Virtual Assets

Costa Rica & Panama Crypto Company 2026 โ€” Register Without a VASP License, SUGEF & UAF Compliance Guide

June 25, 2026Zitadelle AG

Most of the world's crypto-friendly offshore jurisdictions have converged on mandatory licensing. The Seychelles VASP Act 2024 made licensing compulsory from September 2024. El Salvador's CNAD issues DASP licenses. Mauritius's FSC requires formal VASP authorization. Even the BVI has formal VASP registration. Costa Rica and Panama stand apart โ€” two Central American jurisdictions where incorporating a company with cryptocurrency activities in its bylaws remains legally permissible without a government-issued VASP license, formal capital requirements, or mandatory regulatory approval. That status is under legislative pressure on both sides of the border. Bills are pending in both countries. Panama signed the OECD's CARF agreement in December 2025, and presented the comprehensive Anteproyecto Ley Nยฐ 314 in January 2026. Costa Rica unanimously approved a Law No. 7786 amendment bringing VASPs under SUGEF AML/CFT oversight on 25 May 2026 โ€” though, crucially, SUGEF registration is not a VASP operating license. The window for operating without a formal license is still open โ€” but it is narrowing. This is the honest 2026 picture.

Why Costa Rica and Panama Still Offer What Most Jurisdictions No Longer Do

The global regulatory trend since 2021 has been relentlessly in one direction: every jurisdiction that had a light-touch or no-registration VASP framework has either introduced mandatory licensing, faced FATF grey-listing pressure, or both. The EU's MiCA framework covers the entire European market. The Seychelles VASP Act 2024 ended the era of unregulated offshore Seychelles crypto structures. SVG banned forex and tightened its stance on crypto. The Marshall Islands โ€” once a popular zero-regulation alternative โ€” faces increasing banking pressure. The result is that the market for genuinely light-touch VASP corporate structures has narrowed significantly.

Costa Rica and Panama occupy a distinct position because their regulatory neutrality toward crypto is not a deliberate pro-crypto policy โ€” it is a reflection of legislative bandwidth and sequencing. Both governments have larger economic priorities than crypto regulation. Both are small economies with significant offshore financial services ecosystems that create political resistance to heavy-handed new regulation. Both operate under territorial tax systems where foreign-sourced crypto income is generally not taxed โ€” a structural advantage that reinforces the commercial case for incorporation. And both are currently in the middle of messy legislative processes around crypto regulation that have not yet produced enacted law.

The honest description of Costa Rica and Panama in 2026 is not "crypto-friendly" in the sense that Estonia or Malta is crypto-friendly. It is that neither country currently requires a formal VASP license to operate a crypto business through a properly structured corporation with AML/CFT compliance in place. That distinction matters โ€” and it is worth understanding precisely because both countries have pending legislation that could change it.

Costa Rica vs Panama vs SVG vs Georgia โ€” 2026 Fast-Start Crypto Structures

FeatureCosta RicaPanamaSVGGeorgia
Formal VASP licenseNoNoNoNo
AML registrationSUGEF (May 2026 reform)UAF (mandatory now)FSA notificationNBG registration
Company typeS.A. or S.R.L.S.A.LLC or LTDLLC
Time to incorporate1โ€“2 weeks1โ€“2 weeks3โ€“5 days1โ€“2 weeks
Capital requirementNoneNoneNoneNone
Corporate tax0% foreign income0% foreign income0%0% foreign income
Annual franchise taxNoneUSD $300LowNone
iGaming (data processing)Yes โ€” 30+ year historyLimitedMinimalNo
Crypto salary paymentsLegalYesNoNo
CARF reportingFrom Jan 2027Signed CARF-MCAA Dec 2025Not committedNot OECD member
Banking difficultyHighHighVery highModerate
Legal opinion availableYesYesLimitedYes
EU high-risk listNot listedExited July 2025Not listedNot listed
Year 1 cost (all-in)USD $4,000โ€“$8,000USD $2,000โ€“$4,000USD $2,500โ€“$5,000USD $5,000โ€“$12,000
Pending licensingExpediente 25.340/25.362 (enacted May 2026)Ley 314 (Jan 2026, pending)SVG VASP ActNBG reform
Best foriGaming, crypto casino, OTCUSD economy, privacy, LATAMSpeed, prop tradingFast start, CIS corridor

