Regulatory Sandboxes for Tokenization: What the UK DSS, EU DLT Pilot & MAS Guardian Actually Produced

Introduction

Thirty-three months after it opened, the UK's Digital Securities Sandbox (DSS) has one firm cleared for live business. Sixteen firms hold testing approvals, and none has joined since December 2025 (Bank of England, 2026). The EU's distributed ledger technology (DLT) Pilot Regime shows a similar gap. Six infrastructures hold permits, yet the last public activity data records about €11.9 million of tokenized shares. The Commission wants to scale the EU regime, and the Council of the EU is due to seek its position on 9 October 2026. This guide scores the UK, EU and Singapore programmes, plus the Financial Conduct Authority (FCA) sandbox and the Hong Kong and Dubai pilots. It counts entrants, live permissions, recorded volume and end dates. It then sets out why uptake stays low, in the regulators' own words.

Which Tokenization Sandboxes Exist, and How Should Their Results Be Measured?

A regulatory sandbox for tokenization is any regime that lets firms issue, trade or settle tokenized securities under supervision before permanent rules exist ↗. The label covers three different tools. Four measures separate output from announcements: entrants, live permissions, recorded volume and a fixed end date.

Three Kinds of Sandbox

The first kind changes the law. The UK Digital Securities Sandbox (DSS) and the EU's distributed ledger technology (DLT) Pilot Regime let approved firms disapply settlement and custody rules written for book-entry securities. Both rest on legislation: Statutory Instrument (SI) 2023/1398 in the UK and Regulation (EU) 2022/858 in the EU (legislation.gov.uk, 2023; EUR-Lex, 2022). The second kind tests products under existing law. The Financial Conduct Authority (FCA) Regulatory Sandbox and the Dubai Financial Services Authority (DFSA) Innovation Testing Licence fall here. The FCA states that its sandbox "is not regulatory exempt" (FCA, 2026). The third kind is an industry programme. Project Guardian, run by the Monetary Authority of Singapore (MAS), and Project Ensemble at the Hong Kong Monetary Authority (HKMA) coordinate pilots and standards without granting permissions.

Four Ways to Measure Output

Entrant counts come first, because regulators publish them. The Bank of England lists every sandbox approval notice (SAN) on its DSS dashboard. The European Securities and Markets Authority (ESMA) keeps a list of authorised DLT market infrastructures. Live permissions come second. A UK firm at Gate 1 may test, but it "does not have permission to undertake any live activity" until Gate 2 (Bank of England, 2026). Recorded volume is the third and scarcest measure; only ESMA has published issuance values, in its June 2025 review. The fourth measure is the end date, since a time-limited permission shapes whether a firm will invest at all. Applied to six programmes, these four measures produce the scorecard later in this guide.

The UK sandbox's public dashboard dates every approval it has granted, which makes it the easiest of the six to audit.

What Has the UK Digital Securities Sandbox Produced Since January 2024?

The Digital Securities Sandbox has admitted 16 firms and put one into live business since it opened on 8 January 2024. HSBC Bank plc is that firm, approved at Gate 2 on 13 July 2026; no other entrant had passed Gate 2 as of 6 October 2026 (Bank of England, 2026).

Sixteen Gate 1 Entrants and None in 2026

The Bank of England's dashboard listed 16 Gate 1 sandbox approval notices as of 6 October 2026. ClearToken CSD and Montis Digital came first, in December 2024 (Bank of England, 2026). Market infrastructure incumbents followed: Euroclear UK & International in March 2025, Tradeweb Europe in July and LSEG B3 in August. J.P. Morgan Securities plc and Monee Financial Technologies joined on 2 October 2025. The latest notice, dated 4 December 2025, reissued Alt Ltd's March 2025 approval to a new entity, Ctrl Alt. No Gate 1 notice carries a 2026 date. Gate 1 is a testing stage only, so these firms can run nothing live inside the sandbox (Bank of England, 2026). The approval curve went flat after the fourth quarter of 2025.

