Costa Rica VASP Registration: SUGEF Rules (2026)

Costa Rica now requires virtual asset service providers to register with its financial superintendency, SUGEF. The duty comes from Law 10961, published on 19 June 2026 and in force three months later. It is an anti-money-laundering registration and the law states that it is not an authorisation to operate. This guide works from the text printed in La Gaceta and separates what the statute fixes from what still waits on regulation.

What Law 10961 changes

Until this year Costa Rica had no statute that mentioned virtual assets. Companies handling crypto incorporated as ordinary corporations and the Central Bank’s position was that crypto is not legal tender. Bill 25.340 changed the AML law instead of writing a crypto code: it inserts a new article 15 quater into Law 7786 and adds “15 quater” to the list of obliged subjects across the rest of that statute, including the sanctions article.

The dates, from the Gaceta text:

Law firms read the regulation deadline differently. Some count the three months from publication, others from entry into force, and the article itself only says “a period of up to three months is granted for the due regulation of this law”. Plan for the later reading and check SUGEF’s site before you file anything.

Who counts as a VASP

A provider is any natural or legal person that, as a business, carries out one of four activities for itself or on behalf of a third party:

1. Exchange between virtual assets and legal tender, or between one or more forms of virtual assets.
2. Transfers of virtual assets.
3. Custody, deposit, administration or control of virtual assets, by any means.
4. Taking part in and providing financial services related to the issue, marketing, offer or sale of virtual assets, in its own name or for clients.

A virtual asset is “a digital representation of value or funds that can be traded or transferred digitally and used for payments or investments”. The definition adds that this does not make it legal tender or foreign currency in Costa Rica.

Territorial reach is wider than incorporation. SUGEF is told to make sure that no person operates in Costa Rican territory without registration, “whatever their legal domicile or place of operation”, where they carry on these activities habitually. A foreign platform serving the Costa Rican market is therefore within the text. The reverse case is less settled: a Costa Rican company whose customers and operations are all abroad. At least one local firm takes the view that such a company should not necessarily need to register if it performs no service activity in Costa Rica. The law leaves “the scope of the activities” to CONASSIF, so treat that reading as an opinion until the regulation is out.

What a registered provider has to do

Article 15 quater lists ten duties, (a) to (j), and adds several more in the paragraphs that follow. In plain terms:

• Customer due diligence. Identify customers and beneficial owners using reliable information from independent sources when a relationship starts or a service is provided.
• Records. Keep transaction records sufficient to reconstruct each transaction and hand them to the authorities on request.
• PEPs and high-risk countries. Apply controls to politically exposed persons and enhanced controls to relationships with countries rated as risky by international bodies.
• Transfers. For incoming and outgoing virtual asset transfers, obtain and keep the originator and beneficiary information set by the FATF standard. This is the Travel Rule written into Costa Rican law.
• Risk assessment. Document an assessment of money-laundering, terrorist-financing and proliferation-financing risk and keep it current.
• Reporting. Report suspicious transactions, including attempts, to the Financial Intelligence Unit of the Instituto Costarricense sobre Drogas (ICD) without delay and in confidence.
• Sanctions lists. Freeze assets immediately and refuse transactions with persons designated by international bodies.
• Compliance officer. SUGEF decides on a risk basis (size, structure, volume, staff) whether to require a compliance officer inside the organisation or to authorise a different arrangement.
• Supervision cost. Registered providers contribute to SUGEF’s supervision costs according to their structure and the number and amount of their transactions. No amount is set in the law.

The due-diligence threshold is also left open. The law applies due diligence when transactions “equal or exceed the amount that CONASSIF sets by regulation”.

Registration, and why it is not a licence

Providers “must register with the Superintendencia General de Entidades Financieras”, which supervises them for AML purposes on a risk basis. The same paragraph states that registration does not represent an authorisation to operate, obliges providers to keep their registration details current, and has SUGEF keep a single central register whose lists it may publish.

SUGEF is also told to set the measures for checking the background of a provider’s participants, associates and beneficial owners against the offences in Law 7786. That is the nearest the statute comes to a fit-and-proper test. It sets no capital requirement, no local-director rule and no office requirement.

The practical consequence is commercial. A SUGEF registration number shows a counterparty that you are inside the AML perimeter. It does not show that a regulator has examined your custody arrangements, your solvency or your product, which is what a bank or exchange partner is usually asking when it requests “your licence”.

Banking and penalties

The clause that will be felt first is the one aimed at everyone else. Banks and the other entities obliged under articles 14, 15, 15 bis, 15 ter and 15 quater “may not maintain commercial relationships” with anyone carrying on these activities who is not duly registered with SUGEF. The amended article 81 makes that a sanctionable breach for the bank as well. An unregistered provider should expect its Costa Rican bank to ask for proof of registration or close the account.

For the providers themselves, article 81 sets two bands:

The Tico Times put the base-salary band at roughly USD 1,800 to USD 90,000 when the bill passed. Fines are due within eight working days of notification and carry a 3% monthly surcharge after that. SUGEF and the ICD keep a public list of final sanctions.

What is still open

Four points decide how heavy this regime is in practice, and none is in the statute:

• the registration form, supporting documents and any fee;
• the transaction threshold for due diligence;
• how far “the scope of the activities” reaches, including Costa Rican companies that serve only non-residents;
• whether existing providers get a period to register, since the law contains no transitional clause for them.

We will update this page when CONASSIF publishes the regulation.

How Costa Rica compares

Costa Rica now sits in the group of jurisdictions that register crypto firms for AML purposes without licensing them. That is lighter than a licensed regime such as the BVI VASP Act or the Seychelles VASP licence, where the regulator approves the business, its capital and its people. It also carries less weight with counterparties for the same reason. Panama is the usual comparison in the region, and our Panama crypto licence requirements guide sets out where that framework stands. If your customers are in the EU, none of these substitutes for a CASP authorisation; see EU CASP vs offshore VASP.

If you already hold a Costa Rican company for other reasons, our Costa Rica company setup guide covers the corporate side. To work out whether a Costa Rican registration, an offshore licence or an EU authorisation fits your model, compare the options on our crypto licences page or book a free consultation.

Christina S.

Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.