American University Washington College of Law

Washington College of Law Research Paper No. 2019-18

SANDBOX BOUNDARIES

Hilary L. Allen

This paper can be downloaded without charge from

The Social Science Research Network Electronic Paper Collection

Electroniccopy
Electronic copyavailable
available at:
at: https://ssrn.com/abstract=3409847
https://ssrn.com/abstract=3409847
 Sandbox Boundaries

Hilary J. Allen*

ABSTRACT

Around the world, subnational and national regulatory

sandboxes are being adopted in an effort to promote fintech innovation.
These regulatory sandboxes seek to do so by rolling back some of the
consumer protection and prudential regulations that would otherwise
apply to firms trialing their financial products and services in the
sandbox. While sacrificing such protections in order to promote
innovation is problematic, such sacrifice may nonetheless be justifiable
if, by working with innovators in the sandbox, regulators are educated
about new technologies in a way that enhances their ability to effectively
promote consumer protection and financial stability in other contexts.
However, the market for fintech products and services transcends
national and subnational borders, and this Article predicts that as
competition among countries for fintech business intensifies, the
phenomena of regulatory arbitrage and race to the bottom are likely to
drive the regulatory sandbox model toward further deregulation and
disincentivize vital information sharing among financial regulators
about new technologies. After examining the regulatory sandboxes
adopted by Arizona and the Consumer Financial Protection Bureau, as
well as the proposals for transnational cooperation in the form of the
Global Financial Innovation Network, this Article suggests that there is
reason to be pessimistic about regulatory sandboxes in general and about
information sharing across sandbox boundaries in particular.

TABLE OF CONTENTS

I. INTRODUCTION ............................................................................ 300

II. WHAT ARE REGULATORY SANDBOXES AND WHO HAS ADOPTED
THEM? .......................................................................................... 302
III. THE COMPETING REGULATORY GOALS IMPLICATED BY
SANDBOXES .................................................................................. 305

* Associate Professor, American University Washington College of Law. The

information in this Article is current as of October 2019.

299

Electronic copy available at: https://ssrn.com/abstract=3409847

300 VAND. J. ENT. & TECH. L. [Vol. 22:2:299

IV. REGULATORY ARBITRAGE AND RACE TO THE BOTTOM ............... 309

A. Theory and History ................................................................. 309
B. The Basic Theory as Applied to Regulatory Sandboxes........ 312
C. Toward a More Nuanced Understanding of Regulatory
Sandboxes ............................................................................. 314
1. Nonlegal Constraints on Regulatory Arbitrage ............. 314
2. Second-Order Effects of International Coordination .... 315
3. Incentives for Information Sharing ................................ 317
V. CONCLUSION ................................................................................ 321

I. INTRODUCTION

The concept of using a “regulatory sandbox” to promote fintech

innovation was pioneered by the United Kingdom’s Financial Conduct
Authority (FCA) in 2016.1 The FCA uses its sandbox to provide limited
relief from financial regulation and enforcement, with the intention of
reducing regulatory barriers to entry for fintech entrepreneurs who
wish to test their innovations with real customers.2 Since 2016, several
other countries around the world have adopted regulatory sandboxes
for fintech, although what is meant by “regulatory sandbox” varies by
jurisdiction.3 The term “fintech” itself also suffers from a lack of
definitional consensus; it is perhaps best thought of as an umbrella
term encompassing the latest wave of internet-enabled (and often
data-driven) innovations, including cryptoassets and distributed ledger
technologies, crowdfunding, mobile payments, marketplace lending,
and robo-advisory services.4 In addition to these consumer-facing
products and services, some commentators take the view that the term
“fintech” also encompasses big data, artificial intelligence,
high-frequency trading, and blockchain-based applications that are
developed by financial institutions (or their vendors) for use in-house.5
The market for fintech products and services does not respect
national borders, with many of these fintech innovations “being
developed and deployed simultaneously in different financial
markets.”6 To date, however, regulatory sandboxes have only been

1. Hilary J. Allen, Regulatory Sandboxes, 87 GEO. WASH. L. REV. 579, 596 (2019).
2. Regulatory Sandbox, FIN. CONDUCT AUTHORITY, https://www.fca.org.uk/firms/regula-
tory-sandbox [https://perma.cc/8GJC-LUPC] (last updated Oct. 23, 2019).
3. Allen, supra note 1, at 592.
4. Id. at 585–86.
5. Id.
6. GLOB. FIN. INNOVATION NETWORK (GFIN), CONSULTATION DOCUMENT 3 (2018),
https://files.consumerfinance.gov/f/documents/bcfp_global-financial-innovation-network_consul-
tation-document.pdf [https://perma.cc/K768-VK5V] [hereinafter CONSULTATION DOCUMENT]. In
particular, the technologies of “AI, distributed ledger technology, data protection, regulation of

Electronic copy available at: https://ssrn.com/abstract=3409847

2020] SANDBOX BOUNDARIES 301

created at national—sometimes even subnational—levels of

government. From a practical perspective, this often creates a
mismatch between the regulatory regimes for fintech innovation and
the markets that the innovators wish to serve. As a response to this
mismatch, the FCA has spearheaded the formation of a “Global
Financial Innovation Network” (GFIN) of financial regulators.7 While
the FCA had originally envisaged that the GFIN would coordinate a
global regulatory sandbox that would facilitate multilateral trials of
fintech innovations, it has since walked back that ambition in face of
practical challenges.8 Instead, the GFIN is currently focused on
coordinating regulators overseeing simultaneous trials in different
jurisdictions.9
The GFIN is used as a case study in this Article, as are the
sandboxes recently adopted by the state of Arizona and the Consumer
Financial Protection Bureau (CFPB). These case studies afford an
opportunity to reexamine the literature on regulatory arbitrage and
race to the bottom in the context of a borderless financial services
market being transformed by fintech innovations. This Article
demonstrates that a nuanced view of these phenomena, one that
embraces the complexities of the incentives of public and private actors,
is necessary to explain the evolution of sandboxes to date and to make
any predictions about how they are likely to develop in the future.
This Author has previously argued that the key benefit of the
regulatory sandbox model is its ability to educate regulators on new
technologies; this is the best justification that can be offered for a
regulatory model that otherwise undoes prudential regulations
and consumer protection rules in the name of promoting innovation
and competition.10 This Article therefore explores how the
information-generating characteristics of the regulatory sandbox
interplay with our understanding of regulatory arbitrage and race to
the bottom. Unfortunately, this Article concludes that regulators have
strong incentives to cloister information within individual regulatory
sandboxes, rather than share it across sandbox boundaries to improve
regulatory practices everywhere.
This Article proceeds as follows: Part II provides some
background on the current state of regulatory sandboxes around the

securities and Initial Coin Offerings (ICOs), know your customer (KYC) or anti-money laundering
(AML), and green finance” are being developed on a global scale. Id. at 4.
7. Id. at 3.
8. Gina Conheady, Is Fintech Ready for a Global Regulatory Sandbox?, A&L GOODBODY
(Nov. 27, 2018), https://www.algoodbody.com/insights-publications/is-fintech-ready-for-a-global-
regulatory-sandbox [https://perma.cc/ZHL3-CAQC].
9. CONSULTATION DOCUMENT, supra note 6, at 6.
10. Allen, supra note 1, at 581.

Electronic copy available at: https://ssrn.com/abstract=3409847

302 VAND. J. ENT. & TECH. L. [Vol. 22:2:299

world by explaining what they are and where they have been adopted.
Part III considers regulatory sandboxes in a more theoretical light by
exploring the competing regulatory goals implicated by the sandbox
model. Part IV provides a brief introduction to the literature on
regulatory arbitrage and race to the bottom, before using the GFIN and
the Arizona and CFPB regulatory sandboxes as case studies that
demonstrate the need for a nuanced understanding of these
phenomena. In so doing, Part IV provides reasons to be pessimistic
about the evolution of regulatory sandboxes, both because of their
potential to undo protections for consumers and the financial system
more broadly and because of the incentives that exist to stymie the flow
of information about innovation among regulators. Part V concludes.

