SBP Launches Regulatory Sandbox Cohort 2: Greenlights AI Agents, Biometric Payments, and Alternative Credit Scoring

The State Bank of Pakistan (SBP) has officially inaugurated the second cohort of its Regulatory Sandbox, accelerating its strategic roadmap under SBP Vision 2028 to cultivate secure, responsible, and data-driven financial innovation across the national economy.

Following the successful conclusion of its inaugural sandbox cohort in mid-2026—which evaluated breakthroughs in open banking architecture, merchant onboarding automation, and cross-border digital remittances—the central bank has expanded its regulatory perimeter. Cohort 2 specifically solicits institutional pilots for Artificial Intelligence (AI) in financial services, biometric and offline retail payment innovations, Banking-as-a-Service (BaaS) operational models, and next-generation inward remittance corridors.

With applications open through November 30, 2026, eligible commercial banks, microfinance banks, electronic money institutions (EMIs), payment system operators (PSOs), and non-bank technology startups are invited to deploy live, controlled pilots under direct central bank oversight.

For fintech engineering teams and financial institutions deploying mission-critical API gateways, real-time transaction monitoring, and low-latency algorithmic scoring backends, dedicated computational capacity can be provisioned locally through Dedicated Servers and sovereign Dedicated Servers in Pakistan.

---

1. Cohort 1 Outcomes: From Proof-of-Concept to Regulatory Formalization

The launch of Cohort 2 builds directly upon the operational insights harvested during the inaugural sandbox cycle initiated under SBP Vision 2028.

The first cohort shortlisted six pioneering entities to test uncodified business models within defined transaction limits and consumer safeguards:

• Taptap Send UK & United Bank Limited (UBL): Evaluated accelerated inward remittance rails utilizing direct API interconnects.
• Digi Khata (SMC-Pvt) Ltd: Assessed digital merchant bookkeeping integration with formal micro-lending pipelines.
• Swich Retail (Pvt) Ltd & Neem Exponential Financial Services: Validated open banking data aggregators and embedded credit underwriting.
• The Bank of Punjab (BOP): Piloted digital, paperless onboarding mechanics for micro-merchants and street vendors.
• Barq Fintech: Tested alternative routing channels for international remittance inflows.

Following rigorous testing, SBP confirmed that four participants successfully proved their regulatory and technical hypotheses. The practical outcomes from these pilots directly informed the central bank’s consultative drafts on national Open Banking guidelines and streamlined the commercial rollout of digital retail banking licenses across Pakistan.

---

2. Core Focal Themes for Regulatory Sandbox Cohort 2

To address long-standing market frictions—including a massive unbanked population, heavy cash reliance in retail trade, and the high cost of cross-border inflows—the SBP has segmented Cohort 2 into four specific thematic pillars:

Cohort 2 Pillar	Target Technological Focus	Expected Industry Impact
AI in Financial Services	Autonomous agentic payment initiation, machine learning-driven alternative credit scoring, algorithmic AML/CFT transaction screening	Unlocks formal underwriting for thin-file micro-enterprises and consumers without traditional credit histories.
Innovations in Payments	Palm-vein and facial biometric point-of-sale (POS) authentication, store-and-forward offline transactions, BaaS APIs	Removes smartphone ownership hurdles for marginalized citizens and ensures payment resiliency in low-connectivity rural belts.
Technology-Enabled Inward Remittances	Real-time foreign exchange clearing, direct digital wallet interoperability, automated remittance compliance filtering	Lowers remittance intermediation costs below global averages while directing flows into formal banking channels.
NextGen Financial Services (Open Theme)	Quantum-resistant cryptographic signing, tokenized trade receivables, programmable escrow frameworks	Encourages breakthrough engineering paradigms that do not fit standard regulatory buckets.

Fintechs seeking admission must demonstrate not only functional technical viability but also comprehensive consumer protection safeguards, zero-trust cybersecurity controls, and clear fallback mechanisms in the event of pilot termination.

---

3. Deep Dive: Autonomous AI Agents and Alternative Credit Scoring

The explicit inclusion of Artificial Intelligence in Financial Services marks a watershed moment in Pakistani monetary regulation. Historically, algorithmic credit scoring and automated financial decisioning faced conservative compliance barriers due to explainability and data provenance mandates.

