What Happened
On May 27, 2026, Costa Rica's Legislative Assembly unanimously passed Legislative Decree No. 10961, amending Law No. 7786— the country's Anti-Money Laundering and Counter-Terrorist Financing statute — to formally incorporate Virtual Asset Service Providers as obligated subjects for the first time.
The amendment was enacted through the addition of Article 15 quater to Law No. 7786, which has governed AML/CFT obligations in Costa Rica since its original enactment. It is the official publication in the Official Gazette (La Gaceta) that triggers the entry into force timeline — not the legislative vote itself.
Costa Rica joins the international consensus on VASP supervision: operators that exchange, transfer, provide custody of, or offer financial services related to the issuance, offering, or commercialization of virtual assets are now formally within the scope of the country's AML/CFT framework.
The Critical Distinction: Registration vs License
This is the most important point in the entire reform — and the most frequently confused.
SUGEF registration is mandatory for AML/CFT supervision purposes.
SUGEF registration does not constitute an authorization or license to operate.
These two statements are both simultaneously true. Costa Rica has not introduced a formal VASP operating license. No regulator issues a permit approving a VASP's business model. Operators do not receive a government authorization to provide virtual asset services. The reform is a compliance and supervision measure — not a licensing regime.
But the practical consequence is significant: regulated financial institutions in Costa Rica are now restricted from engaging with VASPs that fail to register with SUGEF when required to do so. While registration does not grant operational permission, the absence of registration blocks access to the formal financial system. In a jurisdiction where banking access is already the primary operational challenge for VASP operators, this is a material commercial consequence.
In short: registration without a license is still registration — and without it, banking becomes unavailable.
New AML/CFT Obligations Now In Force
The amendment imposes six core AML/CFT obligations on all entities qualifying as VASPs under the new definitions:
- Customer identification and beneficial owner verification: Full KYC and CDD procedures applicable to all clients. Enhanced due diligence for higher-risk relationships.
- Transaction recordkeeping: All transaction records must be maintained and made available to SUGEF and the FIU on request.
- PEP controls: Enhanced controls for Politically Exposed Persons and their immediate relatives and close associates.
- Risk assessment for new products and technologies: VASPs must assess and manage risks associated with new products, services, and technologies before deployment.
- Controls over virtual asset transfers: Travel Rule alignment — collecting and transmitting originator and beneficiary information for qualifying virtual asset transfers.
- Suspicious transaction reporting: All suspicious transactions — including attempted transactions — must be reported to the Financial Intelligence Unit (UIF), which operates under the Costa Rican Drug Institute (ICD).
New Legal Definitions
Legislative Decree No. 10961 introduces formal legal definitions of "virtual asset" and "virtual asset service provider" into Costa Rican law for the first time. These definitions cover activities including:
- Exchange of virtual assets for fiat currency
- Exchange between virtual assets
- Transfer of virtual assets
- Custody and administration of virtual assets
- Financial services related to the issuance, offering, or commercialization of virtual assets
These definitions matter because they determine which businesses fall within the scope of mandatory SUGEF registration. Non-custodial services where no control over client funds exists may fall outside the reporting obligations — but activity-specific legal analysis is required to confirm scope.
Penalties
Non-compliance with the new AML/CFT obligations carries financial penalties set directly in the enacted law — not deferred to implementing regulations:
Minimum
USD $1,800 per violation
Maximum
USD $90,000 per violation
Alternative
5% to 50% of the transaction value
These figures are denominated in colones in the original legislation and USD equivalents are approximate at current exchange rates.
What Happens Next — CONASSIF Implementing Regulations
The amendment passed by the Legislative Assembly awaits presidential signature. After publication in La Gaceta, the National Council for the Supervision of the Financial System (CONASSIF) — the supervisory body that oversees SUGEF — has approximately three months to issue implementing regulations defining:
- The practical scope of the VASP definition and which activities trigger registration
- Registration procedure and required documentation
- Supervision criteria and examination frequency
- Thresholds and proportionality standards
- Timelines for existing operators to achieve compliance
The implementing regulations are the document that will define what SUGEF registration actually requires in practice. Much of the operational detail remains undefined until CONASSIF acts.
What This Means for Operators in Costa Rica
For operators already structured in Costa Rica
The AML/CFT obligations that form the core of the new reform are not conceptually new — Law No. 7786 already imposed AML/CFT requirements on a range of financial activities, and SUGEF and the ICD already had supervisory jurisdiction over certain activities. The reform extends the formal perimeter to VASPs and creates the SUGEF registration requirement.
Operators with a functioning, documented AML/CFT framework — KYC procedures, transaction monitoring, STR reporting, Travel Rule controls — are well positioned to complete SUGEF registration when the implementing regulations are published. The registration process itself, based on CONASSIF's expected approach, will involve submitting a compliance documentation package demonstrating that the AML/CFT obligations are being met.
Operators without a documented AML/CFT framework face both the compliance obligation and the risk of banking exclusion simultaneously.
For new operators considering Costa Rica
The reform does not close the jurisdiction. Costa Rica remains a jurisdiction where virtual asset activities can be structured legally without a formal operating license. The reform adds a compliance layer — SUGEF registration for AML/CFT supervision — that, once the implementing regulations are published, will be a standard operational step rather than a licensing barrier.
The correct approach for new operators is to incorporate with VASP-specific corporate objects, build a SUGEF registration-ready AML/CFT framework from day one, and monitor CONASSIF's implementing regulations as they are published.
For iGaming and crypto casino operators
The reform covers VASPs as defined by the new Article 15 quater — operators in the iGaming space using crypto payment processing should conduct a scope analysis to determine whether their specific activities trigger the VASP definition. Pure data processing models that do not involve exchange, transfer, or custody of client virtual assets may not trigger VASP obligations — but this requires case-by-case legal assessment.
Zitadelle AG — How We Help
Zitadelle AG provides complete Costa Rica setup and compliance services for VASP operators:
- Company formation: S.A. or S.R.L. incorporation with VASP-specific corporate objects, registered office, resident agent, UBO registration.
- SUGEF registration preparation: AML/CFT compliance manual and policy suite built to SUGEF registration standard — KYC/CDD procedures, transaction monitoring policy, STR reporting framework, Travel Rule implementation, PEP controls, risk assessment documentation.
- Legal opinion: Formal written opinion from a Costa Rica-licensed attorney confirming lawful activities, AML/CFT framework adequacy, and territorial tax treatment — required by banking partners and PSPs.
- Banking and PSP introductions: Specialist banking partners and payment processors experienced with Costa Rica VASP operators. Complete KYC dossier preparation.
- Multi-stage structure advisory: Costa Rica as a fast-start structure while a Seychelles, Mauritius, or MiCA CASP license application runs in parallel.
Full Costa Rica VASP Service Page →
Contact Zitadelle AG →
Disclaimer: This article is for informational purposes only and does not constitute legal advice. The Costa Rica AML/CFT reform is subject to implementing regulations from CONASSIF that have not yet been published. Operators should consult qualified Costa Rica legal counsel before making any compliance or structural decisions. Last updated: July 2026.
Frequently Asked Questions
Legislative Decree No. 10961, enacted May 27 2026, amended Law No. 7786 to add VASPs as obligated subjects under Costa Rica's AML/CFT framework for the first time. VASPs must now register with SUGEF for supervision purposes, comply with KYC/CDD, transaction recordkeeping, PEP controls, suspicious transaction reporting, and Travel Rule requirements. Registration does not constitute an operating license — Costa Rica still has no formal VASP operating permit. But regulated financial institutions are now restricted from servicing unregistered VASPs, making registration a de facto banking access requirement.