II. WHAT ARE REGULATORY SANDBOXES AND WHO HAS ADOPTED

THEM?

Because the financial industry is highly regulated, technology

entrepreneurs seeking to enter the market for financial services often
face significant regulatory barriers to entry.11 Even for established
financial institutions, determining how regulation will apply to a new
financial product can be a daunting and expensive exercise.12
Responding to regulation’s potential to hinder innovation by both
start-ups and regulated entities, several jurisdictions around the world
have adopted “regulatory sandboxes” designed to allow innovators to
conduct a limited test of fintech products and services in a lenient
regulatory environment.13 The United Kingdom’s FCA was the first to
implement a fintech regulatory sandbox. Since its inception in 2016, a
number of other jurisdictions (including Australia, Bahrain, Brunei,
Canada, Hong Kong, Indonesia, Malaysia, Mauritius, the Netherlands,
Singapore, Switzerland, Thailand, and the United Arab Emirates) have
followed the FCA’s lead.14
It is important to note that there has been significant variation
in the forms of the regulatory sandboxes that have been adopted, with
the result that the term “regulatory sandbox” often means different
things in different jurisdictions.15 There has also been significant
variation in the stated objectives of the sandboxes that have been
implemented around the world, with one survey listing the following
alternatives: “[s]upport financial innovation and FinTech firms who are

11. Id. at 589.

12. Id. at 588.
13. Id. at 592.
14. Dirk A. Zetzsche et al., Regulating a Revolution: From Regulatory Sandboxes to Smart
Regulation, 23 FORDHAM J. CORP. & FIN. L. 31, 64 (2017).
15. See Allen, supra note 1, at 592.

Electronic copy available at: https://ssrn.com/abstract=3409847

2020] SANDBOX BOUNDARIES 303

seeking to offer innovative new products, services, or business models”;

“[f]oster a financial services system that is more efficient and manages
risks more effectively”; “[u]nderstand how emerging technologies and
business models interact with the regulatory framework and where it
may lead to barriers to entry”; “[p]romote effective competition in the
interest of consumers”; and “[p]romote financial inclusion for
consumers.”16
Finally, there is also significant variation in the practical
implementation of regulatory sandboxes around the world. Some
jurisdictions allow a broad range of financial products and services to
be tested in sandboxes, whereas others, such as Australia and Hong
Kong, are much more restrictive.17 Most jurisdictions place limitations
on the duration of testing—typically, from six months to two
years18—but a few outliers do not specify any limit on the duration of
the sandbox trial.19 The United Kingdom’s regulatory sandbox was
structured to promote iterative dialogue between innovators and
regulators, but other jurisdictions—notably Australia—have done less
to promote this type of interaction in their regulatory sandboxes.20
In the United States, Congress has not yet taken any action to
implement a regulatory sandbox at the federal level. While some states
have adopted or are contemplating adopting regulatory sandboxes,21
these can only allow for access to consumers residing in their state. The
CFPB has attempted to implement a national regulatory sandbox by
way of executive action, but the legality of that effort is uncertain: in

16. CONSULTATION DOCUMENT, supra note 6, at 17.

17. See Allen, supra note 1, at 599 (discussing the limitations on the Australian
sandbox); Fintech Supervisory Sandbox (FSS), H. K. MONETARY AUTHORITY,
https://www.hkma.gov.hk/eng/key-functions/international-financial-centre/fintech-supervisory-
sandbox.shtmlshtmlshtml [https://perma.cc/8PXL-9AZN] (last modified Sept. 24, 2019) (stating
Hong Kong’s sandbox is only available to licensed banks and technology firms that partner with
licensed banks).
18. CONSULTATION DOCUMENT, supra note 6, at 18.
19. See BAKER MCKENZIE, A GUIDE TO REGULATORY FINTECH SANDBOXES ACROSS ASIA
PACIFIC 5, 7 (2017), https://www.bakermckenzie.com/-/media/files/insight/publica-
tions/2018/01/qrg_ap_regulatoryfintech_jan18.pdf?la=en [https://perma.cc/S46M-DK27] (noting
jurisdictions without specific limits include Hong Kong and Singapore).
20. Allen, supra note 1, at 598. Because there is no need for eligible start-ups to apply to
the Australian Securities & Investments Commission for sandbox relief besides a
notification requirement, this sandbox does not foster the same level of interaction as the FCA’s
sandbox. Id.
21. See Press Release, Mark Brnovich, Ariz. Attorney Gen., Arizona Becomes First State
in U.S. to Offer Fintech Regulatory Sandbox (Mar. 22, 2018),
https://www.azag.gov/press-release/arizona-becomes-first-state-us-offer-fintech-regulatory-sand-
box [https://perma.cc/VEQ5-PGX8] (noting Arizona became the first US state
to formally adopt a regulatory sandbox in March 2018); Bill Status of
SB3133, ILL. GEN. ASSEMBLY, http://www.ilga.gov/legislation/BillStatus.asp?Doc-
Num=3133&GAID=14&DocTypeID=SB&LegID=110721&SessionID=91&SpecSess=&Session=&
GA=100#top [https://perma.cc/HR35-2S4F] (last visited Oct. 14, 2019) (noting a regulatory
sandbox bill in Illinois is still pending).

Electronic copy available at: https://ssrn.com/abstract=3409847

304 VAND. J. ENT. & TECH. L. [Vol. 22:2:299

December 2018, it issued a “Policy on No-Action Letters and the BCFP

Product Sandbox.”22 The policy purports to provide two years of relief to
qualifying applicants “from enforcement actions by any Federal or State
Authorities, as well as from lawsuits brought by private parties.”23
However, this attempt to preempt state law has been criticized as
overreaching by twenty-two state attorneys general, who have argued
that the CFBP “cannot give applicants such a blanket safe harbor
protecting them from enforcement actions by state and federal
authorities.”24 The Conference of State Bank Supervisors has also
issued a letter stating that “[s]tate regulators believe the extent of this
relief exceeds the authority of the Bureau under Title X of the
Dodd-Frank Act. . . . [T]he Bureau is not authorized to prevent state
officials from enforcing federal consumer financial laws.”25
It is therefore uncertain whether any federal regulatory sandbox
is available in the United States. There is also significant uncertainty
about how to approach fintech at the transnational level. While
international financial regulatory bodies like the International
Organization of Securities Commissions (IOSCO) and the Financial
Security Board (FSB) have highlighted issues relating to fintech
business models, they have not yet proposed any concrete solutions or
standards. Instead, their activities could best be described as
monitoring and generating research reports.26 In January 2019,
however, the United Kingdom’s FCA helped found the GFIN, a
transnational regulatory body focused on providing more concrete
responses to the rise of fintech.27

22. Policy on No-Action Letters and the BCFP Product Sandbox, 83 Fed. Reg. 64036
(proposed Dec. 13, 2018) (to be codified at 12 C.F.R.); see Rory Van Loo, Making Innovation More
Competitive: The Case of Fintech, 65 UCLA L. REV. 232, 260–61 (2018) (explaining this policy was
designed as an update to the CFPB’s Project Catalyst, which permitted “innovative financial firms
[to] apply for ‘no-action letters.’” Project Catalyst did not allow the CFBP to provide relief from
enforcement from the states, or any other federal financial regulatory authority, and so its utility
was limited—only one firm sought a no-action letter from the CFPB in connection with Project
Catalyst).
23. Policy on No-Action Letters and the BCFP Product Sandbox, 83 Fed. Reg. at 64042.
24. Kate Berry, State AGs Assail CFPB Plan to Build Fintech Sandbox, AM. BANKER (Feb.
12, 2019, 4:14 PM), https://www.americanbanker.com/news/state-ags-assail-cfpb-plan-to-build-
fintech-sandbox [https://perma.cc/43DE-GT8U].
25. Conference of State Bank Supervisors, Comment Letter on Proposed Policy Guidance
and Procedural Rule on No-Action Letters and Product Sandbox (Feb. 11, 2019),
https://www.csbs.org/sites/default/files/2019-02/CSBS%20Letter--
CFPB%20NAL%20Policy%20Revisions%20and%20Product%20Sandbox_%20021119%20FINAL
%20NOSIG.pdf [https://perma.cc/F2RE-8GWL].
26. See, e.g., FIN. STABILITY BD., FINANCIAL STABILITY IMPLICATIONS FROM FINTECH:
SUPERVISORY AND REGULATORY ISSUES THAT MERIT AUTHORITIES’ ATTENTION (2017),
http://www.fsb.org/wp-content/uploads/R270617.pdf [https://perma.cc/9VGK-NCRQ]; INT’L ORG.
OF SEC. COMM’NS, IOSCO RESEARCH REPORT ON FINANCIAL TECHNOLOGIES (FINTECH) (2017),
https://www.iosco.org/library/pubdocs/pdf/IOSCOPD554.pdf [https://perma.cc/SFX6-Z4MB].
27. Conheady, supra note 8.

