Corporate Criminal Liability in Costa Rica: Guide to Law 9699

Corporate Criminal Liability in Costa Rica: Complete Guide to Law 9699

---

Since 2019, a company in Costa Rica can be held criminally liable for corruption and bribery offenses — not just the individual who acted on its behalf. Today, understanding corporate criminal liability in Costa Rica is no longer an academic question for any legal entity operating here, Costa Rican or foreign. It’s now part of ordinary legal due diligence.

What is Law 9699 and why does it exist?

Law N.º 9699 is officially known as the Law on Liability of Legal Entities for Domestic Bribery, Transnational Bribery, and Related Offenses. It took effect in 2019, as part of Costa Rica’s process of joining the Organization for Economic Cooperation and Development (OECD). In fact, it moved through the legislature in just four months. The push came mainly from the need to comply with the OECD’s Anti-Bribery Convention and its Working Group on Bribery.

Before this law, Costa Rican criminal law rested on a classic principle: societas delinquere non potest, or “companies cannot commit crimes.” Under that rule, only a natural person, with intent and the capacity for guilt, could commit an offense. Law 9699 broke that principle directly. As a result, for the first time in the country’s legal history, a company itself can be the subject of a criminal proceeding.

Who does corporate criminal liability in Costa Rica apply to?

Generally, the law covers any private legal entity, Costa Rican or foreign, that is domiciled in Costa Rica or has operations here — regardless of where its capital comes from. In practice, that means a local subsidiary of a multinational can fall under this regime. So can a company formed by foreign investors, or one that only holds commercial contracts in Costa Rican territory.

Notably, one point often surprises foreign investors: trusts are expressly included as “de facto legal entities.” That’s because trusts are a flexible contractual vehicle. They’ve been used — and at times questioned — for managing assets in public works and private projects.

In addition, state-owned companies and autonomous institutions can also be liable. However, that only happens when they’re involved in international commercial relations and become entangled in transnational bribery or related concealment activity.

The “connecting act”: how a company becomes liable

Costa Rica uses what legal scholars call a vicarious liability model. Under this model, the criminal responsibility of the individual who acted transfers to the company. That happens as long as the person acted for the company’s benefit — the so-called “connecting act.” In other words, there’s no need to prove the company had a defective internal structure that allowed the crime. The link between the individual’s conduct and the benefit the company received is enough.

That has a practical consequence worth understanding. If the benefit of the criminal conduct went to the employee personally, or to a third party, there’s generally no corporate criminal liability under this law. That said, other administrative or civil liability may still apply.

The catalog of crimes that trigger the law

Law 9699 doesn’t cover every offense. It applies to a closed list of 23 crimes, all connected to public administration. That list includes corruption, domestic bribery, transnational bribery, and related offenses like receiving, laundering, or concealing assets from those crimes. This matters for any company: the law does not directly include broader financial crimes like money laundering outside its link to transnational bribery, nor organized crime in general. However, that doesn’t mean a company is exempt from other forms of liability in those areas — it just means they run through separate legal channels.

Compliance programs: what they do and don’t do

Here’s the point that confuses companies coming from jurisdictions where compliance can fully exempt a company from criminal liability. In Costa Rica, however, a compliance program does not exempt a company from corporate criminal liability. Instead, the law treats it as an optional model (Article 8 of Law 9699). If a judge finds it adequate, it can only reduce the fine by up to 40%.

For that reduction to be recognized, the company has to show that its program actually works. The burden initially rests with the Public Prosecutor’s Office, but the company itself has every incentive to present its own evidence. Specifically, judges look for a risk analysis tailored to the company’s own activity, plus internal reporting channels and a compliance officer with real independence. They also look for staff training and internal and external audit mechanisms.

In short, the practical takeaway is simple: adopting a generic, off-the-shelf compliance policy isn’t enough. The program has to be designed around the company’s actual activity and risks, and it has to be demonstrably implemented — not just a document sitting in a drawer.

Penalties a company can face

Article 11 of Law 9699 sets out a catalog of penalties that can be imposed on a legal entity, including:

• A fine of 1,000 to 10,000 base salaries.
• Loss of state benefits or subsidies for 3 to 10 years.
• Loss of tax or social security benefits, also for 3 to 10 years.
• Cancellation of the operating permit tied to the activity involved in the crime.
• Dissolution of the legal entity, when it was created specifically to commit the crime.
• Publication of the operative part of the conviction in a national publication, at the convicted company’s expense.

Beyond the formal penalty, there’s a cost many companies underestimate. Reputational damage can start the moment a case becomes public, even before a final conviction. In turn, this can affect business relationships, ongoing bids, and the confidence of international partners.

