Classification depends on function, control and the company’s role in the transaction. A model is more likely to fall within Article 15 quater when the company stores or controls virtual assets, executes transfers, intermediates exchange, moves fiat for customers or has a direct financial-service relationship with them. Labels such as “software” or “non-custodial” do not decide the result.
Separate rules may apply when the product performs payment services or involves securities. Tokenization is therefore a secondary use case here. The analysis starts with the rights represented by the token, the issuance and distribution model, custody and payment flows, not with the tokenization label itself.
What Gofaizen & Sherle Will Handle
Licensing and regulatory consultants coordinating the corporate, compliance, filing and operational-readiness workstreams.
01. Business model and regulatory perimeter assessment
02. Corporate structure and company incorporation
03. Preparation for SUGEF VASP registration
04. AML / CFT / CPF risk assessment
05. AML / KYC policies and procedures
06. PEP, sanctions and high-risk-country controls
07. Transaction monitoring and Travel Rule readiness
08. UBO and corporate documentation
09. Banking / EMI preparation
10. Regulatory communication and ongoing compliance support
Working result
A structured project that is ready for the applicable corporate and SUGEF registration steps—not a promise of a non-existent standalone license.
Choose the Level of Support You Need
Packages describe genuine decision stages. Final pricing follows the project scope and the filing procedure in force.
Full Setup + Banking + Compliance
For teams that also need operational readiness and ongoing support.
$12,550Preparation: project roadmap
Full setup scope
Bank / EMI preparation
Regulatory interaction
Ongoing compliance support
Company + VASP Registration Setup
For a complete corporate, compliance and registration-preparation workstream.
$8.950Preparation: scope-dependent
Assessment and structure
Company incorporation
AML / KYC framework
SUGEF registration support
Regulatory Assessment
For teams that need a clear applicability and jurisdiction decision first.
$5,250Preparation: quoted after intake
Business-model review
VASP perimeter analysis
Additional-regime flags
Recommended route and scope
Regulatory and supervisory fees are quoted separately once applicable rules are confirmed.
How the Setup Works
Company formation is one stage in a regulated launch—not permission to start crypto activity immediately.
1. Project assessment
Activity, custody, fiat flows, countries and customers
2. Regulatory perimeter
Article 15 quater and any additional regimes
3. Corporate setup
Create or adapt the Costa Rican company
4. Compliance framework
AML/KYC, risk, monitoring, sanctions and Travel Rule
5. SUGEF preparation
Build the filing package against the current procedure
6. Regulatory interaction
Handle questions, clarifications and corrections
7. Operational readiness
Banking / EMI file and launch controls
8. Ongoing compliance
Maintain policies, data and reporting after launch
What We Need From You
01. Founders, shareholders and UBOs
02. Directors and managers
03. Countries of residence
04. Business and revenue model
05. Services provided
06. Custody model
07. Fiat and crypto flows
08. Expected transaction volumes
09. Customer countries and target markets
10. Banking requirements
11. Existing AML / KYC materials
Three Timelines, Shown Separately
The regulatory review period must follow the procedure currently applied by SUGEF.
01 · Corporate
Company incorporation
Show a separate estimate after the entity type, ownership and document readiness are known.
Timeline: confirmed at intake
02 · Readiness
Compliance preparation
Estimate depends on the business model, existing policies and complexity of the control framework.
Timeline: scope-dependent
03 · Regulator
SUGEF review
The regulator’s review is outside the company-incorporation timeline and cannot be guaranteed.
Timeline: current SUGEF procedure
Effective from
19 September 2026
Costa Rica crypto regulation after commencement
Law No. 10961 adds Article 15 quater to Law No. 7786. From 19 September 2026, a business within the statutory VASP perimeter must register with SUGEF and comply with risk-based AML / CFT / CPF obligations. From that date, the perimeter will cover exchange, virtual-asset transfers, custody, deposit, administration or control, and specified financial services connected with the issuance, commercialization, offering or sale of virtual assets.
Costa Rica still does not issue a standalone crypto license. Article 15 quater states that SUGEF registration is not operating authorization. If the business also provides regulated payment services, conducts securities activity or enters another supervised financial perimeter, separate authorization and supervision may apply.
Current Regulatory Status
Regulatory status as of 4 September 2026
Confirmed
Verify on every update
Law No. 10961 has been enacted
Implementing regulation
Article 15 quater creates the VASP perimeter
Filing route and forms
Covered VASPs are subject to SUGEF registration from commencement
Review procedure and timing
AML / CFT / CPF obligations apply
Public register
Supervisory contributions
Law No. 10961 took effect on 19 September 2026. The law provides up to three months for its implementing regulation; filing forms and procedure should be checked against the latest SUGEF and CONASSIF publications.
