Panama & Costa Rica: Registering a Crypto Company Without a Full VASP License (2026 Guide)

Updated: March 2026 | Author: Zitadelle AG Regulatory Team

⚠️ Important Legislative Developments for 2026:

Panama — Bill 247 (2025): Panama introduced Bill 247 in 2025 to create a formal VASP registration regime under the Financial Analysis Unit (UAF). The bill was partially returned for revision and has not been enacted into law. As of March 2026, Panama's no-formal-license framework remains intact — but formal VASP registration is likely to arrive in the near future. Panama also signed the OECD CARF-MCAA on December 2, 2025, joining the international Crypto-Asset Reporting Framework for automatic exchange of tax information.

Costa Rica — Bill 22.837 (First Debate Passed July 2025): Costa Rica's Legislative Assembly approved Bill 22.837 in its first reading in July 2025 — a bill that would mandate SUGEF registration for all VASPs operating in Costa Rica. The bill has not yet completed its legislative process. In late 2025, SUGEF shut down one unregistered platform that had processed over $50 million in transactions without KYC procedures. The no-license framework remains in place for now, but formal regulation is advancing.

Contact Zitadelle AG for current guidance on Panama and Costa Rica crypto company setup.

The global regulatory framework for virtual asset service providers (VASPs) continues to tighten. MiCA governs the EU. AUSTRAC's VASP regime expanded in Australia. The UAE CMA licensing framework deepened. Canada's FINTRAC has accelerated MSB enforcement.

In this environment, Panama and Costa Rica remain two of the most accessible jurisdictions for crypto startups, exchanges, Web3 projects, and OTC desks to incorporate and begin operations quickly — without the capital requirements, lengthy timelines, or governance demands of full VASP licensing in regulated jurisdictions. Both offer territorial taxation, streamlined company formation, and AML/CFT compliance frameworks that satisfy international banking and payments partners.

Neither jurisdiction, however, is a compliance-free zone. AML/CTF obligations are mandatory, real, and increasingly enforced. The distinction is between compliance without licensing (what Panama and Costa Rica offer today) and the compliance-plus-licensing model that characterizes jurisdictions like the Cayman Islands, Mauritius, Cyprus, or the UAE. For businesses at an early stage, testing a market, structuring a group, or managing costs while building toward full licensing, Panama and Costa Rica offer compelling strategic value.

Zitadelle AG provides end-to-end support for company formation, AML/CTF compliance setup, UAF/SUGEF registration, and legal opinions in both jurisdictions, as part of our broader Latin America crypto advisory practice.

Panama vs. Costa Rica: 2026 Comparison at a Glance

Panama: VASP Operations via Standard Corporate Registration

The Current Framework

Panama operates under a territorial tax system and a general corporate law framework for digital asset businesses. There is no dedicated VASP license regime in force. Crypto businesses register as standard Panamanian corporations — typically a Sociedad Anónima (S.A.) — and operate under the existing AML/CFT framework, with the UAF (Financial Analysis Unit) as the primary compliance authority.

Panama's financial regulators — including the Superintendency of Banks and the Superintendency of the Securities Market — have explicitly stated that digital assets fall outside their direct regulatory competence. This means that most crypto activities (exchange, custody, transfer, wallet services) are not regulated as banking or securities — which allows businesses to operate without sector-specific licensing. However, this does not mean without compliance.

Mandatory AML/CTF Compliance

Under Law 23 of 2015 (Panama's AML/CFT framework), all entities providing VASP-type services are subject to AML/CTF obligations. This is not optional. Key requirements:

• UAF registration — mandatory. All VASPs must register with the Unidad de Análisis Financiero (UAF) and provide AML policies, compliance officer details, and organizational information

• KYC/Customer Due Diligence (CDD) — mandatory identity verification for all clients, including UBO identification for corporate clients

• Enhanced Due Diligence (EDD) — required for high-risk clients, PEPs, and clients from high-risk jurisdictions

• Transaction monitoring — real-time systems to detect suspicious activity

• Suspicious Transaction Reports (STRs) — filed within 15 working days of detection; no minimum threshold applies

• Record-keeping — all customer data and transaction records must be retained for at least 5 years

• Sanctions screening — all clients and transactions must be screened against relevant lists (OFAC, UN, etc.)

• FATF Travel Rule — mandatory for qualifying cross-border virtual asset transfers

Superintendencia de Sujetos No Financieros (SSNF) also supervises non-financial entities, including crypto businesses, for AML/CTF compliance. Some businesses may register as Specialized Financial Institutions (SFIs) under emerging interpretations, providing a further layer of voluntary regulatory recognition.