HSBC Orion: The Only Firm Live

HSBC Bank plc passed Gate 2 on 13 July 2026 and became a digital securities depository (DSD), the sandbox's name for a ledger-based securities depository. Its platform, HSBC Orion, may now record and settle live digital securities within the Bank's go-live limits (Bank of England, 2026). The step took a year: HSBC had received its Gate 1 notice on 7 July 2025. HM Treasury had already chosen HSBC Orion in February 2026 as the platform for its digital gilt pilot (HM Treasury, 2026). No public figure yet shows how much HSBC has issued or settled inside the sandbox. No entrant has reached Gate 3, the scaling stage with higher limits. Gate 4, a permanent regime for depositories, does not exist yet.

Limits, Fees and the January 2029 End

Each digital securities depository works within go-live limits that the Bank of England sets per firm. A depository may start with £600 million of UK government debt and £900 million to £1.5 billion of sterling corporate bonds (Bank of England, 2026). Approval costs £40,000, plus an estimated £85,000 annual fee shared equally across depositories. The sandbox covers shares, bonds, money market instruments, fund units and emissions allowances, but not derivatives or Bitcoin. Its end date is fixed in law. Regulation 13 of SI 2023/1398 says the regulations "cease to have effect on 8th January 2029" (legislation.gov.uk, 2023). HM Treasury can extend that date only by further legislation, and the Bank describes a later move to a permanent regime as the intended exit (Bank of England, 2026).

Data current as of October 2026.

A depository with permission and limits still needs issuers, and HM Treasury plans to be the first sovereign one (HM Treasury, 2026).

Will the DIGIT Digital Gilt Give the UK Sandbox Real Volume?

The Digital Gilt Instrument (DIGIT) is the sandbox's clearest test of scale, but it has not been issued. HM Treasury expects the first transaction by the first quarter of 2027 on HSBC Orion and appointed six lead managers on 6 October 2026 (HM Treasury, 2026).

What HM Treasury Has Committed

HM Treasury opened procurement for DIGIT in March 2025 and confirmed its design in July 2025. The note will be digitally native, short-dated and issued on a platform inside the Digital Securities Sandbox, with on-chain settlement. It sits outside the government's main debt management programme, so it replaces no conventional gilt auction. HSBC won the platform contract in February 2026. On 6 October 2026, the Treasury named Barclays, HSBC, Lloyds, Morgan Stanley, NatWest and RBC Capital Markets as joint lead managers. The government also expects to list DIGIT on the London Stock Exchange's main market. It has published no issue size, and further issues depend on the first transaction succeeding.

Stablecoin Settlement and the LSEG Link

Two infrastructure decisions shape whether DIGIT can trade after issue. In July 2026, HSBC and LSEG signed a memorandum of understanding for a link between HSBC Orion and LSEG B3, which holds a Gate 1 notice and would act as investor depository (HM Treasury, 2026). That link would let investors hold the gilt through a second sandbox platform. The cash side changed too. Since 30 June 2026, sandbox firms may apply to settle in stablecoins that meet minimum requirements aligned with the FCA's stablecoin regime (Bank of England, 2026). Those include a redemption right for every holder and a separate legal entity holding the backing assets. A firm requests the change as a modification to the Gate 2 settlement rules, and the Bank judges each stablecoin case by case.

The EU pilot began nearly ten months before the UK sandbox and has six permits to show for it.

How Many Firms Has the EU DLT Pilot Regime Actually Authorised?

Six DLT market infrastructures hold permits under the DLT Pilot Regime, on an ESMA list dated January 2026 that was still current on 6 October 2026 (ESMA, 2026). The only measured activity is older: ESMA's June 2025 review recorded about €11.9 million of tokenized shares and two bond issues.

