Why Costa Rica and Panama Still Offer What Most Jurisdictions No Longer Do
The global regulatory trend since 2021 has been relentlessly in one direction: every jurisdiction that had a light-touch or no-registration VASP framework has either introduced mandatory licensing, faced FATF grey-listing pressure, or both. The EU's MiCA framework covers the entire European market. The Seychelles VASP Act 2024 ended the era of unregulated offshore Seychelles crypto structures. SVG banned forex and tightened its stance on crypto. The Marshall Islands โ once a popular zero-regulation alternative โ faces increasing banking pressure. The result is that the market for genuinely light-touch VASP corporate structures has narrowed significantly.
Costa Rica and Panama occupy a distinct position because their regulatory neutrality toward crypto is not a deliberate pro-crypto policy โ it is a reflection of legislative bandwidth and sequencing. Both governments have larger economic priorities than crypto regulation. Both are small economies with significant offshore financial services ecosystems that create political resistance to heavy-handed new regulation. Both operate under territorial tax systems where foreign-sourced crypto income is generally not taxed โ a structural advantage that reinforces the commercial case for incorporation. And both are currently in the middle of messy legislative processes around crypto regulation that have not yet produced enacted law.
The honest description of Costa Rica and Panama in 2026 is not "crypto-friendly" in the sense that Estonia or Malta is crypto-friendly. It is that neither country currently requires a formal VASP license to operate a crypto business through a properly structured corporation with AML/CFT compliance in place. That distinction matters โ and it is worth understanding precisely because both countries have pending legislation that could change it.
Costa Rica vs Panama vs SVG vs Georgia โ 2026 Fast-Start Crypto Structures
| Feature | Costa Rica | Panama | SVG | Georgia |
|---|---|---|---|---|
| Formal VASP license | No | No | No | No |
| AML registration | SUGEF (May 2026 reform) | UAF (mandatory now) | FSA notification | NBG registration |
| Company type | S.A. or S.R.L. | S.A. | LLC or LTD | LLC |
| Time to incorporate | 1โ2 weeks | 1โ2 weeks | 3โ5 days | 1โ2 weeks |
| Capital requirement | None | None | None | None |
| Corporate tax | 0% foreign income | 0% foreign income | 0% | 0% foreign income |
| Annual franchise tax | None | USD $300 | Low | None |
| iGaming (data processing) | Yes โ 30+ year history | Limited | Minimal | No |
| Crypto salary payments | Legal | Yes | No | No |
| CARF reporting | From Jan 2027 | Signed CARF-MCAA Dec 2025 | Not committed | Not OECD member |
| Banking difficulty | High | High | Very high | Moderate |
| Legal opinion available | Yes | Yes | Limited | Yes |
| EU high-risk list | Not listed | Exited July 2025 | Not listed | Not listed |
| Year 1 cost (all-in) | USD $4,000โ$8,000 | USD $2,000โ$4,000 | USD $2,500โ$5,000 | USD $5,000โ$12,000 |
| Pending licensing | Expediente 25.340/25.362 (enacted May 2026) | Ley 314 (Jan 2026, pending) | SVG VASP Act | NBG reform |
| Best for | iGaming, crypto casino, OTC | USD economy, privacy, LATAM | Speed, prop trading | Fast start, CIS corridor |
Costa Rica 2026 โ The SUGEF Bill, the Tax Advantage, and the Regulatory Timeline
Costa Rica's crypto framework in 2026 is simultaneously simple and in flux. Here is what is actually the case:
No Formal VASP License Required (As of June 2026)
As of June 2026, Costa Rica does not issue a formal VASP operating license and does not require one to operate a crypto business. A company can include cryptocurrency exchange, wallet services, token issuance, GameFi, and OTC operations in its corporate bylaws under general commercial law without obtaining government approval. The May 2026 reform to Law No. 7786 adds mandatory SUGEF registration for AML/CFT purposes โ but explicitly states this is not an operating permit. No capital requirements. No physical office or local director required. The entire incorporation process can be completed in 1โ6 weeks remotely.
