How to Get a VASP Licence in Costa Rica (step‑by‑step, 2026)

vasp license costa rica applications have moved from a niche compliance question to a board‑level decision for crypto exchanges, custodians and token projects looking to operate in Central America. This guide is written for founders, in‑house counsel and compliance officers who need a practical, step‑by‑step orientation, not high‑level commentary. It sets out who is likely to fall within scope, the documents regulators and banks expect, realistic timelines, costs and the AML/CFT controls that influence whether a registration is accepted and whether a bank will actually open an account. A key point to understand at the outset: Costa Rica does not currently operate a dedicated, standalone “VASP licence” regime in the way some jurisdictions do.

In practice, the controlling obligations arise from anti‑money‑laundering law and registration with the financial authorities, together with general corporate and tax compliance. The practical differentiator in 2026 is not a licence certificate on paper, but whether your application is bank‑ready and your anti‑money‑laundering programme survives scrutiny.

Overview: The VASP Costa Rica Landscape in 2026

Costa Rica’s digital‑asset market is maturing. Regional projects are increasingly considering Central American hubs, and in 2026 the emphasis has shifted decisively toward bank‑friendly AML/CFT programmes, clearer compliance expectations, and cross‑border payment discipline. It is important to be precise about the regulatory position: Costa Rica has not, as of 2026, enacted a comprehensive bespoke virtual‑asset framework, and virtual assets are not legal tender. The Banco Central de Costa Rica (BCCR) has publicly cautioned that cryptocurrencies are not backed by the State and carry risk. This means that what the market loosely calls a “VASP licence” is, in practice, a combination of AML/CFT registration and compliance obligations plus standard corporate authorisation to operate, rather than a single dedicated crypto licence.

A compliant local presence matters for three reasons: access to domestic banking and fiat rails, contractual clarity with Costa Rican counterparties, and reduced enforcement risk. Many projects assume they can operate cross‑border indefinitely; in practice, serving local customers, offering fiat on‑ramps or holding customer assets typically triggers local obligations, including AML/CFT duties and bank due diligence.

Before committing to a full compliance track, run a quick decision checklist: Are you serving Costa Rican residents? Do you need a local bank account or fiat rails? Do you hold customer funds or private keys? If the answer to any of these is yes, a local compliance path is likely the right route. If you serve only foreign markets with non‑custodial infrastructure, a cross‑border model may suffice, but expect banking friction. The remainder of this guide assumes you are evaluating a vasp license costa rica application seriously and want a defensible, bankable outcome.

What is a VASP in Costa Rica?

A Virtual Asset Service Provider (VASP) is, following the Financial Action Task Force (FATF) definition, any natural or legal person conducting, as a business, one or more of the following on behalf of another: exchange between virtual assets and fiat currency; exchange between one or more forms of virtual assets; transfer of virtual assets; safekeeping or administration of virtual assets or the instruments enabling control over them; and participation in and provision of financial services related to an issuer’s offer or sale of a virtual asset. Costa Rica is a member of the FATF‑style regional body GAFILAT, and local AML expectations are aligned with FATF standards.

In practice, a virtual asset service provider in Costa Rica includes crypto exchanges, custodians holding private keys, OTC desks and certain token‑issuance platforms.

Who uses this guide?

This guide is built for three audiences: founders mapping whether to incorporate locally; in‑house counsel assessing regulatory exposure; and compliance officers responsible for designing an AML/CFT programme that will pass both regulator review and bank onboarding. Each section is written so these readers can extract the specific artefact they need, a document list, a timeline, a cost range or a control checklist.

Eligibility: Who Should Comply as a Crypto Business in Costa Rica

Eligibility for a crypto license costa rica path turns on the activities you conduct, not on your corporate branding. If you perform any of the VASP activities listed above as a business and on behalf of customers, you fall within AML scope. A local legal entity is generally the cleanest vehicle for providing exchange, custody, token‑issuance or transfer services to the Costa Rican market, because it creates a clear, supervisable counterparty for banks and for the national financial intelligence unit.