Corporate Structure Requirements

The standard vehicle is the Sociedad Anónima (S.A.):

• Minimum 3 directors — foreign nationals are permitted; no residency requirement

• Bearer shares are prohibited — registered shares with UBO disclosure required

• Registered agent in Panama — mandatory for legal presence

• Business objects must explicitly include virtual asset services — Zitadelle AG drafts corporate documents to ensure crypto activities are properly covered

• Legal opinion — a Panamanian legal opinion confirming the legality of your specific crypto activities is strongly recommended, and required by most banks and payment partners

Tax Treatment

Panama's territorial tax system is one of its most commercially attractive features:

• 0% corporate income tax on foreign-source income — income generated outside Panama is not taxed

• 25% corporate income tax on local income — applicable only to income earned within Panama

• No capital gains tax on digital assets

• No VAT on digital asset transactions (unless revenue crosses domestic registration thresholds)

For internationally-oriented crypto businesses that generate primary revenues from non-Panamanian clients and operations, the effective tax burden is minimal.

Banking Reality

Panama's established position in international finance — home to a significant banking sector with USD as currency and no capital controls — theoretically provides excellent banking access. In practice, banks applying enhanced due diligence to crypto-related accounts means banking access for crypto companies is materially difficult. Demonstrating strong AML/CTF infrastructure, UAF registration, a legal opinion, and clear corporate substance significantly improves banking prospects. Many Panama crypto businesses use offshore EMIs or fintech payment partners for operational accounts.

Pending Legislation: Bill 247

Bill 247 (2025) is Panama's most serious attempt to create a formal VASP licensing/registration regime. Key features of the proposed bill:

• Formal recognition of digital assets as a legal means of payment (voluntary)

• Mandatory UAF registration for all VASPs (exchanges, wallets, custodians)

• FATF-aligned AML/KYC compliance obligations

• Smart contracts recognized as legally enforceable

• Blockchain for public administration (digital identity, tokenized securities)

Current status (March 2026): The bill was partially returned for revision and has not been enacted. It is under active review in the National Assembly. Businesses should monitor its progress — enactment would introduce a formal registration process for all VASPs, likely with a transition period for existing operators.

CARF-MCAA (December 2, 2025): Panama signed the OECD Crypto-Asset Reporting Framework Multilateral Competent Authority Agreement — committing Panama to automatic exchange of crypto-related tax information with other participating countries. This is a significant development for internationally-oriented businesses structuring through Panama, as it reduces the confidentiality of crypto holdings and transactions in CARF-compliant countries.

Step-by-Step: Setting Up a Crypto Company in Panama

1. Engage Zitadelle AG for regulatory scoping, corporate structuring advice, and local legal opinion

2. Reserve company name and draft Articles of Incorporation (S.A.) with virtual asset service objects explicitly included

3. Appoint 3 directors (can be foreign nationals); designate a Registered Agent in Panama

4. Register with the Public Registry — notarized documents filed; approval typically 5–10 business days

5. Obtain Tax Identification Number (RUC) from the Dirección General de Ingresos (DGI)

6. Register with the UAF — submit AML policies, compliance officer details, and organizational information

7. Draft full AML/CTF compliance documentation — policies, KYC/KYB procedures, transaction monitoring framework, STR reporting procedures

8. Obtain legal opinion from a Panamanian legal firm confirming legality of your specific activities

9. Open banking or payment accounts — Zitadelle AG advises on optimal banking partners for crypto businesses in Panama

10. Ongoing compliance — annual corporate renewals, UAF reporting, AML program maintenance

Total timeline: 1–2 weeks for incorporation; 2–4 additional weeks for full AML setup and UAF registration. Setup costs: USD 2,000–4,000 (incorporation, agent, basic documents). Additional costs for AML/CTF framework preparation, legal opinion, and banking setup.

Costa Rica: Lean Crypto Company Setup

The Current Framework

Costa Rica regulates crypto businesses through general commercial and financial law rather than dedicated crypto legislation. Crypto is not legal tender in Costa Rica, but it is not prohibited — it is a lawful commercial activity. There is no specific crypto license. Businesses incorporate as a standard Sociedad Anónima (S.A.) or Sociedad de Responsabilidad Limitada (S.R.L.) and operate under AML/CTF obligations.

SUGEF (the financial superintendent) oversees AML/CTF compliance. The ICD (Financial Intelligence Unit / Instituto Costarricense sobre Drogas) receives suspicious transaction reports. No single body has been designated as the exclusive crypto regulator, but SUGEF applies general AML standards to virtual asset businesses.

