Regulation
The Digital Securities Sandbox
The Digital Securities Sandbox is a live regime run jointly by the Bank of England and the FCA, in which a UK firm may run securities settlement on a new ledger under limits it could not otherwise get. chainscore.net is not in it, and the directory does not record who is.
What the sandbox actually is
The Digital Securities Sandbox is a regulated live environment, operated jointly by the Bank of England and the Financial Conduct Authority under the Financial Services and Markets Act 2023 (Digital Securities Sandbox) Regulations 2023. Its purpose, in the regulators’ own framing, is to explore how developing technologies could be used to carry out the activities of notary, maintenance and settlement for financial securities — either alone, or together with operating a trading venue.
That is a narrower thing than “a sandbox for digital assets.” The subject is post-trade plumbing: recording who owns a security, keeping that record, and settling changes to it. The sandbox exists because the existing law assumes that job is done by a central securities depository working a particular way, so the regulations switch off and rewrite parts of that framework for firms inside it. It runs until 8 January 2029 and can be extended by HM Treasury.
A firm moves through five stages separated by four gates, and its legal designation changes as it goes. Clearing Gate 1 makes it a sandbox entrant, which confers no permission to do live business — only the right to test and to engage with supervisors. Gate 2 is the one that matters commercially: pass it and the firm becomes a Digital Securities Depository, and may settle real securities under an initial limit. Gate 3 raises the limit. Gate 4 is the exit, into a permanent regime that does not exist yet.
Each entrant holds a Sandbox Approval Notice, which the guidance describes as a visa. It names the activities the firm may carry on, any conditions attached, and the limits that apply. The notices are published, which is why the entrant list below is a matter of record rather than inference.
Two regulators, one gate
Depository activity is the Bank’s to approve; operating a trading venue is the FCA’s. A firm that wants to do both — the guidance calls this a hybrid entity — has to satisfy both, and the trading-venue authorisation can only take effect at the same point the Bank approves the depository. The two assessment tracks run in parallel and converge at Gate 2.
Only UK-established entities are eligible. Branches of overseas firms are explicitly excluded, and a consortium has to incorporate a single UK entity to apply. This is the detail that does most of the work later in this note: a global bank’s UK presence is not by itself a qualification, and the thing that gets approved is one named legal entity rather than a group.
The published timings are unusually concrete. A Gate 1 decision takes roughly four to five weeks. The Bank aims to assess a depository application at Gate 2 within four months on average; the FCA usually determines a complete trading-venue application within six, against a statutory limit of twelve. Fees are £10,000 on application, £40,000 once approved as a depository, and an estimated £85,000 a year on a cost-recovery basis, with £54,380 for a trading-venue authorisation.
One disclosure in the guidance deserves to be quoted rather than paraphrased: a depository in the sandbox is not required to meet the same standards as a central securities depository, and users “should expect a higher risk of failure and operational disruption relative to activity outside of the DSS.” Entrants must also hold wind-down plans and the capital to execute them, because the regulators expect some entrants to fail. Passing a gate is not a quality mark.
Limits are the containment
The Bank is explicit that limits, not requirements, are its main mitigant against financial-stability risk from the sandbox. Because activity is capped, it can afford a lighter standard at Gate 2 than a real depository would face. Everything else follows from that trade.
A firm entering go-live is set at the bottom of a published range: £600 million of UK government debt, £900 million of sterling corporate bonds against a ceiling of £1.5 billion, £1.8 to £3 billion equivalent of non-sterling corporate bonds, £600 million of asset-backed securities, and £300 million of short-term money market instruments combined. A sterling money market fund is capped at £5 billion of assets under management per fund. When an instrument matures the capacity is freed for reuse.
Trading-venue activity is not limited at all — and the FCA does not expect to accept a trading-venue-only model into the sandbox in the first place. The cap is on the settlement layer, which is where the financial-stability exposure sits.
How much headroom exists
Above the per-firm limits sits a second ceiling for the sandbox as a whole: £8 to £13.1 billion of UK government debt, £17 to £28 billion of sterling corporate bonds, £8 to £16 billion of asset-backed securities, and £4.4 to £8.8 billion of commercial paper and certificates of deposit. Equities are handled differently — a firm may immobilise and tokenise up to 6% of a FTSE 350 company’s outstanding shares, and has to show how it will reflect corporate actions in the tokenised holdings.
Set one firm’s opening allowance against the aggregate and the character of the regime is clear. A single entrant starts with something on the order of a twentieth of sandbox-wide corporate bond capacity. The Bank has said it will review its whole approach to limits within three years of launch.
Applications
The instrument classes the limits name are the applications: gilts, corporate bonds, asset-backed securities, commercial paper and certificates of deposit, money market funds, and immobilised FTSE 350 equity. The first live use is a digitally native bond programme — HSBC has been approved to run issuance, servicing and settlement on its Orion platform, including DIGIT, the UK’s digital gilt instrument, and corporate bonds.
