Sandboxes are judged by their press releases going in and rarely by what comes out. A look at the Gulf’s track record: real graduates, real rule changes — and the limbo problem nobody advertises.
Every Gulf financial regulator now runs a sandbox, and every sandbox cohort gets a press release. Almost nobody follows up on the only question that matters: what came out the other side? Judged by outputs — licensed companies, rule changes, products in market — the record is real but narrower than the announcements suggest, and the gap is instructive for anyone planning to build through one.
Our short answer: Gulf sandboxes have genuinely produced three things — licensed graduates, evidence that reshaped rulebooks, and credibility that travels across borders. They have also produced limbo, and founders should plan for both.
What a sandbox is for
A regulatory sandbox lets a firm test a product with real customers under relaxed or bespoke conditions, supervised, time-boxed, with defined exit criteria. The regulator's side of the bargain is learning: sandbox cohorts are how a supervisor discovers what rules a new model actually needs before writing them. It is a policy instrument first and a startup programme second — misunderstanding that ordering is the root of most sandbox disappointment.
The receipts
The clearest documented insurance outcome in the region belongs to Bahrain. In November 2020, Tasweya — a motor claims exchange platform built by Braxtone — became the first insurance platform to graduate from the Central Bank of Bahrain's regulatory sandbox, moving from supervised testing to live operation in a market with hundreds of thousands of motor policies. One graduate is a modest tally for a programme that has run since 2017, but it is a complete, verifiable loop: admission, test, graduation, market.
Saudi Arabia's sandbox — run by the Saudi Central Bank under a published framework — has operated differently: less as an incubator, more as the controlled front door to the Kingdom's fintech licensing pipeline. SAMA has admitted firms in successive batches under its framework, and sandbox cohorts preceded the formal frameworks that now govern areas like open banking. The pattern to note: in Saudi Arabia, the sandbox has functioned as the place where rules get drafted against live evidence, with permanent licensing regimes following behind it.
On the insurance side specifically, Saudi supervision has since moved to a dedicated regulator — the Insurance Authority — and the direction of travel is the same one the sandbox era established: structured, supervised paths from testing to authorisation, rather than either blanket prohibition or unsupervised innovation.
The limbo problem
The honest criticism of sandboxes everywhere, the Gulf included, is what happens between admission and graduation. Testing windows stretch. Exit criteria shift as the regulator's own thinking evolves — which is the sandbox doing its policy job, but at the tenant's expense. A firm can spend its runway compliant, supervised and unable to scale. And a sandbox permit is routinely mistaken — by customers, partners, sometimes investors — for a licence, which it is not.
- Plan for the test period to be the slowest phase of your company's life, not the fastest.
- Know your exit criteria in writing before you enter, and track them like a burn rate.
- Do not build your commercial pipeline on sandbox-stage capacity; build it on what you are licensed for.
Why we still think they worked
Count what exists now that did not before the sandbox era: dedicated digital-insurance rules in several Gulf jurisdictions, open banking frameworks written against tested evidence, a generation of founders who learned to work with supervisors instead of around them, and regulators whose default answer to a new model is "show us" rather than "no." That last change is the big one, and it is easy to take for granted because it happened gradually.
It also set the template commercially. The test-first logic — prove the integration in a safe environment, then flip to production under supervision — is now how the whole regulated stack works, including ours: Yasmina partners build in a sandbox first, and production access follows approval in about a day. The regulatory sandbox normalised that rhythm for an entire region's financial infrastructure.
The sources for the specific claims above — SAMA's framework and permit announcements, and Bahrain's first insurance graduation — are linked below. Cohort-by-cohort outcome data is not published consistently by any Gulf regulator, which is itself the improvement we would most like to see: sandboxes that report their graduation rates would be easier to praise precisely.