Costa Rica 2026 โ€” The SUGEF Bill, the Tax Advantage, and the Regulatory Timeline

Costa Rica's crypto framework in 2026 is simultaneously simple and in flux. Here is what is actually the case:

No Formal VASP License Required (As of June 2026)

As of June 2026, Costa Rica does not issue a formal VASP operating license and does not require one to operate a crypto business. A company can include cryptocurrency exchange, wallet services, token issuance, GameFi, and OTC operations in its corporate bylaws under general commercial law without obtaining government approval. The May 2026 reform to Law No. 7786 adds mandatory SUGEF registration for AML/CFT purposes โ€” but explicitly states this is not an operating permit. No capital requirements. No physical office or local director required. The entire incorporation process can be completed in 1โ€“6 weeks remotely.

AML/CFT Compliance is Mandatory Under Law 7786

Despite the absence of a license requirement, crypto companies operating in or from Costa Rica are subject to AML/CFT obligations under Law No. 7786 (the AML/CFT Law). SUGEF (Superintendencia General de Entidades Financieras) has oversight responsibilities, and ICD (Instituto Costarricense sobre Drogas โ€” the Anti-Money Laundering body) enforces AML/CFT obligations. VASPs must implement KYC/CDD procedures, beneficial ownership transparency, suspicious transaction reporting, and Travel Rule compliance for cross-border transfers. Practical compliance with these obligations is required โ€” not optional. Banks and payment processors require evidence of AML compliance frameworks before onboarding.

May 2026: SUGEF Registration Reform Enacted (Not a License)

On 25 May 2026, Costa Rica's Legislative Assembly unanimously approved an amendment to Law No. 7786 โ€” the country's AML/CFT law โ€” incorporating Virtual Asset Service Providers as obligated subjects. This reform was passed under Expediente 25.340, which replaced the previously discussed Bill 22.837 (now archived and no longer active) and its successor Expediente 25.362. The amendment awaits presidential signature and publication in La Gaceta, after which implementing regulations are expected within three months. Critical distinction: SUGEF registration is NOT a VASP operating license. The reform explicitly states that registration does not constitute an operating permit or government authorization โ€” operators can incorporate a Costa Rica company, register with SUGEF for AML/CFT purposes, and operate. What remains unregulated: token issuance rules, custody standards, exchange licensing, and consumer protection โ€” none are covered by the May 2026 reform. The reform's primary motivation was FATF Recommendation 15 technical compliance, as Costa Rica faced greylisting risk without bringing VASPs under AML/CFT oversight. This is an AML/CFT supervision measure, not a licensing regime: Costa Rica remains a jurisdiction where you can operate a crypto business without a VASP operating license โ€” but you must now build your AML/CFT framework to SUGEF registration standard from day one.

Territorial Tax and No CARF Until 2027

Costa Rica's territorial tax system means income generated from customers outside Costa Rica is generally not subject to Costa Rican corporate income tax. Foreign-sourced crypto exchange and service income is typically outside the Costa Rican tax base when operational activity is conducted offshore. The OECD's Crypto-Asset Reporting Framework (CARF) โ€” which will require automatic exchange of crypto transaction data between tax authorities โ€” is expected to apply from 2027, with data collection commencing January 1, 2027 and first international exchanges in 2028. Costa Rica's favorable tax position for international crypto operations will remain largely intact through 2026.

