#
Costa Rica has no crypto-asset operating licence. Since 19 September 2026, Ley 10961 (adding Art. 15 quater to Ley 7786) requires VASP registration with SUGEF for AML/CFT supervision; CONASSIF implementing regulation remained unpublished as of 2 October 2026.
This is best read as a supervisory-perimeter expansion rather than a licensing-regime creation. The reform closes a documented gap relative to FATF Recommendation 15 by bringing VASPs into an AML/CFT obligated-entity framework, but it leaves the more fundamental question of activity licensing — capital adequacy, fit-and-proper tests for principals, product-specific conduct rules — unaddressed. SUGEF implementing regulations are expected within roughly three months of the gazette publication; until those issue, the operational mechanics of the registration duty remain unsettled.
Outlook
The principal item to watch is whether SUGEF's implementing regulations, expected in the fourth quarter of 2026, extend beyond registration mechanics into any form of activity-level licensing or capital requirement. Until they issue, Costa Rica's crypto sector operates under a registration mandate without an accompanying licensing perimeter.
Crypto Licensing
Costa Rica's crypto licensing architecture is governed by Article 15 quater of Ley 7786, added by Ley 10961, which entered into force on 19 September 2026. The provision requires any person conducting, as a business, the exchange, transfer, custody or administration of virtual assets, or the provision of financial services linked to their issuance, marketing or offer within Costa Rican territory, to register with SUGEF for AML/CFT supervision. This registration is explicitly not an operating authorisation: it establishes a supervisory relationship for AML/CFT purposes rather than granting a licence to conduct business. The duty is binding and currently in force.
The critical complication is implementation. As of 2 October 2026, the CONASSIF implementing regulation that would define the registration procedure, applicable thresholds, and fee structure had not been published, nor had CONASSIF opened the matter for public consultation. No registration form, platform, or defined registration window currently exists. The statutory duty is therefore live in the sense that the obligation to register is already binding, but operationally the mechanism for compliance is absent. This is a genuine implementation gap: a VASP operating in Costa Rica today is subject to a registration duty it has no concrete means of discharging.
No primary legislative text, such as the official Gazette publication or a SUGEF circular, was directly retrieved this cycle; the findings rest on converging Tier 3 law-firm commentary rather than a Tier 1 source. This should be read as a caveat on precision rather than a reason to doubt the substance of the finding, since multiple independent commentary sources converge on the same description of the registration duty and the implementation gap.
Outlook
The CONASSIF implementing regulation is anticipated during the fourth quarter of 2026, a quarter-level estimate that carries genuine uncertainty given that no consultation had opened as of early October. Until the regulation is published, the registration canon, procedural steps and supervisory fee amount remain unknown, and VASPs operating in Costa Rica remain in a position of holding a binding registration obligation without a defined means of compliance. This implementation gap is the single most important fact for any entity assessing its Costa Rican regulatory exposure in this area.
3 earlier distinct update(s)
Crypto Licensing
Costa Rica's crypto licensing landscape shifted from a complete regulatory gap to a narrow AML registration perimeter with the entry into force of Ley 10961 on 19 September 2026. The law added article 15 quater to Ley 7786, requiring virtual-asset service providers to register with SUGEF for AML/CFT/CPF risk-based supervision. This is a confirmed, Tier-1-sourced statutory requirement. Critically, the law and its registration mechanism are framed explicitly as a supervision and compliance perimeter, not an operating authorisation: a VASP that registers with SUGEF obtains no licence to operate, no prudential status, and no conduct-of-business approval. The registration addresses money-laundering risk exposure alone.
Enforcement provisions accompany the new registration requirement. Secondary analysis reports fines between 5% and 50% of the transaction amount for certain breaches, alongside sanctions ranging from two to one hundred base salaries for other forms of non-compliance; this detail is probable rather than confirmed, resting on a Tier-3 legal-commentary source rather than the statutory penalty schedule itself. CONASSIF has since opened a public consultation, reported around 7 October 2026, on an implementing regulation intended to flesh out thresholds, scope, exclusions and technical requirements under article 15 quater; this detail is uncertain, since CONASSIF's own consultation document was not located this cycle and the reporting rests on a single Tier-3 press account.
The overall licensing picture, then, is one of a tightening AML perimeter sitting atop an otherwise unregulated activity: no token-classification-driven licensing tiers, no capital or prudential requirements, and no market-conduct supervision exist for virtual-asset activity in Costa Rica beyond the AML/CFT registration obligation itself.
