Costa Rica's Crypto Register: Virtual Asset Providers and Registration with SUGEF Under Anti-money-laundering Law

Costa Rica’s framework for virtual asset service providers (VASPs) operates through the country’s long-standing anti-money-laundering statute, Ley 7786 (the Ley sobre Estupefacientes, Sustancias Psicotrópicas, Drogas de Uso No Autorizado, Actividades Conexas, Legitimación de Capitales y Financiamiento al Terrorismo). Legislative and regulatory efforts have been directed at bringing virtual assets within this anti-money-laundering (AML) perimeter and at requiring VASPs to register as reporting entities with the Superintendencia General de Entidades Financieras (SUGEF).

For founders, banks, payment firms and compliance teams, the practical consequence is significant: if you serve Costa Rican users, you need to understand who must register, what registration does and does not mean, and how the enabling rules from the Consejo Nacional de Supervisión del Sistema Financiero (CONASSIF) shape day-to-day obligations. This guide explains the likely scope of such a regime, the registration process, AML duties, penalties and the outstanding regulatory items you should monitor. Because the status, number and effective date of any specific reforming law can change, you should verify the current text against the official gazette.

The legal framework and why it matters

Costa Rica’s approach to virtual assets builds on Ley 7786, the country’s foundational AML and counter-terrorist-financing statute. Rather than creating a standalone crypto code, the policy direction has been to extend an existing, familiar AML framework to cover digital assets. The approach involves defining virtual assets and virtual asset service providers and obliging those providers to register with SUGEF as reporting entities. The significance of this structural choice is that, by attaching the crypto sector to the established AML regime, the framework imports a body of supervisory practice, reporting expectations and enforcement powers that already apply to banks and other reporting entities.

The driver behind the reform is international. The Financial Action Task Force (FATF) has, since 2019, expected its members and jurisdictions in its network to bring VASPs within AML supervision, apply customer due diligence, and require registration or licensing. Costa Rica’s alignment with those standards reduces the risk of the country being viewed as a gap in the regional AML architecture. Costa Rica is a member of GAFILAT (Grupo de Acción Financiera de Latinoamérica), the FATF-style regional body, which periodically assesses the country’s compliance.

Legislative process and how to verify publication in La Gaceta

The authoritative text of any Costa Rican law is the version published in the official gazette, La Gaceta, by the Imprenta Nacional. Costa Rican laws generally take effect on publication unless the statute specifies a different date or a transitional period. Many statutes of this kind contemplate a period after publication before full effect, with the responsible regulator given a window to adopt enabling regulations. Because effective-date mechanics and transitional provisions carry real compliance consequences, you should verify the exact dates, law number and article references against the official La Gaceta text (available through the Imprenta Nacional and the Sistema Costarricense de Información Jurídica, SCIJ) rather than relying on secondary summaries.

Why Costa Rica is moving to include VASPs, FATF standards and regional context

FATF’s guidance on virtual assets and VASPs sets the international baseline: define the sector, require registration or licensing, apply the risk-based approach, and mandate customer due diligence and suspicious transaction reporting. Across Latin America, jurisdictions have moved at different speeds to meet these expectations, producing a patchwork of regimes. Costa Rica’s direction reflects both FATF and GAFILAT expectations and a desire to avoid becoming a conduit for flows displaced from neighbouring markets that have already tightened their rules. For market participants, the trajectory signals that informal, unsupervised operation is an increasingly risky posture.

Who counts as a virtual asset service provider?

The operative definitions depend on the precise statutory and regulatory wording in force, which should always be consulted in the official Spanish text; any English rendering is a working translation and is not authoritative. In broad terms, consistent with the FATF standard, a virtual asset is a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes, excluding digital representations of fiat currency and other assets already regulated under existing financial law. A virtual asset service provider is, correspondingly, a natural or legal person that, as a business, conducts one or more defined activities on behalf of others.

