UAE FinTech Sandbox and Regulatory Perimeter

by Barrister Tahmidur Rahman | Sep 28, 2026

Trade, Competition & RegulationTesting innovation across UAE regimes8 min read

UAE FinTech Sandbox and Regulatory Perimeter

UAE fintech sandbox and regulatory perimeter advice for Bangladesh-connected founders, banks and technology groups, covering DIFC, ADGM, Dubai virtual asset and federal routes, licensing questions, testing plans, and the Bangladesh foreign exchange, data and corporate issues that travel with the business.

UAE FinTech Sandbox and Regulatory Perimeter: UAE fintech sandbox with TRW & Co
Matter planTrade, Competition & Regulation
  1. Activity and perimeter review
  2. Structure and Bangladesh approvals
  3. Application and engagement
  4. Testing and graduation
Overview

Choosing the right UAE fintech sandbox before you apply

Many Bangladeshi founders, payment companies and software groups see the UAE as the natural regional base for a financial technology business. The difficulty is that the UAE does not have one regulator or one testing programme. A UAE fintech sandbox may sit in the Dubai International Financial Centre, in Abu Dhabi Global Market, in a Dubai virtual asset regime or at federal level, and each starts from a different jurisdictional point. We help clients decide which perimeter their proposed activity actually falls within before they commit time, capital and a public launch plan to one application route.

The first question is always what the business will do, for whom and from where. Payments, stored value, lending, crowdfunding, custody, brokerage, token issuance and data aggregation can each be regulated activities, and the answer can change depending on whether customers are retail or professional, onshore or in a free zone. Testing in a UAE fintech sandbox does not remove the need to understand the full licence that will follow. We map the activity, the entities, the flow of funds and the data so that the testing plan reflects the eventual permanent model and the investors understand it.

The main programmes are well known. The Dubai Financial Services Authority runs an Innovation Testing Licence for eligible firms operating in or from the DIFC. The Financial Services Regulatory Authority in ADGM operates its RegLab framework. The Central Bank of the UAE and the Securities and Commodities Authority have their own innovation and testing arrangements for activities within their federal remit, and Dubai's Virtual Assets Regulatory Authority regulates virtual asset activity across Dubai outside the DIFC. Each UAE fintech sandbox sets its own criteria, which change, so we work from official material and, where needed, with UAE-qualified counsel.

For Bangladesh-connected businesses the UAE analysis is only half the picture. A Bangladeshi parent company investing in a new UAE subsidiary will usually need Bangladesh Bank permission for outward investment, and remittances, intra-group service fees and founder shareholdings raise foreign exchange questions. Customer and employee data moving between Dhaka and the UAE engages the Personal Data Protection Act 2026. Serving Bangladeshi users from the UAE may itself be a regulated activity in Bangladesh, whatever a UAE fintech sandbox permits. We coordinate the UAE and Bangladesh sides together through our regulatory practice and our technology law team.

Barrister Tahmidur Rahman and Barrister Remura Meheruba Mahbub lead this work, drawing on their transactional, banking and foreign investment experience. We work alongside counsel in the UAE, UK, Singapore and other centres when a matter requires foreign law advice or a filing that local practitioners must make. Our role is to give founders and boards one coordinated view: which UAE fintech sandbox, if any, fits the proposition, what the regulator will expect, what must be fixed at group level in Bangladesh, and how to move from testing to a full authorisation without restructuring the business twice.

01 · What we handle

Core workstreams

  • Regulatory perimeter mapping
  • Sandbox application preparation
  • Group structuring and Bangladesh approvals
  • Data, outsourcing and cyber terms
02 · How it runs

Four clear stages

  1. 01Activity and perimeter review
  2. 02Structure and Bangladesh approvals
  3. 03Application and engagement
  4. 04Testing and graduation
03 · Start here

Talk to a partner

Consultations in Dhaka or by video. Scope, team and fees are agreed in writing first.

