Regulatory Sandbox vs Full Crypto License: What Can You Legally Do?

• A regulatory sandbox lets a crypto firm test one defined product with real customers under caps on customers, volumes and time, while a full crypto license lets it run the business commercially with no test boundaries.
• Sandboxes confer three legal positions: a restricted license (FCA, DFSA), a time-limited exemption (Wyoming, ASIC, the SEC’s 2026 Innovation Exemption) or dialogue with no permission at all (European Blockchain Sandbox).
• MiCA has no sandbox lane, so since 1 July 2026 every firm providing crypto-asset services in the EU needs CASP authorisation or an Article 60 notification.
• Sandbox entry is no guarantee of a license: Hong Kong received 36 stablecoin issuer applications and granted two licences in April 2026.
• Anti-money laundering rules and customer-asset protection generally stay in force inside a sandbox, and permissions typically end after 12 to 24 months, so the exit needs planning from day one.

Why the Sandbox Question Matters in 2026

A regulatory sandbox gives a crypto firm permission to test a specific product with a limited group of customers, for a limited time, under close supervision. A full crypto license authorises it to offer approved services commercially, at scale and, in some regimes, across borders. In any regulatory sandbox vs crypto license comparison, the sandbox answers the question “may we try this?”, and the license answers “may we build a business on this?”. That gap decides what a company can legally sell, to whom and for how long.

Hong Kong shows how wide the gap can be. When the Hong Kong Monetary Authority (HKMA) named its first stablecoin issuer sandbox participants on 18 July 2024, they were barred from handling the general public’s funds or soliciting money from the public at the initial stage. Standard Chartered, Animoca Brands and HKT were among them. Almost two years later, on 10 April 2026, their joint venture Anchorpoint Financial became one of only two licensed stablecoin issuers, chosen from 36 applications received in the first window.

That journey shows both sides of the trade-off. The sections below explain what each route permits, where the legal edges sit in nine jurisdictions and how firms move from one to the other.

The future of finance is here. Trade crypto and more

What Is a Regulatory Sandbox?

A regulatory sandbox is a supervised testing framework in which a financial regulator allows a firm to trial an innovative product with real customers under an agreed test plan, safeguards and limits. The European Supervisory Authorities (ESAs) counted 14 such sandboxes in 12 European Economic Area countries in their 2023 report on innovation facilitators, alongside 41 innovation hubs.

That report also draws the most important legal line in Europe: sandboxes “do not entail the disapplication of regulatory requirements that must be applied as a result of EU law”. Regulators outside the EU have more room. The UK Financial Conduct Authority (FCA) offers six tools in its Regulatory Sandbox, including restricted authorisation, individual guidance, rule waivers and no enforcement action letters. Even so, waivers cannot override national or international law, and tests run on a small scale, for a limited time and with a limited number of consumers.

Three Legal Positions Inside a Sandbox

Because “sandbox” covers very different arrangements, the first question for any founder is which legal position a programme confers. There are three.

1. Restricted license. The firm receives real authorisation, narrowed to the activity being tested. The FCA’s restricted authorisation works this way, and the Dubai Financial Services Authority (DFSA) calls its Innovation Testing Licence its version of a sandbox, with tests that typically last 12 months and limits on clients, transaction volumes and values.
2. Time-limited exemption. The firm operates without the license it would normally need, as long as it meets the exemption’s conditions. Australia’s Enhanced Regulatory Sandbox, in place since 1 September 2020, allows eligible businesses to test certain financial services or credit activities for up to 24 months, and Wyoming and the US Securities and Exchange Commission (SEC) use the same model.
3. Dialogue only. The firm gets structured access to regulators and no legal permission at all. The European Commission’s European Blockchain Sandbox, launched on 14 February 2023 with 20 projects a year, provides confidential legal guidance, and selection does not imply legal endorsement of the business model.

Those three positions carry very different rights. A restricted license holder is a regulated firm with narrow permissions, an exempt firm stays outside the licensing requirement only while it meets every condition, and a dialogue participant still needs whatever license its activity already requires.

What a Full Crypto License Lets You Do

Where a sandbox fences in a test, a full crypto license sets a permanent perimeter: the firm may provide every service in its authorisation, to any eligible client, in any volume, for as long as it meets the conditions. Under the EU’s Markets in Crypto-Assets Regulation (MiCA), the public register shows which of the ten crypto-asset services each provider may offer, as this walkthrough of CASP permissions on the MiCA register explains.

