NRB Regulatory Sandbox: Who Can Apply, What Can Be Tested and How It Works

As of 13 October 2026 (27 Asoj 2083). Based on Nepal Rastra Bank’s 20-page Guidelines on the Regulatory Sandbox, effective 14 May 2026, and the questions and answers NRB published on its website in August 2026. We read both in full.

The NRB regulatory sandbox is a controlled, supervised environment in which a company can test a new financial product on real customers for up to six months, under rules agreed with Nepal Rastra Bank. It has been in force since 14 May 2026.

It is open to licensed banks, payment companies and remittance companies, and also to new fintech companies. It runs in themed rounds that NRB calls cohorts. When we checked NRB’s Payment Systems Department pages on 13 October 2026, we did not find a call for applications for a cohort.

So this is the time to prepare, not to apply. This guide sets out what the guidelines require, in the order a founder or product head would need it.

Quick answers

What a regulatory sandbox is, and is not

A sandbox lets a regulator watch a new product work on a small scale before deciding how to treat it. The company gets to test with real customers. The regulator gets evidence.

The guidelines are firm about the limits. Acceptance into the sandbox is not a permanent licence. It is not permission to operate without oversight. Testing is limited to customers who have consented and have been told about the risks.

NRB’s own answer on its website is direct: a product tested in the sandbox is not automatically approved for the market. The normal licence or approval is still needed afterwards.

Who can apply

The guidelines define an applicant as a regulated financial institution or a fintech company, applying alone or together with another regulated institution. The eligibility annex adds that the applicant must be incorporated in Nepal.

One condition matters for startups. If a fintech company is accepted but cannot get the approvals it needs from NRB by itself, it must partner with a licensed financial services provider before testing begins.

What can be tested, and what cannot

Annex 2 of the guidelines lists both.

The eligible list ends with any other innovation that NRB approves or recognises. Each cohort will have a theme, and an application has to fit it.

The eligibility criteria

Annex 1 sets nine tests. In plain terms:

1. Incorporation. A company incorporated in Nepal, of one of the types above.
2. Innovation. The product is new, or uses existing technology in a new way. NRB expects market research and a comparison with competitors.
3. Financial inclusion. It has the potential to widen access to financial services in Nepal.
4. Need for a sandbox. Live testing is necessary to reach the testing objective.
5. Readiness. The product is built. There is a testing plan, and the main risks and their controls are set out.
6. Fit and proper. Owners, directors and senior managers are not blacklisted or sanctioned and have no criminal record.
7. Consumer benefit. The product is better for customers, or widens their choice.
8. Thematic fit. It suits the cohort theme NRB has called.
9. A complete application.

The fit-and-proper test includes two staffing requirements that small teams should note:

• at least two full-time technical staff, such as developers and cyber security experts;
• a project manager with at least two years of relevant experience in fintech or regulatory technology.

Where someone was blacklisted in the past, at least three years must have passed since removal from the list. The applicant, its directors and senior managers also sign a self-disclosure taking legal responsibility for the accuracy of everything submitted.

The four phases and the timeline

The guidelines describe four phases: application, application evaluation, testing, and evaluation and graduation.

Two notes on this table. NRB may extend any of the evaluation timelines, and the guidelines say an extension is not a deemed approval or rejection. And the participant pays for the test: deploying, operating and meeting its costs is the applicant’s responsibility.

After approval, NRB and the participant agree the terms: the scope and duration of testing, the performance indicators, reporting, risk controls and customer protection, and any conditions tied to regulatory relief.

What relief NRB may give

This is the reason to apply. To the extent the law permits, NRB may temporarily relax or waive requirements for the testing period.

• For licensed entities, the guidelines mention authorisation to test, relaxation of asset or cash balance requirements, and exemptions on items such as minimum paid-up capital, licence fees, credit rating, management experience and escrow requirements.
• For new fintech companies, they mention permission to test, and temporary exemptions on requirements such as risk management, outsourcing, minimum liquid assets, management experience, track record and escrow.
• For both, where possible: simpler reporting, non-discriminatory and low-cost access to payment and banking infrastructure, and some flexibility in marketing, provided customers know the product is in a sandbox.

Some duties are never relaxed. A participant must follow the rules on customer confidentiality, know-your-customer, anti-money laundering and countering the financing of terrorism at all times. It must also hold resources to compensate customers for any loss.

What goes into an application

Annex 3 lists what NRB may ask for. The exact form will come with each cohort’s call.