Electronic copy available at: https://ssrn.com/abstract=3409847

2020] SANDBOX BOUNDARIES 305

The GFIN’s primary functions are:

1. [T]o act as a collaborative group of regulators to cooperate and share experience
of innovation in respective markets, including emerging technologies and business
models, and to provide accessible regulatory contact information for firms;
2. [T]o provide a forum for joint RegTech work and collaborative knowledge
sharing/lessons learned; and
3. [T]o provide firms with an environment in which to trial cross-border solutions.28

The GFIN’s ambition to be a network and discussion forum for

national regulatory bodies is not particularly novel,29 but its ambition
to facilitate cross-border trials for new technologies is. While the FCA
had initially envisaged “a full multilateral sandbox that allows
concurrent testing and launch across multiple jurisdictions,” the level
of regulatory coordination necessary for a project has been conceded as
too ambitious for now.30 However, even bilateral coordination on
sandbox trials is likely to prove an interesting experiment.
Notwithstanding that the GFIN has stated that it does not desire to be
“active in . . . assessing and articulating international standards, and
best practices,”31 the cooperation of its members on cross-border
sandbox testing will undoubtedly be treated as a resource in developing
best practices for sandbox development.

III. THE COMPETING REGULATORY GOALS IMPLICATED BY SANDBOXES

The implementation of regulatory sandboxes at the state,

national, and possibly international level revives old questions about
regulatory arbitrage and races to the bottom. It requires us to reckon
with how our theoretical understanding of such concepts applies in the
context of a post–Financial Crisis world animated by new fintech
technologies. To provide further background for such a discussion in
Part IV, this Part considers the goals that drive financial regulatory
policies and see how they may conflict as jurisdictions consider how to
address fintech generally, and more specifically, whether to adopt
regulatory sandboxes.

28. GLOB. FIN. INNOVATION NETWORK, TERMS OF REFERENCE FOR MEMBERSHIP

AND GOVERNANCE OF THE GLOBAL FINANCIAL INNOVATION NETWORK (GFIN) 1 (2019),
https://www.fca.org.uk/publication/mou/gfin-terms-of-reference.pdf [https://perma.cc/WB4G-
8N6E].
29. Existing international financial regulatory bodies like the FSB and IOSCO already
fulfill similar functions. For a discussion of the architecture of international financial law, see
CHRIS BRUMMER, SOFT LAW AND THE GLOBAL FINANCIAL SYSTEM: RULE MAKING IN THE 21ST
CENTURY 62–118 (2d ed. 2015).
30. Conheady, supra note 8.
31. CONSULTATION DOCUMENT, supra note 6, at 7.

Electronic copy available at: https://ssrn.com/abstract=3409847

306 VAND. J. ENT. & TECH. L. [Vol. 22:2:299

The primary goals of financial regulation are the protection of

consumers and investors, the promotion of financial stability, market
efficiency and competition, and the prevention of financial crime.32
Regulatory policy can sometimes promote all of these goals, but often
the goals will conflict, and in some contexts it will be necessary to
prioritize some goals over others.33 Policy makers that adopt regulatory
sandboxes typically do so in order to further the goals of efficiency and
competition,34 often at the expense of consumer and investor protection
and, potentially, even financial stability. These policy makers hope that
sandboxes will incentivize innovation that enables cheaper and more
efficient delivery of financial services35 and that sandboxes will also
promote the competitiveness of a jurisdiction by enabling it to attract
innovative businesses who will provide tax revenue and employment
opportunities.36 Many jurisdictions’ sandboxes do have the additional
goal of promoting consumer welfare, particularly by broadening access
to and reducing the cost of financial services.37 Some even have the
stated goal of improving risk management,38 which may ultimately be
beneficial from a financial stability perspective. However, the
regulatory barriers to entry that regulatory sandboxes seek to remove
are typically regulations that protect consumers, investors, or the
stability of the financial system, and the primary purpose of this
deregulation seems to be the promotion of efficiency and competition.39
Except in the immediate aftermath of a crisis, there tends not to
be any constituency agitating for improved consumer protection and
financial stability regulation—at least, not an organized constituency
that can match the intensity of the interests seeking to roll back such
regulation.40 To the extent that regulators agree to roll back consumer
protection and financial stability regulations for firms conducting
sandbox trials, regulatory sandboxes can be viewed as a type of
deregulation that can harm an unrepresented public. While it
might be theoretically possible for these regulators to replace
consumer protection and financial stability rules with alternative
arrangements—such as principles-based regulatory regimes which are

32. JOHN ARMOUR ET AL., PRINCIPLES OF FINANCIAL REGULATION 61–69 (2016).

33. Hilary J. Allen, The SEC as Financial Stability Regulator, 43 J. CORP. L. 715, 730
(2018).
34. CONSULTATION DOCUMENT, supra note 6, at 17.
35. FIN. CONDUCT AUTH., REGULATORY SANDBOX LESSONS LEARNED REPORT ¶ 3.7 (2017),
https://www.fca.org.uk/publication/research-and-data/regulatory-sandbox-lessons-learned-re-
port.pdf [https://perma.cc/8ZFQ-UHYT].
36. Zetzsche et al., supra note 14, at 81.
37. CONSULTATION DOCUMENT, supra note 6, at 17.
38. See id.
39. Zetzsche et al., supra note 14, at 80–81.
40. John C. Coffee, Jr., The Political Economy of Dodd-Frank: Why Financial Reform
Tends to Be Frustrated and Systemic Risk Perpetuated, 97 CORNELL L. REV. 1019, 1021 (2012).

Electronic copy available at: https://ssrn.com/abstract=3409847

2020] SANDBOX BOUNDARIES 307

less burdensome on innovators but equally effective in protecting

consumers and financial stability41—such regimes can easily devolve
into deregulation if they are not properly staffed and resourced.42 Such
a deregulatory outcome is particularly likely if the subject matter of the
regime is highly complex and thus defies regulatory understanding and
incentivizes deference to the regulated industry43—a real concern when
dealing with complicated financial algorithms and other fintech
innovations.44
Sandboxes therefore have very real deregulatory potential—but
they can also afford some benefits to financial regulators seeking to
promote consumer protection and financial stability. All such
regulators share the need to understand the technology that is used to
provide financial services, and this Author has argued that the most
beneficial aspect of a regulatory sandbox is that it provides a partial
solution to the informational challenges that financial regulators face
when dealing with new technologies.45 This Author has therefore
argued that if a jurisdiction adopts a sandbox, it should be carefully
designed to maximize information production and sharing, as well as to
minimize harms to consumers and the financial system.46
Given that fintech sandboxes have only been around since 2016
(and therefore have not yet been tested during an economic downturn),
it is difficult to make concrete judgments about the extent to which the
regulatory sandboxes that have been adopted, and the fintech
innovations they promote, are in fact sacrificing consumer or investor
protection or financial stability. For example, we do not yet fully
comprehend the scope of the discrimination and privacy violations that

