Why Costa Rica and Panama Still Offer What Most Jurisdictions No Longer Do
The global regulatory trend since 2021 has been relentlessly in one direction: every jurisdiction that had a light-touch or no-registration VASP framework has either introduced mandatory licensing, faced FATF grey-listing pressure, or both. The EU's MiCA framework covers the entire European market. The Seychelles VASP Act 2024 ended the era of unregulated offshore Seychelles crypto structures. SVG banned forex and tightened its stance on crypto. The Marshall Islands — once a popular zero-regulation alternative — faces increasing banking pressure. The result is that the market for genuinely light-touch VASP corporate structures has narrowed significantly.
Costa Rica and Panama occupy a distinct position because their regulatory neutrality toward crypto is not a deliberate pro-crypto policy — it is a reflection of legislative bandwidth and sequencing. Both governments have larger economic priorities than crypto regulation. Both are small economies with significant offshore financial services ecosystems that create political resistance to heavy-handed new regulation. Both operate under territorial tax systems where foreign-sourced crypto income is generally not taxed — a structural advantage that reinforces the commercial case for incorporation. And both are currently in the middle of messy legislative processes around crypto regulation that have not yet produced enacted law.
The honest description of Costa Rica and Panama in 2026 is not "crypto-friendly" in the sense that Estonia or Malta is crypto-friendly. It is that neither country currently requires a formal VASP license to operate a crypto business through a properly structured corporation with AML/CFT compliance in place. That distinction matters — and it is worth understanding precisely because both countries have pending legislation that could change it.
Costa Rica 2026 — The SUGEF Bill, the Tax Advantage, and the Regulatory Timeline
Costa Rica's crypto framework in 2026 is simultaneously simple and in flux. Here is what is actually the case:
No Formal VASP License Required (As of April 2026)
As of April 2026, Costa Rica does not issue a formal VASP license and does not require one to operate a crypto business. A company can include cryptocurrency exchange, wallet services, token issuance, GameFi, and OTC operations in its corporate bylaws under general commercial law without obtaining government approval. No capital requirements. No mandatory regulatory application. No physical office or local director required. The entire incorporation process can be completed in 1–6 weeks remotely.
AML/CFT Compliance is Mandatory Under Law 7786
Despite the absence of a license requirement, crypto companies operating in or from Costa Rica are subject to AML/CFT obligations under Law No. 7786 (the AML/CFT Law). SUGEF (Superintendencia General de Entidades Financieras) has oversight responsibilities, and ICD (Instituto Costarricense sobre Drogas — the Anti-Money Laundering body) enforces AML/CFT obligations. VASPs must implement KYC/CDD procedures, beneficial ownership transparency, suspicious transaction reporting, and Travel Rule compliance for cross-border transfers. Practical compliance with these obligations is required — not optional. Banks and payment processors require evidence of AML compliance frameworks before onboarding.
Bill 22.837: The Pending SUGEF Registration Bill
Bill No. 22.837 — Costa Rica's pending crypto regulation bill — passed its first legislative debate in July 2025. If enacted, it would require formal VASP registration with SUGEF, mandatory public listing of registered entities, risk-based supervision with continuous audits, enhanced KYC and beneficial ownership requirements, and Travel Rule adherence. The bill does not introduce a formal licensing regime in the traditional sense — it focuses on mandatory SUGEF registration and AML/CFT enforcement infrastructure. As of April 2026, the bill has not been enacted. Its final scope depends on the legislative text adopted.
Territorial Tax and No CARF Until 2027
Costa Rica's territorial tax system means income generated from customers outside Costa Rica is generally not subject to Costa Rican corporate income tax. Foreign-sourced crypto exchange and service income is typically outside the Costa Rican tax base when operational activity is conducted offshore. The OECD's Crypto-Asset Reporting Framework (CARF) — which will require automatic exchange of crypto transaction data between tax authorities — is expected to apply from 2027, with data collection commencing January 1, 2027 and first international exchanges in 2028. Costa Rica's favorable tax position for international crypto operations will remain largely intact through 2026.
