Expert Insights from: Punit Thakker, Founding team at PayPal, Checkout.com, and PayTabs. 20 years of experience in Fintech
Punit Thakker has spent over 20 years at the intersection of payments, licensing, and financial infrastructure. As a veteran of founding teams at PayPal, Checkout.com, and PayTabs, he has navigated the regulatory landscape of the GCC from the inside. Here, he explains why the sandbox isn’t a shortcut; it’s a smarter way to build.
The Problem with Going All-In from Day One
When a FinTech startup enters the GCC market, the licensing question isn’t just paperwork; it’s a strategic bet. Get it wrong, and you’re looking at capital locked in a compliance structure that doesn’t fit your product. Get it right, and you have a launchpad.
The traditional route is a full-fledged license. But as Punit Thakker explains, that path comes with a steep upfront cost and a long runway before you can test anything in the real world.
“The cost of a license, just the share capital, could be two million dollars. How would you try a product and test it in the market without that runway?”
This is the core tension that regulatory sandboxes were designed to resolve. Rather than forcing a startup to commit fully before it has proven its model, a sandbox grants a limited, time-bound license, what Punit calls a ‘mini-license’, that allows testing under lighter compliance conditions and a defined customer cap. The central bank of the UAE, Bahrain’s CBB, Saudi Arabia’s SAMA, and similar GCC regulators all offer variations of this structure.
In Dubai’s DIFC, for example, the equivalent is an Innovation Testing License (ITL) issued by the DFSA. The ITL defines a ceiling, say, 100 customers in phase one, 500 in phase two, 1,000 in phase three, and graduates the company toward full licensing as it satisfies each set of requirements.
GCC FinTech License Types — And the Companies That Used Them
The GCC licensing landscape isn’t one-size-fits-all. Different products require different structures — and many of today’s leading FinTechs started with far lighter authorizations than they hold now.
Sandboxes as Permission to Pivot
One of the most underappreciated aspects of a sandbox is what it allows companies to do that a full license does not: make mistakes without paying fines.
“Sandbox is designed to make mistakes and learn from your mistakes, and if you make mistakes, you have to rectify them before you become a mature licensed holder.”
For early-stage FinTechs, this is operationally significant. A startup applying for a sandbox license can typically get approved within two to three months. The same process for a full-fledged license takes closer to a year. That nine-month gap is the difference between a product that pivots in time and one that runs out of runway trying to prove a model that doesn’t work.
The flexibility also extends to the product itself. Because the sandbox creates a structured but adaptive environment, companies can test their infrastructure, refine their policies, and adjust their governance, all with the regulatory body’s awareness and input. Punit describes it like a product trial: “It’s a three-month subscription. You only pay after you’ve tested it.”
How Tabby Used Licensing to Build Trust at Scale
When Tabby entered the market as a Buy Now Pay Later platform, no license category mapped neatly onto what it was doing. The company was essentially providing short-term financing on behalf of customers, collecting merchant proceeds and paying them out on installment terms, but the regulatory framework hadn’t yet caught up.
Rather than operating in a gray area indefinitely, the regulatory response was to create a new license category: the short-term financing license. Tabby operated within this framework, and the impact was measurable. Its initial transaction cap was 500 dirhams. As it demonstrated compliance and scale, the cap expanded to 3,000 dirhams.
The regulatory stamp did more than increase limits. It built customer trust. As Punit frames it: “When you get into licensed activity with the central bank, it not only gives you safeguarding measures but it also protects the customers, they know they’re paying a company that isn’t going to disappear.”
Tabby is one of four categories of GCC FinTechs that Punit points to as sandbox success stories. The others include digital wallet operators like Mamo Pay and Zena, account-to-account open banking players like Lean Technologies (operating under the AISP and PISP framework), and corporate card and expense management companies like Peel, Alan, and Pluto, many of which started with sandbox-level MSB (Money Service Business) licenses before expanding their activities and jurisdictions.
Saudi Arabia’s Deliberate Ecosystem Play
Not all GCC markets approach the sandbox identically. Saudi Arabia has taken a particularly proactive stance through Fintech Saudi, a dedicated initiative under SAMA that has cultivated a licensed FinTech ecosystem now approaching 300 companies, with ambitions to reach 1,000.
Part of what makes Saudi’s approach distinctive is how established banks are being drawn into the ecosystem as anchor partners rather than competitors. Al Rajhi Bank, for instance, has developed multiple FinTech subsidiaries, including Neo Leap, MAN Finance, and Ajada. These subsidiaries don’t build all their technology in-house; they work with FinTech companies and can effectively act as a “mini sandbox” themselves, helping startups obtain NOCs from the central bank or Fintech Saudi in a fraction of the usual time.
“If you go without Neo Leap in Saudi Arabia, you might wait two years,” Punit notes. “With Neo Leap, you can get started in two months. And the bank becomes your first customer.”
This model is also appearing in the UAE and other GCC markets, where banks are spinning off fintech subsidiaries and creating structured onboarding pathways for startups, compressing time-to-market, reducing compliance friction, and providing a ready customer base from day one.
The Sandbox-to-Full-License Pathway
The sandbox isn’t meant to be a permanent state. Its value lies in the pathway it creates, from concept to pilot to compliant, scalable operation.
Punit’s advice to FinTech founders considering the licensing question is precise: start with the sandbox, operate in one country, and only expand activities as the product proves itself. “Focus on licenses once you’ve pivoted your product one step, then get more activities and categories, but start something.”
The broader GCC regulatory infrastructure supports this approach. Saudi Arabia has SAR (its account-to-account framework), the UAE has ANI and the Open Finance Framework, Bahrain has Benefit, Oman has Omanet, and Kuwait has Knet. Each of these provides a compliant rail on which FinTechs can build, and sandbox licenses are the mechanism through which new entrants gain access to those rails without full capital commitment upfront. For international companies eyeing the GCC, the message is similarly pragmatic. The region has significant purchasing power, a central banking system open to innovation, and regulatory frameworks designed to bring new entrants in carefully rather than shut them out. The sandbox is the front door
The GCC FinTech Sandbox Pathway
From concept to compliant operation — how startups move from sandbox license to full-scale market presence.