How to Test a Fintech Product in a Regulatory Sandbox Without Exposing Customer Data

You can usually test a fintech prototype without giving it identifiable customer records: define the behaviour you need to test, then use public, synthetic, anonymised or otherwise non-personal data that is fit for that purpose. In the UK, the FCA Digital Sandbox is aimed at early-stage development, while the FCA Regulatory Sandbox is for controlled tests with real consumers. A sandbox is not, by itself, permission to process personal data or conduct regulated activity.

Start with the test question, not the data

Write down the uncertainty the test is meant to resolve before selecting a dataset. Be specific about the feature, model or customer journey; the transactions or user group that matter; and the result that would count as success. For example, a test might ask whether a transaction-monitoring workflow flags a defined pattern quickly enough, rather than whether it performs well on a particular customer file.

#	Preview	Product	Price
1		Thetis FIDO2 Security Key (USB-A, 2-Pack) - Hardware MFA & Passkey Access for Business, School ERP &...	$39.99	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

Then identify what the test actually needs to observe. A prototype that checks screen flow may need only representative account states and transaction patterns. A model-performance test may need realistic distributions and edge cases. A live test may be necessary only if the question depends on real consumer behaviour or interactions with live systems. Do not upload real records merely because they are available.

Choose the right UK sandbox route

The FCA’s two sandboxes serve different stages. Its Digital Sandbox is an online, secure development environment for early-stage propositions; its Regulatory Sandbox supports controlled testing in the market with real consumers. The ICO’s Regulatory Sandbox may also be relevant when an innovative service uses personal data and the organisation needs data-protection support.

#1 Best Overall

Thetis FIDO2 Security Key (USB-A, 2-Pack) - Hardware MFA & Passkey Access for Business, School ERP & Employee Accounts | Compatible with Windows, Google Workspace, Apple ID, Coinbase, Salesforce

• FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
• Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
• Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
• Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
• Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.

$39.99

Buy on Amazon

The FCA lists five eligibility criteria for its Regulatory Sandbox: the proposition must be in scope, genuinely innovative, offer consumer benefit, be ready for testing, and need the FCA’s support. Its readiness considerations include a well-developed plan, clear objectives and success criteria, adequate resources, safeguards and redress. The FCA also states that “The Sandbox isn’t just for start-ups that may need to be authorised in the future.”

Use the least sensitive data that can answer the question

Work through data options from least to most sensitive. Public data may be enough for broad market or workflow checks. Synthetic data can help create controlled scenarios, including rare or unusual cases, but its usefulness depends on how it was generated and what the test needs to measure. Anonymised records may support some forms of analysis if people can no longer be identified. Pseudonymised records still relate to identifiable people when they can be linked back using separately held information; do not describe them as anonymous.

• Match data to purpose: use only the fields, granularity and history needed for the test. Remove or generalise fields that do not affect the result.
• Check the environment: confirm where data will be stored, who can access it, how access is logged, and whether it can be exported or copied into other systems.
• Set retention rules: decide in advance what is retained, for how long, and how working copies and outputs are deleted or archived.
• Keep development separate: do not let a prototype or sandbox dataset flow into production or an unrelated test without a documented reason and appropriate review.

The FCA’s Digital Sandbox page reports a marketplace of 300+ datasets and 1,000+ API endpoints; those counts and categories are specific to that page as updated 5 August 2026 and may change. They are not a claim that every dataset is synthetic or suitable for every test.

Validate synthetic data instead of assuming it is safe or representative

Synthetic data is a technique, not a privacy guarantee. It may retain patterns that create disclosure risks, fail to preserve behaviours that matter, or reproduce bias in the source data or generation process. Test the dataset against the particular task before relying on it.

1. Check utility: compare relevant distributions, relationships, edge cases and model outcomes with an appropriate benchmark, without exposing more source data than necessary.
2. Check disclosure risk: assess whether records or rare combinations could reveal information about people in the source data, especially if the dataset will be shared beyond the original team.
3. Check bias and coverage: examine whether important customer groups or uncommon but consequential cases are missing or distorted.
4. Record limits: document how the data was generated, what validation was performed, what it can support, and what conclusions it cannot support.

The FCA’s 8 March 2024 report on synthetic data covers data augmentation and bias mitigation, testing and model validation, and data sharing for fraud controls. The FCA describes synthetic data as “one of many privacy enhancing technologies that can expand and support data sharing.” Its 19 August 2025 report discusses governance for generating and using synthetic data in financial-services models, but the FCA expressly says that report is not guidance. Neither report is an assurance that a particular dataset is private, representative or suitable.

If personal data or real consumers are necessary

First document why the test question cannot be answered effectively using non-personal data or a non-live environment. Then have the responsible privacy and regulatory teams establish the applicable legal basis, the parties’ roles, the relevant permissions and the safeguards required in the jurisdiction where the test will run. A sandbox application or acceptance should not be treated as a substitute for that assessment.

• Limit the test: define the cohort, duration, data fields, access permissions and permitted uses before the test starts.
• Protect participants: explain relevant risks and support routes, monitor outcomes, and set clear escalation and stop criteria.
• Plan redress: decide how affected consumers can raise problems and how harms or errors will be corrected.
• Prepare for incidents: assign responsibility for detecting, escalating and responding to data or consumer-safety incidents.
• Confirm regulatory status: establish whether authorisation, registration, an exemption or another permission is required for the activity and test scope.

For projects within scope of the EU AI Act, the cited consolidated text contains a narrow conditional provision concerning personal data in an AI regulatory sandbox. It applies only where its statutory conditions are met, including that requirements cannot effectively be fulfilled using anonymised, synthetic or other non-personal data. It is not a general permission for fintech testing, does not apply to every jurisdiction or project, and should be assessed alongside applicable data-protection law.

Keep an auditable plan from setup through closeout

For a sandbox test, keep one version-controlled plan that connects the test question to the data, controls and decision to proceed. The FCA’s Regulatory Sandbox materials emphasise clear objectives, parameters, success criteria, resources, consumer safeguards and redress. A practical plan should also record:

• the proposition, test scope, cohort and exclusions;
• data sources, classification, transformations and why each is needed;
• who can access data and systems, with access controls and logging;
• success measures, monitoring, escalation thresholds and stop conditions;
• consumer communications, support, complaint handling and redress;
• retention, deletion, incident handling and final reporting responsibilities.

For an FCA Regulatory Sandbox test, the FCA says testing normally lasts around six months under agreed plans and safeguards, followed by a final report. Treat that as the FCA’s stated normal duration, not a guaranteed timetable for every test.

Practical decision rule

If the question is about whether a prototype or model can perform a defined task, start with suitable synthetic, public or anonymised data in a development environment. If the answer depends on real consumer behaviour, consider a controlled live test only after its necessity, permissions, safeguards and redress are documented. If the test involves personal data, seek current, jurisdiction-specific advice from the relevant regulator or qualified counsel rather than treating sandbox participation as a privacy or regulatory exemption.

Quick Recap

Bestseller No. 1

Thetis FIDO2 Security Key (USB-A, 2-Pack) - Hardware MFA & Passkey Access for Business, School ERP & Employee Accounts | Compatible with Windows, Google Workspace, Apple ID, Coinbase, Salesforce

$39.99

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.