What Makes Costa Rica Distinctive

No minimum capital — unlike most full VASP licensing jurisdictions, Costa Rica requires no paid-up capital to form a company providing crypto services.

No local director or residency requirement — directors can be of any nationality; no Costa Rica residency required.

No mandatory local office (for now) — a registered legal address (virtual office) is sufficient under current law. Banking partners may expect more substance, but regulatory requirements do not mandate physical presence.

One of the fastest and most affordable crypto setups available in any jurisdiction with AML/CTF framework recognition. Full company formation is achievable in 1–2 weeks; costs start under USD 4,000 for a basic setup.

Broad permitted activities — exchanges, custodians, wallet providers, OTC desks, remittance services, token issuers (unless tokens qualify as securities), NFT platforms, GameFi and Web3 projects, DeFi protocols, and stablecoin operations can all be structured through a Costa Rica company without a formal license under the current framework.

Mandatory AML/CTF Compliance

Under Law 7786 (Costa Rica's Anti-Money Laundering and Counter-Terrorism Financing Act), virtual asset businesses are subject to AML/CTF obligations. These are not theoretical — enforcement is real:

• SUGEF alignment — AML/CTF policies must be designed and implemented to SUGEF and FATF standards

• KYC/CDD — identity verification for all clients, including UBO identification

• EDD for PEPs and high-risk clients — enhanced due diligence with source of funds verification

• Suspicious transaction reporting — promptly to the ICD (Financial Intelligence Unit)

• Transaction monitoring — systems to detect and flag suspicious patterns

• Beneficial ownership transparency — UBO declaration required for all entities with 25%+ ownership or control

• FATF Travel Rule — mandatory for qualifying cross-border virtual asset transfers

• Record-keeping — customer and transaction records maintained for 5 years minimum

SUGEF enforcement is escalating. In late 2025, SUGEF shut down one unregistered platform that had processed over $50 million in transactions without KYC procedures. The operator was fined. The business was closed. This enforcement action signals that operating without compliant AML/CTF infrastructure — even in the absence of formal licensing — carries real regulatory and financial risk.

Bill 22.837 — The SUGEF Registration Bill

Bill 22.837 was approved in its first reading by the Legislative Assembly in July 2025 with unanimous support. It has not yet completed the legislative process (the bill may be sent back for further modifications before final approval).

Key provisions of Bill 22.837:

• Mandatory SUGEF registration for all VASPs operating in Costa Rica — registration is a compliance checkpoint, not a license to operate

• Public VASP registry maintained by SUGEF

• Risk-based supervision — SUGEF may require compliance officers and ongoing audits depending on entity size and volume

• Prohibited business with unregistered VASPs — banks and financial institutions will be barred from servicing unregistered VASPs once enacted

• Fines for non-compliance — ranging from 2 to 100 base salaries, based on severity

• CARF reporting — the bill aligns Costa Rica with the OECD Crypto-Asset Reporting Framework, requiring tax information reporting to SUGEF for exchange with other CARF-participating jurisdictions

• Grace period for existing operators once enacted

For businesses setting up in 2026: The prudent approach is to build SUGEF-ready compliance infrastructure now — so that when Bill 22.837 is enacted, registration is a straightforward compliance step rather than a disruptive overhaul.

Corporate Structure

S.A. (Sociedad Anónima) is the most common vehicle for crypto businesses. For smaller operations, an S.R.L. is also viable.

• Minimum 1 director — can be any nationality; no Costa Rica residency required

• Minimum 1 shareholder — foreign ownership 100% permitted

• Registered legal address — virtual office acceptable under current law

• Compliance officer — a dedicated compliance officer (internal or external) must be appointed to oversee AML/CTF implementation and reporting

• No minimum share capital

Zitadelle AG drafts corporate documents (Articles of Incorporation, bylaws, compliance policies) that explicitly authorize virtual asset services and align with SUGEF's expectations.

Tax Treatment

Costa Rica's territorial tax system is favorable for internationally-oriented businesses:

• 0% on foreign-source income — income generated from non-Costa Rican clients and operations is not taxable

• No capital gains tax on crypto — for individual holders; companies pay standard corporate rates on business profits

• No VAT on crypto transactions under current law

• Corporate income tax on domestic income — tiered rates apply to locally-generated income

Banking Reality

Costa Rica's banks are conservative toward crypto-related businesses. Traditional banking accounts are difficult to open without demonstrating strong AML/CTF frameworks, clear business models, and established compliance infrastructure. Once Bill 22.837 is enacted, only registered VASPs will be able to access banking and financial services in Costa Rica — making early voluntary registration with SUGEF-aligned compliance increasingly important for banking access.

