Costa Rica VASP AML/KYC Requirements After Registration

Last updated: 9 September 2026

As of 9 September 2026, Law No. 10961 has been published but is not yet in force. Once Article 15 quater takes effect, a covered Costa Rica virtual asset service provider (VASP) will have to meet its anti-money laundering, counter-terrorist financing and counter-proliferation financing (AML/CFT/CPF) duties and register with the General Superintendency of Financial Entities (SUGEF) before operating in Costa Rica. Registration is one duty, not a general operating authorisation. Preparation should focus on accountable controls and evidence for cryptocurrency services.

What Is Confirmed and What Still Depends on CONASSIF

Law No. 10961 was published on 19 June 2026 and is scheduled to take effect on 19 September. Article 15 quater will establish VASP registration and AML/CFT/CPF supervision. The National Council for Supervision of the Financial System (CONASSIF) must set the details. On 9 September 2026, the SUGEF regulations page listed no Article 15 quater instrument. SUGEF 11-18 and 13-19 do not implement it unless extended or replaced. See the Costa Rica crypto regulation framework.

Quick Answer: Controls to Prepare for Under the Enacted Framework

Law No. 10961 supplies the control areas. Listed owners, triggers/cadence, evidence and escalation are recommendations pending final rules. Gofaizen & Sherle can help map them through Costa Rica VASP registration and compliance support.

1. Governance, Ownership and the Risk Assessment

Once effective, Article 15 quater will require crypto businesses to keep current AML/CFT/CPF risk assessments available to authorities. A practical assessment may cover products, customers, geographies, channels, transactions, technology and counterparties, subject to final methodology. Management should approve remediation. SUGEF may require a compliance officer or permit another structure based on size, operations, staff, volume and risk. Crypto businesses should not combine roles without confirmation. Groups should map branches and subsidiaries.

2. Customer Identification, UBO Checks and Risk Classification

Once effective, Article 15 quater will require customer and ultimate beneficial owner (UBO) checks using reliable, independent information. The customer due diligence (CDD) file should record relationship purpose and nature, risk-relevant source or origin information, screening, classification and decision. Documents and thresholds must follow final rules.

3. Ongoing Monitoring and KYC Refresh Triggers

Article 15 quater sets no alert workflow or KYC cycle. Pending CONASSIF rules, monitoring can compare activity with the expected profile, assign alerts and escalate exceptions. Ownership, product, channel, activity, geography, politically exposed person (PEP) or sanctions changes, adverse information or reactivation can trigger re-KYC. Final rules must set timing.

4. PEPs, High-Risk Countries, Third Parties and Group Controls

Once effective, Article 15 quater will cover PEPs, high-risk countries, third-party reliance, foreign branches, group sharing and new technology. The Financial Intelligence Unit (UIF) PEP notice calls its list non-exhaustive. Final rules must define PEP measures, approvals and reliance conditions. Until then, use clear ownership, file access and testing.

5. Virtual-Asset Transfers and Travel Rule Readiness

Once effective, Article 15 quater will cover virtual asset transfers and origin and destination information. CONASSIF must set the threshold, fields and method. The FATF virtual-assets guidance is a benchmark, not Costa Rican law. Preparatory workflows can validate data, identify the counterparty VASP, exchange data securely, screen parties, hold exceptions and retain an audit trail.

6. Sanctions Screening, Freezing and Prohibited Transactions

When the amendments apply, Law 7786 will require permanent monitoring of relevant international lists and prohibit transactions with designated parties. Screen customers and transactions. Once a designation is confirmed, covered assets must be frozen or immobilised immediately and communicated under the applicable procedure. Preserve evidence of alerts, analysis, action, false positives and system failures.

7. Suspicious-Transaction Reporting and Confidentiality

Once effective, Article 15 quater will require confidential reports of suspicious and attempted transactions without delay to the UIF of the Costa Rican Institute on Drugs (ICD). Escalate unusual activity to a suspicious-transaction decision, then record facts, analysis, decisions and filing evidence with restricted access and no tipping-off. On 9 September 2026, the UIF Reportes page described Articles 15, 15 bis and 15 ter, so the new channel remained unconfirmed.

8. Records, Registration Updates and Supervisory Readiness

Once effective, Article 15 quater will require reconstructable records and authority access. Index KYC/UBO, monitoring, transfer, sanctions, STR, governance, training and change evidence. Final rules must set retention. Test retrieval and protect data through access control, minimisation, vendor oversight and incident handling. Depending on final fields, UBO, director, control, service, product, channel, jurisdiction, technology, branch or material-risk changes may trigger SUGEF review.

The evidence can support due diligence but does not guarantee a bank or EMI account for a Costa Rica VASP. Tax and company work remain separate.

9. A Practical 30/60/90-Day Compliance Plan

This is an implementation plan, not a statutory deadline.

Turn the Costa Rica VASP registration documents into maintained evidence. Startups can phase preparation, but every applicable control must work by the deadline confirmed in final rules. Larger groups may add independent testing and cross-border data governance.