Outlook
The CONASSIF implementing regulation is expected within the fourth quarter of 2026 as scheduled, carrying a quarter-wide uncertainty band given its basis in secondary reporting rather than a confirmed regulatory timetable. Until the regulation, or the underlying consultation document, is retrieved directly, the precise scope, thresholds, and exclusions of the registration regime remain provisional, while the underlying registration obligation itself stands confirmed and in force.
Crypto Licensing
Costa Rica's crypto-licensing landscape changed materially this cycle with the entry into force of Article 15 quater of Law 7786, added by Law N.246 10961 and published in La Gaceta Alcance N.246 78 on 19 June 2026. The provision requires any provider of virtual-asset exchange, transfer, custody or control, or issuance-related financial services to register with SUGEF before conducting that activity in Costa Rica. The statutory text is unambiguous that this registration does not constitute authorisation to operate -- it is a compliance gate built for AML/CFT purposes, not a prudential or conduct licence. The provision took effect roughly three months after publication, around 19 September 2026.
Penalties for breach of registration, customer-due-diligence or reporting obligations under amended Article 81 run from 5% to 50% of the transaction amount, or 2 to 100 base salaries, scaled to gravity and recidivism. This is a meaningful exposure for any VASP operating in or into Costa Rica without registering.
The open gap is CONASSIF's implementing regulation, due under Article 4 of Law 10961 within three months of entry into force -- meaning roughly December 2026 -- covering thresholds, scope, exclusions and technical requirements. That regulation has not been published as of this cycle, so the registration duty currently exists without published quantitative or technical detail, and secondary commentary (not yet confirmed against the gazette text) suggests VASPs may also be drawn into Costa Rica's existing RTBF beneficial-ownership filing regime with the Central Bank.
Outlook
The CONASSIF implementing regulation, expected in Q4 2026, is the development that will convert this statutory registration duty into an operative regime with defined thresholds and technical requirements. Until it publishes, the practical scope of who must register and under what conditions remains incompletely specified.
Crypto Licensing
Costa Rica's crypto-licensing landscape shifted this cycle with the introduction of a mandatory SUGEF registration requirement for virtual asset service providers, established under new Article 15 quater of Law No. 7786. This registration is explicitly for AML/CFT supervisory purposes only and does not constitute an operating licence or any form of government authorisation to conduct crypto-asset business. The distinction matters commercially: a VASP operating in Costa Rica can now become subject to AML/CFT obligations and SUGEF oversight without ever obtaining a substantive licence, because no such licence exists to obtain. Token issuance rules, custody standards, and exchange licensing all remain unregulated as of this reform; the 2026 change addresses AML/CFT registration only and leaves the broader licensing gap untouched.
This creates what the evidence characterises as an expanding AML/CFT perimeter running ahead of, and separate from, any expansion of substantive licensing perimeter. A firm can become AML-obligated while remaining functionally unlicensed, and current evidence suggests this gap is likely to persist absent further legislative action beyond the AML/CFT reform itself. Secondary sources report a registration deadline falling in the third quarter of 2026, though this has not been confirmed against a primary regulatory calendar, and whether Legislative Decree 10961 has actually been published in La Gaceta with that precise effective date remains an open question this cycle, with SUGEF's own domain not independently fetched.
Outlook
The near-term watch item is confirmation of the SUGEF registration deadline and the gazette-publication status of Legislative Decree 10961. Longer term, whether Costa Rica moves beyond AML/CFT registration toward a substantive licensing framework for crypto-asset businesses remains an open legislative question, with no current evidence of movement in that direction.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and findings (3)
- T3 · CoinDeskCoinDesk — Costa Rica has no formal crypto-asset legislation; under the constitutional and civil-code principle that any activity not explicitly prohibited is permitted, private parties may trade, own, and provide crypto-asset services without a license or registration requirement.retrieved M5bindingin force
- T3 · CoinDeskCoinDesk — A 2022 'Crypto Asset Market Law' bill that would have required crypto-asset service providers to register and be incorporated into the BCCR's national electronic payment system (SINPE) was introduced in the Legislative Assembly but stalled at the committee level and was never enacted.retrieved M3non-bindinga fact about the regime
- T1 · FATF / GAFILATFATF / GAFILAT — Costa Rica reported to GAFILAT a draft law intended to incorporate virtual asset service providers (VASPs) into the AML/CFT regime, but as of the 2023 enhanced follow-up assessment the bill had not been approved or entered into force as law.retrieved M3non-bindingour coverage gap, expected to resolve on a re-run