41. See Douglas W. Arner et al., The Evolution of FinTech: A New Post-Crisis Paradigm?,
47 GEO. J. INT’L L. 1271, 1311–12 (2016). In a principles-based regulatory regime, “more focus is
given to the spirit of a regulation rather than solely following the rules and procedures by the
letter,” affording more flexibility to industry participants in how they satisfy regulatory goals. See
id.
42. See Allen, supra note 1, at 602. For a discussion of the deregulatory impact of the
principles-based regime adopted by the Financial Services Authority (the FCA’s predecessor), see
id.
43. See Cristie Ford, New Governance in the Teeth of Human Frailty: Lessons
from Financial Regulation, 2010 WIS. L. REV. 441, 479 (2010) (“Without countervailing,
independent-minded regulatory power to push back against self-interested industry conduct, the
“creep” may run downwards—to more risk, less transparency, less systemic stability, and less
consumer protection.”).
44. See Allen, supra note 1, at 615. (“[I]f regulators come to rely on the providers of
complex financial products and services for explanations about how they work, the result may be
that regulation ultimately comes to reflect the worldview of the financial industry, rather than the
objectives of society as a whole (this phenomenon is often referred to as ‘cognitive capture’).”).
45. See Hilary J. Allen, A New Philosophy for Financial Stability Regulation, 45 LOY. U.
CHI. L.J. 173, 209 (2013). For a discussion of the difficulties that regulators face in finding out
about the existence of new products and services, let alone understanding their complexities, see
id.
46. Allen, supra note 1, at 582.

Electronic copy available at: https://ssrn.com/abstract=3409847

308 VAND. J. ENT. & TECH. L. [Vol. 22:2:299

consumers may be subjected to by financial algorithms capable of

artificial intelligence.47 Nor do we fully comprehend the financial
stability implications of delegating financial risk management to such
algorithms.48 Regulators should therefore exercise caution before
rolling back regulatory protections through regulatory sandboxes. To do
otherwise would, as twenty-two state attorneys general stated in a
letter to the CFPB, “give companies employing [fintech technologies]
what may effectively be a permanent get-out-of-jail-free card.”49
Even the benefits of regulatory sandboxes are difficult to judge
at this stage: there are very limited empirical data from which to draw
any conclusions about the extent to which sandboxes are succeeding in
promoting efficiency and competition.50 In the absence of such data,
policy makers’ decisions about whether to adopt and how to implement
a regulatory sandbox are likely to be driven by value judgments about
which regulatory goals to prioritize and by political considerations. The
choice of regulatory goals is likely to be impacted by the mandates of
the financial regulators implementing the regulatory sandbox. For
example, the United Kingdom’s FCA, the progenitor of the fintech
regulatory sandbox concept, has a mandate to promote competition that
most US financial regulators lack.51 In general, mandates to promote
competition or efficiency are likely to render a regulator more
hospitable to the promotion of technological innovation, which may help
explain the FCA’s enthusiasm for the regulatory sandbox model.
However, this Author, along with other scholars, has previously argued
that because of the breadth of harm that financial crises can occasion,
financial stability regulation should be the apex concern of any
regulatory regime.52 Consumer protection should also be a priority,
given that, unlike the industry providing them with financial products
and services, vulnerable consumers are often unable to organize to
protect themselves.53 However, regulatory arbitrage and races to the
bottom associated with regulatory sandboxes may ultimately
undermine these important regulatory goals.

47. Exploring the Fintech Landscape: Hearing Before the S. Comm. on the Banking,
Housing, and Urban Affairs, 115th Cong. 4 (2017) (written testimony of Frank Pasquale,
Professor of Law, University of Maryland), https://www.banking.senate.gov/imo/me-
dia/doc/Pasquale%20Testimony%209-12-17.pdf [https://perma.cc/UJ5A-2JFM].
48. Hilary J. Allen, Driverless Finance 3 (Apr. 3, 2019) (unpublished manuscript) (on file
with author).
49. Berry, supra note 24.
50. Allen, supra note 1, at 612.
51. Financial Services and Markets Act 2000, c. 8, § 1E.
52. Allen, supra note 48, at 3–4.
53. See supra note 44 and accompanying text.

Electronic copy available at: https://ssrn.com/abstract=3409847

2020] SANDBOX BOUNDARIES 309

IV. REGULATORY ARBITRAGE AND RACE TO THE BOTTOM

A. Theory and History

Regulatory arbitrage and race to the bottom are perennial issues

in both domestic and international financial regulation. “Regulatory
arbitrage” refers collectively to the many strategies that can be used to
achieve an economically equivalent outcome to a regulated activity
while avoiding the legal constraints (colloquially, complying with the
letter but avoiding the spirit of the law).54 This Article focuses on the
jurisdictional variant of regulatory arbitrage, whereby a market
participant chooses to conduct business in a jurisdiction that affords a
more favorable regulatory treatment to the business in question.55
Jurisdictional arbitrage opportunities abound at the international level
and also within a federal system like the United States where market
participants can pick and choose among different federal and state
regulators. The ability for a market participant to choose their own
regulator can lead to what is known as “race to the bottom,” a
phenomenon where jurisdictions compete to lower their regulatory
standards in order to attract business, resulting in a general
deregulatory trend.56 One jurisdiction’s lowering of regulatory
standards can have spillover effects, generating negative outcomes that
are felt even in jurisdictions with more stringent legal regimes;57 if a
jurisdiction recognizes that its consumers and financial system may be
harmed regardless of its own regulatory protections, it may seem logical
to focus instead on reaping the benefits of innovation and competition
by lowering regulatory standards itself.
If interpreted as simple coordination problems,58 regulatory
arbitrage and race to the bottom can be solved so long as jurisdictions

54. Professor Victor Fleischer defines regulatory arbitrage as “a perfectly legal planning
technique used to avoid taxes, accounting rules, securities disclosure, and other regulatory costs”
that “exploits the gap between the economic substance of a transaction and its legal or regulatory
treatment.” Victor Fleischer, Regulatory Arbitrage, 89 TEX. L. REV. 227, 229 (2010).
55. Elizabeth Pollman, Tech, Regulatory Arbitrage, and Limits 8 (European Corp.
Governance Inst., Working Paper No. 455/2019, 2019), https://ecgi.global/sites/default/files/work-
ing_papers/documents/finalpollman.pdf [https://perma.cc/86V7-9657].
56. For a discussion of the dynamics of races to the bottom, see RICHARD SCOTT CARNELL
ET AL., THE LAW OF FINANCIAL INSTITUTIONS 65 (5th ed. 2013).
57. Coffee notes that when it comes to financial stability, “many nations do not have to
internalize the costs they impose on others, some nations will behave as ‘free riders,’ preferring
that others bear the costs and encouraging regulatory arbitrage when it benefits them.” John C.
Coffee, Jr., Extraterritorial Financial Regulation: Why E.T. Can’t Come Home, 99 CORNELL L. REV.
1259, 1269 (2014).
58. Coordination problems “are rooted in the need of certain kinds of uniformity on the
one hand, and the absence of any inherent tendency for such uniformity spontaneously to emerge
on the other hand.” Robert C. Hockett, Recursive Collective Action Problems: The Structure of

Electronic copy available at: https://ssrn.com/abstract=3409847

310 VAND. J. ENT. & TECH. L. [Vol. 22:2:299

share the information necessary to formulate the optimal regulatory

solution and trust one another enough to commit to that solution.59
Following this simplified line of thinking, attempts to arbitrage and
undercut consumer protection and financial stability regulation can be
solved relatively easily by agreements to apply consistently high
standards across jurisdictions.60 A more realistic perspective, however,
recognizes that there is no one solution that is optimal for all parties
involved; even with perfect information and trust, coordination can be
elusive when jurisdictions have different incentives and policy
preferences that they are trying to pursue.61 As a result, the financial
regulatory goals of consumer protection and financial stability—which,
in the absence of a crisis, often lack an organized constituency to agitate
for them62—have often been undercut by the forces of regulatory
arbitrage and races to the bottom, facilitated by factions that prioritize
efficiency and competition.
Such dynamics have been observed both domestically and
internationally. Domestically, these dynamics have generally been
discussed under the rubric of “preemption.” Since the enactment of the
National Bank Act in the 1860s, banks in the United States have had
the option to charter at the national or the state level.63 The
implementation of this dual banking system ensured that issues
regarding the extent to which federal financial regulation can preempt
state financial regulation—and vice versa—have been alive for over a
century. Over the years, the Office of the Comptroller of the Currency,
the national bank regulator, has often succeeded in preempting state
regulators trying to implement more stringent consumer financial
protections.64 In the lead up to the Financial Crisis, other federal
regulators also neglected consumer financial protection with disastrous
results,65 and it took the Financial Crisis to galvanize support for