Book →
How we help

How we support fintech testing and licensing

Workstream 01Trade, Competition & Regulation

Regulatory perimeter mapping

  • Activity and perimeter review
  • Structure and Bangladesh approvals
  • Application and engagement
  • Testing and graduation
Workstream 02Trade, Competition & Regulation

Sandbox application preparation

  • Activity and perimeter review
  • Structure and Bangladesh approvals
  • Application and engagement
  • Testing and graduation
Workstream 03Trade, Competition & Regulation

Group structuring and Bangladesh approvals

  • Activity and perimeter review
  • Structure and Bangladesh approvals
  • Application and engagement
  • Testing and graduation
Workstream 04Trade, Competition & Regulation

Data, outsourcing and cyber terms

  • Activity and perimeter review
  • Structure and Bangladesh approvals
  • Application and engagement
  • Testing and graduation
Workstream 05Trade, Competition & Regulation

Customer documentation and disclosures

  • Activity and perimeter review
  • Structure and Bangladesh approvals
  • Application and engagement
  • Testing and graduation
Workstream 06Trade, Competition & Regulation

Graduation and full authorisation

  • Activity and perimeter review
  • Structure and Bangladesh approvals
  • Application and engagement
  • Testing and graduation
01

Regulatory perimeter mapping

We analyse the proposed product against the regulated activity definitions of the relevant UAE regimes, identifying whether it is regulated at all, which authority is likely to be competent, and whether a sandbox, a full licence or an exemption is the realistic route. Where a UAE fintech sandbox is not needed, we say so. The output is a short decision memo that management can use to brief investors, technology partners and the board on the regulatory path ahead.

02

Sandbox application preparation

Once a UAE fintech sandbox is chosen, we help prepare the application narrative, business plan, test parameters, customer limits, risk register, exit plan and governance documents. We check that the technology, outsourcing and safeguarding descriptions match what the engineering team will actually build, because inconsistencies between the application and the live product are a common source of regulatory follow-up questions, conditions and delay in admission.

03

Group structuring and Bangladesh approvals

We advise on how the UAE entity should sit within the wider group, including holding arrangements, intellectual property ownership, intra-group service agreements and transfer pricing assumptions. On the Bangladesh side we handle outward investment permission, foreign exchange reporting, board and shareholder approvals, and the corporate records that UAE regulators and banks will ask to see during onboarding and fitness and propriety reviews of the founders and controllers.

04

Data, outsourcing and cyber terms

Fintech propositions depend on cloud providers, developers and data flows that often run through Bangladesh. We draft and review outsourcing, software development, hosting and data processing agreements so that they satisfy UAE regulatory expectations, the conditions of any UAE fintech sandbox and the Personal Data Protection Act 2026, with audit rights, incident reporting, business continuity and exit provisions that a regulator will expect to see in place before any live customer testing begins.

05

Customer documentation and disclosures

Testing customers must understand that the service is being tested and what protections apply. We prepare terms of service, risk warnings, complaints procedures and marketing guidance tailored to the permitted test scope, and we review how the product is promoted to Bangladeshi diaspora users in the UAE so that promotion does not stray outside the UAE fintech sandbox permission or create unexpected licensing obligations in Bangladesh.

06

Graduation and full authorisation

A UAE fintech sandbox is designed to end. We plan the move to a full licence from the start, tracking capital, systems, compliance staffing, safeguarding and reporting requirements that will apply after testing. Where a test does not succeed, we advise on an orderly wind-down, customer communication, return of customer funds and the regulatory record, so that the founders retain credibility for any later application.

RecognitionThe Legal 500Asia Pacific ranks Tahmidur Remura Wahid (TRW) Law Firm for dispute resolution in Bangladesh.
Cross-border reach6 jurisdictionsMatters coordinated with counsel in the UK, US, UAE, China, India and Singapore.
Bar and admissionsDhaka and LondonBarristers and advocates in Bangladesh, with a solicitor of England and Wales (non-practising).
HeadquartersDhakaHouse 410, Road 29, Mohakhali DOHS. Consultations in person or by video.
Who leads this work

Partner-led, on every matter.

Trade, Competition & Regulation matters at TRW are led by partners, supported by associates, with one responsible lawyer from first advice to final outcome.

Meet the firm →
01

Which UAE fintech sandbox is right for a Bangladesh-founded payments start-up?

There is no single answer, because the right route depends on the activity, the target customers and where the business will actually operate. A payments business serving onshore UAE customers will usually look first at the federal regime, while a firm planning to serve institutional clients from a financial free zone may look at the DIFC or ADGM. Each UAE fintech sandbox has its own eligibility tests. We compare the realistic options, explain the trade-offs on cost, timing, customer reach and graduation, and recommend a route that matches the commercial plan rather than simply the quickest or cheapest application.