Six Infrastructures on ESMA's List

The regime has applied since 23 March 2023, yet the first permit came more than 18 months later. In April 2024, ESMA told EU lawmakers that no infrastructure was authorised and only four formal applications had arrived (ESMA, 2024). The Czech National Bank authorised CSD Prague to run a DLT settlement system on 11 October 2024. Germany's Federal Financial Supervisory Authority (BaFin) followed with 21X AG on 3 December 2024 and 360X AG on 29 April 2025. Three more arrived in the second half of 2025: Axiology in Lithuania, LISE in France and Securitize Europe in Spain. Four of the six run combined trading and settlement systems. ESMA's list shows no end dates and no lower thresholds for any of them.

What ESMA's Review Measured

ESMA's review, published on 25 June 2025, covered the regime from launch to 31 May 2025. Only three infrastructures were authorised at the cut-off, and ESMA described trading activity as "extremely limited" (ESMA, 2025). CSD Prague had recorded six share issues worth €11,917,753 and one debt issue worth €401. 21X had recorded one debt issue of up to $500 million and had operated since 21 May 2025. ESMA recorded no investor losses or market abuse, noting that no trading took place in the period. About ten more potential applicants were in the pipeline. ESMA had published no later issuance or trading figures as of 6 October 2026. The three newer venues therefore have no public performance record.

The Exemptions Operators Asked For

The DLT Pilot works by exemption. Each operator asks its national regulator to disapply named articles of the Central Securities Depositories Regulation (CSDR) or the Markets in Financial Instruments Directive (MiFID II). All five settlement-capable infrastructures were exempted from CSDR Article 40, the cash-settlement rule that favours central bank money (ESMA, 2026). Four also set aside CSDR's book-entry requirement in Article 3, because a token on a ledger is not a book entry at a depository. 360X, a trading facility only, needed no exemption. The pattern defines the regime's reach. Operators can rebuild the securities record on a ledger, but they still need a cash asset that the law and their participants accept.

Data current as of October 2026.

The European Commission's answer to thin uptake is to make the caps far larger and the permits permanent.

What Would the December 2025 Proposal Change for the DLT Pilot?

The Commission's proposal would turn the pilot into a large, permanent route, but none of it applies yet. COM(2025) 943, published on 4 December 2025, remained a proposal as of 6 October 2026. Finance ministers are scheduled to seek a Council position on 9 October 2026 (Council of the EU, 2026).

From €6bn to €100bn

Today's caps bind each infrastructure, not the regime as a whole. Article 3 of Regulation (EU) 2022/858 limits shares to issuers under €500 million market capitalisation and bonds to issues under €1 billion. Instruments on one infrastructure may not exceed €6 billion in total, and an operator reaching €9 billion must activate its transition strategy (EUR-Lex, 2022). The Commission's explanatory memorandum proposes to "raise it to EUR 100 billion". It adds that the "product-specific threshold would be removed" (European Commission, 2025). Permissions would lose their time limits, and operators below €10 billion would get a simplified regime. Crypto-asset service providers (CASPs) authorised to run a trading platform would also be allowed to operate DLT trading and settlement systems.

Where the Council Stands Before 9 October

The DLT Pilot changes ride inside the Market Integration and Supervision Package, whose hardest fight sits elsewhere. Member states disagree over how much direct supervision to hand ESMA. A Council note of 8 June 2026 recorded a broad majority for ESMA supervising significant CASPs only, not all of them (Council of the EU, 2026). The provisional agenda for 9 October lists the package for a general approach. The European Parliament's file read "Awaiting committee decision" on 2 October 2026. A Council deal would open trilogue negotiations with Parliament, not change the law. Until a final text appears in the Official Journal, the €6 billion cap and six-year permits remain law.

Singapore took a different path: it built standards with industry instead of rewriting statutes.

What Did MAS Project Guardian Produce If It Grants No Licences?

Project Guardian produced standards, trials and a pipeline to live products, not permits. MAS calls it "a cross-border sandbox program" with 28 financial institutions and nine policymakers as members as of November 2025 (MAS, 2025). It exempts no participant from Singapore securities law.