What happens during the criminal process

By law, a legal entity has the same basic procedural rights as any defendant. These include the right to a defense, the right against self-incrimination, and the right to its own legal representation. Importantly, this representation is separate from that of the individual employee or representative named in the same case.

Unlike the United States, Costa Rica has no equivalent to non-prosecution agreements (NPAs) or deferred prosecution agreements (DPAs). Instead, three alternative resolutions exist: suspending the process on probation, conciliation, and full reparation of the harm caused. Any of these can keep a case from reaching a formal conviction.

A company’s own internal investigations play a double role. First, they help detect and correct misconduct before it escalates. Second, effective cooperation with the Public Prosecutor’s Office — providing decisive evidence about the individual’s involvement — can be treated as a mitigating factor for the company.

Specific considerations for foreign companies

Although Law 9699 applies equally to Costa Rican and foreign legal entities, a few details tend to catch multinational companies and foreign investors off guard:

• A parent company’s compliance program isn’t automatically enough. A compliance model designed in another jurisdiction, without adapting it to the Costa Rican operation’s specific risks, is unlikely to be recognized as adequate. This is especially true given the law’s closed list of 23 crimes.
• Costa Rica has no equivalent to non-prosecution agreements (NPAs) or deferred prosecution agreements (DPAs), unlike the United States and other jurisdictions. Instead, the alternative resolutions available here are probation-style suspension, conciliation, and full reparation of harm, each with different rules and scope.
• Trusts used as foreign investment vehicles — common in real estate and asset-management projects — are expressly included as “de facto legal entities” under this law.
• Liability doesn’t depend on where the capital comes from. It depends only on whether the legal entity is domiciled, resident, or operating in Costa Rica. As a result, a local subsidiary of a multinational answers for it exactly like any Costa Rican company.

Practical recommendations for your company

1. Don’t assume a generic compliance program is enough. It needs to be tailored to your specific risks and to the 23 crimes covered by Law 9699.
2. Appoint a compliance officer with real independence, not just a title on an org chart.
3. Document everything. If a case arises, the burden of showing the program was effective falls, in practice, on the company seeking the reduction.
4. Review your exposure if you operate through trusts in public works or asset-management projects — they’re expressly covered by the law.
5. At the first internal suspicion of bribery or corruption, get specialized criminal counsel immediately, before deciding how to run an internal investigation. After all, how it’s handled can determine whether the company ends up with a mitigating or an aggravating factor.

Frequently Asked Questions

Which companies does corporate criminal liability in Costa Rica apply to under Law 9699?

Any private legal entity, Costa Rican or foreign, domiciled or operating in Costa Rica. It applies as long as one of the 23 crimes in the legal catalog occurs, with a connecting act tying it to an individual who acted for the company’s benefit. It also applies to certain state-owned companies involved in international commercial relations.

Can a foreign company with a Costa Rican subsidiary be held criminally liable here?

Yes, and it answers under the same conditions as a Costa Rican company — the law doesn’t distinguish by where the capital comes from. However, a compliance program designed at headquarters without adapting it to the local operation is unlikely to be recognized as adequate for a fine reduction.

Does a compliance program exempt a company from liability?

No. Unlike other jurisdictions, a compliance program does not exempt a company from criminal liability in Costa Rica. At best, if a judge finds it adequate, it can reduce the fine by up to 40%.

More on Crimes, Trusts, and Penalties

What crimes trigger corporate criminal liability for a legal entity in Costa Rica?

A closed list of 23 crimes tied to public administration: corruption, domestic bribery, transnational bribery, and related offenses involving receiving, laundering, or concealing assets derived from those crimes.

Can trusts be held liable under this law?

Yes. The law expressly includes them as “de facto legal entities,” given how often they’re used as a vehicle for managing assets in public and private projects.

What penalties can a company convicted under Law 9699 face?

A fine of 1,000 to 10,000 base salaries, plus loss of state and tax benefits for 3 to 10 years. Other penalties include cancellation of the operating permit, dissolution in extreme cases, and publication of the conviction in a national publication.

What should a company do if it discovers possible corruption internally?

Get specialized legal advice before deciding how to proceed. A well-handled internal investigation, with effective cooperation toward the Public Prosecutor’s Office, can be treated as a mitigating factor. A poorly handled one, however, can expose the company even further.

Recommended reading

• Tax Crime in Costa Rica: Thresholds, Penalties, and the Legal Excuse
• Double Taxation
• Costa Rica Wills for Foreign Property Owners
• How to Dissolve a Company in Costa Rica
• Land Disputes in Costa Rica: Protect Your Property From Fraud
• Costa Rica Corporate Compliance Calendar 2026: Tax Deadlines

This article is for informational purposes only and does not replace individualized legal advice. Laws and their judicial interpretation can change; always consult a lawyer before making decisions based on this content.