Until recently, Costa Rica was one of the few jurisdictions in Latin America where crypto businesses could operate with essentially no specific regulation – just as an ordinary trading company. That made the country an attractive base for startups, OTC desks, and trust structures. That era is now ending.
On June 19, 2026, Law No. 10961 was published in the official gazette La Gaceta – an amendment to the country’s core anti-money laundering statute, Law No. 7786, which for the first time introduces the concept of a VASP (Virtual Asset Service Provider) and places such companies under AML supervision. The law takes effect three months after publication – around September 19, 2026.
Here’s a full breakdown: what’s changing, who it affects, the penalties involved, and what businesses should be doing right now.
Why Now
The formal trigger is pressure from the Financial Action Task Force (FATF) (Financial Action Task Force). Back in 2024, the organization explicitly flagged a regulatory gap in Costa Rica around companies dealing in crypto assets – essentially, the risk that the country could become a convenient transit point for money laundering through crypto. The reform was tracked under Bill No. 25,340 and was ultimately approved unanimously by the Legislative Assembly in its second debate on May 25, 2026.
This fits into a broader regional trend: Panama introduced its own comprehensive VASP/CASP licensing bill to the National Assembly in January 2026 (Anteproyecto Ley No. 314), OECD countries are synchronizing CARF reporting (the international exchange of crypto tax information), and FATF continues pushing all jurisdictions to implement Recommendation 15 – the baseline standard for virtual asset regulation. Costa Rica wasn’t a first-mover here – it was closing one of the last visible gaps in its own AML framework.
What the Law Actually Changes
Law No. 10961 adds a new Article 15 quater to Law No. 7786. The core message from lawmakers: this isn’t a ban, and it isn’t legal recognition of crypto as currency – it’s bringing certain business activities into the existing AML/CFT supervisory perimeter.
Key principles to understand:
- Bitcoin does not become legal tender. The colón remains the sole official currency, and the Central Bank of Costa Rica does not recognize crypto assets as money or foreign currency.
- Crypto itself is not banned – for individuals or businesses. Private individuals remain free to hold, receive, and transfer crypto assets in private transactions.
- What changes is the status of intermediary businesses – companies that provide crypto-related services to third parties.
- The supervisor is Superintendencia General de Entidades Financieras – SUGEF (the General Superintendency of Financial Entities), while detailed implementing rules (transaction thresholds, technical requirements) are expected from Consejo Nacional de Supervisión del Sistema Financiero (Conassif) (the National Council for Financial System Supervision) within three months.
Who Qualifies as a VASP
The law’s definition is deliberately broad and doesn’t hinge on how a company brands itself – it doesn’t matter whether a project calls itself an “exchange,” a “payment gateway,” or a “fintech platform.” What matters is the activity actually performed. A company qualifies as a VASP if it performs, on a regular business basis (not as an isolated transaction):
- exchange between crypto and fiat currency, or between crypto and crypto;
- transfer of virtual assets on behalf of clients;
- custody, administration, or other forms of control over third-party virtual assets;
- financial services related to the issuance, offering, sale, or promotion of virtual assets – which also brings token projects raising funds into scope.
SUGEF Registration Is NOT a License
One point worth stressing, since it’s often misunderstood: registering as a VASP with SUGEF does not constitute authorization to operate. It is not a banking license, not a securities license, and not a general approval of a company’s products or tokens.
What registration actually means in practice:
- the company becomes visible to the AML supervisor;
- it must comply with AML/CFT obligations;
- it may face information requests, inspections, and sanctions;
- it gets entered into a centralized VASP registry.
In other words – you don’t “get a crypto license.” You determine whether your activity qualifies as a VASP, and if it does, you register and comply. The law does not set a fixed registration fee: CONASSIF will define the details, and supervision costs will be recovered proportionally to a company’s size, number of operations, and transaction volume. The real cost driver is the compliance program itself – policies, a compliance officer, monitoring tools, recordkeeping systems, legal support. That should be budgeted before launch, not after.
VASP Obligations Under the Law
A company that qualifies as a VASP must build a real AML/KYC program – not just incorporate a legal entity:
- Customer identification – using reliable and independent information.