Frameworks, Pilots and Live Use Cases

By November 2024, Guardian had run more than 15 industry trials in six currencies, with over 40 institutions, associations and policymakers across seven jurisdictions (MAS, 2024). That month its industry groups published the Guardian Fixed Income Framework and the Guardian Funds Framework. The fixed income framework combines the International Capital Market Association's bond data taxonomy with existing token standards and design principles. The funds framework sets out on-chain share-register models and a token taxonomy for multi-asset funds. MAS's Guardian page now lists seven publications and cites live use cases from Ant Group, Apollo, DBS, Franklin Templeton, Hamilton Lane, OCBC and UBS. Citi, HSBC, Schroders, Standard Chartered and UOB formed a Guardian Wholesale Network to commercialise their trials.

From Guardian to the Tokenisation Guide and MAS Bill

Singapore turned its tokenization policy into guidance, not new statute. MAS's Guide on the Tokenisation of Capital Markets Products, updated on 14 November 2025, applies existing securities law under the principle "same activity, same risk, same regulatory outcome" (MAS, 2025). MAS then tested its own paper. On 13 November 2025, it announced the first live issuance of Singapore dollar wholesale central bank digital currency (CBDC), used by DBS, OCBC and UOB for overnight interbank loans. On 21 September 2026, MAS auctioned a S$1 million tokenised MAS Bill settled in that wholesale CBDC; the bill matured on 30 September. Guardian's measurable output is standards and live institutional products, not a register of authorised venues (MAS, 2025). A companion guide covers Guardian's individual pilots ↗ in depth.

The FCA's own sandbox, running since 2016 (FCA, 2026), works more like Guardian's tests than like the DSS.

Is the FCA Regulatory Sandbox the Same as the Digital Securities Sandbox?

No. The FCA Regulatory Sandbox tests products under existing law, while the Digital Securities Sandbox modifies the law for market infrastructure. Searches for "FCA sandbox crypto" blur the two. The FCA's 2026 stablecoin cohort shows the older sandbox's distinct output: changes to final rules.

A Testing Programme, Not a Legal Carve-Out

The FCA launched its Regulatory Sandbox in 2016 and has accepted applications year-round since 2021. Firms test products live with real consumers, on a small scale and for a limited time. The FCA states that the sandbox "is not regulatory exempt", so a firm carrying on a regulated activity needs authorisation first, restricted to the test (FCA, 2026). The Digital Securities Sandbox works the other way: SI 2023/1398 modifies settlement and depository law for the firms admitted. For crypto firms, the FCA door is narrow. As of October 2026, its innovation services accept new cryptoasset-related applications only from registered prospective stablecoin issuers seeking settlement use in the DSS.

The Stablecoin Cohort and Its Rule Changes

The FCA opened a stablecoin cohort on 26 November 2025 and received 20 applications by 18 January 2026. It chose four firms on 25 February 2026: Monee Financial Technologies, ReStabilise, Revolut and VVTX (FCA, 2026). Monee also holds a Gate 1 notice in the Digital Securities Sandbox. The cohort produced a measurable result within months. The FCA's final stablecoin rules, PS26/10, published on 30 June 2026, cite lessons from the four testers. The T+1 redemption clock now starts once the issuer receives the stablecoin in its wallet, not when a holder files a request. The FCA also allowed more flexibility in disclosures. Those rules apply when the UK cryptoasset regime commences on 25 October 2027.

Data current as of October 2026.

Outside the UK and EU, Hong Kong and Dubai run the two tokenization sandboxes with the most public detail.

How Do Hong Kong's and Dubai's Tokenization Sandboxes Compare on Output?

Hong Kong has moved furthest, from experiments to real-value settlement, while Dubai's DFSA has a cohort but no published results. The HKMA's EnsembleTX pilot, launched on 13 November 2025, runs through 2026 (HKMA, 2025). The DFSA drew 96 expressions of interest but has published no count of admitted firms.