AML/CFT Compliance is Mandatory Under Law 7786
Despite the absence of a license requirement, crypto companies operating in or from Costa Rica are subject to AML/CFT obligations under Law No. 7786 (the AML/CFT Law). SUGEF (Superintendencia General de Entidades Financieras) has oversight responsibilities, and ICD (Instituto Costarricense sobre Drogas โ the Anti-Money Laundering body) enforces AML/CFT obligations. VASPs must implement KYC/CDD procedures, beneficial ownership transparency, suspicious transaction reporting, and Travel Rule compliance for cross-border transfers. Practical compliance with these obligations is required โ not optional. Banks and payment processors require evidence of AML compliance frameworks before onboarding.
May 2026: SUGEF Registration Reform Enacted (Not a License)
On 25 May 2026, Costa Rica's Legislative Assembly unanimously approved an amendment to Law No. 7786 โ the country's AML/CFT law โ incorporating Virtual Asset Service Providers as obligated subjects. This reform was passed under Expediente 25.340, which replaced the previously discussed Bill 22.837 (now archived and no longer active) and its successor Expediente 25.362. The amendment awaits presidential signature and publication in La Gaceta, after which implementing regulations are expected within three months. Critical distinction: SUGEF registration is NOT a VASP operating license. The reform explicitly states that registration does not constitute an operating permit or government authorization โ operators can incorporate a Costa Rica company, register with SUGEF for AML/CFT purposes, and operate. What remains unregulated: token issuance rules, custody standards, exchange licensing, and consumer protection โ none are covered by the May 2026 reform. The reform's primary motivation was FATF Recommendation 15 technical compliance, as Costa Rica faced greylisting risk without bringing VASPs under AML/CFT oversight. This is an AML/CFT supervision measure, not a licensing regime: Costa Rica remains a jurisdiction where you can operate a crypto business without a VASP operating license โ but you must now build your AML/CFT framework to SUGEF registration standard from day one.
Territorial Tax and No CARF Until 2027
Costa Rica's territorial tax system means income generated from customers outside Costa Rica is generally not subject to Costa Rican corporate income tax. Foreign-sourced crypto exchange and service income is typically outside the Costa Rican tax base when operational activity is conducted offshore. The OECD's Crypto-Asset Reporting Framework (CARF) โ which will require automatic exchange of crypto transaction data between tax authorities โ is expected to apply from 2027, with data collection commencing January 1, 2027 and first international exchanges in 2028. Costa Rica's favorable tax position for international crypto operations will remain largely intact through 2026.
Panama 2026 โ Two Bills Pending, EU High-Risk List Exit, and the CARF Timeline
Panama's crypto regulatory situation is more actively in motion than Costa Rica's. Three significant developments in 2025โ2026 are reshaping the landscape:
Three major 2025 Panama developments every crypto operator should know:
- July 2025: Panama officially exited the European Commission's list of high-risk countries for money laundering โ a meaningful improvement for banking relationships
- December 2025: Panama signed the OECD CARF Multilateral Competent Authority Agreement (CARF-MCAA) โ signaling commitment to future crypto tax transparency reporting
- 2025: Two draft bills (Bill 247 and Bill 326) introduced comprehensive VASP regulation frameworks โ neither yet enacted, but both advancing through the National Assembly
No Mandatory VASP License (Current Status)
As of June 2026, Panama does not operate a standalone crypto licensing regime. Crypto activities โ exchanges, wallets, custody, token issuance, DeFi protocols, NFT marketplaces, GameFi โ can be conducted through a standard Panamanian corporation (Sociedad Anรณnima / S.A.) without a dedicated VASP license or regulatory approval. Company registration takes 1โ2 weeks. No minimum capital, no local director requirement, no physical office mandatory. Panama uses the US dollar as legal tender, eliminating currency risk. Foreign-sourced income is not subject to Panama's territorial tax โ crypto revenue from international clients is generally tax-free.
