SBP’s Sandbox and EU AI Act: a timing advantage for Pakistani fintechs

The State Bank of Pakistan (SBP), as part of its Vision 2028 strategy, launched the country’s first Regulatory Sandbox for financial services in late 2025. Licensed and non-licensed entities were both invited to apply for this inaugural cohort, where they would test their innovative products with real consumer data, in a controlled regulatory environment.

The regulator released details of the shortlisted participants in early 2026. The cohort comprises fintech providers and private banks with products in three main service categories i.e. technology-enabled remittances, open banking and remote merchant onboarding.

Regulatory sandboxes worldwide are used as live laboratories by central banks and other regulatory agencies to assess emerging technology such as artificial intelligence (AI), machine learning and blockchain for developing evidence-based policy for their regulation.

SBP launched the Regulatory Sandbox with a well-defined roadmap and release strategy. It is anticipated the central bank will ultimately shape the country’s modern technology governance guidelines, as the federal government continues to rely on outdated legal frameworks to govern emerging technology in both the financial and non-financial sectors. The timing of SBP’s Regulatory Sandbox is opportune for both the regulator and its participants, for reasons few anticipated before the release of the sandbox applications.

The launch of the State Bank’s Regulatory Sandbox coincides with unprecedented regulatory developments in AI, halfway across the world in the European Union (EU). While Pakistani firms are not directly bound by regulations in the EU, the third-party service providers they contract with, most certainly are.

Pakistan’s banking sector relies heavily on international technology vendors such as Temenos, Oracle and Salesforce, to manage their core banking platforms, digital customer portals and processing of electronic payments. Many of these vendors are either headquartered in the European Union, or do large-scale business there, making them directly liable to the EU AI Act’s obligations for technology service providers.

The EU AI Act was not introduced as an optional compliance framework. It instead mandates an entirely new governance architecture for AI.  This includes transparency requirements, system embedded mechanisms to cater to human oversight and continuous monitoring of high-risk AI systems. Service providers headquartered in the EU who are providing AI services have already cited massive rise in operational costs in trying to cater to these mandatory compliance requirements

As a classic case of value chain economics, the service providers will not bear this rise in operational costs. It will instead be spread downstream to their clients. Their clients will face incremental costs via rising licensing fees, subscriptions or implementation charges. This will not just affect users in the EU, it will have a ripple effect worldwide.

In an efficient global technology market vendors would be expected to create two lines of products, one offered to their EU clients and the other to their overseas clients. The rising operational costs caused by the EU AI Act would be expected to be borne downstream only by the clients doing business in the EU. However, the market is not fair and has rarely succeeded in jurisdictional cost isolation.

This phenomenon is due to what historians, and modern-day scholars call the “Brussels Effect”, which is based on an understanding that the size and purchasing power of the European market is too large to ignore.

For multinational firms and technology solution providers this means aligning their products with EU standards rather than creating different classes of products to match different markets and their regulatory standards. The EU regulations become a de facto global standard and users residing in non-EU countries are offered the same pricing structure for products offered to users residing in the European Union, compliant with the EU AI Act.

Financial institutions in Pakistan, relying on imported software and cross-border cloud infrastructure from the EU, will see rising costs of service from these international service providers. This is where the State Bank’s Regulatory Sandbox may help create a cost-efficient alternative solution for Pakistani banks and protect domestic financial institutions from regulatory spillover and escalating costs.

Policy recommendation

The anticipated escalation in cost of imported software and services will only be linked to their AI components, leaving their standard versions unaffected. To proactively manage the incoming compliance cost of the EU AI regulation, the SBP may consider using its Regulatory Sandbox to encourage startups and fintechs to build AI add-ons for local banks. These can include local AI modules for KYC/AML, fraud detection, credit scoring and transaction monitoring.

Pakistani banks may continue operating their core banking systems and managing their infrastructure on imported software. They should however be encouraged to adopt locally developed component-level AI functionality from fintechs who have successfully tested their AI solutions in the State Bank’s Regulatory Sandbox. This strategy will ensure banks maintain operational continuity while insulating themselves against the incoming compliance cost.

The article does not necessarily reflect the opinion of Business Recorder or its owners.