Activities that typically create local obligations

• Fiat–crypto exchange. Converting colones or US dollars to and from virtual assets, including operating fiat on‑ramps and off‑ramps.
• Crypto–crypto exchange. Running a trading venue or matching engine between virtual assets.
• Custody of customer assets. Holding virtual assets, or the private keys and instruments enabling control over them, on behalf of clients.
• Transfer services. Moving virtual assets between wallets or accounts on behalf of customers, which engages FATF travel‑rule expectations.
• Token issuance and related financial services. Participating in an issuer’s offer or sale of a virtual asset, including primary distribution.
• OTC desks. Bilateral large‑ticket dealing, which banks and regulators scrutinise closely because of source‑of‑funds risk.

Foreign operators, permitted models

Foreign crypto exchanges frequently ask whether they can serve Costa Rican customers without a local footprint. There is no broad passporting regime for VASPs into Costa Rica, so a foreign entity cannot simply rely on a home‑state authorisation. The realistic options are a local subsidiary (full activity, local banking access), a representative presence (market research and partnerships only, no trading), or a cross‑border model that avoids local operations but carries banking and enforcement risk. The comparison table later in this guide sets out the trade‑offs.

The key point: the moment you touch local fiat rails, local customers or local custody, assume local AML/CFT and corporate obligations apply, and confirm the current requirements with the Ministerio de Hacienda and the SUGEF (supervisor for AML registration) before proceeding.

Step‑by‑Step: VASP Registration Costa Rica Process

The following nine steps describe the full VASP registration costa rica process from business‑model mapping to post‑registration compliance. Each step identifies who is responsible, the expected duration and the key sub‑tasks. The mandatory Step / Who / Duration table below consolidates the timeline; read it alongside the narrative so you can build a realistic project plan. End‑to‑end, a well‑prepared application typically takes three to six months, with complex follow‑ups or banking delays pushing realistic plans to six to nine months.

*Total end‑to‑end typical: 3–6 months. Processing times are not fixed by a published statutory window for a dedicated crypto licence; confirm current timelines with the relevant authority at the time of filing. See the Timeline & deadlines section for how to plan around the longer tail.

Step 1: Pre‑work, business model mapping and trigger analysis

Before engaging any authority, map every customer‑facing flow: KYC onboarding, custody arrangements, fiat rails and virtual‑asset transfers. The goal is to identify precisely which activities create AML/CFT and corporate obligations. This is where most time is saved later, an accurate trigger analysis prevents you from over‑ or under‑scoping the project. Responsible party: founders working with external counsel or a compliance consultant. Expected duration: one to two weeks.

Step 2: Choose entity type and incorporate

Select the vehicle, typically a Sociedad Anónima (S.A.) or Sociedad de Responsabilidad Limitada (S.R.L.) for full activity. Local counsel handles incorporation, registered office, tax registration and corporate formalities, including registration with the National Registry (Registro Nacional) and tax registration with Hacienda. For foreign groups, decide early how the local entity sits within the group structure, because the beneficial‑ownership chain will be scrutinised, including through the beneficial‑ownership register (Registro de Transparencia y Beneficiarios Finales) administered via the Banco Central. Responsible party: corporate team with a local law firm. Expected duration: two to four weeks.

Step 3: Prepare the AML/CFT programme and risk assessment

Draft the enterprise AML/CFT programme and the AML risk assessment in parallel with incorporation. This is the single most important artefact in the file: regulators and banks judge the application on the quality of the risk assessment, KYC tiers, transaction‑monitoring design and sanctions‑screening logic. Anchor every control to FATF standards and local supervisory expectations. Responsible party: compliance officer or compliance counsel. Expected duration: two to six weeks.

Step 4: Governance and key appointments

Appoint a compliance officer responsible for AML/CFT (often referred to locally as the oficial de cumplimiento), a KYC/compliance function and establish board oversight of AML/CFT. Prepare signed appointment letters, CVs and contact details. This step runs in parallel with Step 3 and typically takes one to two weeks. Weak or absent governance is a common reason for delay.

Step 5: Compile, notarise and translate documents

Assemble the full document pack (see the Required documents section), arrange notarisation and apostille where required, and obtain certified Spanish translations of any document not originally in Spanish. Responsible party: the company with a notary and translator. Expected duration: one to three weeks. Build in buffer, apostille and certified translation are frequent bottlenecks.