UAF Registration is Mandatory
Unlike Costa Rica's model โ where AML compliance is required but registration is pending legislation โ Panama's Law 23 of 2015 already mandates registration with the Unidad de Anรกlisis Financiero (UAF) for entities that meet the VASP definition. UAF registration requires appointing a compliance officer, implementing KYC/CDD procedures, and establishing suspicious transaction reporting. This is the existing mandatory requirement โ it is not a license, but it is not optional. Failure to register with the UAF or maintain AML compliance exposes operators to administrative sanctions or criminal penalties.
Bill 247 and Bill 326: Two Pending Frameworks
Bill 247 (introduced April 2025 by the Commerce and Economic Affairs Commission) would establish mandatory VASP registration with the UAF and create a National Council of Digital Assets (CONAD) to supervise crypto policy. It defines core concepts including cryptocurrency, stablecoin, blockchain, smart contracts, security tokens, utility tokens, NFTs, and VASPs. Tax incentives for blockchain startups are included. Bill 326 (also pending 2025) complements Bill 247 by proposing mandatory licensing under the Superintendency of the Securities Market (SMV), FATF-aligned AML controls, and a public VASP registry. Neither bill has been enacted. Panama's legislative process requires three separate National Assembly debates before presidential sanction โ the bills are still moving through this process.
Panama Exited the EU High-Risk List
Panama's exit from the European Commission's list of high-risk money laundering jurisdictions in July 2025 is commercially significant. Banks and payment processors that applied enhanced due diligence to Panama-incorporated entities as a result of EU high-risk list designation have started revisiting their positions. Combined with the FATF grey list exit in 2023, Panama's AML/CFT credibility trajectory is positive โ creating better banking access for legitimately structured Panama crypto companies than existed two years ago.
Anteproyecto Ley Nยฐ 314 (January 2026):
The most recent and most comprehensive Panama crypto legislative draft is Anteproyecto Ley Nยฐ 314, formally presented to the National Assembly on 13 January 2026. It supersedes Bills 247 and 326 in scope and detail, introducing:
- Formal VASP and CASP definitions aligned with FATF and MiCA terminology
- Mandatory licensing obligations for entities meeting VASP/CASP definitions
- Minimum capitalisation and governance standards
- Oversight by both the Superintendencia de Bancos de Panamรก (SBP) and the UAF jointly
- A regulatory sandbox mechanism for innovative projects
Ley 314 has not been enacted as of June 2026. However, its scope is significantly more detailed than its predecessors โ when enacted, it would introduce Panama's first formal VASP/CASP licensing regime. Operators incorporating now should build AML/CFT infrastructure to Ley 314 standards to ensure smooth transition when the law passes.
Who Is Using Costa Rica and Panama for Crypto Structures in 2026
The commercial profile of operators choosing Costa Rica and Panama in 2026 is consistent. They are not large institutional operators seeking long-term banking relationships in European markets โ those operators need CySEC MiCA CASP licenses, FSC Mauritius VASP authorization, or FSA Seychelles VASP licenses. Costa Rica and Panama are primarily used by three categories of operators.
First, early-stage startups testing product-market fit before committing to full regulatory licensing. A Costa Rica or Panama S.A. can be operational in one to two weeks at four-figure cost โ allowing a team to launch, acquire initial users, validate the business model, and generate the revenue history that makes a subsequent Seychelles or Mauritius licensing application credible. This "regulatory bridge" strategy is common and commercially rational.
Second, GameFi, DeFi, NFT marketplace, and crypto casino operators. Both Costa Rica and Panama have specific commercial advantages for these categories โ Costa Rica because its enabling regulation makes crypto gaming structuring straightforward, Panama because its decades-long offshore gaming and financial services infrastructure supports these business models with local service provider ecosystems. Third, operators whose primary client base is in Latin America, where the cultural and language alignment of a Costa Rican or Panamanian corporate domicile has genuine commercial value for client acquisition and local banking relationships.
