so confirm the live dates on the regulator’s own site before you build your submission.