Three freedoms separate a license from any sandbox permission. The first is scale, with no customer cap, volume ceiling or end date. The second is geography, since a MiCA crypto-asset service provider (CASP) can serve clients across the EU through the cross-border notification in Article 65 and start by the 15th calendar day after notifying its home authority at the latest. The third is commercial standing, because banks, partners and acquirers treat a licensed entity as a known quantity.

Those freedoms bring obligations from the first day. MiCA sets minimum capital requirements of EUR 50,000, EUR 125,000 or EUR 150,000 depending on the class of services, and directors and qualifying shareholders must pass fit-and-proper assessments. The full process is set out in this guide on how to get a MiCA license in the EU.

Why MiCA Leaves No Sandbox Lane

The EU is the clearest case where a sandbox cannot stand in for a license. MiCA applies directly in every member state, and national sandboxes have no power to disapply it. The grandfathering period closed on 1 July 2026 at the latest. Since then, a firm providing crypto-asset services in the EU needs CASP authorisation or, if it is already a bank, investment firm or other listed regulated entity, an Article 60 notification. The consequences of that cut-off are covered in this analysis of the MiCA deadline.

The only EU-level framework that grants formal exemptions serves a different market. The DLT Pilot Regime, in operation since 23 March 2023, lets authorised DLT market infrastructures trade and settle tokenised financial instruments with targeted exemptions from MiFID II and CSDR rules. Its caps include EUR 6 billion across all instruments on a venue.

Buy bitcoin and stocks. Signup to Coinbase today

That ceiling may rise. In its market integration package of 4 December 2025, the European Commission proposed lifting the main threshold to EUR 100 billion, removing time limits and letting CASPs participate. The same proposal would move CASP authorisation and supervision to the European Securities and Markets Authority (ESMA), so firms planning an EU license should follow it closely.

Sandbox vs Full License: The Legal Boundaries Side by Side

Set side by side, the two routes differ on almost every question a founder asks about growth. The table compares a typical regulatory sandbox with a full crypto license, and the next section gives programme specifics.

Two patterns run through that table. A sandbox exchanges reach for flexibility, and every limit comes with an end date, while a license removes the ceilings and adds the full weight of capital, governance and reporting duties.

Five Things a Sandbox Firm Cannot Do

Those limits become concrete prohibitions that catch out firms planning growth around a test.

• Scale past the test plan. Customer numbers, transaction values and product scope are fixed in advance, and lifting them requires a fresh application to the regulator.
• Use the permission abroad. A sandbox permission is granted by one national or state authority, so a firm testing in one market has no right to serve clients in another.
• Relax core safeguards. Singapore’s sandbox guidelines keep customer confidentiality, honesty and integrity tests, the handling of customer money and anti-money laundering rules outside the scope of relaxation.
• Present the product as fully licensed. Wyoming, for example, requires written notice that the product is under temporary test and may not function as intended, and the Monetary Authority of Singapore (MAS) warns consumers to verify any company’s claimed sandbox status.
• Stay indefinitely. Every sandbox permission has a closing date, from roughly 12 months at the DFSA to 24 months plus a 12-month extension in Wyoming, after which the tested activity must stop unless a full license is in place.

How Crypto Regulatory Sandboxes Work Across Major Jurisdictions

Although the logic is shared, each regulator draws the boundaries differently. The table summarises the programmes most relevant to crypto firms as of September 2026.

Read across the rows, two camps emerge: programmes in Hong Kong and the UK run alongside a licensing regime under construction, while Switzerland and Australia carve standing exemptions out of existing law.

United Kingdom: Testing Ahead of the 2027 Regime

The UK uses its sandbox as a laboratory for rules still being finalised. In February 2026, the FCA selected four firms for its stablecoin cohort, Monee Financial Technologies, ReStabilise, Revolut and VVTX, out of 20 applications, with testing focused mainly on issuance. The cohort confers no special authorisation, because firms test within the permissions and registrations they already hold. Their results feed the final stablecoin rules, while the gateway for the new cryptoasset regime opens on 30 September 2026 and closes on 28 February 2027, ahead of the regime taking effect on 25 October 2027.

The future of finance is here. Trade crypto and more

Tokenised securities follow a separate track. The Bank of England and the FCA run the Digital Securities Sandbox under a modified legal regime that moves firms from testing to live activity under initial limits, then onto a glidepath to full authorisation.