02

Does a sandbox mean we do not need a full licence?

No. A sandbox allows a firm to test a proposition under conditions, often with limits on customer numbers, transaction values or duration. It is not a permanent authorisation, and a firm that wants to continue after testing usually needs to apply for the relevant licence and meet its capital, governance and systems requirements. We plan the test so that the evidence it produces supports the later application, and we flag early any requirements that will be difficult to meet at scale. A UAE fintech sandbox works best as the first stage of a planned licensing journey.

03

What does regulatory perimeter mean in practice?

The regulatory perimeter is the boundary between activities that need a licence and those that do not. In the UAE it is drawn by several regulators, so the same product can be inside one regime and outside another depending on location, customer type and structure. A wallet, a lending marketplace or a token platform may involve more than one regulated activity. We analyse the product feature by feature, identify which parts are regulated and by whom, and advise whether design changes could reduce the licensing burden without undermining the commercial proposition. This analysis comes before any UAE fintech sandbox application.

04

Do we need Bangladesh Bank approval to set up a UAE fintech sandbox entity?

If a Bangladeshi company or resident individual will invest money or hold shares in a UAE entity, Bangladesh foreign exchange law generally requires permission for that outward investment, and some routes are tightly controlled. The answer depends on who is investing, how much, and how the shares are funded. Founders sometimes hold shares personally without considering this, which can create problems later during fundraising or regulatory vetting in a UAE fintech sandbox. We review the shareholding plan, advise on the approval route, and prepare the application and supporting documents for Bangladesh Bank, keeping the timetable aligned with the UAE process.

05

Can our Dhaka team build and operate the platform for a UAE licensed entity?

Yes, many groups use a Bangladesh development centre, but UAE regulators will treat it as outsourcing or a group service arrangement and will expect proper oversight. The licensed entity must retain responsibility, have access to data and premises, and be able to exit the arrangement. In Bangladesh, payment for services and transfer of data require attention to foreign exchange rules, tax and the Personal Data Protection Act 2026. We draft intra-group agreements that satisfy both sides and document the oversight and governance that a UAE regulator will want to see during review, including service levels and reporting lines.

06

How long does a UAE fintech sandbox application usually take?

Timing varies by regulator, programme and the quality of the application. Most programmes involve an initial screening or pre-application stage, followed by a fuller assessment and agreement of test parameters, and regulators may run admission in cohorts or on a rolling basis. Delays usually come from unclear business models, incomplete ownership information, unrealistic test parameters or weak risk controls. We cannot promise a timetable that a regulator controls, but careful preparation, consistent documents and early engagement on difficult points are the best way to avoid back-and-forth and repeated information requests from the UAE fintech sandbox team.

07

Will testing in the UAE allow us to serve customers in Bangladesh?

Not by itself. A UAE authorisation, whether a test licence or a full licence, governs activity in the relevant UAE jurisdiction. Offering payment, remittance, lending or investment services to customers in Bangladesh can require Bangladesh licences or approvals, and cross-border payment flows are closely controlled by Bangladesh Bank. Diaspora remittance products need particular care on both sides. We advise on what can lawfully be offered to Bangladeshi users, whether a local partner bank or licensed provider is needed, and how to structure the service so that it does not breach either regime or put the UAE licence at risk.

08

What happens if regulators change the rules during our test?

UAE financial regulation has developed quickly, and regulators publish new rules, guidance and consultation papers regularly. A firm in a test is expected to keep up and may need to adjust its controls or documents. Changes in federal licensing scope have also affected technology platforms that previously assumed they were outside regulation. We monitor developments relevant to each client's proposition, explain promptly what a change means for the test plan, the budget and the eventual licence, and help prepare any notification or variation request that the regulator requires during the UAE fintech sandbox testing period.

How a matter runs

From first call to resolution.

  1. 01

    Activity and perimeter review

    We review the product, customers, funds and data flows, identify the regulated activities and competent authorities, and confirm whether a UAE fintech sandbox, a full licence or no licence at all is the realistic and proportionate route for the business.

  2. 02

    Structure and Bangladesh approvals

    We settle the group structure, shareholdings and intra-group arrangements, and obtain the Bangladesh Bank and corporate approvals needed before money, shares or intellectual property move from Bangladesh to the UAE entity, so that later investor due diligence is clean.