Panama 2026 — Two Bills Pending, EU High-Risk List Exit, and the CARF Timeline
Panama's crypto regulatory situation is more actively in motion than Costa Rica's. Three significant developments in 2025–2026 are reshaping the landscape:
Three major 2025 Panama developments every crypto operator should know:
- July 2025: Panama officially exited the European Commission's list of high-risk countries for money laundering — a meaningful improvement for banking relationships
- December 2025: Panama signed the OECD CARF Multilateral Competent Authority Agreement (CARF-MCAA) — signaling commitment to future crypto tax transparency reporting
- 2025: Two draft bills (Bill 247 and Bill 326) introduced comprehensive VASP regulation frameworks — neither yet enacted, but both advancing through the National Assembly
No Mandatory VASP License (Current Status)
As of April 2026, Panama does not operate a standalone crypto licensing regime. Crypto activities — exchanges, wallets, custody, token issuance, DeFi protocols, NFT marketplaces, GameFi — can be conducted through a standard Panamanian corporation (Sociedad Anónima / S.A.) without a dedicated VASP license or regulatory approval. Company registration takes 1–2 weeks. No minimum capital, no local director requirement, no physical office mandatory. Panama uses the US dollar as legal tender, eliminating currency risk. Foreign-sourced income is not subject to Panama's territorial tax — crypto revenue from international clients is generally tax-free.
UAF Registration is Mandatory
Unlike Costa Rica's model — where AML compliance is required but registration is pending legislation — Panama's Law 23 of 2015 already mandates registration with the Unidad de Análisis Financiero (UAF) for entities that meet the VASP definition. UAF registration requires appointing a compliance officer, implementing KYC/CDD procedures, and establishing suspicious transaction reporting. This is the existing mandatory requirement — it is not a license, but it is not optional. Failure to register with the UAF or maintain AML compliance exposes operators to administrative sanctions or criminal penalties.
Bill 247 and Bill 326: Two Pending Frameworks
Bill 247 (introduced April 2025 by the Commerce and Economic Affairs Commission) would establish mandatory VASP registration with the UAF and create a National Council of Digital Assets (CONAD) to supervise crypto policy. It defines core concepts including cryptocurrency, stablecoin, blockchain, smart contracts, security tokens, utility tokens, NFTs, and VASPs. Tax incentives for blockchain startups are included. Bill 326 (also pending 2025) complements Bill 247 by proposing mandatory licensing under the Superintendency of the Securities Market (SMV), FATF-aligned AML controls, and a public VASP registry. Neither bill has been enacted. Panama's legislative process requires three separate National Assembly debates before presidential sanction — the bills are still moving through this process.
Panama Exited the EU High-Risk List
Panama's exit from the European Commission's list of high-risk money laundering jurisdictions in July 2025 is commercially significant. Banks and payment processors that applied enhanced due diligence to Panama-incorporated entities as a result of EU high-risk list designation have started revisiting their positions. Combined with the FATF grey list exit in 2023, Panama's AML/CFT credibility trajectory is positive — creating better banking access for legitimately structured Panama crypto companies than existed two years ago.
Who Is Using Costa Rica and Panama for Crypto Structures in 2026
The commercial profile of operators choosing Costa Rica and Panama in 2026 is consistent. They are not large institutional operators seeking long-term banking relationships in European markets — those operators need CySEC MiCA CASP licenses, FSC Mauritius VASP authorization, or FSA Seychelles VASP licenses. Costa Rica and Panama are primarily used by three categories of operators.
First, early-stage startups testing product-market fit before committing to full regulatory licensing. A Costa Rica or Panama S.A. can be operational in one to two weeks at four-figure cost — allowing a team to launch, acquire initial users, validate the business model, and generate the revenue history that makes a subsequent Seychelles or Mauritius licensing application credible. This "regulatory bridge" strategy is common and commercially rational.
Second, GameFi, DeFi, NFT marketplace, and crypto casino operators. Both Costa Rica and Panama have specific commercial advantages for these categories — Costa Rica because its enabling regulation makes crypto gaming structuring straightforward, Panama because its decades-long offshore gaming and financial services infrastructure supports these business models with local service provider ecosystems. Third, operators whose primary client base is in Latin America, where the cultural and language alignment of a Costa Rican or Panamanian corporate domicile has genuine commercial value for client acquisition and local banking relationships.
The Honest Timeline — When Are These Jurisdictions Likely to Require Licensing?
The timeline based on current legislative status (April 2026):
Costa Rica: Bill 22.837 passed first debate in July 2025. Second debate procedural setback means enactment in 2026 is possible but not certain. The bill proposes mandatory SUGEF registration rather than full licensing — which is less burdensome than a formal VASP license. Most likely timeline for mandatory SUGEF registration: late 2026 to mid-2027. CARF reporting: data collection begins January 2027, first international exchange 2028.