The filing route, forms, review mechanics, public register and supervisory contributions should be checked against the latest SUGEF regulations and consultation materials before any filing. No VASP-specific filing route, forms or public review period were identified on the checked SUGEF pages as of 4 September 2026. This does not change the statutory effective date or turn registration into an operating license.
Ongoing Compliance Obligations
1. Customer and beneficial-owner identification.
2. Customer due diligence and record keeping.
3. PEP and high-risk-jurisdiction controls.
4. Transaction monitoring and suspicious-transaction reporting.
5. Travel Rule and sanctions screening.
6. Risk assessment and data updates to SUGEF.
Is a compliance officer required?
No single compliance-function model applies to every VASP. Once effective, Article 15 quater will require SUGEF to consider the company’s size, structure, number of operations, employees, volume and AML / CFT / CPF exposure when deciding whether a compliance officer is required or a differentiated structure can be authorized.
Gofaizen & Sherle can assess the operating model, allocate responsibilities and prepare a proportionate compliance structure for the applicable SUGEF framework. The final arrangement remains subject to the current rules and the regulator’s assessment.
No “0% Tax” Promise
Tax treatment depends on whether income is Costa Rican-source or foreign-source and on what the business actually does in Costa Rica. Management, personnel, contracting, assets, customers and transaction flows can affect the analysis. Article 1 of Income Tax Law No. 7092 taxes income from profitable activities of Costa Rican source. A project-specific tax review is required. Territoriality should not be presented as a blanket 0% exemption.
Costa Rica vs Other Crypto Jurisdictions
Route
Costa Rica
EU MiCA
El Salvador
Canada
Regulatory model
VASP AML registration
CASP authorization
DASP regime
MSB registration
Prudential authorization
No standalone license
Broader regime
Broader authorization
No
Passporting
No
EU / EEA scope
No
No
Main fit
Selected VASP models and international structuring
Buying an incorporated company does not transfer a ready-made crypto license or automatically carry SUGEF registration. Before acquisition, review its corporate, tax and accounting history, beneficial-ownership records, contracts, bank relationships, liabilities, compliance files and any correspondence with public authorities.
After the ownership change, the company may need updated governance, policies, business-flow documentation and operating records. The parties should also confirm whether notifications, amendments or new steps are required before SUGEF. A share transfer does not provide immediate regulated status or guarantee continuity of a bank account.
Confirm Applicability Before Launch
From 19 September 2026, operating within the Article 15-quater perimeter without the required registration may lead to supervisory action and restrictions on relationships with covered counterparties. Law No. 10961 will also bring Article 15-quater providers into the amended sanction framework.
From commencement, refusal to register and listed AML / CFT failures may attract fines of two to one hundred base salaries. Separate sanctions of 5% to 50% of the transaction value will apply to specified failures to record qualifying transactions, including relevant inflows or outflows of USD 10,000 or more and multiple transactions under Article 23. The percentage range is not a general penalty for every AML or registration breach.
No. Costa Rica does not issue a standalone crypto license.Law No. 10961 instead creates SUGEF registration for providers within Article 15 quater from 19 September 2026. In commercial use, “Costa Rica crypto license” may refer loosely to the company, compliance and registration workstream, but it is not the name of a legal authorization. The first step is to confirm whether the actual activities fall within the statutory VASP definition.
Is SUGEF registration mandatory after 19 September 2026?
Yes. An in-scope provider must register with SUGEF from 19 September 2026.Law No. 10961 has been enacted, but as of 4 September 2026 it has not yet commenced. Whether a particular business is in scope is addressed in the activity-perimeter answer below. No VASP-specific public procedure was identified on the checked SUGEF pages as of 4 September 2026, but that finding does not defer the statutory effective date.
Is VASP registration the same as a license?
No. SUGEF registration has a narrower legal effect than an operating license. From 19 September 2026, Article 15 quater will place an in-scope provider within SUGEF’s risk-based AML / CFT / CPF registration and supervision framework. It will not validate the business model, authorize every product, create market-access rights or replace company incorporation. The filing status and public record should be confirmed against current SUGEF materials.
Which crypto businesses need registration?
From 19 September 2026, registration will apply to businesses within the activity-based definition in Article 15 quater.Law No. 10961 defines exchange between virtual assets and fiat or other virtual assets, transfers, custody, deposit, administration or control, and specified financial services related to issuance, commercialization, offering or sale. Mining, software, non-custodial products, NFTs, DeFi and tokenization require individual analysis because the result depends on the company’s actual role, control and customer relationship.