Procyclicality in Financial and Monetary Markets, Macroeconomies and Formally Similar

Contexts, J. FIN. PERSP., July 2015, at 1, 2.
59. Chris Brummer, How International Financial Law Works (and How It Doesn’t), 99
GEO. L.J. 257, 269 (2011).
60. “[T]he prevailing wisdom is that regulatory arbitrage can be counteracted by
harmonization.” Pollman, supra Note 55 at 2. There are, however, some scholars who object to
harmonization either because of its second-order effects or because harmonization can generate
further opportunities for regulatory arbitrage in the implementation phase. For a discussion of the
work of these scholars, see Hilary J. Allen, What Is “Financial Stability”? The Need for Some
Common Language in International Financial Regulation, 45 GEO. J. INT’L L. 929, 938–39 (2014).
61. Id.
62. See supra note 45 and accompanying text.
63. CARNELL ET AL., supra note 56, at 78.
64. See, for example, the seminal cases of Barnett Bank of Marion Cty., N.A. v. Nelson,
517 U.S. 25 (1996) and Marquette Nat’l Bank of Minneapolis v. First of Omaha Serv. Corp., 439
U.S. 299 (1978).
65. Leonard J. Kennedy et al., The Consumer Financial Protection Bureau: Financial
Regulation for the Twenty-First Century, 97 CORNELL L. REV. 1141, 1145 (2012).

Electronic copy available at: https://ssrn.com/abstract=3409847

2020] SANDBOX BOUNDARIES 311

ending this race to the bottom by enacting more robust federal

consumer financial protection regulation. The Dodd-Frank legislation
enacted in the aftermath of the Financial Crisis sought to alter the
status quo in two ways. First, it sought to limit federal preemption
authority by increasing “both the lawmaking and law enforcement
functions of the states in the area of consumer financial protection.”66
Second, it created a new federal agency, the Consumer Financial
Protection Bureau, with a mandate “to implement and, where
applicable, enforce Federal consumer financial law consistently for the
purpose of ensuring that all consumers have access to markets for
consumer financial products and services and that markets for
consumer financial products and services are fair, transparent, and
competitive.”67 Given that these steps were taken to avoid races to the
bottom in the area of consumer financial protection regulation, there
is an unmistakable irony in the CFPB now seeking to utilize
the regulatory sandbox model to preempt state consumer
financial protection laws, an issue this Article will return to shortly.
If the history of federal preemption in the United States has
been animated by concerns about consumer protection, at the
international level, the primary concern is that financial stability will
be compromised by regulatory arbitrage and races to the bottom.
International financial regulation was first developed in the 1970s as a
response to national concerns about negative spillover effects
communicated from one jurisdiction to another by globalized capital
flows.68 An international consensus has since developed that the best
way to avoid such spillover effects is to coordinate the rules that govern
financial activity, and so international financial regulation has
developed as a compilation of harmonized international standards.69
The international financial regulatory standards adopted prior to 2008
proved insufficient to prevent a global financial crisis, and there has
since been significant international regulatory activity with the aim of
making the global financial system more resilient to a shock emanating
from any one country.70 Concerns about cross-border spillover effects

66. Arthur E. Wilmarth, Jr., The Dodd-Frank Act’s Expansion of State Authority to Protect
Consumers of Financial Services, 36 J. CORP. L. 893, 896 (2011).
67. Dodd-Frank Wall Street Reform and Consumer Protection Act § 1021, 12
U.S.C. § 5511(a) (2018); see also Kennedy et al., supra note 65, at 1145–46.
68. Brummer, supra note 59, at 265; Carl Felsenfeld & Genci Bilali, The Role of the Bank
for International Settlements in Shaping the World Financial System, 25 U. PA. J. INT’L ECON. L.
945, 951 (2004).
69. Brummer, supra note 59, at 268–69.
70. See id. at 265, 276 (describing how, in the wake of the “deeply international nature of
the ongoing financial crisis,” several working groups comprised of representatives from G20
countries have “been tasked to develop reports and recommendations to strengthen international
standards in areas like accounting, disclosure, and prudential management”).

Electronic copy available at: https://ssrn.com/abstract=3409847

312 VAND. J. ENT. & TECH. L. [Vol. 22:2:299

remain, though, notwithstanding this postcrisis reform. Gaps between

international financial regulatory standards provide opportunities for
regulatory arbitrage, and agile new fintech technologies are likely to be
particularly adept at exploiting these regulatory gaps.71 International
vulnerabilities have also been exacerbated by the increased use of the
internet to facilitate the provision of financial services across national
borders.72

B. The Basic Theory as Applied to Regulatory Sandboxes

Understanding the standard accounts of regulatory arbitrage and

race to the bottom can assist us—at least to some degree—in
understanding recent developments in regulatory sandboxes. For
example, Arizona could be viewed as having lowered regulatory
protections for consumers in order to encourage fintech entrepreneurs
to set up in Arizona and thus arbitrage the regulatory environment of
their home states.73 Arizona’s actions could potentially spur a race to
the bottom as states like Illinois and others contemplate their own
regulatory sandboxes.74 While the CFPB could arguably invoke federal
preemption to set a floor requiring Arizona and other states to maintain
more stringent consumer protection rules, the CFPB has not evinced
any desire to do so, and so there is no legal limit on innovators taking
advantage of Arizona’s lowered regulatory standards.
In fact, the CFPB has purported to create its own regulatory
sandbox that preempts consumer financial protection laws at both the
state and federal level. The CFPB sandbox is designed to offer two years
of relief from regulatory compliance;75 this is longer than most
jurisdictions offer but not entirely an outlier position. What is
particularly unusual about the CFPB sandbox is that relief need not be

71. See Pollman, supra note 55, at 4 (“We might be especially concerned about large and
potentially even growing amount of regulatory arbitrage in the tech industry because it is highly
adaptive by its nature in the digital era.”).
72. Brummer, supra note 59, at 266; Rosa Lastra & Jason Grant Allen, Cyberspace and
Fintech Borders, FINTECHPOLICY.ORG (Jan. 21, 2019), https://fintechpolicy.org/2019/01/21/law-
and-borders-the-regulation-of-internet-based-financial-services/ [https://perma.cc/R2CL-6NGG].
73. Press Release, Mark Brnovich, supra note 21; Zetzsche et al. have argued that one of
the primary reasons for adopting a regulatory sandbox is its “signaling” function, in that it
demonstrates a commitment to promoting fintech innovation in the hope of attracting
entrepreneurs to the jurisdiction. Zetzsche et al., supra note 14, at 81.
74. Kendra Haar, Josh Boehm & Donald Mills, Fintech Regulatory Sandboxes:
Update on Arizona’s Sandbox and Other Developments, PERKINS COIE: VIRTUAL CURRENCY
REPORT (Feb. 8, 2019), https://www.virtualcurrencyreport.com/2019/02/fintech-regulatory-sand-
boxes-update-on-arizonas-sandbox-and-other-developments/?utm_source=feedburner&utm_me-
dium=feed&utm_campaign=Feed%3A+VirtualCurrencyReport+%28Virtual+Currency+Re-
port%29 [https://perma.cc/8ZZK-Z2YQ].
75. Policy on No-Action Letters and the BCFP Product Sandbox, 83 Fed. Reg. 64036,
64037 (proposed Dec. 13, 2018) (to be codified at 12 C.F.R.).