The activities typically captured by a VASP definition drafted to FATF standards include:

• Exchange services. Converting between virtual assets and fiat currency, or between one virtual asset and another.
• Transfer services. Moving virtual assets from one address or account to another on behalf of a client.
• Custody and administration. Safekeeping virtual assets or the instruments that control them, such as private keys.
• Participation in and provision of financial services related to issuance. Facilitating an issuer’s offer or sale of a virtual asset, where applicable.

The common thread is acting for or on behalf of another person as a business. That distinction matters when assessing borderline cases.

Examples and real-world scenarios

A centralised exchange that lets Costa Rican residents buy, sell and swap tokens is squarely in scope, it performs exchange and, frequently, custody functions. A custodian that holds client keys or coins for safekeeping is in scope because it administers assets on behalf of others. A payment gateway that accepts crypto from customers and settles value to merchants is likely in scope where it transfers virtual assets on behalf of clients. In each case the business is intermediating value for third parties, which is the hallmark such a regime targets.

Out-of-scope activities and areas of legal ambiguity

Some activities sit closer to the edge. Pure software developers who publish code but never take custody or transact on behalf of users, and individuals mining for their own account, are generally not performing VASP functions because they are not providing a service to third parties. Advisory-only businesses that never touch client assets or execute transfers may also fall outside the core definition. That said, these are interpretive questions, and classification can turn on the specific facts and on how CONASSIF frames its implementing rules. Where a business model combines elements, for example, a wallet provider that also facilitates swaps, the balance can tip into scope.

Firms in grey areas should document their analysis and seek local advice rather than assume exclusion.

Registration with SUGEF, what it means and what it does not

The central obligation under a Costa Rican VASP regime is registration with SUGEF. It is essential to understand the character of that duty. Registration here is an AML identification and supervisory tool: it brings the provider onto SUGEF’s radar as a reporting entity subject to customer due diligence, monitoring and reporting obligations. Crucially, registration is not an authorisation to operate. It does not grant a financial licence, does not of itself confirm prudential soundness, and does not substitute for any other permission a business may require under general commercial or financial law.

This distinction has practical weight. A registered VASP has satisfied an AML gatekeeping requirement, but registration is not a seal of broad regulatory approval. Conversely, operating without registering once in scope exposes the provider to enforcement and to commercial exclusion, because counterparties and banks will expect confirmation of registration before dealing.

Expected registration fields and supporting documents

While the definitive list of required information will be fixed by SUGEF’s forms and CONASSIF’s rules, a registration dossier built to AML standards would typically include:

• Entity identification. Legal name, corporate form, registration details and contact information.
• Beneficial ownership. Disclosure of ultimate beneficial owners and the ownership and control structure.
• Governance and responsible persons. Directors, senior managers and the designated compliance officer.
• AML/CTF policies. Written customer due diligence, monitoring, reporting and record-retention procedures.
• Activity description. The virtual asset services provided and the jurisdictions and customer segments served.

Timeline, fees and public register expectations

Once SUGEF publishes its registration mechanics, firms should expect a defined application window and standardised forms. SUGEF maintains registers of various non-financial reporting entities, and status is typically verifiable through official channels. Any fees and the precise processing timeline will be set by the supervisor. Because the registration process depends on SUGEF’s operational notices, monitor the supervisor’s official channels for the forms and submission procedures as they are released, and treat early press summaries as provisional until confirmed.

Registration vs licensing, comparison and legal consequences

A recurring question is whether Costa Rica has adopted a licensing regime for VASPs. The AML registration model is materially different from the licensing frameworks some other jurisdictions use, where a regulator grants express permission to operate after fit-and-proper assessments and imposes ongoing prudential and conduct supervision. The table below contrasts the two models.

Practical effect on banks and counterparties

The legal consequences of non-registration are commercial as much as regulatory. Banks, payment processors and other reporting entities apply their own AML risk policies. Once registration is the market norm, dealing with an unregistered VASP becomes a red flag that can trigger enhanced scrutiny, account closures or refusal to onboard. Counterparties may contractually require proof of registration as a condition of doing business. In effect, the register can become a precondition for banking access and for maintaining the relationships a crypto business needs to function.