Step 6: File with the designated authority

Submit to the relevant authority. AML/CFT registration and supervision in the regulated financial sector is handled through SUGEF under the applicable anti‑money‑laundering legislation; tax and general corporate matters sit with Hacienda and the National Registry. Confirm the current registration channel and whether your activity is treated as a regulated obligated subject with the SUGEF and the Ministerio de Hacienda before filing. Submission itself can be same‑day; substantive review timelines vary.

Step 7: Authority follow‑up and requests for information

Expect requests for additional information, clarifications on UBO chains, source of funds, transaction‑monitoring rules or banking arrangements. Respond promptly and completely; incomplete responses are the main driver of delay. Responsible party: company with counsel. Expected duration: two to eight weeks depending on complexity.

Step 8: Decision and bank introductions

The authority issues a registration, a conditional outcome or a refusal. A conditional outcome may require remediation before full operation. Use this period to begin bank introductions, because banking onboarding runs on its own timeline and should not be left to the end.

Step 9: Post‑registration compliance

Once registered, operational compliance begins: ongoing suspicious‑transaction reporting to the financial intelligence unit, periodic independent audit of the AML function, record retention, renewals and continuous monitoring. Bank onboarding typically takes a further two to eight weeks. Treat this as the start of a continuous compliance calendar, not a finish line.

Required Documents and VASP Compliance Requirements

The document pack is where most applications stand or fall. The requirements below reflect what regulators and banks expect to see in a bank‑ready file. Notes on translation, notarisation and apostille apply throughout: any document not in Spanish generally needs a certified Spanish translation, and foreign corporate documents typically require notarisation and apostille. Bank‑ready attachments, owners’ source of funds and evidence of business continuity, are increasingly decisive in 2026.

Two practical notes. First, the UBO register and source‑of‑funds evidence receive the closest attention; thin or inconsistent beneficial‑ownership documentation is a leading cause of rejection. Second, bank partner letters, even at intent stage, materially strengthen the file because they demonstrate that your fiat rails are viable. For a structured template set, see the Costa Rica FinTech practice page.

Timeline and Deadlines

Plan to a realistic calendar rather than a best‑case one. The Step / Who / Duration table above sets out component durations; this section explains how they combine. Because Costa Rica does not operate a single statutory crypto‑licence clock, review periods depend on the authority, the completeness of the file and the complexity of the ownership structure. Where the authority issues requests for information, each round can add two to eight weeks, so front‑load completeness to avoid iterative delays.

Banking is the dependency most applicants underestimate. Even with full registration, bank onboarding typically takes two to eight weeks and is driven by the bank’s own AML review, which is why engaging banks in parallel from Step 3 onward is strongly advised. There is no commonly published fast‑track; the closest practical equivalent is a complete, bank‑ready application supported by pre‑application contact with the relevant authority.

Typical total time: 3–6 months. With complex follow‑ups or banking delays, a realistic plan is 6–9 months. Build renewal and periodic‑reporting deadlines into a compliance calendar from day one, and confirm any applicable processing windows with SUGEF and Hacienda at the time of filing.

Costs and Fees

The dominant costs of a vasp license costa rica application are professional and compliance‑implementation costs, not government fees. Because there is no dedicated standalone crypto‑licence fee schedule, verify any applicable administrative fees with the relevant authority at the time of filing. The ranges below are indicative planning figures, not quotations.

Government fee ranges are indicative; check published fees at the time of filing.

AML/CFT Costa Rica Requirements

AML CFT costa rica expectations are the backbone of any successful application. The principal domestic AML framework is Costa Rica’s anti‑money‑laundering and counter‑terrorist‑financing legislation and its implementing regulations, supervised in the financial sector by SUGEF, with financial intelligence functions carried out by the national financial intelligence unit. Regulators and banks expect a programme that maps cleanly to FATF standards. At minimum, your programme must include an enterprise risk assessment, tiered KYC, transaction monitoring, suspicious‑transaction reporting, sanctions screening, record retention and a designated compliance officer. Anchor every policy clause to FATF guidance and local supervisory expectations, and have the drafted programme reviewed by qualified counsel before submission.