Hong Kong: A Sandbox That Fed a Licensing Regime

Hong Kong offers the cleanest example of a sandbox feeding a new license. The Stablecoins Ordinance took effect in August 2025, and on 10 April 2026 the HKMA granted the first two stablecoin issuer licences to Anchorpoint Financial and The Hongkong and Shanghai Banking Corporation. Standard Chartered confirms that Anchorpoint, its joint venture with HKT and Animoca Brands, had been admitted to the sandbox in 2024, so the sandbox helped with preparation, and the license still required a full assessment.

Singapore, Australia, Dubai and Switzerland: Relief With Hard Limits

Across Asia-Pacific and the Middle East, relief comes inside firm boundaries. Singapore runs a standard sandbox for complex tests, Sandbox Express for pre-defined activities that can start within 21 days, and Sandbox Plus, which offers first movers a grant of 50% of qualifying expenses, capped at S$400,000. Australia and Dubai both require a formal step at the end: an ASIC exemption expires after 24 months, and a DFSA test ends only when the holder proves it meets every requirement for an unrestricted licence or withdraws.

Switzerland takes a threshold approach instead of a test period. Since August 2017, FINMA’s sandbox has let firms accept up to CHF 1 million in public deposits without a banking licence, provided they comply with anti-money laundering law and join a self-regulatory organisation. Above that level, the FinTech licence covers deposits of up to CHF 100 million.

United States and Canada: Exemptions That Expire

North America shows how sandbox relief expires. In the US, most sandboxes operate at state level, and the Wyoming Financial Technology Sandbox, created in 2019, can waive specified state laws for up to 24 months, plus 12 more when a permanent license application is pending. At federal level, the SEC’s Innovation Exemption of 17 September 2026 lets Tokenized Securities Venues trade tokenized NMS stock through permissioned automated market makers, within symbol and volume caps, until the relief expires five years after publication. The wider federal picture is covered in this overview of US crypto regulation.

Canada is the cautionary tale. Crypto trading platforms could once operate under time-limited restricted dealer registration, generally for two years, while working toward investment dealer registration and membership of the Canadian Investment Regulatory Organization (CIRO). In August 2024, the Canadian Securities Administrators ended that interim approach for new platforms, so newcomers now take the full route from the start.

From Sandbox to Full License: Planning the Exit

Every example above points to one practical rule: a sandbox is worth entering only with a mapped route out. The path usually runs through five stages.

1. Engage the regulator’s innovation team early to confirm whether the product needs a license and which programme fits.
2. Agree a test plan with customer caps, safeguards, reporting duties and an exit plan.
3. Run the live test and record data on the risks the regulator cares about.
4. File the full license application, using the test evidence in the business plan and risk assessments.
5. Exit by lifting restrictions or obtaining the license, or wind down and return customer assets.

Build the License File While You Test

Test evidence helps only when it lands in a complete application. Governance, capital planning, AML frameworks and management CVs take months to prepare, and this MiCA license checklist of documents shows how much of that work runs independently of any test. Gaps in those files remain a leading reason crypto license applications get rejected, and capital needs early attention, because a sandbox may relax prudential rules that the full license will enforce.

Choosing the Right Route

The decision usually turns on four questions.

Buy bitcoin and stocks. Signup to Coinbase today

• Does a license already exist for the activity? If the product fits an existing license, applying directly is usually faster, and in the EU crypto-asset services always require CASP authorisation or an Article 60 notification.
• Are the rules unclear for this product? Novel models, such as tokenised settlement, gain the most from a sandbox or innovation hub.
• How fast must the business scale? Test caps can hold growth back for 12 to 24 months.
• Where are the customers? A multi-country client base points to a passportable license, while a single-market pilot suits a sandbox.

Before choosing, it helps to see how the market is positioned. A global VASP database tracking more than 30,000 registered crypto companies across 30+ jurisdictions shows who holds which license, and this crypto license map shows where a full regime already exists.

Final Thoughts

A regulatory sandbox buys supervised room to prove a new model within limits on customers, volume, geography and time, while a full crypto license buys the right to scale at the price of capital, governance and permanent supervision. With MiCA leaving no sandbox shortcut, the UK gateway opening on 30 September 2026 and Hong Kong licensing two of 36 stablecoin applicants, the firms best placed for 2027 will treat any test as the first chapter of a license application. New authorisations are tracked each month in the crypto licensing register.