The Spanish financial sandbox is a controlled space where a project can test its model for a limited time, with a limited number of real users and oversight by supervisors. For a security token issuer, it serves to validate sensitive aspects before operating, not to circumvent the regime that applies to it.
The Spanish financial sandbox is a controlled testing space where a fintech project can test its model for a limited time, with real but limited users and under direct monitoring by supervisors. Applied to the CNMV tokenization sandbox, it allows an issuer of security tokens to validate sensitive aspects: representation of securities through DLT, registry, trading models, before applying for ordinary licenses and going to market. It is not an authorization to operate permanently: it is a testing ground with limited legal effects created by Ley 7/2020, de 13 de noviembre, for the digital transformation of the financial system. If you work in regulated asset tokenization and doubt whether your model fits current regulation, this article explains when the sandbox helps you and when you do not need it.
What is the Spanish financial sandbox
The sandbox is a regulated environment where a company tests a project based on technological innovation with potential application in the financial system. The key is that during testing the activity is carried out with reinforced guarantees and a reduced scope: limited number of participants, capped volume, and safeguards agreed in writing. In return, the promoter gets something very valuable: direct and early contact with the supervisor that will later have to authorize its business (Ley 7/2020, de 13 de noviembre).
The regime is coordinated by the Secretaría General del Tesoro y Financiación Internacional, and the competent supervisor participates depending on the project's scope: the CNMV for securities markets and investment services companies, the Banco de España for credit and payments, and the Dirección General de Seguros y Fondos de Pensiones for the insurance sector. A project for the issuance and trading of tokens that represent securities falls, by its nature, under the CNMV's remit (Ley 6/2023, de 17 de marzo, de los Mercados de Valores y de los Servicios de Inversión).
How it works: cohorts, protocol and monitor
The sandbox does not accept applications at any time. It works by cohorts or calls: a deadline opens, projects are received, evaluated as a batch, and those that pass are selected. This matters for your planning, because it sets a specific window and a finite number of places. Once selected, the heart of the process is the testing protocol, a document you sign with the supervisor that sets exactly what you will test, with how many users, for how long, and with what safeguards.
That protocol includes guarantees for participants: clear information that they are in a testing environment, limits on volume and number of users, protection mechanisms against losses, and the right to withdraw. Throughout the tests you have a monitor assigned from the supervisor who follows progress, receives periodic information, and verifies that what was agreed is met. At the end, a results report is prepared documenting what worked and what did not.
The steps of the process, in order
- Application and project memorandum. You submit the project during the open call, with a memorandum describing the innovative nature, usefulness, and technical maturity of the proposal.
- Preliminary assessment. The Secretaría General del Tesoro and the supervisors assess whether it fits, that is, whether it adds value and meets the conditions to enter.
- Signing of the testing protocol. If it passes the filter, you negotiate and sign the protocol with the CNMV: scope, number of users, maximum volume, duration, and safeguards.
- Monitor assignment. The supervisor appoints a monitor who accompanies the tests and receives periodic information.
- Execution of tests. You operate live with the agreed limited scope and for the agreed term.
- Results report. The project's performance and the conclusions of the trial are documented.
- Activity gateway. To continue operating outside the sandbox, you process the ordinary authorizations that correspond to your activity.
How a tokenization project fits
An issuer of security tokens works with transferable securities, and that places it squarely within the scope of the CNMV and MiFID II. The sandbox is useful precisely for the points where technology and regulation are still being fitted together. You can test the representation of securities through systems based on distributed ledger technology (DLT), check how the register of those securities behaves, or try a trading model that does not fit cleanly into the classic categories (Ley 6/2023, de 17 de marzo).
The representation of securities by DLT relies on a specific legal figure, the entity responsible for registration and record-keeping (ERIR), regulated by the implementing regulations of the LMVSI. As of today, the first registered ERIR is Ursus-3 Capital (Real Decreto 814/2023, de 8 de noviembre). If your project explores its own register or a novel registration architecture, the sandbox is the place to validate it with the supervisor present, instead of discovering problems after launch. For details on the issuance process, review how to issue a security token in Spain.