Many Costa Rica crypto companies use offshore fintech partners, EMIs, and stablecoin-based settlement for operational cash management.

Step-by-Step: Setting Up a Crypto Company in Costa Rica

1. Engage Zitadelle AG for regulatory scoping and corporate structure advice

2. Name reservation and draft Articles of Incorporation (S.A. or S.R.L.) with virtual asset service objects explicitly included

3. Incorporate at the National Registry (Registro Nacional) — typically 1–2 weeks

4. Obtain corporate tax registration (Hacienda) and other required registrations

5. Draft full AML/CTF compliance documentation — policies, KYC/KYB, transaction monitoring, STR reporting procedures, UBO disclosure

6. Appoint compliance officer — internal or external; responsible for AML/CTF oversight and SUGEF engagement

7. Optional: Voluntarily align with SUGEF registration requirements (recommended as bill approaches enactment)

8. Obtain local legal opinion confirming legality of specific crypto activities

9. Open banking or payment accounts — Zitadelle AG advises on fintech and banking partners for crypto businesses in Costa Rica

10. Ongoing compliance — annual corporate renewals, AML program maintenance, SUGEF monitoring

Total timeline: 1 week (simple setup) to 4–6 weeks (full compliance setup including AML framework and banking) Setup costs: USD 3,500–5,500 (incorporation, legal address, basic compliance documents). Additional costs for full AML/CTF framework preparation and legal opinion.

When to Use Panama or Costa Rica — and When to Look Elsewhere

Panama or Costa Rica Is the Right Choice When:

You are at an early or pre-revenue stage. The cost of full VASP licensing in the Cayman Islands, Mauritius, or Cyprus often cannot be justified before a product is proven. Panama and Costa Rica allow you to build, test, and grow with a compliant legal entity in place.

You need speed. Full VASP licensing takes 4–12 months in most regulated jurisdictions. Panama and Costa Rica offer legal entities with explicit crypto business objects in 1–4 weeks.

You are targeting Latin American or regional markets. Both jurisdictions provide genuine commercial and cultural positioning in Latin America, with established financial infrastructure (Panama's banking corridor, Costa Rica's tech ecosystem) and USD-based economies.

You are building toward full licensing. Many operators use a Panama or Costa Rica entity as the initial operating vehicle while building toward a full VASP license in Mauritius, the Cayman Islands, or another regulated jurisdiction. The corporate structure can be maintained in parallel.

Your business model is non-custodial, B2B, or technology-facing. Token issuers (non-securities), GameFi developers, DeFi protocols, Web3 infrastructure providers, and B2B payment technology companies face lower regulatory risk in these jurisdictions than exchange or custody operators.

Panama or Costa Rica May Not Be Sufficient When:

You need institutional banking. If your business model requires relationships with institutional banks, prime brokers, or regulated fund administrators, a full VASP license from a recognized jurisdiction (Cayman Islands, Mauritius, Cyprus) provides meaningfully stronger positioning.

You are targeting EU clients. Offering crypto services to EU retail clients requires MiCA CASP authorization. A Panama or Costa Rica entity does not satisfy EU regulatory requirements.

Your business handles custody of significant client assets. Custody operations face the most scrutiny from banking partners and institutional clients. A registered but unlicensed custody operator will struggle with banking and counterparty relationships at scale.

You need cross-border passporting or formal regulatory recognition. Panama and Costa Rica provide no cross-border regulatory recognition equivalent to EU passporting or comparable frameworks.

You face FATF grey-list risk. Panama has been on and off FATF grey lists historically. Operators should monitor FATF country assessments when planning long-term structures through Panama.

How Zitadelle AG Supports Your Latin America Crypto Setup

Zitadelle AG provides end-to-end support for crypto company formation in Panama and Costa Rica:

Corporate structuring and incorporation — S.A. drafting with explicit virtual asset service objects; registered agent arrangements; director and shareholder structuring for both jurisdictions.

AML/CTF compliance framework preparation — full AML/CTF manual, risk assessment, KYC/KYB procedures, transaction monitoring framework, STR reporting procedures, and sanctions screening program. Built to satisfy UAF (Panama) and SUGEF/FATF (Costa Rica) standards.

UAF registration (Panama) — managing the mandatory registration process with the Financial Analysis Unit, including submission of policies and compliance officer details.