Panama 2026 โ€” Two Bills Pending, EU High-Risk List Exit, and the CARF Timeline

Panama's crypto regulatory situation is more actively in motion than Costa Rica's. Three significant developments in 2025โ€“2026 are reshaping the landscape:

Three major 2025 Panama developments every crypto operator should know:

  • July 2025: Panama officially exited the European Commission's list of high-risk countries for money laundering โ€” a meaningful improvement for banking relationships
  • December 2025: Panama signed the OECD CARF Multilateral Competent Authority Agreement (CARF-MCAA) โ€” signaling commitment to future crypto tax transparency reporting
  • 2025: Two draft bills (Bill 247 and Bill 326) introduced comprehensive VASP regulation frameworks โ€” neither yet enacted, but both advancing through the National Assembly

No Mandatory VASP License (Current Status)

As of June 2026, Panama does not operate a standalone crypto licensing regime. Crypto activities โ€” exchanges, wallets, custody, token issuance, DeFi protocols, NFT marketplaces, GameFi โ€” can be conducted through a standard Panamanian corporation (Sociedad Anรณnima / S.A.) without a dedicated VASP license or regulatory approval. Company registration takes 1โ€“2 weeks. No minimum capital, no local director requirement, no physical office mandatory. Panama uses the US dollar as legal tender, eliminating currency risk. Foreign-sourced income is not subject to Panama's territorial tax โ€” crypto revenue from international clients is generally tax-free.

UAF Registration is Mandatory

Unlike Costa Rica's model โ€” where AML compliance is required but registration is pending legislation โ€” Panama's Law 23 of 2015 already mandates registration with the Unidad de Anรกlisis Financiero (UAF) for entities that meet the VASP definition. UAF registration requires appointing a compliance officer, implementing KYC/CDD procedures, and establishing suspicious transaction reporting. This is the existing mandatory requirement โ€” it is not a license, but it is not optional. Failure to register with the UAF or maintain AML compliance exposes operators to administrative sanctions or criminal penalties.

Bill 247 and Bill 326: Two Pending Frameworks

Bill 247 (introduced April 2025 by the Commerce and Economic Affairs Commission) would establish mandatory VASP registration with the UAF and create a National Council of Digital Assets (CONAD) to supervise crypto policy. It defines core concepts including cryptocurrency, stablecoin, blockchain, smart contracts, security tokens, utility tokens, NFTs, and VASPs. Tax incentives for blockchain startups are included. Bill 326 (also pending 2025) complements Bill 247 by proposing mandatory licensing under the Superintendency of the Securities Market (SMV), FATF-aligned AML controls, and a public VASP registry. Neither bill has been enacted. Panama's legislative process requires three separate National Assembly debates before presidential sanction โ€” the bills are still moving through this process.

Panama Exited the EU High-Risk List

Panama's exit from the European Commission's list of high-risk money laundering jurisdictions in July 2025 is commercially significant. Banks and payment processors that applied enhanced due diligence to Panama-incorporated entities as a result of EU high-risk list designation have started revisiting their positions. Combined with the FATF grey list exit in 2023, Panama's AML/CFT credibility trajectory is positive โ€” creating better banking access for legitimately structured Panama crypto companies than existed two years ago.

Anteproyecto Ley Nยฐ 314 (January 2026):

The most recent and most comprehensive Panama crypto legislative draft is Anteproyecto Ley Nยฐ 314, formally presented to the National Assembly on 13 January 2026. It supersedes Bills 247 and 326 in scope and detail, introducing:

  • Formal VASP and CASP definitions aligned with FATF and MiCA terminology
  • Mandatory licensing obligations for entities meeting VASP/CASP definitions
  • Minimum capitalisation and governance standards
  • Oversight by both the Superintendencia de Bancos de Panamรก (SBP) and the UAF jointly
  • A regulatory sandbox mechanism for innovative projects

Ley 314 has not been enacted as of June 2026. However, its scope is significantly more detailed than its predecessors โ€” when enacted, it would introduce Panama's first formal VASP/CASP licensing regime. Operators incorporating now should build AML/CFT infrastructure to Ley 314 standards to ensure smooth transition when the law passes.

Who Is Using Costa Rica and Panama for Crypto Structures in 2026

The commercial profile of operators choosing Costa Rica and Panama in 2026 is consistent. They are not large institutional operators seeking long-term banking relationships in European markets โ€” those operators need CySEC MiCA CASP licenses, FSC Mauritius VASP authorization, or FSA Seychelles VASP licenses. Costa Rica and Panama are primarily used by three categories of operators.