Panama:Bill 247 and Bill 326 both introduced 2025, neither enacted. Panama's legislative process (three National Assembly debates + presidential sanction) means 2026 enactment would require significant acceleration. The president previously vetoed an earlier crypto bill (Bill 697 in 2021). Most likely timeline for mandatory VASP licensing in Panama: 2027 at earliest if current bills progress without veto. CARF-MCAA signed December 2025 — Panama committed to CARF implementation timeline.
The commercial window: Both jurisdictions remain genuinely viable for legal crypto company formation without mandatory licensing through at least end-2026. The probability of the legislative window remaining open through 2027 is significantly lower. Operators who want to use Costa Rica or Panama as their primary regulatory structure should plan for licensing transitions within 12–18 months.
Costa Rica vs Panama — Which Is Right for Your Crypto Structure?
| Feature | Costa Rica | Panama |
|---|---|---|
| VASP license required | No | No |
| UAF/AML registration | Pending (Bill 22.837) | Yes — UAF mandatory |
| Corporate structure | S.A. (Sociedad Anónima) | S.A. or S.R.L. |
| Directors required | Min. 3 (no residency) | Min. 3 (no residency) |
| Min. capital | None | None |
| Local office required | No (legal address via agent) | No (registered agent) |
| Currency | Colón (USD widely used) | USD (legal tender) |
| Incorporation timeline | 1–6 weeks | 1–2 weeks |
| Territorial tax | Yes — foreign income exempt | Yes — foreign income exempt |
| CARF implementation | Data from Jan 2027 | MCAA signed Dec 2025 |
| Pending legislation | Bill 22.837 (SUGEF reg) | Bill 247 + Bill 326 |
| EU high-risk list | Clean | Exited July 2025 |
| FATF grey list | Clean | Exited 2023 |
| GameFi/Crypto casino | Strong | Strong |
| Banking access | Moderate | Improving (post-EU exit) |
| Best for | Startups, GameFi, DeFi, fast entry | Latin American ops, OTC, gaming, fintech |
Zitadelle AG's Assessment — When Costa Rica or Panama Makes Sense, and When It Doesn't
Costa Rica and Panama are genuinely useful — but for specific situations and with specific caveats. They are the right choice when you need a legal corporate entity that can explicitly state crypto activities in its bylaws, in the shortest possible timeframe, at the lowest possible cost, while you build your product and prove your business model. The regulatory uncertainty is a feature, not a bug, for operators at this stage — the absence of mandatory licensing is the point. A startup that has raised $500,000 in seed funding, needs to launch within 60 days, and does not yet have the compliance infrastructure for an FSC Mauritius or FSA Seychelles application is the canonical Costa Rica or Panama operator.
They are the wrong choice when you need EU client access, institutional banking relationships with European banks, Tier-1 liquidity provider onboarding, or credibility with sophisticated institutional counterparties. A Costa Rican or Panamanian corporation with UAF registration is not a credential that unlocks those relationships. For operators who need EU market access, Cyprus MiCA CASP is the answer. For operators targeting Africa and Asia with credible regulated standing, Mauritius FSC VASP or Seychelles FSA VASP is the answer. Costa Rica and Panama sit in the "entry-level or bridge structure" category — extremely useful in the right context, inadequate for others.
The regulatory transition risk is real and should be priced into the decision. Operators who establish Costa Rica or Panama structures in 2026 should simultaneously plan for the licensing transition — identifying the target jurisdiction, building the compliance infrastructure, and having the capital ready for a Seychelles, Mauritius, or AIFC application when the legislative environment changes. Zitadelle AG designs these multi-stage structures regularly: Costa Rica or Panama for immediate launch, with a Mauritius or Seychelles VASP application in progress on a parallel track.
Setting up a Costa Rica or Panama VASP company?
Zitadelle AG provides end-to-end support for Costa Rica and Panama VASP company formation — incorporation, legal opinion, AML/CFT framework, UAF registration, and bank account introductions.
Frequently Asked Questions
No — as of April 2026, neither Costa Rica nor Panama requires a formal VASP license to operate a crypto business. Both allow companies to include cryptocurrency activities in their corporate bylaws under general commercial law. AML/CFT compliance is mandatory under existing law in both countries. This status is under legislative pressure from pending bills in both countries.