• How you meet each eligibility criterion, with evidence.
• Your organisation: governance, financial standing, expertise, licence status and key people.
• The product: the problem it solves, its benefits, the business model with each use case shown end to end, and the technical architecture.
• For a financial solution, the licensed partner you are talking to and proof of how far the talks have gone, such as a letter of intent or a memorandum of understanding.
• The tests you will run and for how long, up to six months.
• Targets and key performance indicators.
• Boundaries: customer types, customer limits, transaction limits and flows.
• The regulatory requirements you want relaxed.
• Customer safeguards and a customer communications plan with risk disclosures.
• Cyber security, anti-money laundering and consumer protection measures.
• Any outsourcing, with the due diligence you did on the third party.
• An exit and transition plan for customers, and a scale-up plan.

A team that has these twelve items written down before a cohort opens will not be rushed by a 45-day window.

After testing: four ways out

NRB evaluates the result on performance against the indicators, suitability for the wider market, risks and customer protection, and readiness for licensing. Annex 4 then sets four exit paths.

The last box needs care. A completion acknowledgement only confirms that the company took part and finished. The guidelines say it is not a licence, certification, approval or endorsement. Licensed institutions may then adopt the solution after their own due diligence.

The guidelines also say that successful graduation is not a guarantee of a licence or approval.

How a participant can be removed

NRB can revoke permission during testing. The grounds include significant harm to customers, breach of the agreed terms, failure to protect consumers, a data security breach, failure to meet anti-money laundering requirements, misleading information given to NRB, and unresolved technical defects.

An exiting participant must give a customer exit plan, stop operations within a time NRB accepts, hand over the test data, delete the customer data collected during testing and meet every obligation to its customers and partners.

How to prepare before a cohort opens

This list is our own reading of the guidelines, not NRB’s.

1. Check the eligible list. If your product is on the non-eligible side, the sandbox is closed to it.
2. Finish the product. The sandbox is for products that are built and ready for live testing, not for ideas.
3. Start partner talks now and keep the emails. NRB accepts correspondence as evidence.
4. Write the customer safeguards first. Consent, disclosure, complaint handling and compensation are what the regulator reads most closely.
5. Meet the staffing rule. Two full-time technical staff and an experienced project manager.
6. Watch NRB’s notices for the cohort theme and the call.

NRB is holding its Fintech Innovation Showcase on 2 November 2026, run by the same department. For the wider policy, see our explainer on the NRB fintech strategy. If your product touches payment rails, our guide to NCHL, the national clearing house, explains the infrastructure you would connect to.

Where to ask NRB

NRB’s website gives a dedicated contact for sandbox questions.

Frequently asked questions

What is the NRB regulatory sandbox?

A controlled and supervised testing environment run by Nepal Rastra Bank, where approved participants test financial products, services or solutions on consenting customers for a limited time.

Who can apply to the NRB regulatory sandbox?

Licensed banks and financial institutions, payment system operators, payment service providers and remittance companies, and new fintech companies incorporated in Nepal whose product NRB can supervise.

Is the sandbox open for applications now?

Applications are taken only when NRB calls for a cohort. We found no call on NRB’s Payment Systems Department pages on 13 October 2026.

How long can a company test in the sandbox?

Up to six months. NRB may extend it by up to six more months if it sees good reason.

Can crypto products be tested in the sandbox?

No. Cryptocurrency, virtual assets and central bank digital currency are on the non-eligible list.

Does graduating from the sandbox give a licence?

No. The guidelines say graduation is not a guarantee of licensing or approval. The normal licence or approval is still required.

Conclusion

The NRB regulatory sandbox gives fintech companies and licensed institutions in Nepal a lawful way to test on real customers for up to six months, with some requirements relaxed and the main protections kept. It opens only in themed cohorts, with a 45-working-day window each time.

Until NRB calls the first one, the useful work is preparation: a finished product, a licensed partner where needed, written customer safeguards and the twelve application items ready to submit.

Sources

• Nepal Rastra Bank, Payment Systems Department, Guidelines on the Regulatory Sandbox, effective 14 May 2026: https://www.nrb.org.np/contents/uploads/2026/06/Guidelines-on-the-Regulatory-Sandbox-1.pdf
• Nepal Rastra Bank, frequently asked questions on the regulatory sandbox, published August 2026, found through the site search: https://www.nrb.org.np/?s=sandbox
• Nepal Rastra Bank, Payment Systems Department page, checked 13 October 2026: https://www.nrb.org.np/departments/psd/

Digital Solution Pvt. Ltd. is an independent publisher and is not affiliated with Nepal Rastra Bank. The tables summarise the guidelines; the preparation list is our own. This is general information, not legal or regulatory advice. Read the guidelines and each cohort’s call before you apply.

Written by

Rabin Paudel

Rabin Paudel is the Founder of Digital Solution, a Content Creator, and an AI Trainer. He shares practical and easy-to-understand content on Artificial Intelligence, Digital Literacy, Online Services, FinTech, and Technology. His mission is to make technology simple, accessible, and useful for everyone.

View all posts by Rabin Paudel →