NAMPOST INNOVATION SANDBOX

Application Guidelines & Application Form

Based on international best practices (Central Bank of Eswatini, Capital Market Authority of Rwanda, Bank of Namibia FinTech Regulatory Framework)

How to apply: Read these guidelines, then complete the online application form.

Operator process. For the full seven-stage lifecycle (application through exit), Testing Agreement terms, and Annexures B–D (progress report template, Sandbox-Ready Certificate contents), read the NPIF charter §9. This document is the applicant-facing companion to Annexure A.

TABLE OF CONTENTS

1. Introduction
2. Rationale for a FinTech Regulatory Sandbox
3. Eligibility and Evaluation Criteria
4. Potential Risks and Safeguards
5. Application and Approval Process (NPIF Stage 1–2)
6. Submission of Information and Periodic Reports (NPIF Stage 5)
7. Expiry of Approval and Exiting the Sandbox (NPIF Stages 6–7)
8. Revocation of Approval
9. Application form (complete online)
10. Document Attachment Checklist (Annexure A)
11. Glossary of Key Terms (NamPost-Specific)
12. Production Licensing After Sandbox Exit

1. INTRODUCTION

1.1 Purpose of the Sandbox

The NamPost Innovation Sandbox (the "Sandbox") is a postal-financial module within Namibia's national regulatory-sandbox landscape. It is operated by NamPost ICT under the NamPost Postal-Financial Innovation Framework (NPIF) with joint supervision by the Bank of Namibia (BoN) and the Namibia Financial Institutions Supervisory Authority (NAMFISA).

NPIF runs a two-stage pipeline:

The NamPost Digital Sandbox is a free, synthetic-data proving ground. Innovators test integrations with NamPost rails (SmartCard, G2P, NAMQR, PoL, PoP network) using synthetic data only — no production credentials, no live Ministry of Finance grant files, and no real beneficiary personal data. Successful completion yields a Sandbox-Ready Certificate — a readiness signal for a downstream statutory application, not a licence.

Live testing with real customer data occurs only in Stage B (BoN Allow-and-See / Regulatory Sandbox or NAMFISA testing agreement), after and independent of the NamPost Digital Sandbox.

Key principle: Synthetic data by default in the Digital Sandbox (exclusion X-02). AML/CTF obligations cannot be relaxed in either stage (NPIF Principle 8).

1.2 Objectives

1.3 Target Audience

FinTechs, financial institutions, merchants, government agencies (e.g. MoF programme officers), professional service firms, and NamPost internal product teams.

1.4 Self-service participant types

Self-service application journeys are limited to:

• FINTECH_PARTICIPANT — payments, AIS/PIS, NPS, open banking, QR, G2P-adjacent services
• MERCHANT_AGENCY — merchant acceptance and agency-network partners at NamPost service points

Legacy role labels from older integrations are mapped to these types at sign-in without rejecting your application.

2. RATIONALE FOR A FINTECH REGULATORY SANDBOX

The sandbox is an evidence and testing layer — it does not grant statutory relief from standing law. Anti-money-laundering and counter-terrorist-financing requirements apply in full.

3. ELIGIBILITY AND EVALUATION CRITERIA

The Sandbox cannot be used to circumvent legal and regulatory requirements.

3.1 Eligibility Criteria

Applicants that need interpretive guidance only (no buildable product) should contact the BoN FinTech Office (Innovations Hub), not this intake.

3.2 Evaluation Criteria (Scoring Rubric)

Canonical numeric rubric: [the sandbox programme guide ](./the sandbox programme guide) (aligned with NPIF §8).

Evaluation committee: BoN + NAMFISA + NamPost ICT. Target SLA: 14 working days for a complete application.