First, early-stage startups testing product-market fit before committing to full regulatory licensing. A Costa Rica or Panama S.A. can be operational in one to two weeks at four-figure cost โ€” allowing a team to launch, acquire initial users, validate the business model, and generate the revenue history that makes a subsequent Seychelles or Mauritius licensing application credible. This "regulatory bridge" strategy is common and commercially rational.

Second, GameFi, DeFi, NFT marketplace, and crypto casino operators. Both Costa Rica and Panama have specific commercial advantages for these categories โ€” Costa Rica because its enabling regulation makes crypto gaming structuring straightforward, Panama because its decades-long offshore gaming and financial services infrastructure supports these business models with local service provider ecosystems. Third, operators whose primary client base is in Latin America, where the cultural and language alignment of a Costa Rican or Panamanian corporate domicile has genuine commercial value for client acquisition and local banking relationships.

The Honest Timeline โ€” When Are These Jurisdictions Likely to Require Licensing?

The timeline based on current legislative status (June 2026):

Costa Rica: The Legislative Assembly unanimously approved the Law No. 7786 amendment (Expediente 25.340) on 25 May 2026, bringing VASPs under AML/CFT oversight. It awaits presidential signature and publication in La Gaceta, with implementing regulations expected within three months. This mandates SUGEF registration โ€” an AML/CFT supervision measure, not an operating license. Operators should be SUGEF-registration-ready in H2 2026. CARF reporting: data collection begins January 2027, first international exchange 2028.

Panama:Anteproyecto Ley Nยฐ 314 โ€” presented to the National Assembly on 13 January 2026 โ€” now supersedes Bills 247 and 326, introducing formal VASP/CASP licensing, capitalisation standards, and joint SBP/UAF oversight. It has not been enacted as of June 2026. Panama's legislative process (three National Assembly debates + presidential sanction) means 2026 enactment would require significant acceleration, and the president previously vetoed an earlier crypto bill (Bill 697 in 2021). Most likely timeline for mandatory VASP licensing: 2027 at earliest. CARF-MCAA signed December 2025 โ€” Panama committed to CARF implementation timeline.

The commercial window: Both jurisdictions remain genuinely viable for legal crypto company formation without mandatory licensing through at least end-2026. The probability of the legislative window remaining open through 2027 is significantly lower. Operators who want to use Costa Rica or Panama as their primary regulatory structure should plan for licensing transitions within 12โ€“18 months.

Costa Rica vs Panama โ€” Which Is Right for Your Crypto Structure?

FeatureCosta RicaPanama
VASP license requiredNoNo
UAF/AML registrationPending (Bill 22.837)Yes โ€” UAF mandatory
Corporate structureS.A. (Sociedad Anรณnima)S.A. or S.R.L.
Directors requiredMin. 3 (no residency)Min. 3 (no residency)
Min. capitalNoneNone
Local office requiredNo (legal address via agent)No (registered agent)
CurrencyColรณn (USD widely used)USD (legal tender)
Incorporation timeline1โ€“6 weeks1โ€“2 weeks
Territorial taxYes โ€” foreign income exemptYes โ€” foreign income exempt
CARF implementationData from Jan 2027MCAA signed Dec 2025
Pending legislationBill 22.837 (SUGEF reg)Bill 247 + Bill 326
EU high-risk listCleanExited July 2025
FATF grey listCleanExited 2023
GameFi/Crypto casinoStrongStrong
Banking accessModerateImproving (post-EU exit)
Best forStartups, GameFi, DeFi, fast entryLatin American ops, OTC, gaming, fintech

What Does It Cost? โ€” Realistic 2026 Cost Breakdown

One of the most common questions from operators evaluating Costa Rica and Panama is what the total cost actually is โ€” not the marketing headline, but the real Year 1 number. Here is Zitadelle AG's honest breakdown:

Costa Rica โ€” Year 1 All-In

ItemCost
S.A. or S.R.L. incorporationUSD $500โ€“$1,500
Registered office (fiscal address)USD $500โ€“$1,000/year
Resident agentUSD $500โ€“$1,000/year
AML/CFT policy manual (SUGEF-ready)USD $1,500โ€“$3,000
SUGEF registration preparationUSD $500โ€“$1,500
Legal opinion (banking/PSP partners)USD $1,000โ€“$2,500
Zitadelle AG serviceQuoted on scope
Year 1 total (excl. service fee)USD $4,000โ€“$10,000

No government application fee. No license fee. No capital requirement.