Electronic copy available at: https://ssrn.com/abstract=3409847

2020] SANDBOX BOUNDARIES 313

sought by individual firms; instead, “[t]he Bureau invites applications

from trade associations, service providers, and other third parties.”76
This will allow for much more expansive grants of regulatory relief than
the typical sandbox, and if these grants preempt other state and federal
consumer protection law, the CFPB’s regulatory sandbox could become
a potent force for deregulation.
The CFPB is also a member of GFIN, the Global Financial
Innovation Network spearheaded by the United Kingdom’s FCA. In
theory, the GFIN could be viewed as a simple coordination mechanism,
an attempt by nations to develop apolitical and expert best practices as
to the operation of a regulatory sandbox that maximizes efficiency and
promotes competition, while minimizing harm to consumers and
financial stability. Once in place, such best practices could harmonize
sandbox operation in different jurisdictions, preventing regulatory
arbitrage and races to the bottom with respect to the regulation of
fintech innovation.77 However, this characterization of the GFIN is
likely overly rosy, because (like much of the analysis in this Section) it
is based on theoretical foundations that tend to oversimplify the
incentives of those involved.
Discussions of regulatory arbitrage often neglect nonlegal
impediments to setting up a business in a new jurisdiction. These
nonlegal constraints may be decisive in determining the utility of a
regulatory sandbox. Furthermore, many accounts of race to the bottom
assume that all actors within a jurisdiction share the same incentives,
but the motivations of these actors can sometimes conflict, which will
impact the willingness of a jurisdiction to adopt a sandbox. Finally,
theories of regulatory arbitrage and race to the bottom do not
adequately take into account the sensitivity and value of the
information likely to be generated by regulatory sandboxes. The next
Section seeks to provide a more nuanced understanding of the
phenomena motivating and constraining the adoption of regulatory
sandboxes.

76. Id. at 64039.

77. See CONSULTATION DOCUMENT, supra note 6, at 9. For example, one commentator has
noted that former tax havens, having capitulated to pressure to meet international standards with
regard to preventing tax avoidance and evasion, are now increasingly adopting loose financial
regulatory regimes to attract businesses associated with cryptoassets and blockchain. Omri
Marian, Blockchain Havens and the Need for Their Internationally-Coordinated Regulation, 20
N.C. J.L. & TECH. 529, 531 (2019). This is perhaps the beginning of a race to the bottom, and the
GFIN could theoretically play a role in arresting it. CONSULTATION DOCUMENT, supra note 6, at 9;
Allen, supra note 1, at 622..

Electronic copy available at: https://ssrn.com/abstract=3409847

314 VAND. J. ENT. & TECH. L. [Vol. 22:2:299

C. Toward a More Nuanced Understanding of Regulatory Sandboxes

This Section relies on cutting-edge literature on the incentives

of political actors and the innovators themselves to develop a much
more nuanced understanding of why regulatory sandboxes are being
pursued and how effective they are likely to be. It begins by considering
nonlegal forces that are likely to limit the use of regulatory sandboxes
as a tool for regulatory arbitrage. It then relies on political scientists
Abraham Newman and Elliot Posner’s work on the “second-order”
effects of international coordination—in this context, the domestic
consequences of international action—to evaluate the GFIN. This
Section finishes with an examination of how the incentives of the
relevant actors are likely to impact information sharing among
regulators operating sandboxes.

1. Nonlegal Constraints on Regulatory Arbitrage

Professor Elizabeth Pollman has recently explored some of the

nonlegal constraints on technological innovators that limit their desire
and ability to engage in regulatory arbitrage;78 these constraints help
explain the limited appeal that Arizona’s sandbox holds for innovators.
In addition to the limitation that a state-based regulatory sandbox only
provides an innovator with access to consumers residing in that state,79
Pollman has observed that the availability of a skilled workforce, and a
founder’s desire to live and work in a particular place, also act as types
of constraints that prevent entrepreneurs from simply moving their
business to the most lightly regulated environment.80 This may explain
why, as of October 2019, only eight firms have taken advantage of
Arizona’s sandbox.81 At this scale, Arizona’s sandbox provides only
limited arbitrage opportunities and is unlikely to inspire a problematic
race to the bottom. In other words, the regulatory goals of consumer
protection and financial stability are unlikely to suffer too much as a
result of Arizona’s sandbox.
Technology services often require consumer trust and social
legitimacy to thrive;82 this is likely to be a fortiori the case in the context
of the technological delivery of financial products, which are credence
goods (in the sense that a customer cannot immediately verify the
quality or utility of the financial product and thus must trust in the

78. Pollman, supra note 55, at 6.

79. Allen, supra note 1, at 619.
80. Pollman, supra note 55, at 28–30.
81. Sandbox Participants, ARIZ. ATT’Y GEN.: MARK BRNOVICH, https://www.azag.gov/fin-
tech/participants [https://perma.cc/VWW6-ANYE] (last visited Nov. 2, 2019).
82. Pollman, supra note 55, at 23–24.

Electronic copy available at: https://ssrn.com/abstract=3409847

2020] SANDBOX BOUNDARIES 315

provider).83 If the CFPB’s sandbox is interpreted by financial consumers

as a backdoor for deregulation—a real possibility, given the publicity
regarding the CFPB’s deregulatory turn under the Trump
administration—consumers may be unwilling to participate in its
sandbox trials, thwarting attempts by innovators to test their products.
Furthermore, many state regulators and attorneys general are
threatening to challenge any concrete assertion by the CFPB of its
sandbox’s preemptory powers.84 These concerns about the participation
of consumers, as well as legal challenges to the preemptive aspects of
the CFPB’s sandbox, may ultimately render it unattractive to
innovators. As with the Arizona sandbox, concerns about regulatory
arbitrage and races to the bottom may be neutered by limited uptake of
the regulatory sandbox.

2. Second-Order Effects of International Coordination

The CFPB is trying to build legitimacy for its sandbox in another

arena, however; it is the only US regulator to have joined the GFIN.85
In their book Voluntary Disruptions, Newman and Posner highlight
that international financial regulation is sometimes used as a tool to
help factions promote their agendas domestically.86 They observe that
when policy actors find themselves blocked at the domestic level, they
will sometimes seek to “expand the arena” to include transnational
negotiations, allowing them to disrupt the domestic policy debate.87 If
the GFIN ultimately develops international best practices for sandbox
design, the CFPB may be able to invoke these best practices in order to
lend legitimacy to its regulatory sandbox, with the goal of making it
harder for US states to challenge the sandbox and thus rendering it
more attractive to innovators. However, the fact that the CFPB is the
only US regulator that is a member of the GFIN might equally be
invoked by state regulators in the United States as undermining the
legitimacy of the GFIN’s practice.88
As an international body, the GFIN will obviously have impacts
beyond the United States as well. A realpolitik account of the GFIN

83. Iris H-Y Chiu, Fintech and Disruptive Business Models in Financial Products,
Intermediation and Markets – Policy Implications for Financial Regulators, 21 J. TECH. L. & POL’Y
55, 74 (2016).
84. See Berry, supra note 24; Conference of State Bank Supervisors, supra note 25, at 4.
85. CONSULTATION DOCUMENT, supra note 6, at 14.
86. ABRAHAM L. NEWMAN & ELLIOT POSNER, VOLUNTARY DISRUPTIONS: INTERNATIONAL
SOFT LAW, FINANCE, AND POWER 4 (Liesbet Hooghe & Gary Marks eds., 2018).
87. Id. at 5.
88. See id. at 26–27 (“There are plenty of instances when soft law or the bodies that
produce it are framed as suffering from bias or lacking the technical expertise that others claim or
the accountability expected in a democracy.”).