AML duties after registration, CDD, thresholds, STRs and recordkeeping

Registration is the gateway; the substantive obligations are the AML duties that follow. As a reporting entity under Ley 7786, a registered VASP must implement a full AML/CTF compliance programme. That means identifying and verifying customers through customer due diligence, conducting ongoing monitoring of transactions and relationships, filing reports on suspicious activity, and retaining records for the periods the law prescribes. The regime therefore converts informal onboarding into a documented, auditable process.

Thresholds, what CONASSIF is expected to set

A key operational question is when customer due diligence is triggered for occasional transactions. The FATF model uses a transaction threshold above which full CDD applies to one-off clients. Under the Costa Rican framework, the specific monetary thresholds and the mechanics for applying them are expected to be fixed by CONASSIF in implementing regulation. Until those rules are published, firms should design conservative procedures, applying CDD broadly and recalibrating once the thresholds are confirmed, rather than waiting and risking a gap. Treat any pre-regulation threshold figures circulating in commentary as provisional.

STR mechanisms and cross-border information sharing

Suspicious transaction reporting channels into Costa Rica’s existing AML reporting architecture under Ley 7786, with the Unidad de Inteligencia Financiera (UIF), housed within the Instituto Costarricense sobre Drogas (ICD), serving as the financial intelligence unit that receives such reports. A registered VASP that forms a suspicion of money laundering or terrorist financing must report through the prescribed mechanism and maintain confidentiality around that report. The framework also contemplates supervisory information exchange with foreign counterparts, reflecting the cross-border nature of virtual assets. The operational detail of how reports are formatted and how information is shared internationally is elaborated by SUGEF and CONASSIF.

Penalties, enforcement and practical risk for unregistered providers

Non-compliance carries meaningful exposure. Costa Rica’s AML regime provides for a penalty architecture that can include both proportional and fixed fines; some AML sanctions in Costa Rican law are expressed relative to a transaction value and others relative to the national base salary (salario base), the standard reference unit used in Costa Rican penalty scales. The definitive penalty scales must be read from the official statutory text and any implementing schedules before you rely on them, as specific figures and bands change. Enforcement is likely to proceed primarily through administrative fines, with the possibility of referral where conduct crosses into criminal money laundering under the broader AML law.

Commercial and banking consequences

Beyond fines, the practical risk is de-risking. An unregistered provider can find bank accounts frozen or closed, correspondent relationships denied, and payment rails withdrawn, outcomes that can be more damaging to a going concern than a monetary penalty. Under this regime, compliance is not merely a legal formality but a condition of continued market access.

Outstanding items, what CONASSIF must still regulate

A statutory framework sets the structure, but a significant amount of operational detail is delegated to CONASSIF. Until that regulation is in place, important parameters remain open. The items to watch include:

• CDD thresholds. The monetary trigger for full due diligence on occasional transactions.
• Registration form and process. The exact documentation, submission channel and timeline SUGEF will require.
• Reporting formats. How suspicious transaction and other regulatory reports must be structured and filed.
• Correspondent banking and custody chains. Guidance on how VASPs interact with banks and multi-layer custody arrangements.
• Cross-border structures. Treatment of offshore entities and groups serving Costa Rican users.

Timetable and monitoring

Where a reforming statute sets a defined window after publication for the regulator to issue rules, firms should not treat the gap as a holiday. Build your compliance architecture now against FATF and existing Ley 7786 expectations, then adjust once the regulation lands. Monitor La Gaceta, SUGEF notices and CONASSIF publications directly so you capture draft rules and consultation windows as they appear.