- Beneficial ownership verification – understanding who ultimately controls a client or structure.
- Risk-based due diligence – before and during business relationships.
- Transaction recordkeeping – sufficient to reconstruct operations on request from authorities.
- PEP controls – for politically exposed persons.
- Assessment of new-technology risk – for new products, services, and business practices.
- Enhanced controls for high-risk jurisdictions.
- Suspicious transaction reporting – confidential and without delay, to the Financial Intelligence Unit at the ICD (Costa Rican Drug Institute).
One provision with outsized operational impact deserves particular attention: the Travel Rule – the requirement to attach originator and beneficiary information to virtual asset transfers, in line with FATF standards. For exchanges, custodians, OTC desks, and transfer platforms, this can mean reworking onboarding flows, data architecture, blockchain analytics, transaction monitoring systems, and user agreements.
The law also reaches trust and fiduciary structures: if a trust administers virtual assets, it falls under Article 15 quater supervision too – relevant given how heavily Costa Rica is used for escrow and fiduciary arrangements.
Penalties for Non-Compliance
The reform updates the sanctions regime under Law No. 7786 for VASPs and other obligated parties:
- Fines of 5% to 50% of the transaction amount for certain violations;
- Fines of 2 to 100 base salaries for specific compliance failures (failure to register, identify customers, keep records, etc.);
- Late-payment surcharges if a fine isn’t paid within the legal deadline;
- Publication of final sanctions by supervisory authorities;
- Supervisory powers to inspect, request information, and enforce.
International Structures and Holding Companies: Where the Line Sits
A practical question that comes up constantly: what about Costa Rican entities that are formally incorporated locally but serve clients abroad? Here, the law regulates activity, not the “nationality” of the entity.
SUGEF registration is likely NOT required if all of the following hold:
- the company doesn’t operate an exchange or platform;
- it doesn’t sign contracts directly with clients/users;
- it doesn’t provide custody, transfer, administration, or control of assets;
- it doesn’t provide financial services related to asset issuance;
- all activity, clients, infrastructure, and personnel are located outside Costa Rica;
- the company functions purely as a passive holding or investment vehicle.
Registration IS likely required if the Costa Rican entity is the one actually providing the service – signing user contracts, operating the platform, collecting fees, providing custody, or transferring assets – even if all clients are located abroad.
This is especially relevant for exchanges, OTC desks, custody and wallet providers, token issuers, Web3 startups with founders or management based in Costa Rica, and fintech companies integrating crypto payment rails.
Tax Considerations
Costa Rica generally follows a territorial tax system – a company isn’t taxed simply because it’s incorporated there. Everything depends on where income is generated, where the activity is actually carried out, where value is created, and where management decisions are made.
Lower tax exposure is more likely when:
- operations happen outside Costa Rica;
- key infrastructure is located offshore;
- management functions sit outside the country;
- real foreign economic substance can be demonstrated.
Tax risk increases when:
- services are actually performed in Costa Rica;
- operational staff are based locally;
- management decisions are made in-country;
- clients are served from Costa Rica;
- the business has local infrastructure, employees, or other economic substance.
The Banking Problem Isn’t Solved
An important caveat that’s easy to overlook: having a formal VASP framework doesn’t automatically solve the banking challenge for crypto businesses. Local banks may still be cautious due to their own risk appetite, correspondent banking concerns, and enhanced due diligence requirements. A serious crypto structure shouldn’t incorporate first and explain itself to a bank afterward – banking strategy needs to be built into the legal design from day one: ownership structure, source of funds, compliance program, client profile, and transaction flows.
Bottom Line
Costa Rica is finally shedding its “gray zone” reputation for crypto business – without becoming a fully licensed jurisdiction like the ones now requiring formal VASP authorization. What emerges is a middle-ground model: the activity is legal, registration is mandatory, but there’s still no license in the classic sense. For crypto companies operating in the region, the signal is clear: the window for running a crypto business under “default, no special rules” closes on September 19, 2026 – and anyone falling under the VASP definition has the summer to get compliant.