Electronic copy available at: https://ssrn.com/abstract=3409847

316 VAND. J. ENT. & TECH. L. [Vol. 22:2:299

might see it as a tool spearheaded by the FCA to ensure that subsequent

regulatory sandboxes adopted in other countries do not offer
significantly more relaxed regulatory environments than the FCA,
which could attract fintech innovation away from London toward other
jurisdictions. Singapore and Hong Kong could be particularly
threatening potential rivals that the FCA may wish to hold in check
with baseline standards, especially once London tech entrepreneurs are
deprived of unfettered access to the continental European markets
post-Brexit and thus have less reason to stay in London.
Speaking of the European markets, the European Banking
Authority89 and the European Commission90 are reportedly
contemplating the adoption of an EU-wide regulatory sandbox for
fintech, but BaFin—the powerful German financial regulator—has
expressed vocal opposition to regulatory sandboxes in general.91 Again,
Newman and Posner’s explanation of “legitimacy claims” and the
“arena expansion” second-order effects of international soft law
standards is helpful in exploring this dynamic.92 If the GFIN develops
international best practices for regulatory sandboxes, then those could
lend legitimacy to the structure that might assist sandbox proponents
within Germany, and Europe more broadly, to overcome BaFin’s
resistance. BaFin might, however, seek to impugn the legitimacy of
anything developed by the GFIN, particularly because neither BaFin
nor any other European financial regulator—other than the
FCA—joined the GFIN at its inception.93
In general, though, foreign examples of regulatory sandboxes
are likely to lend legitimacy to those seeking to prioritize the regulatory
goals of innovation and competition by implementing regulatory
sandboxes in their own jurisdiction94—at the potential expense of
consumer protection and financial stability. In this sense, the GFIN

89. Huw Jones, EU Guidelines on Fintech to Include “Sandbox” Design Recommendations,

REUTERS (Sept. 6, 2018, 9:58 AM), https://www.reuters.com/article/us-eu-banks-regulator/eu-
guidelines-on-fintech-to-include-sandbox-design-recommendations-idUSKCN1LM25V
[https://perma.cc/F9SP-LHGY].
90. Press Release, European Commission, FinTech: Commission Takes Action for a More
Competitive and Innovative Financial Market (Mar. 8, 2018), https://europa.eu/rapid/press-re-
lease_IP-18-1403_en.htm [https://perma.cc/BH7P-QVGG].
91. Conheady, supra note 8.
92. NEWMAN & POSNER, supra note 86, at 5.
93. The Consumer Financial Protection Bureau and the Global Financial Innovation
Network (GFIN), CONSUMER FIN. PROTECTION BUREAU, https://www.consumerfinance.gov/about-
us/innovation/global-financial-innovation-network/ [https://perma.cc/MY3J-6RYL] (last visited
Oct. 28, 2019). This absence of European regulators from GFIN is conspicuous; perhaps it can be
attributed to tensions over Brexit and the desire to limit any FCA ambitions to expand its arena
of influence through GFIN as it loses clout within the European Union.
94. “[A] company might engage in a sophisticated strategy of sequencing wins in locations
that can build leverage for taking on intransigent regulators in other important markets.”
Pollman, supra note 55 at 34.

Electronic copy available at: https://ssrn.com/abstract=3409847

2020] SANDBOX BOUNDARIES 317

may serve as a useful forum not only for policy makers and regulators
but also for innovators and industry associations lobbying to expand
access to regulatory sandboxes,95 particularly because the GFIN has
signaled that “being accountable to industry is important to GFIN.”96
As such, although the GFIN may serve a coordination function, a closer
inspection of the GFIN portends a deregulatory trend in regulatory
sandboxes, not only as a result of the GFIN’s anticipated deference to
industry interests97 but also because only regulators who have evinced
“a commitment to supporting financial innovation” can become
members of the GFIN.98 There is no place in the forum for regulators
who are simply concerned about the impact that financial innovation
might have on consumers or the stability of the financial system at
large; this means that regulatory bodies that are more skeptical of
fintech innovation may be left out of the conversation.99
Notwithstanding their deregulatory potential, though, an
important argument can be made in favor of adopting regulatory
sandboxes as a “trial for new regulatory approaches to coping with
(rather than promoting) inevitable financial innovation.”100 In
particular, regulators can use the sandbox to learn about nascent
technologies that they will most likely have to grapple with at some
point, irrespective of whether they adopt a regulatory sandbox. The
following Section therefore considers how effective the GFIN and the
sandboxes created by Arizona and the CFPB are likely to be in
promoting regulatory learning in practice.

3. Incentives for Information Sharing

Highlighting the importance of regulatory learning serves as an

indictment of the CFPB’s proposed sandbox: the CFBP’s proposal,
which anticipates providing relief to “trade associations, service
providers, and other third parties” as well as individual firms, is clearly
lacking in terms of information production.101 It is hard to envisage how

95. Id. at 33. Pollman has noted that private sector entities will sometimes seek to change
the law in circumstances where regulatory arbitrage will not achieve their business goals. Id.
96. GLOB. FIN. INNOVATION NETWORK, supra note 28, at 7.
97. Id. The GFIN notes that “[w]hile other stakeholders including industry, firms and
private institutions are not formally a part of GFIN due to the conflict of interests, their views are
welcome and necessary to ensure that GFIN remains relevant for all stakeholders.” Id. No mention
is made of facilitating access for other stakeholders.
98. Id. at 3.
99. See Van Loo, supra note 22, at 232. The international financial regulatory
organizations, FSB or IOSCO, which focus, respectively, on financial stability and investor
protection, have yet to take an active role in fintech regulation. Id.
100. Allen, supra note 1, at 581.
101. Policy on No-Action Letters and the BCFP Product Sandbox, 83 Fed. Reg. 64036,
64039 (proposed Dec. 13, 2018) (to be codified at 12 C.F.R.).

Electronic copy available at: https://ssrn.com/abstract=3409847

318 VAND. J. ENT. & TECH. L. [Vol. 22:2:299

a blanket regulatory exemption granted to a body like a trade

association would facilitate the same degree of regulatory learning as a
working relationship with an individual innovating firm. Small
subnational sandboxes like Arizona’s are also unlikely to produce any
deep cross-sectoral regulatory knowledge, given that they are likely to
trial only a few, disparate innovations. Regulatory sandboxes should
instead be designed to maximize information production and transfer;
some sandboxes, such as the FCA’s, have features that are likely to
make them more successful at information production.102
Unfortunately, however, the prospects for transfer of information across
sandbox boundaries remain dim.
Particularly when it comes to technological innovations that
may impact financial stability, the operators of small subnational
regulatory sandboxes, like Arizona, have limited incentives to share
any information they may uncover during testing; financial stability is
a borderless public good that will accrue largely to persons residing
outside of their state.103 Given that fintech markets are borderless, the
ideal sandbox would facilitate information transfer at the international
level. However, there are likely to be impediments to transnational
sharing of sensitive commercial information garnered from sandbox
trials. It is certainly true that financial regulators have shared
information about regulatory best practices with one another for
decades, at both the domestic and the international levels.104 They have
also shared information about market participants, but traditionally
the information shared has been germane to the financial condition of
those firms.105 What is distinct about the regulatory sandbox is the

102. Allen, supra note 1, at 636. In the FCA sandbox, “each firm will be allocated a
dedicated case officer and given ‘a high degree of bespoke engagement from [the FCA’s] staff.’” Id.
at 635 (quoting Christopher Woolard, Dir. of Strategy & Competition, Fin. Conduct Auth., Speech
at the Innovate Finance Global Summit (Apr. 11, 2016), https://www.fca.org.uk/news/speeches/in-
novate-finance-global-summit [https://perma.cc/MS9Q-2NNZ]).
103. Daniel Schwarcz & Steven L. Schwarcz, Regulating Systemic Risk in Insurance, 81 U.
CHI. L. REV. 1569, 1628 (2014).
104. U.S. GOV’T ACCOUNTABILITY OFF., GAO–16–175, FINANCIAL REGULATION: COMPLEX
AND FRAGMENTED STRUCTURE COULD BE STREAMLINED TO IMPROVE EFFECTIVENESS 16 (2016); In
the United States, the law has generally favored the sharing of confidential business information
among financial regulators, to the extent necessary for them to perform their functions. See, e.g.,
Applicability of Trade Secrets Act to Intra-Governmental Exchange of Regulatory Information, 23
Op. O.L.C. 74, 76 (1999). Internationally, bodies like IOSCO and the FSB specify in their
organizational documents that they exist in part to facilitate information exchange among national
regulators. See Fin. Stability Bd., Charter of the Financial Stability Board art. 2(1)(b) (June 2012),
https://www.iosco.org/library/by_laws/pdf/IOSCO-By-Laws-Section-1-English.pdf
[https://perma.cc/T3F4-LWGQ]; Int’l Org. of Sec. Comm’ns, By-Laws of IOSCO pmbl. (1996),
https://www.iosco.org/library/by_laws/pdf/IOSCO-By-Laws-Section-1-English.pdf
[https://perma.cc/Q8ZQ-5XPW.
105. Financial Sector Assessment Program: Frequently Asked Questions, INT’L MONETARY
FUND, https://www.imf.org/external/np/fsap/faq/index.htm [https://perma.cc/HBM2-4VA9] (last
updated Sept. 10, 2018). For example, the International Monetary Fund notes that in its Financial