Pass rule — all three conditions must be met:

1. total_score ≥ 70
2. No individual dimension score below 40
3. Legislative limitation dimension score ≥ 50

Auto-reject (no cure window):

• Request to use live MoF grant files or production beneficiary PII (X-02)
• Request to bypass consent or PoL workflows

Auto-reject after cure:

• Application remains incomplete after a 14-day cure notice following written notification within 5 business days of receipt

4. POTENTIAL RISKS AND SAFEGUARDS

4.1 Risk Categories

Consumer protection; financial integrity; operational; systemic; liquidity/credit; reputational.

4.2 Mandatory Safeguards

5. APPLICATION AND APPROVAL PROCESS (NPIF STAGES 1–2)

flowchart TD
    A["Stage 1: Submit application + N$500 fee"] --> B["Stage 2: Evaluation committee scores rubric"]
    B --> C{Pass threshold met?}
    C -->|No| D["Written denial; may reapply after 6 months"]
    C -->|Yes| E["Admission letter; execute Testing Agreement"]
    E --> F["Stage 3: Provision synthetic environment ≤10 working days"]
    F --> G["Stage 4: Testing and Observation Deck monitoring"]
    G --> H["Stage 5: Monthly progress reports"]
    H --> I["Stage 6: Final report + Sandbox-Ready Certificate if gates pass"]
    I --> J["Stage 7: Onward routing to BoN or NAMFISA programme"]

5.1 Application Stage (NPIF Stage 1)

Submit completed form (Section 9) and attachments (Section 10) to sandbox@nampost.com.na with subject:

Application to the NamPost Innovation Sandbox – [Organisation Name]

Pay N$500 via the portal payment gateway at submission. Payment is required for processing; it does not constitute admission.

Single intake: always open at /apply — no cohort windows.

If your application is incomplete, NamPost will notify you within 5 business days and grant a 14-day cure window.

5.2 Evaluation Stage (NPIF Stage 2)

Outcome within 14 working days for a complete application. Dual-scope applications (payments + NBFI) are reviewed by BoN and NAMFISA in parallel.

If admitted: you receive an admission letter specifying activity type, provisioned rails, and next steps to execute the Testing Agreement (NPIF Annexure B).

If denied: written reasons with dimension scores and, where applicable, steps to strengthen a future application.

Admission does not confer: a licence, a guarantee of Sandbox-Ready Certificate, market success, or regulatory endorsement (X-04).

5.3 Testing Agreement and provisioning (NPIF Stage 3)

Before testing begins, you and NamPost execute a Testing Agreement fixing duration, consumer cap (≤500 synthetic consumers unless supervisors approve more in writing), transaction caps, KPIs, reporting frequency, and exit strategy.

Target provisioning: ≤10 working days after admission. No production NamPost credentials are issued at any stage.

Failure to execute the Testing Agreement within 20 working days (with a further 10-day cure period) may result in withdrawal of admission.

6. SUBMISSION OF INFORMATION AND PERIODIC REPORTS (NPIF STAGE 5)

Submit progress reports per the Testing Agreement — typically monthly — to sandbox@nampost.com.na with subject:

Progress Report – [Organisation Name] – [Month/Year]

Each report must cover KPI progress, milestones, synthetic-consumer complaints, emerging risks, organisational changes, and any matter supervisors should know. Template: NPIF Annexure C.

Late reports: reminder within 5 business days; possible suspension after 10 business days from due date.

7. EXPIRY OF APPROVAL AND EXITING THE SANDBOX (NPIF STAGES 6–7)

Before the testing period ends, submit a final progress report (typically within 15–20 working days of notice).

If successful: NamPost issues a Sandbox-Ready Certificate (machine-readable JSON + supervisor-visible PDF per NPIF Annexure D and PRD ). This certificate:

• evidences technical and compliance design maturity in the Digital Sandbox
• is not a licence, funding approval, or BoN/NAMFISA policy decision

Onward routing (BoN or NAMFISA only): licence application, regulatory amendment, no-objection, or orderly wind-down.

If unsuccessful: cease sandbox operations; you may reapply after 6 months.

Extension requests should be submitted 30 working days before expiry. Full regulatory requirements apply after successful commercial introduction outside the sandbox.