Panama โ€” Year 1 All-In

ItemCost
S.A. incorporationUSD $500โ€“$1,500
Registered agentUSD $800โ€“$1,500/year
Annual franchise taxUSD $300
UAF registration (preparation)USD $500โ€“$1,000
AML/CFT compliance frameworkUSD $1,500โ€“$3,000
Legal opinionUSD $1,000โ€“$2,500
Zitadelle AG serviceQuoted on scope
Year 1 total (excl. service fee)USD $3,000โ€“$8,000

No license fee. No capital requirement.

These figures cover a functional, compliant entity ready for banking applications. They do not include the banking service itself โ€” securing a corporate account is a separate process that adds 4โ€“12 weeks and specialist banker introduction.

Zitadelle AG's Assessment โ€” When Costa Rica or Panama Makes Sense, and When It Doesn't

Costa Rica and Panama are genuinely useful โ€” but for specific situations and with specific caveats. They are the right choice when you need a legal corporate entity that can explicitly state crypto activities in its bylaws, in the shortest possible timeframe, at the lowest possible cost, while you build your product and prove your business model. The regulatory uncertainty is a feature, not a bug, for operators at this stage โ€” the absence of mandatory licensing is the point. A startup that has raised $500,000 in seed funding, needs to launch within 60 days, and does not yet have the compliance infrastructure for an FSC Mauritius or FSA Seychelles application is the canonical Costa Rica or Panama operator.

They are the wrong choice when you need EU client access, institutional banking relationships with European banks, Tier-1 liquidity provider onboarding, or credibility with sophisticated institutional counterparties. A Costa Rican or Panamanian corporation with UAF registration is not a credential that unlocks those relationships. For operators who need EU market access, Cyprus MiCA CASP is the answer. For operators targeting Africa and Asia with credible regulated standing, Mauritius FSC VASP or Seychelles FSA VASP is the answer. Costa Rica and Panama sit in the "entry-level or bridge structure" category โ€” extremely useful in the right context, inadequate for others.

The regulatory transition risk is real and should be priced into the decision. Operators who establish Costa Rica or Panama structures in 2026 should simultaneously plan for the licensing transition โ€” identifying the target jurisdiction, building the compliance infrastructure, and having the capital ready for a Seychelles, Mauritius, or AIFC application when the legislative environment changes. Zitadelle AG designs these multi-stage structures regularly: Costa Rica or Panama for immediate launch, with a Mauritius or Seychelles VASP application in progress on a parallel track.

How Zitadelle AG Helps

Zitadelle AG provides end-to-end support for Costa Rica and Panama crypto company formation and the compliance infrastructure that now accompanies it:

Setting up a Costa Rica or Panama VASP company?

Zitadelle AG provides end-to-end support for Costa Rica and Panama VASP company formation โ€” incorporation, legal opinion, AML/CFT framework, UAF registration, and bank account introductions.

Frequently Asked Questions

No โ€” as of June 2026, neither Costa Rica nor Panama requires a formal VASP operating license to run a crypto business. Both allow companies to include cryptocurrency activities in their corporate bylaws under general commercial law. AML/CFT compliance is mandatory: Panama requires UAF registration now, and Costa Rica's May 2026 reform to Law No. 7786 adds mandatory SUGEF registration for AML/CFT purposes โ€” which is explicitly not an operating license.

Share this article

Setting up a Costa Rica or Panama VASP company?

Zitadelle AG provides end-to-end support for Costa Rica and Panama crypto company formation โ€” incorporation, legal opinion, AML/CFT framework, UAF registration coordination, and bank account introductions. We also design multi-stage structures pairing immediate LatAm entry with parallel formal licensing applications.

WhatsApp Us