Costa Rica#
Costa Rica has no crypto-asset operating licence. Since 19 September 2026, Ley 10961 (adding Art. 15 quater to Ley 7786) requires VASP registration with SUGEF for AML/CFT supervision; CONASSIF implementing regulation remained unpublished as of 2 October 2026.
This is best read as a supervisory-perimeter expansion rather than a licensing-regime creation. The reform closes a documented gap relative to FATF Recommendation 15 by bringing VASPs into an AML/CFT obligated-entity framework, but it leaves the more fundamental question of activity licensing — capital adequacy, fit-and-proper tests for principals, product-specific conduct rules — unaddressed. SUGEF implementing regulations are expected within roughly three months of the gazette publication; until those issue, the operational mechanics of the registration duty remain unsettled.
Outlook
The principal item to watch is whether SUGEF's implementing regulations, expected in the fourth quarter of 2026, extend beyond registration mechanics into any form of activity-level licensing or capital requirement. Until they issue, Costa Rica's crypto sector operates under a registration mandate without an accompanying licensing perimeter.
Crypto Licensing
Costa Rica's licensing posture for virtual asset service providers shifted meaningfully, though the shift is better described as the arrival of an AML registration gateway than as the creation of a licensing regime. Article 15 quater of Law 7786, added by Law 10961 and in force since 19 September 2026, requires providers of virtual asset exchange, custody, transfer, and issuance or offer services to register with SUGEF for AML/CFT supervisory purposes. This statutory trigger is confirmed directly from the official gazette publication. In early October 2026, the National Council for Financial System Supervision opened a public consultation on a draft amendment to Acuerdo SUGEF 13-19 designed to operationalise that registration requirement with risk-based customer due diligence, new-product and new-technology risk assessment, and suspicious-transaction reporting duties. The substantive content of the draft, however, rests on secondary press reporting rather than direct access to the consultation text, so it should be read as probable rather than confirmed.
The critical qualifying fact, evidenced independently from commentary on the underlying law, is that SUGEF registration does not constitute an operating permit, authorisation, or government endorsement. This distinction matters because it means Costa Rica now has an AML contact point for virtual asset activity without having created any parallel mechanism for market entry, consumer protection, or custody standards. In effect, registration confers supervisory visibility to SUGEF without conferring market legitimacy to the registrant, a configuration that leaves the overall regime amber: tightening in its AML dimension but still structurally absent a licensing framework. Industry commentary around the consultation has also flagged a short consultation window and unresolved questions over the criteria for appointing a compliance officer at registered entities, both of which bear directly on how quickly and how completely providers can come into compliance once a final rule is adopted.
Outlook
The consultation remained open as of late October 2026 reporting, with no independently confirmed closing date or adoption timeline, and the draft amendment text itself was not directly retrieved. Whether the final rule preserves the risk-based due diligence and reporting duties broadly as described, and whether it resolves the compliance-officer appointment question flagged by industry commentary, will determine how substantial the registration regime proves in practice. Until the amendment is adopted and a primary text is available, the registration gateway should be understood as a developing AML control mechanism rather than as any form of licensing or market-authorisation regime, and providers should not treat SUGEF registration as conferring any operating legitimacy beyond AML supervisory contact.
4 earlier distinct update(s)
Crypto Licensing
Costa Rica's crypto licensing architecture is governed by Article 15 quater of Ley 7786, added by Ley 10961, which entered into force on 19 September 2026. The provision requires any person conducting, as a business, the exchange, transfer, custody or administration of virtual assets, or the provision of financial services linked to their issuance, marketing or offer within Costa Rican territory, to register with SUGEF for AML/CFT supervision. This registration is explicitly not an operating authorisation: it establishes a supervisory relationship for AML/CFT purposes rather than granting a licence to conduct business. The duty is binding and currently in force.