Does a foreign-facing Costa Rican crypto company need registration?
A foreign-facing model will not be automatically exempt from SUGEF registration. From commencement, Article 15 quater will direct SUGEF to prevent habitual in-scope activity in Costa Rican territory by unregistered providers, regardless of legal domicile or stated place of operation. A Costa Rican company serving customers abroad therefore needs a factual review of management, personnel, contracting, custody, transaction flows and customer relationships. See the territorial provision in Law No. 10961.
How much does Costa Rica VASP setup cost?
There is no reliable fixed price before the business model and ownership structure are assessed. The scope may include classification, incorporation, corporate documents, AML / KYC controls, registration preparation, banking support and ongoing compliance. Law No. 10961 also contemplates supervisory contributions, while the amount and payment mechanics require confirmation under the applicable framework. Check the latest SUGEF regulations before relying on any fee estimate.
How long does the process take?
The process does not have one combined timeline. Company incorporation, compliance preparation and SUGEF review are separate stages with different dependencies. Corporate timing depends on the structure and document readiness. Compliance timing depends on the products, customer risks and existing controls. The regulator’s review follows the procedure in force and cannot be guaranteed. No VASP-specific public review period was identified on the checked SUGEF regulations page as of 4 September 2026.
Is a compliance officer mandatory?
Not every VASP should be assumed to need the same compliance-officer structure. Once effective, Article 15 quater will require SUGEF to consider size, structure, number of operations, employees, volume and risk exposure. On that basis, SUGEF will be able to require a compliance officer or authorize a differentiated structure. The company should still assign clear responsibility, independence, reporting lines and escalation procedures while the appropriate model is assessed.
Does the Travel Rule apply?
From 19 September 2026, yes, subject to the applicable Conassif rules.Law No. 10961 will require providers to obtain and retain the prescribed information for incoming and outgoing virtual-asset transfers, including information related to origin and destination. The exact operational requirements, thresholds and implementation mechanics will depend on the rules issued by Conassif. Travel Rule readiness should therefore be designed against the current Costa Rican framework, not a generic foreign template.
Can a Costa Rican VASP open a bank account?
Potentially, but neither company formation nor SUGEF registration guarantees a bank account. Banks and EMIs apply their own risk appetite and review the UBOs, source of funds and wealth, jurisdictions, counterparties, transaction flows and AML controls. From commencement, Law No. 10961 also restricts covered entities from maintaining commercial relationships with an unregistered Article 15-quater provider. Banking should be handled as a separate due-diligence workstream.
Can I buy a ready-made crypto company?
Yes, an existing Costa Rican company can be acquired. The transaction gives the buyer a corporate vehicle, not immediate regulated status. Any SUGEF position must be confirmed under the current framework after reviewing the entity’s history and proposed activity. Ownership, control and business-model changes may require updates, notifications or new steps. Review the acquisition through the ready-made company section above and the current SUGEF regulations before closing.
Does Costa Rica have CARF reporting in 2026?
No general Costa Rican CARF reporting duty for 2026 follows from the OECD commitment alone. Costa Rica has committed to implementing CARF in time to commence exchanges by 2028. The OECD Global Forum commitment list was updated on 23 June 2026. Applicable provider obligations require separate review of Costa Rican implementing legislation, effective dates, nexus and scope. CARF is a tax-transparency framework and remains separate from SUGEF VASP registration under Law No. 10961.
What if Costa Rica does not fit my business?
Choose another jurisdiction if its legal effect and market access match the business more closely. An EU-facing model may require the authorization framework under MiCA. El Salvador has a separate digital-asset provider route administered by the CNAD, while Canadian virtual-currency MSBs register with FINTRAC. The comparison should consider customers, products, custody, payments, distribution, banking and the type of regulatory status counterparties expect.
Gofaizen & Sherle has successfully implemented all the tasks related to the settlement of legal part (company formation and VASP license application) of our exchange whitebit.com.
Services Provided: End-to-end support with company share transfers in Lithuania and the USA (Montana), corporate account opening, AML/KYC policy development, regulatory compliance for FNTT and FinCEN, MICA licensing advisory, HR recruitment for C-level and AML roles, and payroll accounting services.
By clicking “Accept”, you agree to the storing of cookies and similar technologies on your device to enhance site navigation, analyze site usage, offer certain functionalities and assists in our marketing effort. Strickly necessary cookies are always active.
Our experts will tell you how to do it as quickly and easily as possible.
By clicking the button, I confirm that I have read the privacy policy and consent to the collection and processing of my personal data in accordance with the GDPR rules.
Thank you
Thank you for reaching us. Our team is working on your request, and we will contact you soon.