Crypto Regulation in Costa Rica After Law 10961: VASP Rules

Last updated: 9 September 2026

Costa Rica’s Law 10961 changes requirements for exchanges, custodians and token services. Once effective, covered providers will enter the anti-money laundering, counter-terrorist financing and counter-proliferation financing (AML/CFT/CPF) perimeter of the General Superintendency of Financial Entities (SUGEF). Registration will not be a general crypto license.

This matters if your business:

Handles client assets.
Serves Costa Rican users from any entity.
Needs a perimeter review before launch.

Law 10961 at a Glance: What Changed for Crypto Companies in Costa Rica

Law 10961 adds Article 15 quater to Law 7786. Once effective, virtual asset service providers (VASPs) will enter SUGEF’s central register and risk-based supervision. The National Council for Supervision of the Financial System (CONASSIF) will set rules. The official text was published in La Gaceta on 19 June 2026.

Before Law 10961	After it takes effect
No Article 15 quater VASP category	Covered VASPs register
No listed activities	Exchange, transfer, custody and issuance-related services are listed
No Article 15 quater duties	Due diligence, records, transfers, risk and reporting apply

Who Is Covered by Costa Rica’s New VASP Framework?

The framework will cover a person or company performing a listed virtual asset service as a business, for itself or a third party. It will cover habitual activity in Costa Rican territory regardless of domicile.

Covered virtual asset services

Exchange between virtual assets and fiat, or between virtual assets.
Transfer of virtual assets.
Custody, deposit, administration or control of virtual assets.
Participation in, or provision of financial services connected with issuance, marketing, offer or sale.

Model	What to verify
OTC desk	Is exchange a business activity?
Wallet	Does it control client assets?
Token project	Listed financial services?
Non-custodial software	Service or technology only?
Foreign group	Is activity habitual in Costa Rica?

Proprietary trading, mining, DeFi, NFTs and passive holding need case review. Labels create no exemption.

SUGEF Registration Is Not a Crypto License

Law 10961 expressly states that SUGEF registration does not represent an authorization to operate.

Definition: Registration places a covered VASP in SUGEF’s AML/CFT/CPF register and supervisory perimeter. It does not approve the business model, grant a crypto license or confirm compliance with every other law.

Company formation, registration and activity-specific permissions are separate questions. Payment, securities, consumer, data, tax or foreign-market rules may still apply. Matters within another Costa Rican financial superintendency’s competence remain with that authority.

Timeline: Publication, Regulation and Effective Date

Date	Event	Practical meaning
19 June 2026	Publication in La Gaceta	The three-month commencement period began
By 19 September 2026	Regulation window	The law grants up to three months for CONASSIF regulation
19 September 2026	Scheduled effective date	TBA

No VASP-specific final regulation, form, fee, review period or due-diligence threshold appeared on the SUGEF current or consultation pages reviewed on 9 September 2026.

Core AML/KYC and Travel Rule Obligations

VASPs will identify customers and beneficial owners through reliable sources. Controls cover politically exposed persons (PEPs) and higher-risk countries. The due-diligence threshold remains subject to regulation.

Control	Statutory direction
Risk	Assess services, customers, geography and technology
Records	Keep enough data to reconstruct transactions
Transfers	Retain origin, destination and required FATF data
Sanctions	Freeze assets and block dealings with designated persons
Reporting	Report suspicious and attempted transactions to the Financial Intelligence Unit of the Costa Rican Drug Institute (UIF/ICD)
Groups	Share information across foreign branches and subsidiaries

VASPs must keep registration data current. Based on risk, SUGEF may require a compliance officer or another structure. A full-time officer is not universal.

Business Impact: Exchanges, Custody, OTC and Token Projects

Exchanges and custodians should map onboarding, ownership checks, screening, asset control, transfer data and reporting. OTC desks should document whether they act as principal, intermediary or service provider. Crypto payment models require analysis of who transfers value.

Token projects must separate token design from financial services surrounding an issuance or sale. Software that neither controls assets nor performs a listed service differs from an operator that markets, transfers or safeguards them. Foreign incorporation alone does not settle scope.

Project stage	Immediate priority
Startup	Confirm scope before building policies or committing budget
Mature group	Compare the law with group controls and outsourcing

The decisive facts are the service, contracts, location, flows and control—not the product label.

Tax, Banking and Market-Access Consequences

Tax: Law 10961 changes the AML perimeter. It does not set a cryptocurrency tax rate or complete tax classification. Treatment depends on the entity, transaction and income source, so separate analysis is required.

Banking: Registration will not guarantee a bank or electronic money institution account. The law will restrict some regulated or registered persons from dealing with a VASP that should register but remains unregistered. Each institution applies its own risk assessment.

Market access: SUGEF registration will not authorize services abroad or create passporting rights. A group must assess customer location, where activities occur and whether another financial authorization applies.

What Crypto Companies Should Do Now

Begin with a product-by-product perimeter map.

Map each service, entity, customer, asset flow and location.
Classify the role against the four Article 15 quater activity groups.
Identify overlap with payment, securities, consumer, tax or other rules.
Assemble the corporate, ownership and beneficial-owner file.
Assess AML/CFT/CPF risks by product, customer and geography.
Review due diligence, screening, records, freezing, transfer-data and reporting controls.
Assign compliance responsibility and third-party roles.
Prepare banking evidence on ownership, flows and monitoring.
Track SUGEF and CONASSIF rules on forms, thresholds, fees and filing.
Recheck the law and target-market requirements before filing or launch.

Track unresolved procedure instead of assuming requirements.

When Costa Rica Fits—and When Another Jurisdiction May Be Better

Costa Rica may fit a business with local activity and readiness for risk-based AML controls. Registration alone is not a reason to choose it.

Position	Indicators	Decision
Potential fit	Costa Rican activity and compliance readiness	Confirm scope against final rules
Review carefully	Foreign delivery, mixed services, token issuance or outsourcing	Classify each activity first
Consider another jurisdiction	Operations are elsewhere, or the model needs passporting or another authorization	Compare the actual target market

Startups should test scope and budget dependencies early. Mature groups should test governance and cross-border control.

Frequently Asked Questions

Does Law 10961 create a crypto license?

No. Once effective, it will create SUGEF registration and AML/CFT/CPF supervision for VASPs. Registration will not authorize every product.

When does Law 10961 take effect?

Published on 19 June 2026, the law is scheduled to take effect on 19 September 2026.

Who supervises VASPs in Costa Rica?

SUGEF will register and supervise covered VASPs for AML/CFT/CPF purposes. Other financial superintendencies retain matters within their competence.

Does SUGEF registration authorize operations?

No. Registration creates AML supervision. Product, payment, securities, tax and cross-border rules remain separate.

Did the law change crypto tax rules?

Not directly. Law 10961 amends the AML framework, not tax rates. Tax treatment requires separate analysis of the entity and transaction.

What penalties can apply?

Specified breaches may attract two to 100 base salaries, while certain transaction-recording failures may attract five to 50 percent of the transaction amount. Classification is fact-specific.

Assess the Right Route Before You File

Gofaizen & Sherle can assess whether an Article 15 quater model falls within the new perimeter, review registration and AML readiness, or compare another jurisdiction when the target market points elsewhere.

Crypto Regulation in Costa Rica After Law 10961 Explained