  3. 03

    Application and engagement

    We prepare the application, test plan, risk controls and governance papers, coordinate with UAE counsel where a local filing is required, and support management through regulator meetings, presentations and follow-up questions until the UAE fintech sandbox admission decision.

  4. 04

    Testing and graduation

    During testing we track conditions, reporting and rule changes, then plan the full licence application or an orderly exit, keeping Bangladesh records, contracts and data arrangements consistent throughout, so that the business can scale without restructuring.

“Demonstrates an extraordinary command over both domestic litigation and international arbitration.”

The Legal 500 Asia Pacific, Bangladesh: Dispute resolution, client feedback

FAQ

Questions, answered.

Still unsure? Email info@trw.co with a short outline of the matter.

What is a UAE fintech sandbox?
It is a regulator-run programme that lets eligible firms test innovative financial products with real customers under agreed conditions and limits, for a defined period. Different UAE regulators run their own programmes with different eligibility rules and scope. A sandbox is a testing route, not a permanent licence, and firms are expected to graduate to full authorisation or exit at the end of the test. Admission to a UAE fintech sandbox is competitive, so a well-prepared application with a clear testing purpose matters.
Is DIFC or ADGM better than the federal route?
Neither is better in general. The financial free zones suit firms serving institutional or professional clients from within those centres, while activity aimed at onshore retail customers often engages federal regulators. Cost, office requirements, customer reach and licence categories differ. We compare the routes against your business plan and recommend the option that fits the customers you actually intend to serve over the next few years, taking account of where your team, bank accounts and investors are based.
Can a Bangladeshi national be a director of a UAE licensed fintech?
Nationality is not usually the deciding factor. UAE regulators assess fitness and propriety, experience, time commitment and residence for key roles, and some roles may need to be based in the UAE. Bangladeshi directors should make sure their own records, tax position and any Bangladesh shareholdings are in order, because regulators may ask detailed questions about background, source of funds and other directorships. Preparing a clear personal file before the application saves time and avoids awkward follow-up questions.
Are crypto businesses eligible for a UAE fintech sandbox?
Virtual asset activity is regulated in the UAE, and the competent regulator depends on location: VARA for most of Dubai, the DFSA in the DIFC and the FSRA in ADGM, with federal rules elsewhere. Some programmes accept token-related propositions and others route them to dedicated licensing. Bangladesh founders should also note that crypto activity remains restricted in Bangladesh, which affects funding, payment flows and customer reach. We advise on both sides before any application is made.
Do we need a UAE lawyer as well as TRW?
Usually yes for UAE filings and formal UAE law opinions. We work with UAE-qualified counsel and coordinate the matter so the client has one plan, one timetable and one point of contact. Our role covers the Bangladesh legal position, group structuring, cross-border contracts and project management, and we make sure UAE and Bangladesh advice stays consistent. This avoids duplicated work and conflicting assumptions between advisers in different countries, and keeps professional fees for the client proportionate to the matter.
What documents should we prepare before contacting a regulator?
Prepare a clear business plan, a description of the product and customer journey, a funds flow diagram, a list of shareholders and controllers with source of funds evidence, draft policies on anti-money laundering, data and complaints, and an outline technology architecture. Consistency matters more than volume. We review these documents before any regulator meeting so that the first impression is accurate and credible. Regulators notice when policies are copied from templates rather than written for the actual UAE fintech sandbox proposition.
How does a UAE fintech sandbox interact with Bangladesh tax?
Profits, service fees, royalties and dividends moving between a Bangladesh company and a UAE entity can have Bangladesh tax and withholding consequences, and transfer pricing rules may apply to intra-group charges. A UAE testing licence does not change those rules. We review the proposed charging model with tax advisers so that the group structure is efficient, defensible and properly documented in both countries. The reduced Finance Act 2026 withholding rate on interest paid to non-residents may also be relevant for intra-group lending arrangements.
How do we start working with TRW?
Send us a short description of the product, target customers, intended UAE location and current group structure through our contact page. We will confirm conflicts, agree scope and fees in writing, and arrange an initial call. Please do not send confidential technical, commercial or regulatory documents until the engagement terms are agreed and signed. We can usually tell you at the first meeting which routes are worth exploring and which are not.

Plan your UAE testing route with confidence

Speak with the partners about UAE fintech sandbox in Bangladesh or across borders.

Book a consultation →
UAE fintech sandbox: TRW & Co, Dhaka
Message TRW on WhatsApp