The critical complication is implementation. As of 2 October 2026, the CONASSIF implementing regulation that would define the registration procedure, applicable thresholds, and fee structure had not been published, nor had CONASSIF opened the matter for public consultation. No registration form, platform, or defined registration window currently exists. The statutory duty is therefore live in the sense that the obligation to register is already binding, but operationally the mechanism for compliance is absent. This is a genuine implementation gap: a VASP operating in Costa Rica today is subject to a registration duty it has no concrete means of discharging.
No primary legislative text, such as the official Gazette publication or a SUGEF circular, was directly retrieved this cycle; the findings rest on converging Tier 3 law-firm commentary rather than a Tier 1 source. This should be read as a caveat on precision rather than a reason to doubt the substance of the finding, since multiple independent commentary sources converge on the same description of the registration duty and the implementation gap.
Outlook
The CONASSIF implementing regulation is anticipated during the fourth quarter of 2026, a quarter-level estimate that carries genuine uncertainty given that no consultation had opened as of early October. Until the regulation is published, the registration canon, procedural steps and supervisory fee amount remain unknown, and VASPs operating in Costa Rica remain in a position of holding a binding registration obligation without a defined means of compliance. This implementation gap is the single most important fact for any entity assessing its Costa Rican regulatory exposure in this area.
Crypto Licensing
Costa Rica's crypto licensing landscape shifted from a complete regulatory gap to a narrow AML registration perimeter with the entry into force of Ley 10961 on 19 September 2026. The law added article 15 quater to Ley 7786, requiring virtual-asset service providers to register with SUGEF for AML/CFT/CPF risk-based supervision. This is a confirmed, Tier-1-sourced statutory requirement. Critically, the law and its registration mechanism are framed explicitly as a supervision and compliance perimeter, not an operating authorisation: a VASP that registers with SUGEF obtains no licence to operate, no prudential status, and no conduct-of-business approval. The registration addresses money-laundering risk exposure alone.
Enforcement provisions accompany the new registration requirement. Secondary analysis reports fines between 5% and 50% of the transaction amount for certain breaches, alongside sanctions ranging from two to one hundred base salaries for other forms of non-compliance; this detail is probable rather than confirmed, resting on a Tier-3 legal-commentary source rather than the statutory penalty schedule itself. CONASSIF has since opened a public consultation, reported around 7 October 2026, on an implementing regulation intended to flesh out thresholds, scope, exclusions and technical requirements under article 15 quater; this detail is uncertain, since CONASSIF's own consultation document was not located this cycle and the reporting rests on a single Tier-3 press account.
The overall licensing picture, then, is one of a tightening AML perimeter sitting atop an otherwise unregulated activity: no token-classification-driven licensing tiers, no capital or prudential requirements, and no market-conduct supervision exist for virtual-asset activity in Costa Rica beyond the AML/CFT registration obligation itself.
Outlook
The CONASSIF implementing regulation is expected within the fourth quarter of 2026 as scheduled, carrying a quarter-wide uncertainty band given its basis in secondary reporting rather than a confirmed regulatory timetable. Until the regulation, or the underlying consultation document, is retrieved directly, the precise scope, thresholds, and exclusions of the registration regime remain provisional, while the underlying registration obligation itself stands confirmed and in force.
Crypto Licensing
Costa Rica's crypto-licensing landscape changed materially this cycle with the entry into force of Article 15 quater of Law 7786, added by Law N.246 10961 and published in La Gaceta Alcance N.246 78 on 19 June 2026. The provision requires any provider of virtual-asset exchange, transfer, custody or control, or issuance-related financial services to register with SUGEF before conducting that activity in Costa Rica. The statutory text is unambiguous that this registration does not constitute authorisation to operate -- it is a compliance gate built for AML/CFT purposes, not a prudential or conduct licence. The provision took effect roughly three months after publication, around 19 September 2026.
Penalties for breach of registration, customer-due-diligence or reporting obligations under amended Article 81 run from 5% to 50% of the transaction amount, or 2 to 100 base salaries, scaled to gravity and recidivism. This is a meaningful exposure for any VASP operating in or into Costa Rica without registering.
