Insurance Regulatory Sandbox Framework (Insurance Lab)

​​

The applicant must provide the Authority with initial requirements for application review, as follows:

• Letter requesting admission to the regulatory sandbox - signed by the applicant
• Completion and submission of the regulatory sandbox application form and related attachments
• Submission of activity profile and contact information
  
   
  
  After reviewing the requirements and verifying their compliance with the criteria mentioned in Article "Sixth" and requirements mentioned in Article "Seventh," the applicant will be notified to provide the Authority with the following commencement requirements:
• Submit proof of concept for the sandbox activity, including at minimum:

• Board of Directors and Senior Management fit and proper form.
• Founders' questionnaire form.
• Statement about the sandbox activity, its objectives, and target segment.
• Added values to be provided and competitive advantages.
• Economic feasibility.
• Pro forma financial statements (balance sheet, income statement, and cash flow statement).
• Expected demand for services and target market.
• Sources and mechanism of funding.
• Organizational structure.
• Go-to-Market Strategy.
• Study including global best practices related to the sandbox activity - if any.
• Operating model with clarification of roles and responsibilities.
  
  Any external agreements with other parties.
• Expected economic and social impacts.
• Business continuity plan.
• Potential risks and mitigation methods.
  
  Submit testing and evaluation plan, including implementation phases, mechanism, timeline, and performance indicators .

• Submit exit plan, including final phases for exiting the regulatory sandbox .
• Submit policies, controls, and procedures including:

• Anti-money laundering and counter-terrorism financing.
• Protection of customers' personal data confidentiality/
• Customer protection procedures Conflict of interest governance.

• Submit patent certificate (if applicable)
• Any additional requirements the Authority may deem necessary for application review​
  

​​

1. The framework aims to contribute to achieving the objectives of the Insurance Authority, the Cooperative Insurance Companies Control Law, its implementing regulations, and related regulations and instructions, and this framework does not violate the relevant controls issued by the Authority.
2. If the intended sandbox activity involves multiple parties in its implementation, the main party in implementing the business model and its supporting parties must be identified. The main party shall be responsible for the sandbox application procedures.
3. The applicant must complete the application form for one sandbox activity. If there are multiple activities, each activity must be submitted with a separate application form. In all cases, the applicant must comply with the approved business model and adhere to procedures for changing the business model throughout the testing period if required.
4. The applicant must not exit from the ownership structure and must adhere to the list of beneficial owners submitted before joining. Any change to the ownership structure is prohibited without prior approval from the Authority throughout the sandbox phases.
5. The participant may increase capital through cash injection or new partners' entry, subject to the Authority's approval.
6. The Authority has the right to suspend the sandbox activity - in whole or in part - at any time when needed, or if substantial risks are found to negatively affect customers, stakeholders, or the insurance sector, without any liability on the Authority.
7. The Authority has the right to reject applications that do not meet the criteria specified in Article "Sixth."​
   

​​

1.      Enhance innovation in the insurance sector by encouraging entrepreneurs and companies to develop and test new solutions and innovative insurance technologies.​

2.      Provide an experimental environment that facilitates the adoption and application of new technologies in the insurance sector effectively and with limited risks.

3.      Attract qualitative investments in the insurance sector.​

4.      Contribute to achieving financial inclusion.

​​

The regulatory sandbox framework applies to all innovative insurance solutions intended to be provided within the Kingdom of Saudi Arabia.​​​

The following categories can apply to join the regulatory sandbox:

1. Companies Licensed by the Insurance Authority
   
   Companies that have obtained a license from the Insurance Authority to conduct insurance activities.
2. Existing Local Companies
   
   Companies with an actual presence that wish to launch an innovative solution related to insurance activities.
3. Foreign Companies
   
   International companies that wish to enter the Saudi Arabian market and launch an innovative solution related to insurance activities.
4. Entrepreneurs and Innovation Owners
   
   Any natural or legal person who provides an innovative insurance solution.​
   

​​

1. The sandbox activity must be insurance-related and innovative.
2. The sandbox activity must be in the development phase and have a minimum level of readiness for testing.
3. It must have added and qualitative value.
4. High potential for sustainability and growth.
5. Fulfillment of the requirements stated in Article "Seventh" that must be submitted by the applicant.​
   

​​

The regulatory sandbox goes through four phases, each with specific controls and provisions, as follows:

1. Application Phase:
   
   The applicant completes the application form and sends it along with the criteria specified in Article "Sixth" and requirements specified in Article "Seventh" to the regulatory sandbox email (--------------------@ia.gov.sa).
   
    
2. Selection Phase:
   
   After receiving applications to join the regulatory sandbox, they will be reviewed according to the criteria and requirements specified in Article "Sixth."
   
    
   
   The Authority will notify the applicant within 45 days of submitting the completed application with acceptance, rejection, or request for clarifications or modifications.
   
    
3. Testing Phase:

1. Upon acceptance into the regulatory sandbox, the participant must comply with all conditions set by the Authority for conducting business within the sandbox scope and complete establishment procedures with other competent authorities within 60 days from acceptance date.
   
    
2. Upon completing establishment procedures, the participant must immediately begin preparing for a live demonstration of the activity within 30 days to present to the Authority.
3. The participant will be notified of approval to begin testing in the sandbox if the live demonstration is successful and regulatory requirements are completed. Testing duration is 6 to 12 months.
4. During this period, live testing of products or services must be conducted under Authority supervision according to the submitted testing plan, including submission of periodic reports on tested activity performance monthly or as determined by the Authority.
5. The participant must notify the Authority of any risks related to cybersecurity or affecting customer rights.
6. The Authority provides participants with testing results observations and may request modifications to the sandbox activity. 
   
    
   
    
   
   Exit Phase:

• Participant transition to the sandbox exit phase upon successful completion of the testing period.  In this phase, final evaluation is conducted to ensure all regulatory requirements are met before final launch.  This includes submitting documents and all reports, and proving compliance with required standards.
  
   
• Upon completing all regulatory requirements, the company will be notified to begin implementing the exit plan, after which the final license will be issued, according to:
  
  License issuance based on existing rules and instructions:  Granting final license for the sandbox activity according to rules and instructions issued by the Authority without any regulatory modifications.

1. License issuance based on modifications to current rules and instructions:  If the project requires updates or modifications to existing rules and instructions.​
   

​​

• Extension: Submit request to the Authority 30 days before testing period ends, including detailed progress report, identifying key milestones achieved, challenges faced, and specific reasons requiring extension.  Clarify additional time requested and statement explaining its objectivity. The Authority has the right to extend testing period based on results with justification for extension decision. 
• Withdrawal: If participant wishes to withdraw from sandbox, must submit letter to Authority 30 days before intended withdrawal, including withdrawal reasons and careful plan to stop tested activity ensuring minimum rights of all stakeholders.
• Exclusion: Authority has the right to exclude activity if found negatively affecting market or customers, causing unacceptable risks, or if any information is inaccurate or misleading, or if the activity proves unrelated to insurance sector.​
  

​​