Central Bank of Uzbekistan Regulatory Sandbox: Three Tracks and Cyber Rules
The Central Bank has put out for discussion a new regulation on the 'regulatory sandbox' for financial services: three testing tracks, 40 business days to review an application and expulsion for a leak of customer data. Comments are accepted until 26 September 2026.
In brief: On 16 September 2026 the Central Bank of Uzbekistan (CBU) published on the regulation.adliya.uz portal a draft of a new Regulation on the "regulatory sandbox" (tartibga solish qumdoni) in financial services. The draft introduces three testing tracks ("innovation," "acceleration" and "technology partnership"), requires applicants to confirm their cybersecurity measures and allows a participant to be expelled over a serious incident involving a leak of customer data. It is a draft resolution of the CBU Board; public discussion runs until 26 September 2026, and Spot.uz reported on it on 23 September.
What changes: key figures of the draft
| Rule | Value | Draft clause |
|---|---|---|
| Review of an application | 40 business days | para. 23 |
| Entry in the register and notification after the decision | 1 business day | para. 26 |
| Arranging a consultation before filing an application | within 5 business days of the request | para. 18 |
| Testing in the "acceleration" track | up to 12 months + up to 6 months | para. 16 |
| Overall term: test + operation under a CBU permit | no more than 3 years | para. 40 |
| Report a cyber incident to the CBU | within 24 hours of detection at the latest | para. 22 |
The draft will replace the current Regulation No. 3391, registered by the Ministry of Justice on 4 October 2022 (lex.uz). The new resolution will take effect on the day of its official publication (para. 3 of the draft); no date has been set yet. The basis cited in the preamble is Presidential Resolution PQ-359 of 27 November 2025 (in force since 28 November 2025) on the development of fintech (lex.uz).
The three tracks of the CBU sandbox
- "Innovation" (para. 12) — a new or previously unused approach that is hindered by current rules, where there is scope to change those rules.
- "Acceleration" (para. 13) — a service that is new to Uzbekistan or already proven abroad. The applicant or co-applicant must be an organization supervised by the CBU, and the service must require a license and/or an amendment to legislation.
- "Technology partnership" (para. 14) — technical solutions for the services of CBU-supervised organizations that do not breach current rules.
The applicant must be a resident legal entity; a co-applicant may be a non-resident (except in cases provided for by law). A company supervised by another agency is eligible if its service belongs to a type the CBU supervises and its own regulator has issued a positive opinion (para. 4). Crypto platforms are covered by a separate NAPP regime, while stablecoins are tested in the joint NAPP and CBU sandbox (see the HUMO token pilot).
Cybersecurity and grounds for expulsion
Insufficient technical capacity to protect personal data and banking secrecy is grounds for refusal (para. 25). The CBU strips a participant of its status (the decision is taken within five business days of detection), including if:
- the start of testing is delayed by more than 6 months, or there is no activity for 6 months after the start;
- the conditions of the temporary procedure are breached two or more times;
- a serious cyber incident occurs involving a leak or loss of customer data.
In advertising, a participant must state that the service is operating in test mode, and must unconditionally compensate losses from transactions made without the customer's consent, including those caused by its own error (Chapter 3 of the draft).
FAQ
What is the Central Bank of Uzbekistan regulatory sandbox? It is a special legal regime under which a company tests a new financial service on a limited circle of customers and volumes under the supervision of the Central Bank. The current rules are Regulation No. 3391 of 4 October 2022; the 2026 draft is meant to replace it.
How long does the CBU take to review a sandbox application? Under the draft, 40 business days from receipt of the application (para. 23). After the decision, the CBU enters the data in the register and notifies the applicant via the platform within one business day (para. 26).
Can I influence the draft regulation? Yes: until 26 September 2026, proposals are accepted on the regulation.adliya.uz portal. The final text is approved by the CBU Board and will take effect on the day of its official publication.
Sources
- Draft resolution of the CBU Board, regulation.adliya.uz, published 16 September 2026: https://regulation.adliya.uz/project/11492/36064
- Spot.uz, 23 September 2026: https://www.spot.uz/ru/2026/09/23/cbu-sandbox/
- Regulation No. 3391 of 4 October 2022, lex.uz: https://lex.uz/docs/6225378
- PQ-359 of 27 November 2025, lex.uz: https://lex.uz/ru/docs/7864260