The open gap is CONASSIF's implementing regulation, due under Article 4 of Law 10961 within three months of entry into force -- meaning roughly December 2026 -- covering thresholds, scope, exclusions and technical requirements. That regulation has not been published as of this cycle, so the registration duty currently exists without published quantitative or technical detail, and secondary commentary (not yet confirmed against the gazette text) suggests VASPs may also be drawn into Costa Rica's existing RTBF beneficial-ownership filing regime with the Central Bank.
Outlook
The CONASSIF implementing regulation, expected in Q4 2026, is the development that will convert this statutory registration duty into an operative regime with defined thresholds and technical requirements. Until it publishes, the practical scope of who must register and under what conditions remains incompletely specified.
Crypto Licensing
Costa Rica's crypto-licensing landscape shifted this cycle with the introduction of a mandatory SUGEF registration requirement for virtual asset service providers, established under new Article 15 quater of Law No. 7786. This registration is explicitly for AML/CFT supervisory purposes only and does not constitute an operating licence or any form of government authorisation to conduct crypto-asset business. The distinction matters commercially: a VASP operating in Costa Rica can now become subject to AML/CFT obligations and SUGEF oversight without ever obtaining a substantive licence, because no such licence exists to obtain. Token issuance rules, custody standards, and exchange licensing all remain unregulated as of this reform; the 2026 change addresses AML/CFT registration only and leaves the broader licensing gap untouched.
This creates what the evidence characterises as an expanding AML/CFT perimeter running ahead of, and separate from, any expansion of substantive licensing perimeter. A firm can become AML-obligated while remaining functionally unlicensed, and current evidence suggests this gap is likely to persist absent further legislative action beyond the AML/CFT reform itself. Secondary sources report a registration deadline falling in the third quarter of 2026, though this has not been confirmed against a primary regulatory calendar, and whether Legislative Decree 10961 has actually been published in La Gaceta with that precise effective date remains an open question this cycle, with SUGEF's own domain not independently fetched.
Outlook
The near-term watch item is confirmation of the SUGEF registration deadline and the gazette-publication status of Legislative Decree 10961. Longer term, whether Costa Rica moves beyond AML/CFT registration toward a substantive licensing framework for crypto-asset businesses remains an open legislative question, with no current evidence of movement in that direction.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and findings (11)
- T3SUGEF — VASPs must register with SUGEF for AML/CFT supervisory purposes; registration explicitly does not constitute an operating licence or government authorization. retrieved M5 binding enacted not yet effective new
- T3Costa Rica — Incorporation of a company with cryptocurrency activities in its bylaws without a government-issued VASP licence, formal capital requirements, or mandatory regulatory approval, though this status is under legislative pressure. retrieved M4 non-binding
- T3SUGEF — registration before offering virtual-asset exchange, transfer, custody/administration, or issuance-related financial services in Costa Rican territory retrieved M4 binding in force
- T2CONASSIF — amendment to Acuerdo Sugef 13-19 adding VASPs as obliged subjects for client identification (reported threshold ~US$1,000), wallet-address attribution and suspicious-transaction reporting retrieved M4 non-binding in force
- T3CONASSIF implementing regulation (Ley 10961) — The CONASSIF implementing regulation under Ley 10961, due within approximately three months of the law's entry into force, had not been published or placed under public consultation as of 2 October 2026; no registration window, form or platform yet exists. retrieved M4 non-binding
- T1SUGEF — VASPs (exchange, custody, transfer, issuance/offer services) must register for AML/CFT supervision, effective 19 Sept 2026 retrieved M5 binding in force new
- T3Ley 10961 — SUGEF registration does not constitute an operating permit, authorisation or government endorsement. retrieved M4 binding in force new
- T2CONASSIF — Draft amendment to Acuerdo SUGEF 13-19 setting out risk-based KYC/CDD, new-product risk assessment and STR duties for registered VASPs; industry noted a short consultation window and unresolved compliance-officer appointment criteria. retrieved M4 non-binding proposed new