Under Cohort 2, the central bank provides a structured safe harbor for two distinct AI implementations:

Autonomous AI Payment Initiation

The sandbox permits testing of autonomous AI agents operating under deterministic user-defined mandates. Rather than requiring multi-step interactive authentication for every recurring micro-payment, consumers can authorize conversational and algorithmic agents to query balances, optimize bill payments, or trigger scheduled investments within hard cryptographic caps and strict velocity bounds.

Alternative Credit Scoring for Thin-File Borrowers

Over 75% of Pakistan’s informal micro, small, and medium enterprises (MSMEs) lack audited financial statements or conventional credit bureau histories with the Electronic Credit Information Bureau (eCIB).

Fintechs in Cohort 2 can train and validate predictive machine learning models leveraging non-traditional data streams:

• Telecommunications utility top-ups and data usage patterns.
• Merchant invoice cycles and point-of-sale inventory turnover data.
• Electricity and gas utility billing settlement velocity.
• Geolocation-verified supplier payment frequencies.

To prevent algorithmic bias, participating fintechs must submit their model interpretability architectures (such as SHAP values and fairness matrices) for regulatory review, ensuring full transparency in loan decisions.

---

4. Biometric Authentication and Offline Payment Resiliency

While smartphone penetration has grown rapidly, significant digital divides persist across tier-2 and tier-3 rural districts. In response, Cohort 2 prioritizes payment innovation that functions independently of high-end personal smartphones or constant cellular connectivity:

Step	Architectural Stage	Technical Execution Mechanism
01	Biometric Capture & Hashing	Optical sensor / palm-vein scanner extracts minutiae and derives a one-way cryptographic hash locally.
02	Secure Offline Ledger	Transaction payload is cryptographically signed and stored in a tamper-resistant local secure element.
03	Batch Synchronization	Encrypted payload is transmitted via low-bandwidth cellular (NB-IoT) or local mesh network upon connection.
04	Core Banking Settlement	Central switch verifies signature against NADRA/SBP directory and clears via Raast or 1Link rails.

1. Biometric Face and Palm-Vein POS Terminals: By integrating certified biometric sensors directly into retail point-of-sale hardware, consumers can authenticate purchases via local biometric templates linked to NADRA-verified credentials, eliminating the necessity of carrying physical debit cards or smartphones.
2. Asynchronous Offline Payments: Addressing intermittent cellular coverage in remote agricultural markets, the framework allows participants to test cryptographically signed, offline store-and-forward ledgers. Transactions are verified locally on tamper-resistant hardware secure elements and cleared across central switches once network connectivity is re-established.

---

5. Technical Infrastructure Mandates for Sandbox Entrants

Operating within the SBP Regulatory Sandbox requires participating fintechs to maintain stringent enterprise infrastructure standards matching those of scheduled commercial banks:

• Local Data Sovereignty: In compliance with SBP Cloud Policy directives, all sensitive personal financial data (PII), biometric templates, and core transaction ledgers must remain hosted exclusively within Tier-3 or Tier-4 facilities located inside the territorial borders of Pakistan.
• Hardware Security Modules (HSM): Cryptographic keys securing API endpoints, tokenized credentials, and transaction signature keys must reside inside FIPS 140-2 Level 3 certified hardware security modules.
• Deterministic API Latency: Real-time integration with national payment switches—including Raast instant payment APIs and 1Link switches—demands sub-second API execution, necessitating high-speed domestic peering with the Pakistan Internet Exchange (PIE).

Fintechs architecting scalable pilot environments can explore related national infrastructure and regulatory developments:

• SBP Grants Commercial Operational Charters to Five Digital Retail Banks
• SBP & 1Link Mandate Universal Raast P2M Dynamic QR Codes Across Retail POS
• MOITT Notifies Pakistan Cloud First Policy 2.0 with Data Residency Mandates
• High-Performance Cloud VPS Hosting in Pakistan

---

6. How to Apply: Eligibility and Deadlines

The application window for Cohort 2 is open through November 30, 2026. Interested participants must submit comprehensive documentation directly to the State Bank’s dedicated sandbox evaluation unit:

• Official Submission Channel: Proposals must be addressed to [email protected].
• Eligibility Criteria: Open to both regulated financial institutions (commercial banks, microfinance institutions, EMIs) and unregulated technology startups partnering with a licensed sponsor entity.
• Evaluation Matrix: Submissions are scored on innovation uniqueness, consumer protection depth, technical scalability, risk mitigation architecture, and systemic value to Pakistan’s financial inclusion objectives.

Selected participants will enter a structured 6-month testing window, during which they will run live customer pilots within bounded transactional caps before presenting their exit evaluation for full commercial licensing consideration.