Costa Rica vs Panama for a Crypto Company

Last updated: 9 September 2026

There is no universal winner between Costa Rica and Panama for a crypto company. Costa Rica has enacted an AML registration perimeter for virtual asset service providers, scheduled to take effect on 19 September 2026. Panama had not enacted a general VASP framework by this article’s review date. That difference may favour Costa Rica when visible AML registration is important, but it does not settle product licensing, banking or market access.

The choice still turns on custody and control, exchange or transfer functions, fiat flows, customer countries, ownership, substance and group purpose. This comparison turns those variables into a fit, no-fit and next-action decision for startups and mature groups.

Regulatory Snapshot

Confirmed has official support. Pending is incomplete. Provider-specific depends on a counterparty. Requires individual review depends on the model.

Costa Rica or Panama: The Short Answer

The matrix is unweighted. A startup may prioritise speed and budget. A mature group may prioritise recognition, audited evidence and board-approved risk allocation.

Regulatory Status in Costa Rica After Law 10961

Law 10961, published on 19 June 2026, is scheduled to take effect three months later. Article 15 quater covers a person acting as a business for itself or on behalf of a third party in:

1. Exchange between virtual assets and legal-tender currencies, or among virtual assets.
2. Virtual asset transfers.
3. Custody, deposit, administration or control of virtual assets by any means.
4. Participation in and provision of financial services related to issuance, marketing, offer or sale of virtual assets for its own account or for clients.

Specified VASPs must register with SUGEF for risk-based AML/CFT/CPF supervision. Registration is not an authorization to operate. Other product and market rules may apply.

If an activity concerns a matter regulated by another financial superintendency, that regulator applies. Because of the resulting risk, Article 14 entities and subjects registered under Articles 15, 15 bis, 15 ter and 15 quater may not maintain commercial relations with a person conducting Article 15 quater activities without being registered with SUGEF.

On 9 September, SUGEF’s cited pages showed no final VASP-specific procedure, form, fee schedule or review period. The perimeter is confirmed. The procedure is pending. Product labels do not settle scope.

Regulatory Status in Panama

Bill 326 is proposed legislation, not current law or an available license. The National Assembly materials cited in the snapshot described the proposal as under committee and subcommittee analysis. A search of Panama’s digital Official Gazette for “activos virtuales” from 1 January 2025 through the latest editions dated 9 September 2026 returned no results. On that recorded search, no enacted general VASP framework was identified for this article.

This does not make every cryptocurrency business unregulated. Securities intermediation, investment features, payments or e-money, money transmission, custody of client value, banking and AML rules can create separate obligations. The SMV’s 2025 opinions index describes Opinion 04-2025 as assessing a Panamanian company’s custody and facilitation of exchange in cryptocurrencies, including BTC and ETH, through a non-custodial technology platform under the Securities Market Law. That model boundary cannot be generalised.

A Panama plan therefore needs a legal basis for every function and a response if legislation changes. Incorporation, a notice of operation, tax registration or a model-specific opinion does not constitute VASP authorisation.

Which Business Models Fit Each Jurisdiction?

Market Access and Cross-Border Limits

Home jurisdiction and customer permission are separate. Map website language, paid marketing, app availability, onboarding residence, customer type, local establishment, currencies and the contracting company. Check MiCA, US federal and state rules, and the rules of every other targeted country. Article 59 of MiCA restricts EU crypto-asset services to authorised persons within its framework.

Sanctions screening, restricted-country rules and geo-controls belong in the same map. A disclaimer or choice-of-law clause does not cure active solicitation. Geoblocking helps only when advertising, onboarding, affiliates, support and transaction controls follow the restriction. Neither Costa Rica nor Panama creates global access or EU passporting.

Company Formation, Ownership and Substance

A startup may lack history and substance. A mature group must reconcile audited evidence, ownership, intercompany allocation and board oversight.

AML and Compliance Expectations

The FATF VASP guidance is an international baseline, not local authorisation. Controls must match the product, systems and owners.

Banking, EMI and Payment Access

Bankability is an execution risk, not a country slogan. Test both jurisdictions against the same provider-fit scorecard:

Written pre-screening can expose a mismatch but cannot guarantee onboarding. A funds-flow diagram and consistent legal, AML and financial file should precede a full application.

Tax, Accounting and Total Operating Cost

Log income source, management, substance, permanent establishment, payroll, indirect taxes, distributions, reporting and cross-border treatment. Panama’s authority says income from activities in its territory is taxable regardless of nationality, domicile or residence. See its income tax guidance. This is not a “zero tax” conclusion.

Compare dependency-driven total cost, not an unsourced fee or formation headline.

Scenario Matrix: Which Route Fits?

How to Choose in Seven Checks

1. Map activities. Record exchange, transfer, custody, fiat, issuance and investment features.
2. Map target markets. Identify customers, marketing, local presence, sanctions and licensing rules.
3. Define the status needed. Separate AML registration, product authorisation and counterparty expectations.
4. Test banking and payments. Validate funds flow, client money, rails, provider policy and evidence.
5. Design substance and governance. Allocate people, decisions, systems, contracts and accountable owners.
6. Model tax and total cost. Record assumptions, recurring work, dependencies and change risk.
7. Verify current law. Recheck Costa Rica implementation, Panama legislation and every material provider claim.

Critical path

scope → markets → status → entity and controls → provider pre-screen → readiness

Record red flags, evidence and next steps in a one-page memo with a go/no-go owner. Do not incorporate while a blocker lacks an owner.