Minimum KYC elements and onboarding checklist

• Identity verification. Collect and verify full legal name, date of birth, nationality and government‑issued ID for individuals; registration documents and UBO data for entities.
• Risk‑based tiering. Apply standard due diligence to low‑risk customers and enhanced due diligence (EDD) to politically exposed persons (PEPs) and customers connected to high‑risk jurisdictions.
• Source of funds and wealth. Document source of funds for higher‑risk and large‑value customers.
• Ongoing review. Refresh customer data periodically and on trigger events such as unusual activity.

Transaction monitoring expectations and example detection rules

Transaction monitoring must be rule‑based and documented, with a clear rationale for each scenario. Typical detection rules include structuring below reporting thresholds, rapid movement of funds in and out of an account, transactions with sanctioned or high‑risk counterparties, and activity inconsistent with the customer’s stated profile. Alerts should route to the compliance officer with documented investigation and escalation steps, and genuine suspicion should result in a suspicious‑transaction report to the national financial intelligence unit.

Sanctions and screening obligations

Screen customers and counterparties against applicable sanctions lists at onboarding and on an ongoing basis. Where virtual‑asset transfers are in scope, FATF’s travel‑rule expectations require originator and beneficiary information to accompany transfers above the relevant threshold; confirm whether and how a local implementation requirement applies with SUGEF before relying on cross‑border infrastructure alone.

Record retention and audit readiness

Retain KYC records, transaction data, monitoring alerts and investigation files in line with the applicable statutory retention period, confirm the exact period under Costa Rican law before finalising your policy. Maintain an audit trail that a regulator or external auditor can follow end‑to‑end, because audit readiness is a recurring post‑registration obligation and a frequent examination focus.

What Changes in 2026 for a VASP in Costa Rica

The direction of travel in 2026 is toward greater AML scrutiny across Central America and stronger bank onboarding checks for VASPs, with regional convergence on FATF recommendations through GAFILAT. Three practical changes should shape your planning:

• Bankability focus. Written bank engagement letters or a bank‑ready AML pack are increasingly expected; an unbanked entity is a weak applicant.
• Stronger UBO transparency. Deeper beneficial‑ownership proof and source‑of‑funds documentation are now baseline, not optional extras.
• More detailed transaction monitoring. Higher expectations for monitoring scenarios and data‑retention discipline, with supervisors probing the substance behind the policy.

Common Pitfalls

Most delays and refusals trace back to a short list of avoidable mistakes. The following remediation tips address the most frequent failures seen in VASP files:

• Incomplete UBO evidence. Document the full ownership chain with certified records before filing, not after a query.
• Weak AML programme. Tie every control to FATF and local supervisory expectations and have it reviewed by counsel.
• Unbanked entity. Engage banks in parallel from the AML‑drafting stage and secure at least an intent letter.
• Poor sanctions SOPs. Define screening frequency, list coverage and escalation steps in writing.
• Offshore‑only infrastructure. Demonstrate substance and local controls rather than relying solely on offshore arrangements.
• Badly mapped payment flows. Complete an accurate trigger analysis so the compliance scope matches your actual activities.

Comparison: Local Presence vs Cross‑Border and Hybrid Models

Conclusion and Next Steps

Securing a compliant vasp license costa rica footprint is achievable on a three‑to‑six‑month plan when the application is bank‑ready, the UBO and source‑of‑funds evidence is complete, and the AML/CFT programme maps to FATF and local supervisory expectations. Remember that Costa Rica’s regime is built on AML/CFT registration and general corporate and tax compliance rather than a single bespoke crypto licence, so confirming the applicable authority and obligations for your specific activity is essential. Use the step‑by‑step process, document table and cost ranges above to build a realistic plan, engage banks early, and verify current requirements before you file.

For tailored support, see the Costa Rica FinTech practice page or the GLE lawyer directory, Costa Rica FinTech lawyers to arrange a compliance‑readiness review.

Sources

1. Ministerio de Hacienda de Costa Rica
2. Asamblea Legislativa de Costa Rica
3. Superintendencia General de Entidades Financieras (SUGEF)
4. Banco Central de Costa Rica (BCCR)
5. Financial Action Task Force (FATF)
6. GAFILAT (Grupo de Acción Financiera de Latinoamérica)
7. International Monetary Fund (IMF)