Costa Rica VASP Registration: Who Must Register with SUGEF?

Last updated: 9 September 2026

A person or company may need to register as a virtual asset service provider (VASP) with the General Superintendency of Financial Institutions (SUGEF) if it conducts a listed virtual asset activity as a business in Costa Rica. Scope turns on its actual conduct, whether for itself or another person, not on “crypto” in its name.

Exchanges, custodians and transfer providers are the clearest cases. Other models need a fact-specific review. Registration is not a general operating authorization.

Quick Answer: Who Must Register with SUGEF?

Article 15 quater applies when a natural or legal person carries on a listed activity as a business “for itself or on behalf of a third party” with the required Costa Rica nexus. An own-account model can therefore be in scope without clients. Neither blockchain use nor digital-asset holdings alone create VASP status.

Law No. 10961 was published on 19 June 2026 and is scheduled to take effect on 19 September 2026 under the current note in Costa Rica’s official SINALEVI text. For the wider reform, see crypto regulation in Costa Rica after Law 10961.

The Four Activities Covered by Article 15 quater

Law No. 10961 lists four categories:

Category	Covered activity
Exchange	Exchange between virtual assets and legal tender, or between forms of virtual assets
Transfer	Transfer of virtual assets
Custody and control	Custody, deposit, administration or control of virtual assets by any means
Issuance-related finance	Participation in or provision of financial services related to issuance, commercialization, offer or sale, for itself or clients

A product can span categories. Product labels matter less than contracts, key permissions, settlement and fund flows.

SUGEF Registration Is Not a Crypto License

Article 15 quater says registration is not an authorization to operate. Covered VASPs enter risk-based supervision for anti-money laundering, counter-terrorist financing and counter-proliferation financing (AML/CFT/CPF). Registration does not replace any company, payment, securities or other permissions the model may require.

A registered business should not call itself “licensed by SUGEF.” Registration does not grant banking or foreign-market access.

Gofaizen & Sherle offers a Costa Rica VASP registration and compliance assessment covering the activity, entity, territorial nexus and regulatory overlap.

Business Models That Clearly Need a VASP Review

Model	Possible trigger	Evidence to check
Exchange, broker or OTC desk	Exchange	Trading terms, settlement and contracting entity
Custodial wallet or platform	Custody or control	Keys, approval rights and recovery arrangements
Transfer, remittance or payout service	Transfer	Transaction path and responsibility for execution
Token issuer or offer provider	Issuance-related finance	Issuer mandate, marketing role and sale mechanics
Crypto payment operator	Exchange, transfer or custody	Merchant contract, conversion and control of funds

The operator’s actual role is decisive. Assess scope before finalizing the design, then identify the company that contracts with users and controls assets.

Activities That Are Not Automatically VASP Services

Merchant acceptance, treasury holdings, proprietary trading, non-custodial software and mining are not automatically covered by their labels. DeFi and NFT projects are not automatically outside scope either.

Scope may arise if the operator exchanges, transfers or controls virtual assets, or provides covered financial services around an issuance or sale. Review its technical powers, contracts and any separate commercial function. “Not automatic” is not an exemption.

Foreign Companies, Groups and Regulatory Overlap

Foreign domicile does not remove registration risk. Article 15 quater covers habitual activity in Costa Rican territory regardless of legal domicile or place of operation. It sets no remote-services or customer-count threshold.

Review the contracting entity, platform operator, management, clients and transaction path. If another Costa Rican financial superintendency supervises the matter, the competent-regulator clause must be considered. Groups can also compare Costa Rica vs Panama for a crypto company.

Costa Rica VASP Registration Decision Matrix

Model	Screening outcome	Decisive question
Custodial exchange	Likely in scope	Which entity exchanges and controls client assets?
Transfer or payout provider	Likely in scope	Who executes the transfer and where?
Merchant accepting crypto	Not automatic	Does it also exchange, transfer or control assets?
Non-custodial software	Not automatic	Can it approve, recover, route or settle transactions?
Proprietary, mining, DeFi or NFT model	Specialist review	Is a listed activity carried on as a business?
Foreign group	Specialist review	Is covered activity habitual in Costa Rica, and by which entity?

Contracts, custody design and operating geography can change the screening outcome.

What a Covered VASP Should Do Next

Map each product, transaction flow and asset-control point.
Identify the contracting entity, operating locations and Costa Rica nexus.
Confirm whether SUGEF or another financial superintendency is competent.
Prepare the registration and AML/KYC workstream using current official requirements.
Monitor the National Council for Supervision of the Financial System (CONASSIF) and SUGEF before relying on any form, fee, threshold or processing time.

As of 9 September 2026, the official sources reviewed did not confirm a VASP-specific implementing procedure. Do not assume the existing SUGEF page for Article 15 and 15 bis registrants is the Article 15 quater route. When implementation is available, use the SUGEF VASP registration process and requirements guide.

Frequently Asked Questions

Do foreign VASPs have to register with SUGEF?

Potentially. Foreign incorporation does not remove the requirement when covered activity is habitually performed in Costa Rican territory. The law sets no simple online-client or transaction-count threshold. The contracting entity, local activity, personnel, platform role and customer flow require an individual nexus review.

Is a non-custodial wallet provider a VASP?

Not automatically. Software that neither holds keys nor approves, routes or assumes responsibility for transactions may fall outside the custody and transfer categories. That may change if the provider can recover access, control execution, administer assets or supply another listed service. Review the technical architecture and customer terms together.

Does accepting crypto make a merchant a VASP?

Not by itself. Accepting virtual assets for the merchant’s goods or services is not a separate Article 15 quater category. Risk may arise if the merchant or an affiliate also exchanges, transfers or controls assets for another person, or provides covered issuance-related financial services as a business.

Are proprietary trading and mining covered?

Not automatically. Mining is not a standalone category, and passive treasury holdings do not decide the issue. Article 15 quater covers listed business activities performed for oneself or another person. Repeated exchange, transfer, custody or related services need closer analysis.

Can DeFi or NFT projects fall within the definition?

Yes, depending on the facts. “DeFi” and “NFT” are labels, not statutory exclusions. A project may be in scope if an identifiable person carries on exchange, transfer, custody or control, or provides a covered financial service around issuance or sale. Governance powers, smart-contract administration and contractual roles are central.

Does registration authorize the company to operate?

No. Article 15 quater says SUGEF registration is not an operating authorization. It supports AML/CFT/CPF supervision and does not replace any company, payment, securities or other approval required for the model. Nor does it grant foreign-market access, banking services or a right to serve every customer category.

Gofaizen & Sherle

can review the activities, contracts, entity roles, control model and Costa Rica nexus, then identify whether registration appears required, is not automatic or needs further analysis

Who Must Register as a VASP with SUGEF in Costa Rica?