Cross-border considerations and FATF alignment

Virtual assets do not respect borders, and neither does the policy logic behind this regime. A central question for international operators is when a provider is deemed to serve Costa Rican users and therefore falls within scope. Marketing to residents, onboarding Costa Rican customers, or providing services from within the country can all be relevant factors. Providers with offshore headquarters cannot assume they are exempt simply because incorporation sits elsewhere; the test is functional, oriented to the users served, consistent with FATF’s approach.

Practical examples, offshore HQ, custody chains and recognition

Consider an exchange incorporated abroad that actively onboards Costa Rican residents and holds their balances: the fact pattern points towards being in scope, because the provider furnishes exchange and custody services to Costa Rican users. A custody chain where a local front-end relies on a foreign sub-custodian raises questions about which entity in the chain bears the registration duty, an area where CONASSIF guidance will be valuable. Unlike some licensing frameworks, an AML registration does not come with automatic cross-border recognition; interaction with foreign supervisors depends on memoranda of understanding and information-exchange mechanisms.

Interaction with Latin American neighbours

Costa Rica’s framework sits within a regionally fragmented picture, with neighbours at varying stages of regulating VASPs. For groups operating across several Latin American markets, that fragmentation means parallel compliance obligations rather than a single harmonised standard. Aligning internal policies to the FATF baseline helps, because most regional regimes draw on the same source, but local registration, thresholds and reporting formats will still differ jurisdiction by jurisdiction.

Practical action list and checklist for crypto founders, banks and advisers

The right response to this regime is structured and sequenced. Use the following checklist to move from exposure assessment to registration readiness.

1. Map your exposure. Identify whether and how you serve Costa Rican users, and confirm which of your activities fall within the applicable VASP definition.
2. Classify your model. Document your analysis for any borderline activities and seek local counsel where classification is uncertain.
3. Draft AML/CTF policies. Prepare customer due diligence, ongoing monitoring, suspicious transaction reporting and record-retention procedures consistent with Ley 7786 and FATF guidance.
4. Appoint a compliance officer. Designate a responsible person with the authority and resources to run the programme.
5. Prepare beneficial ownership disclosures. Assemble ownership and control information and supporting documentation.
6. Review banking relationships. Engage your banks early, confirm their expectations around registration, and manage de-risking exposure proactively.
7. Assemble registration materials. Keep the dossier ready so you can submit promptly once SUGEF publishes its forms.
8. Monitor official sources. Track La Gaceta, SUGEF and CONASSIF for the registration process, thresholds and effective-date confirmations.

Indicative timeline: immediately, map exposure and classify activities; within roughly 30 days, have policy drafts and governance in place; within the applicable implementation window, have registration materials ready to file; and on an ongoing basis, monitor CONASSIF rulemaking and adjust thresholds and procedures accordingly.

Key takeaways and recommended next steps

Costa Rica’s direction for virtual asset service providers, anchored in Ley 7786’s AML framework and SUGEF supervision, marks a shift from an unsupervised environment towards an AML-regulated one. Virtual asset service providers that serve Costa Rican users should expect to register with SUGEF, operate a full AML/CTF compliance programme, apply customer due diligence once CONASSIF’s thresholds are set, and file suspicious transaction reports. Registration is not a licence, but non-registration carries both administrative penalties and severe commercial consequences, including loss of banking access.

With key operational details to be fixed by CONASSIF, the prudent course is to build compliance capability now against the FATF baseline and existing AML law, keep registration materials ready, and monitor the official gazette and supervisory notices closely. Because several parameters remain subject to regulation and penalty figures must be confirmed against the statutory text, firms should obtain tailored advice from Costa Rican counsel, and verify the current law number, article references and effective dates, before finalising their compliance posture.

Sources

1. Financial Action Task Force (FATF), Guidance on a Risk-Based Approach to Virtual Assets and VASPs
2. Superintendencia General de Entidades Financieras (SUGEF)
3. Consejo Nacional de Supervisión del Sistema Financiero (CONASSIF)
4. Imprenta Nacional, La Gaceta (official gazette)