- The short — who should apply and when
- Where the sandbox stands (on-tap + cadence)
- Live status summary (as of today)
- Entry → Exit gates (acceptance criteria)
- Sponsor-bank models & SLAs
- Compliance & audit checklist
- FAQ (timelines, data, customer protection)
The short
- Status: Theme-neutral, on-tap window is open (since Apr 2025). Expect 6–9 months end-to-end for most pilots.
- Fit: Tests needing real customers under tight guardrails—UPI offline edges, underwriting with capped limits, RegTech controls.
- Tripwires: Auto-pause if complaints > 0.3% of sample or NCL > guardrail; deletion proof mandatory at exit.
- Bank capacity: Sponsor SLAs (onboarding/day caps, dispute TAT) are the bottleneck—lock these before Gate-2.
- Production: Graduation permits only the tested scope; any expansion is a new approval conversation.
Where the sandbox stands (structure & cadence)
| Layer | What it covers | What RBI expects | Common failure |
|---|---|---|---|
| Screening | Eligibility, novelty, consumer benefit | Problem clarity; measurable benefit; risk controls | Generic claims; weak harm mitigation |
| Test design | Cohort size, KPIs, stop-loss | KPI math (default %, TAT); rollback defined | Vague KPIs; no rollback |
| Execution | Live customers under caps | Consent, dispute TAT, real-time logs | Shadow ops; sponsor delays |
| Evaluation | Outcome vs plan; audit | Complete logs; deletion certificate | Partial logs/deletion |
| Graduation | Scope + safeguards | Bounded scope; supervision notes | Assuming licence equivalence |
Live status summary (today)
| Pillar | Current state | Why it matters | What to do this week |
|---|---|---|---|
| Window | On-tap, theme-neutral window open | Apply when sponsor capacity is real | Secure LOI with hard SLA dates |
| Recent cohorts | Prior Cohort-5 entities remain reference points | Set KPI baselines realistically | Harvest benchmarks for your plan |
| Docs | Retail loan reset FAQ updated Oct 1 guides comms style | Borrowed for sandbox comms T&Cs | Mirror format in your comms pack |
Entry → Exit gates (acceptance criteria)
| Gate | To pass | Tripwire (auto-pause) | Docs |
|---|---|---|---|
| Entrance | Eligibility + sponsor LOI + MVD spec | Missing consent or harm plan | Concept note; risk register |
| Go-live | Signed SLAs; customer comms | Dispute TAT undefined | Comms pack; SOPs; TAT matrix |
| Mid-test | KPIs within band; logs complete | Complaints > 0.3% or NCL > guardrail | KPI pack; incident log |
| Exit | KPIs achieved; deletions certified | Deletion failure; scope creep | Audit report; deletion certificate |
| Graduation | Defined production scope + safeguards | Open audit items | Closure note; conditions register |
Sponsor-bank models & SLAs
Models
- Embedded sponsor: Bank runs rails; fintech supplies UX/risk.
- Aggregator hub: Multi-bank integration with common SLA.
- Direct-bank pilot: One bank; shortest approvals; capacity-limited.
SLA guardrails
- Daily onboarding caps; dispute TAT; fraud ops staffing.
- Data-sharing contract: fields, purpose, retention, deletion, breach window.
- Change management: versioning; rollback; stakeholder notice.
Compliance & audit checklist
- MVD plan: Event schema, PII map, retention/deletion, encryption.
- Consent artifacts: Screenshots/timestamps; withdrawal path.
- Incident playbook: Thresholds, comms templates, regulator flow.
- Sandbox logs: Immutable run-logs; access audits; drift notes.
- Post-test deletion: Certificates from all (sub)processors.
FAQ
- Is on-tap indefinite? It’s open, but capacity and themes steer prioritisation.
- How big can a pilot be? Start small; expand only after KPI proof within risk caps.
- Does graduation equal blanket approval? No—only within tested scope and safeguards.