8. REVOCATION OF APPROVAL

NamPost may suspend, remove, or revoke access if safeguards or caps are circumvented; false or misleading information is submitted; applicable law is contravened; data-security obligations are breached; or testing is harmful to consumers or the public.

Written reasons are provided. You have an opportunity to be heard before removal or revocation unless fraud, data breach, or imminent harm requires immediate suspension.

Grounds align with NPIF §9 Stage 4

9. APPLICATION FORM

Submit online: Complete the application form in the portal. Your progress is saved as you go.

Applicant information

Contact person, designation, email, telephone; business name; BIPA registration; address; activity type (FINTECH_PARTICIPANT or MERCHANT_AGENCY); security contact; target NamPost rails; funding and resources.

Optional referral field. If a partner programme such as Scale Up Namibia referred you, you may record it here—or arrive with ?referral=scale-up-namibia on your apply link. This is optional attribution only; it does not change review, confer priority, or share company records with the partner.

About the innovation

Description, novelty, benefits, market research, business plan, expertise, legislative limitation (why sandbox testing is needed), architecture, use cases.

Testing plan

Synthetic consumer count (≤500 default), transaction expectations, KPIs, estimated duration.

Risk, safeguards and exit strategy

Risk register, complaints-resolution process, customer-risk monitoring, communication/disclosure plan, exit paths (successful and unsuccessful).

Regulatory requirements

Specific legislative provisions the innovation cannot currently meet; proposed sandbox relief sought. AML/CFT cannot be relaxed.

Declaration

Truth and completeness; Terms and Sandbox Disclosure; Namibian law compliance; no automatic licence; synthetic-only (X-02); 2FA on every PIS (PSD-12); regulator publication consent; Privacy Policy consent.

10. DOCUMENT ATTACHMENT CHECKLIST (ANNEXURE A)

Aligned with NPIF and Annexure A. Upload in wizard step Documents where applicable.

11. GLOSSARY (NamPost-Specific)

12. PRODUCTION LICENSING AFTER SANDBOX EXIT

Applies after: Stage B regulatory sandbox testing or an approved early exit from the statutory programme.

12.1 What sandbox exit does and does not do

No licence by association: Building on NamPost sandbox APIs does not give you NamPost's licences. Your own production authorisation is a separate legal outcome (X-04).

Investor-readiness signal. The Sandbox-Ready Certificate and progress reports are evidence you can show outside the regulatory process. Upstream partners and financing programmes may treat them as technical-conformance signals — not funding approval or a licence.

12.2 Exit outcomes

1. Licence application support — proceed to production pathway with exit pack attached
2. Time-bound extension — revised KPIs and duration under supervisor programme
3. Managed wind-down — orderly closure; customer communication plan required

12.3 Production pathway decision guide

Use the platform pathway picker at exit (/dashboard/exit-survey) or the public guide Exit and licensing.

12.4 Minimum evidence for licensing pathway

• Final progress report and exit survey
• INT-01–05 conformance summary (where applicable)
• Observation Deck audit trail export
• Architecture and process diagrams (from application)
• Risk register closure or residual-risk treatment plan
• Step-up 2FA evidence on every payment initiation route (PSD-12)

For production licensing enquiries, contact BoN FinTech programme (fintechinnovations@bon.com.na), PSP oversight (oversight.policydivision@bon.com.na), or the NamPost sandbox programme (sandbox@nampost.com.na).

CONTACT

Email: sandbox@nampost.com.na
Subject: Sandbox application enquiry – your organisation name
Hours: Monday – Friday, 8:00–17:00 CAT
Address: NamPost Innovation Sandbox Programme Office, 175 Independence Avenue, Windhoek

Version: 2.0 | Effective: 2026-06-15

v2.0 (2026-06-15): aligned with NPIF v2.0 self-contained charter — two-stage model, synthetic-first Digital Sandbox, §8 rubric (legislative limitation + regulatory insight), seven-stage lifecycle mapping, Annexure A checklist. v1.2 referral and investor-readiness notes retained.