The Honest Timeline โ When Are These Jurisdictions Likely to Require Licensing?
The timeline based on current legislative status (June 2026):
Costa Rica: The Legislative Assembly unanimously approved the Law No. 7786 amendment (Expediente 25.340) on 25 May 2026, bringing VASPs under AML/CFT oversight. It awaits presidential signature and publication in La Gaceta, with implementing regulations expected within three months. This mandates SUGEF registration โ an AML/CFT supervision measure, not an operating license. Operators should be SUGEF-registration-ready in H2 2026. CARF reporting: data collection begins January 2027, first international exchange 2028.
Panama:Anteproyecto Ley Nยฐ 314 โ presented to the National Assembly on 13 January 2026 โ now supersedes Bills 247 and 326, introducing formal VASP/CASP licensing, capitalisation standards, and joint SBP/UAF oversight. It has not been enacted as of June 2026. Panama's legislative process (three National Assembly debates + presidential sanction) means 2026 enactment would require significant acceleration, and the president previously vetoed an earlier crypto bill (Bill 697 in 2021). Most likely timeline for mandatory VASP licensing: 2027 at earliest. CARF-MCAA signed December 2025 โ Panama committed to CARF implementation timeline.
The commercial window: Both jurisdictions remain genuinely viable for legal crypto company formation without mandatory licensing through at least end-2026. The probability of the legislative window remaining open through 2027 is significantly lower. Operators who want to use Costa Rica or Panama as their primary regulatory structure should plan for licensing transitions within 12โ18 months.
Costa Rica vs Panama โ Which Is Right for Your Crypto Structure?
| Feature | Costa Rica | Panama |
|---|---|---|
| VASP license required | No | No |
| UAF/AML registration | Pending (Bill 22.837) | Yes โ UAF mandatory |
| Corporate structure | S.A. (Sociedad Anรณnima) | S.A. or S.R.L. |
| Directors required | Min. 3 (no residency) | Min. 3 (no residency) |
| Min. capital | None | None |
| Local office required | No (legal address via agent) | No (registered agent) |
| Currency | Colรณn (USD widely used) | USD (legal tender) |
| Incorporation timeline | 1โ6 weeks | 1โ2 weeks |
| Territorial tax | Yes โ foreign income exempt | Yes โ foreign income exempt |
| CARF implementation | Data from Jan 2027 | MCAA signed Dec 2025 |
| Pending legislation | Bill 22.837 (SUGEF reg) | Bill 247 + Bill 326 |
| EU high-risk list | Clean | Exited July 2025 |
| FATF grey list | Clean | Exited 2023 |
| GameFi/Crypto casino | Strong | Strong |
| Banking access | Moderate | Improving (post-EU exit) |
| Best for | Startups, GameFi, DeFi, fast entry | Latin American ops, OTC, gaming, fintech |
What Does It Cost? โ Realistic 2026 Cost Breakdown
One of the most common questions from operators evaluating Costa Rica and Panama is what the total cost actually is โ not the marketing headline, but the real Year 1 number. Here is Zitadelle AG's honest breakdown:
Costa Rica โ Year 1 All-In
| Item | Cost |
|---|---|
| S.A. or S.R.L. incorporation | USD $500โ$1,500 |
| Registered office (fiscal address) | USD $500โ$1,000/year |
| Resident agent | USD $500โ$1,000/year |
| AML/CFT policy manual (SUGEF-ready) | USD $1,500โ$3,000 |
| SUGEF registration preparation | USD $500โ$1,500 |
| Legal opinion (banking/PSP partners) | USD $1,000โ$2,500 |
| Zitadelle AG service | Quoted on scope |
| Year 1 total (excl. service fee) | USD $4,000โ$10,000 |
No government application fee. No license fee. No capital requirement.