The payment leg has been the more consequential moving part. On 30 June 2026 the Bank broadened the acceptable settlement assets to include stablecoins that meet a set of minimum requirements closely aligned to the FCA’s regime for UK qualifying stablecoins: a universal right of redemption, backing assets with an independent attestation of the one-to-one ratio, separate legal entities for the issuer and the custodian of those backing assets, financial-crime controls compliant with international standards, and a claim on the backing assets in insolvency.
Permission is case by case and narrow. A firm requests a modification to the settlement-asset rule, naming the specific stablecoins; the Bank decides, issues a direction, and the firm’s notice is updated and republished. Tokenised deposits and a bank’s own settlement tokens are also in use — HSBC’s approval is conditioned on cash settling through accounts at HSBC Bank plc, whether as settlement tokens or tokenised deposits, and on the firm remaining a credit institution permitted to accept deposits.
Retail access is deliberately last. Serving retail clients directly requires the ordinary regulated-activity permissions on top of sandbox approval, and letting a retail client hold direct legal title to a security with no regulated custodian in between requires clearing Gate 3 first.
Who is in it, and until when
Sixteen firms hold published Gate 1 notices. They are a mix of new ventures — ClearToken, Montis Digital, BPX Markets, SLIX Finance, Liquidity Digital Assets, Platform-D, Curveblock, TECHT LABS, Monee Financial Technologies, Netzero Assets International, Ctrl Alt — and incumbent infrastructure: Euroclear UK & International, Tradeweb Europe, LSEG B3, J.P. Morgan Securities plc, and HSBC Bank plc.
One firm has cleared Gate 2. HSBC Bank plc was approved as a Digital Securities Depository on 13 July 2026, having entered at Gate 1 a year earlier. Everyone else on that list is still in non-live testing, whatever their announcements imply.
The window is closing from both ends. The FCA expects applications to shut around March 2027 so that the regulators and the firms already inside can prepare for a transition, and Gate 3 opens only at set review points. Making the permanent regime real needs HM Treasury to report to Parliament and lay a statutory instrument; until then, every entrant is operating inside a regime with an end date.
Where this meets the 28-entity directory
The directory holds 28 entities across 51 service rows, and records what crypto-asset services a house offers and under which licence type. The sandbox list records which UK legal entity may run notary, maintenance and settlement on a new ledger. These are different questions, and the honest answer to “how do they relate” is: barely, and only at one point.
Checked name by name against the published notices, one of the 28 has a UK entity on the entrant list. JPMorgan Chase is a directory entity; J.P. Morgan Securities plc cleared Gate 1 on 2 October 2025. Even there the two records describe different activities — the directory’s three JPMorgan rows are interbank payments, tokenised capital and stablecoin settlement, none of which is depository activity.
The gaps run both ways, and both are instructive. HSBC holds the only Gate 2 approval in the regime (HSBC Orion). HSBC is a directory entity for Hong Kong tokenised-deposit and Project Guardian work; that does not make the UK Gate 2 notice a directory field. The directory rows are EnsembleTX and Guardian tokenisation, not DSS depository activity. And Morgan Stanley is a directory entity with no sandbox entrant — worth stating plainly, because a name-similarity match between “J.P. Morgan Securities” and “Morgan Stanley” is exactly the kind of error that produces a false claim about a regulated firm. The mapping behind the figure above was done by hand for that reason.
6 of the 28 entities carry a UK, FCA or London mention across 17 of the 51 service rows. None of that implies sandbox eligibility, let alone participation: eligibility requires a UK-established entity and excludes branches of overseas firms, so a row saying a service is available in the United Kingdom answers a different question again.
So sandbox status is not a directory field, and it is not derived from one. An unlabelled house stays unknown. Where a directory row and a published notice do line up, the notice is the source and the directory says nothing about it. Verified by chainscore.net means a label is documented in the label book — it is not KYC, and it is certainly not a sandbox approval.
What a screen can and cannot see
A sandbox settlement leg runs on a permissioned ledger, which is the case chainscore.net already handles by refusing to guess. HSBC Orion is named on every report as an unindexed ledger, alongside GS DAP, Citi Token Services and Sygnum DLT. A leg that enters one of those books is reported as not_observable — out of sight, permissioned ledger. It is not recorded as a clean end of trail, and the distinction is the whole point: an empty result and an unreadable one are different findings.
Where an instrument has a public-chain leg, that leg is in scope and ChainTrace can follow the hops. Where it does not, no amount of screening substitutes for the depository’s own record. The regulators’ framing is the same: the notice, the conditions and the limits are the record of what a firm may do, and they are published so they can be read rather than inferred.
chainscore.net is not a sandbox entrant and not a Digital Securities Depository. It holds no Sandbox Approval Notice, is not authorised by the Bank of England or the FCA, and does not settle, issue or screen gilts. Nothing in the product is authorised under the DSS. What it does is screen wallet history on public chains and say so when it cannot see.