The national sandbox coexists with the EU DLT Pilot Regime, designed for market infrastructures, namely multilateral trading and settlement systems based on DLT, which also operate with temporary exemptions and enhanced supervision (Regulation (EU) 2022/858). They are two different tools: the Spanish sandbox is broad and covers multiple business models; the DLT Pilot Regime focuses on trading and settlement infrastructures. An ambitious project can consider both routes depending on what it wants to test.
What the sandbox does NOT give you
The sandbox is not a license. Passing the tests does not authorize you to operate permanently, nor does it exempt you from obtaining the ordinary authorizations when you exit. That transition, the activity gateway, follows its normal course, with its capital, governance, and solvency requirements. Nor does it guarantee that you will obtain authorization afterwards: the results report is a reputational and learning asset, not a free pass.
There are other practical limits worth anticipating. Places per cohort are limited, and entry is competitive. The protocol demands resources: you will have to dedicate a team to periodic reporting, the relationship with the monitor, and compliance with safeguards. And the project must arrive with a certain technical and legal maturity; the sandbox fine-tunes and validates, it does not build from scratch for you.
What it means for you
If you are an issuer or a startup preparing a regulated tokenization, the sandbox offers you something the open market does not: the possibility of making mistakes cheaply and with the supervisor as your point of contact. Validating DLT representation, the register, or a trading model within a protocol reduces the risk of redesigning your product after spending on an authorization. It also shortens the distance with the CNMV: you arrive at the ordinary application with a documented track record and an established relationship.
The cost is time, resources, and exposure. You have to wait for a call for applications, compete for a place, and commit a team for months. The decision therefore depends on how much real regulatory uncertainty your model has. If the answer is 'a lot', the sandbox is a reasonable investment; if it is 'a little', you probably should go straight to the current framework.
Is it worth applying for it?
Green: it makes sense to enter. Your project introduces something the regulation does not clearly address: a DLT-based securities registry scheme different from the standard, a hybrid trading model, a tokenization architecture with no direct precedent in Spain. There is genuine doubt about how it fits into the LMVSI, and you need the supervisor's interpretation before committing capital. Here the sandbox provides certainty and speed of learning.
Grey: it depends. Your model is partly novel, but much of it already fits. You may be interested in testing only one specific component, or a query to the CNMV may resolve your doubt without needing a full protocol. Weigh the effort of the process against the benefit of validating that single point, and assess whether the next cohort arrives in time for your schedule.
Red: you probably don't need it. If your issuance of security tokens already fits the current framework (securities represented via DLT through an existing ERIR, with investment services under MiFID II), the path is to apply for the ordinary authorizations, not to enter the sandbox. Forcing the trial only adds timelines and administrative burden without resolving an uncertainty you do not actually have. Before deciding, compare your case against the LMVSI fact sheet.
Frequently asked questions
Does the CNMV sandbox authorize me to launch my tokenization project?
No. The sandbox is a testing environment with limited legal effects and limited duration. To operate permanently after the tests, you must obtain the ordinary licenses applicable to your activity through the activity gateway. Passing the trial does not equate to an authorization (Ley 7/2020, de 13 de noviembre).
When can I apply for entry into the sandbox?
Access works by cohorts or calls that open periodically, not continuously. Each call has a submission deadline and a limited number of places, and selection is competitive. You should prepare the project report in advance so you can submit it when the window opens.
Does a security token issuer need to go through the sandbox?
Not always. If your issuance and trading model already fits the current framework (representation by TRD through a registered ERIR and investment services under MiFID II), you can go straight to ordinary authorizations. The sandbox adds value when there is genuine regulatory uncertainty about a novel component of your project (Ley 6/2023, de 17 de marzo).
Notice
This content is for informational purposes only and does not constitute legal, financial, or investment advice. The sandbox regime and securities market regulations evolve, and each project has its own particularities. Before submitting an application or designing an issuance of security tokens, consult with professionals and verify the current requirements with the CNMV and the Secretaría General del Tesoro.
Related reading
- Tokenizing energy receivables (PPA)
- Liquidity of real estate tokens
- What is asset tokenization: 2026 guide for companies
- How to issue a security token in Spain: ERIR, Ley 6/2023 and CNMV
- Glossary of tokenization and securities markets
HokenFi is a software and infrastructure provider; it does not provide regulated services (CASP, ESI, EAF, or ERIR). This article is informative and does not constitute financial or legal advice.