Panama โ Year 1 All-In
| Item | Cost |
|---|---|
| S.A. incorporation | USD $500โ$1,500 |
| Registered agent | USD $800โ$1,500/year |
| Annual franchise tax | USD $300 |
| UAF registration (preparation) | USD $500โ$1,000 |
| AML/CFT compliance framework | USD $1,500โ$3,000 |
| Legal opinion | USD $1,000โ$2,500 |
| Zitadelle AG service | Quoted on scope |
| Year 1 total (excl. service fee) | USD $3,000โ$8,000 |
No license fee. No capital requirement.
These figures cover a functional, compliant entity ready for banking applications. They do not include the banking service itself โ securing a corporate account is a separate process that adds 4โ12 weeks and specialist banker introduction.
Zitadelle AG's Assessment โ When Costa Rica or Panama Makes Sense, and When It Doesn't
Costa Rica and Panama are genuinely useful โ but for specific situations and with specific caveats. They are the right choice when you need a legal corporate entity that can explicitly state crypto activities in its bylaws, in the shortest possible timeframe, at the lowest possible cost, while you build your product and prove your business model. The regulatory uncertainty is a feature, not a bug, for operators at this stage โ the absence of mandatory licensing is the point. A startup that has raised $500,000 in seed funding, needs to launch within 60 days, and does not yet have the compliance infrastructure for an FSC Mauritius or FSA Seychelles application is the canonical Costa Rica or Panama operator.
They are the wrong choice when you need EU client access, institutional banking relationships with European banks, Tier-1 liquidity provider onboarding, or credibility with sophisticated institutional counterparties. A Costa Rican or Panamanian corporation with UAF registration is not a credential that unlocks those relationships. For operators who need EU market access, Cyprus MiCA CASP is the answer. For operators targeting Africa and Asia with credible regulated standing, Mauritius FSC VASP or Seychelles FSA VASP is the answer. Costa Rica and Panama sit in the "entry-level or bridge structure" category โ extremely useful in the right context, inadequate for others.
The regulatory transition risk is real and should be priced into the decision. Operators who establish Costa Rica or Panama structures in 2026 should simultaneously plan for the licensing transition โ identifying the target jurisdiction, building the compliance infrastructure, and having the capital ready for a Seychelles, Mauritius, or AIFC application when the legislative environment changes. Zitadelle AG designs these multi-stage structures regularly: Costa Rica or Panama for immediate launch, with a Mauritius or Seychelles VASP application in progress on a parallel track.
How Zitadelle AG Helps
Zitadelle AG provides end-to-end support for Costa Rica and Panama crypto company formation and the compliance infrastructure that now accompanies it:
- S.A. / S.R.L. incorporation in Costa Rica and S.A. incorporation in Panama, including registered office and resident/registered agent
- AML/CFT policy manuals built to SUGEF registration standard (Costa Rica) and UAF registration standard (Panama)
- SUGEF and UAF registration preparation and coordination
- Legal opinions for banking and payment-processor onboarding
- Corporate bank account and PSP introductions
- Multi-stage structures pairing immediate Costa Rica or Panama entry with a parallel Seychelles FSA or Mauritius FSC VASP application for operators who will need formally regulated standing
Setting up a Costa Rica or Panama VASP company?
Zitadelle AG provides end-to-end support for Costa Rica and Panama VASP company formation โ incorporation, legal opinion, AML/CFT framework, UAF registration, and bank account introductions.
Frequently Asked Questions
No โ as of June 2026, neither Costa Rica nor Panama requires a formal VASP operating license to run a crypto business. Both allow companies to include cryptocurrency activities in their corporate bylaws under general commercial law. AML/CFT compliance is mandatory: Panama requires UAF registration now, and Costa Rica's May 2026 reform to Law No. 7786 adds mandatory SUGEF registration for AML/CFT purposes โ which is explicitly not an operating license.