HKMA Ensemble: From Sandbox to Real Value

The HKMA announced Project Ensemble on 7 March 2024 to explore interbank settlement of tokenized money. Its sandbox opened on 28 August 2024 with four themes: fixed income and funds, liquidity management, green finance, and trade finance. Banks connected their tokenized deposit platforms and tested settlement with experimental money (HKMA, 2024). On 13 November 2025, the HKMA moved to EnsembleTX, a pilot for real-value transactions in tokenized deposits. Its first focus is tokenized money market fund trades and real-time treasury management. Interbank settlement runs through Hong Kong's real-time gross settlement system at first, with tokenized central bank money to follow. Ensemble differs from the DSS in its target: the cash leg, not the securities register.

DFSA's Tokenisation Sandbox and ITL Cohort

The DFSA, regulator of the Dubai International Financial Centre (DIFC), opened its Tokenisation Regulatory Sandbox in March 2025. It received 96 expressions of interest from the UAE, the UK, the EU, Canada, Singapore and Hong Kong (DFSA, 2025). On 16 June 2025, the DFSA began working with firms selected for its Innovation Testing Licence, a restricted licence with waivers for the test period. It sent other applicants straight to full authorisation because their businesses were mature. A firm leaving the cohort must apply for a full licence or withdraw. The DFSA has not published the number of firms admitted or any issuance data. Its July 2026 consultation on tokenized fund units noted it had "not seen material market developments in this area" (DFSA, 2026).

Data current as of October 2026.

Across all six, the regulators' own reviews explain why so little has gone live.

Why Has Sandbox Uptake Stayed Low, According to the Regulators Themselves?

The regulators' own reviews name four causes: restrictive caps, uncertain duration, no settlement cash the law fully accepts, and weak links to existing infrastructure. ESMA's June 2025 report documents all four for the EU pilot, and the UK and Eurosystem fixes of 2026 target the same gaps (ESMA, 2025).

Caps and Time-Limited Permissions

ESMA reported that national regulators and industry find the DLT Pilot's thresholds "too restrictive". In practice, the caps exclude many large-cap issuers and established instruments, which limits commercial viability (ESMA, 2025). A share issuer worth €500 million or more cannot use the regime at all. Duration weighs on the same decision. Each EU permit lasts up to six years, and ESMA wrote that "uncertainty around the regime's duration may be dissuading larger market actors" from committing resources. Its April 2024 letter had already flagged the "dissuasive effect of the perceived time limit". The UK sandbox carries a similar cliff edge, because its regulations lapse on 8 January 2029 unless HM Treasury legislates.

The Missing Cash Leg

ESMA called the lack of trusted cash settlement "a recurring challenge cited by multiple applicants". Without central bank money for DLT transactions, platforms fall back on e-money tokens (EMTs) or simulated cash ledgers, which adds legal complexity and credit risk (ESMA, 2025). The exemption pattern confirms it: every settlement-capable EU infrastructure set aside CSDR's cash-settlement article. Regulators are now supplying the missing asset. The Bank of England opened the UK sandbox to qualifying stablecoins on 30 June 2026. The Eurosystem launched Pontes on 21 September 2026 to settle tokenized transactions in central bank money, with 13 banks and four DLT operators, including Axiology (ECB, 2026). Hong Kong's EnsembleTX and Singapore's wholesale CBDC trials target the same gap.

Legal Uncertainty and Incumbents' Alternatives

ESMA also cited heavy set-up costs and the absence of live interoperability with central securities depositories (CSDs), payment systems and trading venues (ESMA, 2025). Buy-side firms raise a parallel list. A November 2025 report by the UK Investment Association and the Investment Management Association of Singapore, prepared with the FCA and MAS, named five barriers. They are liquidity and secondary trading, custody, changes to investor rights, consumer protection and legal or regulatory questions. Large incumbents also have a route that needs no sandbox. KfW's €100 million crypto bond under Germany's Electronic Securities Act and Hong Kong's government digital green bonds on HSBC Orion settled under national law. An issuer using those routes faces no sandbox cap and no expiry date.

FAQ

References / Sources