SUGEF alignment and voluntary registration (Costa Rica) — preparing the compliance infrastructure for proactive SUGEF alignment ahead of Bill 22.837 enactment.

Legal opinion — coordinating local legal opinions from Panama and Costa Rica counsel confirming the legality of your specific crypto activities. Essential for banking access and institutional partnerships.

Banking and payment access advisory — Zitadelle AG advises on optimal banking partners, fintech providers, and EMIs for crypto businesses in both jurisdictions.

Upgrade pathways — for businesses building toward full VASP licensing in Mauritius, the Cayman Islands, Cyprus, or another regulated jurisdiction, Zitadelle AG designs the corporate structure and compliance foundation so that the Panama or Costa Rica entity can be maintained alongside the licensed entity.

Frequently Asked Questions

Do I need a license to operate a crypto exchange in Panama? Not currently. Panama has no formal VASP license regime in force. You incorporate an S.A., register with the UAF for AML compliance, and implement robust KYC/transaction monitoring. Bill 247 may change this — but has not yet been enacted.

Do I need a license to operate a crypto exchange in Costa Rica? Not currently. Costa Rica has no formal crypto license. You incorporate an S.A. or S.R.L. and implement AML/CTF compliance aligned with SUGEF/FATF standards. Bill 22.837 would introduce mandatory SUGEF registration but has not yet completed its legislative process.

Is Panama safe from FATF grey-listing? Panama has a history of FATF grey-list periods (most recently removed in 2023). Operators structuring through Panama should monitor FATF country assessments. The government's signing of CARF-MCAA in December 2025 reflects a deliberate effort to align with international standards and maintain off-list status.

What is the CARF and does it affect me? CARF (the OECD Crypto-Asset Reporting Framework) requires crypto service providers in participating countries to collect and report user tax information to local tax authorities, which is then automatically exchanged with other participating countries. Panama signed the CARF-MCAA in December 2025. Costa Rica's Bill 22.837 includes CARF-aligned reporting obligations. If you have clients in CARF-participating countries, this creates reporting obligations for your Panama or Costa Rica entity once each country's CARF regime takes full effect.

Can foreign nationals own and direct a Panama or Costa Rica crypto company? Yes. Both jurisdictions permit 100% foreign ownership. Directors may be of any nationality. No residency requirements apply in either jurisdiction for corporate directors.

How difficult is banking for Panama/Costa Rica crypto companies? Banking is the primary operational challenge in both jurisdictions. Traditional banks apply enhanced due diligence to crypto-related entities and frequently decline accounts. Strong AML/CTF infrastructure, UAF/SUGEF registration, a clean legal opinion, and a clear business model significantly improve prospects. Offshore EMIs and fintech payment partners are widely used as alternatives. Zitadelle AG provides banking advisory as part of its setup service.

What types of crypto businesses are best suited to Panama or Costa Rica? Both jurisdictions are well-suited for: early-stage exchanges, OTC desks, token issuers (non-securities), Web3 startups, GameFi and NFT platforms, DeFi protocols, remittance services, and payment technology providers. They are less suited for institutional custody, regulated fund operations, or businesses targeting EU retail clients.

Can Zitadelle AG also help with full VASP licensing if we outgrow Panama or Costa Rica? Yes. Zitadelle AG provides full VASP licensing support across Mauritius, Cayman Islands, BVI, Dubai (VARA), Cyprus (MiCA), Canada, Kazakhstan (AIFC), Australia (AUSTRAC), El Salvador, and other jurisdictions. We design the initial Panama or Costa Rica setup so that upgrading to a full licensed structure is as seamless as possible. Contact us to discuss a multi-phase licensing strategy.

Explore All VASP Licensing Options with Zitadelle AG

Panama and Costa Rica are compelling starting points — but they are part of a broader licensing strategy for most serious operators. Zitadelle AG covers the full spectrum:

Contact Zitadelle AG today for a free, no-obligation consultation on Panama, Costa Rica, or any other crypto licensing jurisdiction.

📞 Call / WhatsApp / Telegram: +357 96 649654 🌐 Website: www.zitadelleag.com 📅 Book a Free Consultation

This article is provided for informational purposes only and does not constitute legal or regulatory advice. Regulatory requirements in Panama and Costa Rica are evolving rapidly — both Bill 247 and Bill 22.837 may be enacted at any time. Always consult a qualified local legal advisor before establishing a crypto business structure. Last updated: March 2026.

Related Services from Zitadelle AG:

• Virtual Assets / Crypto Authorizations

• Regulatory Authorizations

• Legal Aid

• Payment / Money Remittance Authorizations