Electronic copy available at: https://ssrn.com/abstract=3409847

2020] SANDBOX BOUNDARIES 319

constant dialogue between regulator and innovator about the

development of new technology. As this Author has argued previously,
“[i]t is this expectation of ongoing engagement that differentiates the
regulatory sandbox from other regulatory waivers and exemptions.”106
As countries adopt regulatory sandboxes, sensitive information about
technological developments will be pertinent to financial regulators, not
only in their capacity as regulators but also in their capacity as
facilitators of private firms’ innovations—a shift acknowledged by the
GFIN.107 Some regulators may therefore want to keep information
about technological innovation to themselves, fearing that, if shared, it
could be used to assist foreign firms competing in the fintech market.
A recent paper by Professors Allison Carnegie and Austin M.
Carson on disclosures by nation states to the World Trade Organization
(WTO) provides a starting point for examining the “disclosure
dilemmas” that arise when national authorities are called upon to share
commercially sensitive information about the activities of their firms.108
As mentioned in the previous Section, coordination problems are in part
a function of—although not wholly attributable to—impediments to
information sharing.109 One response to a coordination problem is to
create a forum, like the GFIN, to facilitate information sharing.
However, merely creating a forum will not solve the problem when
there are incentives to underproduce information.110 Such incentives
are likely to be particularly strong when the information in question is
highly sensitive commercial information about technological
developments and the intended recipients of that information are
regulators in other jurisdictions who may pass that information on to
innovators participating in their own sandboxes. In such circumstances,
a collective action problem is likely to result,111 wherein even regulators
otherwise motivated to cooperate may refuse to share information with

Sector Assessment Program (a program designed to identify the main vulnerabilities in a country
that could trigger a financial crisis), “[t]he most common confidential data typically provided to
FSAP teams include bank-by-bank balance sheet, liquidity, and supervisory data used in stress
tests and, in some cases, data on official reserves.” Id.
106. Allen, supra note 1, at 580.
107. CONSULTATION DOCUMENT, supra note 6, at 8. “A network of regulators from around
the world that shares knowledge and best practice relating to innovation, technological trends and
emerging issues represents an iterative change from the current mode of collaboration in this
space.” Id.
108. Allison Carnegie & Austin M. Carson, Trading Secrets: Disclosure Dilemmas in
International Trade 1 (July 2, 2018) (unpublished manuscript), https://papers.ssrn.com/sol3/pa-
pers.cfm?abstract_id=3206689 [https://perma.cc/9HXX-LMQE].
109. See supra notes 58–59 and accompanying text.
110. Carnegie & Carson, supra note 108, at 3.
111. Hockett, supra note 58, at 2. Collective action problems “stem from certain possible
divergences between what it is individually rational to do, absent coordination, on the one hand,
and what would be both collectively and, therefore, individually optimal to do, were reliable means
of coordination available, on the other hand.” Id.

Electronic copy available at: https://ssrn.com/abstract=3409847

320 VAND. J. ENT. & TECH. L. [Vol. 22:2:299

their counterparts because of the expectation that other regulators will

shirk their information-sharing obligations. Such a dynamic will create
a suboptimal situation where information is cloistered in individual
regulatory sandboxes.
Carnegie and Carson argue that, notwithstanding the general
preference for transparency and accountability in international law,
mechanisms to promote confidentiality and secrecy can be key to
remedying collective action problems relating to the sharing of sensitive
commercial information.112 They use the WTO as their case study and
discuss measures that it could take as an institution to protect sensitive
information disclosed to it.113 Their proposals have merit in the WTO
context because, there, the ultimate purpose of information sharing is
to enable the WTO itself to resolve disputes. However, if one accepts
that the primary purpose of regulatory sandboxes is to provide
regulators with information, it would be insufficient to set up an
international organization to be the confidential repository of such
information and stop the dissemination there. In the sandbox context,
what is needed are measures to ensure that regulators use the
information they receive only for regulatory purposes and not for
assisting innovation by their private sector. Crafting and policing such
measures would be extremely challenging, though, and so information
sharing will likely be stymied by collective action problems unless
regulators believe their incentives to share outweigh the drawbacks
associated with possible technology transfers.114
A regulator’s incentives to share information will depend in part
on its motivations for adopting a regulatory sandbox in the first place.
If the regulator has implemented a regulatory sandbox purely in order
to promote the efficiency and competitiveness of its own fintech
industry, then it has limited incentives to share information. If the
regulator’s primary goal is to learn about new technologies in order to
improve consumer protection or financial stability regulation, then the
sharing of information about nascent technologies is more likely.
However, given that the adoption of most existing sandboxes appears
to have been primarily motivated by concerns about efficiency and
competitiveness, and that the GFIN by its terms excludes from its
membership any regulator that has not demonstrated a commitment to
promoting efficiency and competitiveness in the fintech space, there is
little cause to be sanguine about cross-border information sharing.

112. Carnegie & Carson, supra note 108, at 31.

113. Id. at 2–3.
114. Brummer, supra note 59, at 293. Decisions regarding information sharing may also be
impacted by issues of legality under disparate international intellectual property regimes. See,
e.g., id.

Electronic copy available at: https://ssrn.com/abstract=3409847

2020] SANDBOX BOUNDARIES 321

V. CONCLUSION

This Article builds on the Author’s previous work arguing that

when it comes to nascent fintech technologies, the regulatory goals of
financial stability and consumer protection should be prioritized over
promoting efficiency and competition through innovation. One practical
corollary of this argument is that if a regulatory sandbox is to be
adopted, it should be designed in a way that minimizes any rollback of
prudential and consumer protection regulation and maximizes the
ability of financial regulators to learn about new technologies so that
they are more informed in pursuing the regulatory goals of financial
stability and consumer protection. Unfortunately, many of the
sandboxes that have been implemented recently do not conform to this
ideal. The structures of the Arizona and CFPB regulatory sandboxes
are unlikely to produce significant regulatory learning, and so those
sandboxes do not compensate the public for the reduction in consumer
protection and prudential regulations offered to innovators.
Admittedly, the deregulatory impact of these two sandboxes may be
limited because of practical constraints on their utility to innovators.
Other sandboxes, such as the FCA’s, are both better (if not
perfectly) designed and more appealing to innovators, but we should
nonetheless be concerned about the fact that the regulators operating
these sandboxes have incentives to jealously guard the information they
produce, rather than share it across sandbox boundaries. Although the
GFIN might initially seem like a forum that could facilitate
cross-border information sharing, when the information in question is
commercially sensitive intelligence about fintech innovations, the
problem is more than a simple coordination problem. Instead, the
problem is one of collective action—and the creation of the GFIN is
unlikely to solve it. The GFIN may even have a deleterious impact on
consumer protection and financial stability regulation around the world
to the extent that it legitimizes the use of regulatory sandboxes even as
it excludes skeptical regulators from its membership. Overall, this
Article concludes that there is reason to be pessimistic about the
trajectory of the regulatory sandbox model; the trend suggests that
consumer protection and financial stability regulation are likely to be
sacrificed in the name of promoting innovation.

Electronic copy available at: https://ssrn.com/abstract=3409847