How to Register a VASP with SUGEF in Costa Rica

Last updated: 9 September 2026

Registering a virtual asset service provider (VASP) with the General Superintendency of Financial Entities (SUGEF) starts with a scope check. The business then prepares its company and ownership records, AML/CFT/CPF framework and proof of its actual transaction flows.

Law No. 10961 was published on 19 June 2026 and is due to take effect three months later. As of 9 September 2026, SUGEF had not published a VASP-specific form, filing route, fee or review time in its current rules. Companies can prepare the core evidence now, but they must verify the final filing mechanics before they submit.

Current status as of 9 September 2026: Law No. 10961 adds Article 15 quater to Law No. 7786. It creates AML/CFT/CPF registration and supervision for covered VASPs, not a crypto license, licensing approval or operating authorization. SUGEF’s current regulations list does not identify a VASP filing procedure.

Before You Start: Confirm the Company Is in Scope

Answer five questions before preparing documents:

1. Does the company exchange, transfer, safeguard, administer or provide specified financial services involving virtual assets?
2. Does it perform the activity as a business, for itself or on behalf of a third party?
3. Which entity contracts with customers, controls the platform or wallets, receives fees and bears the operating risk?
4. What connects that entity and activity to Costa Rica?
5. Does the model also enter a banking, payment, securities or other regulated perimeter?

A VASP activity calls for a perimeter review but does not identify the filing entity. Article 15 quater preserves another financial superintendency’s remit. If scope is unclear, first determine who must register.

What Can Be Prepared Before the Final Filing Rules

The evidence behind the application can be prepared now. The filing wrapper must be checked against the rules in force on the submission date.

For Costa Rica VASP readiness, a startup should identify missing owners, policies and systems. A mature group should reconcile contracts, outsourcing and evidence across entities.

Step 1. Map the Activity, Entity and Costa Rica Nexus

Inputs. Services, customer terms, entity chart, target markets, wallet model, fiat rails, outsourcing contracts and legal analyses.

Action. Map each service to the entity that contracts, controls assets, receives fees and keeps records. Note any banking, payment, securities or custody overlap.

Output. A perimeter memorandum and entity-and-flow diagram explaining why the selected company is the filing entity and which activities are included or excluded.

Blocker and next step. A brand or incorporation does not establish scope. Resolve differences between contracts, platform permissions and operations before building the file.

Step 2. Prepare Corporate, Ownership and Background Information

Inputs. Company records, constitutive documents, directors and representatives, participants, associates, ultimate beneficial owners, addresses, control rights and signing powers.

Action. Reconcile names, identification data, ownership percentages and authority across the source documents. Trace the ownership chart to the natural persons who ultimately own or control the structure.

Output. A version-controlled corporate file and source register recording where each fact came from and when it was checked.

Blocker and next step. Implementing rules may set certification, recency or local representation requirements. Treat the documents required for Costa Rica VASP registration as provisional until the official list is published.

Step 3. Build the AML/CFT/CPF Compliance Framework

Article 15 quater requires a risk-based AML/CFT/CPF framework.

Inputs. The business risk assessment, customer types, countries, products, channels, transaction patterns, screening tools and governance structure.

Action. Connect each control to an owner, procedure, system and evidence.

Output. A matrix of the rule, risk, owner, procedure, system, evidence and remediation status.

Blocker and next step. SUGEF must decide on a compliance officer or differentiated structure using a risk-based approach. Reconcile the policy with Step 4.

Step 4. Document Operations, Technology and Transaction Flows

Inputs. Customer journeys, contracts, wallet and key controls, fiat accounts, counterparties, volumes, outsourced services, monitoring logic and retention processes.

Action. Trace sample transactions from onboarding to record retrieval. Identify who can initiate, approve, stop or reverse an action. Show where transfer data is collected and how alerts reach compliance.

Output. Evidence aligning the business model, flows, contracts, systems and risk assessment, so a reviewer can reconstruct the service.

Blocker and next step. Missing wallet controls, unexplained fiat movements or inaccessible records weaken the file. Close each gap or assign an owner and date.

Step 5. Submit Through the Official SUGEF Route

Use only a VASP-specific SUGEF or CONASSIF route in force on the submission date. The consolidated Law No. 7786 records the future reform. Do not reuse the route for Articles 15 and 15 bis without an express direction.

Inputs. Current official instructions and the approved evidence pack.

Action. Record the source, form version and date. Match the entity, signer and annexes, then retain the package and receipt.

Output. A submission file with official proof of delivery.

Blocker and next step. Registration does not resolve the wider Costa Rica regulatory perimeter. It is not banking, payment, securities or general crypto authorization. Check each product and market separately.

Step 6. Respond to Review Questions and Close Gaps

Inputs. The submitted package, source register, issue log and current supporting documents.

Action. Assign an owner to each request. Record the date, deadline, evidence, response status, version and acknowledgement. Check whether the answer changes the perimeter, ownership, risk or flows.

Output. An auditable response file that connects every answer to approved evidence and shows which version it replaces.

Blocker and next step. No VASP-specific response window or guaranteed completion period was verified. Use the deadline in SUGEF’s actual communication and describe registration as complete only after official confirmation.

After Registration: Keep Information and Controls Current

Once Article 15 quater is in force and a VASP is registered, it must keep its registration data current and maintain an updated, documented risk assessment. Ongoing controls should cover customers, beneficial owners, PEPs, transfers, new products, third parties, foreign branches, high-risk countries, suspicious activity, confidentiality and applicable freezing measures.

Update the file when ownership, services, markets, wallet control, fiat rails, outsourcing or risk changes. Keep review evidence and be ready to answer binding requests from the Financial Intelligence Unit (UIF/ICD) and supervisors.

Registration does not guarantee a bank or EMI account. Each institution applies its own controls.

How Long Does Registration Take and What Does It Cost?

No VASP-specific filing fee or review timeline was verified on 9 September 2026. Law No. 10961 contemplates contributions to SUGEF’s supervisory costs, but the mechanics must be confirmed.

Preparation time and cost depend on the model, ownership, records, controls, technology, outsourcing and remediation. Quote professional fees separately from official charges.