Crypto Regulation in Costa Rica: New VASP Law – Guide (2026)

Jun 3, 2026 | Commercial Law

Costa Rica Crypto Regulation | VASP Law | SUGEF Registration | AML Compliance | 2026 Update

Crypto Regulation in Costa Rica: What the New VASP Law Means for Investors and Crypto Businesses

Costa Rica has approved Bill No. 25,340, a major reform that changes the legal landscape for crypto businesses. The new framework does not make Bitcoin legal tender and it does not prohibit cryptocurrency. Instead, it brings Virtual Asset Service Providers, known as VASPs, under anti-money laundering supervision and creates new obligations for exchanges, custody providers, transfer platforms, fintech companies and other businesses dealing with virtual assets.

By Gonzalo Gutierrez Acevedo | AG Legal | Last updated: June 2026

2026 Legal Update: Costa Rica Has Approved Bill No. 25,340

Costa Rica’s Legislative Assembly approved Bill No. 25,340, a reform to Law 7786 that introduces a specific compliance framework for Virtual Asset Service Providers. As of this update, the bill is awaiting presidential signature and publication before becoming enforceable law.

This is the most important development in Costa Rica crypto regulation to date. For foreign investors, crypto exchanges, wallet providers, fintech companies, OTC desks and Web3 founders, the key issue is no longer only whether crypto can exist in Costa Rica. The more important question is whether the business model qualifies as a VASP and what compliance obligations will apply.

Quick Take

  • Cryptocurrency is not prohibited in Costa Rica.
  • Bitcoin is not legal tender and the Costa Rican colón remains the official currency.
  • Bill No. 25,340 creates a VASP framework through a new Article 15 quater of Law 7786.
  • Covered crypto businesses must register with SUGEF for AML supervision.
  • SUGEF registration is not a license to operate and should not be confused with a general business authorization.
  • VASPs must implement AML, KYC, beneficial ownership, recordkeeping, risk assessment and suspicious transaction reporting controls.
  • CONASSIF will issue implementing regulations defining thresholds, scope, exclusions and technical details.
  • A Costa Rican company that only acts as a passive holding vehicle, does not operate the exchange, does not sign client contracts, and has all operations and income generated abroad should not need SUGEF VASP registration.
  • Foreign crypto companies may be affected if they operate in or from Costa Rica or use a Costa Rican entity to provide VASP services.

Introduction: Costa Rica Is Entering a New Stage of Crypto Regulation

For many years, Costa Rica was seen as a flexible jurisdiction for cryptocurrency, blockchain projects and international business structures. Crypto was not banned, there was no specific crypto license, and companies could often operate under general corporate, tax and contractual rules.

That position is changing. With Bill No. 25,340, Costa Rica is moving toward a more formal regulatory model for businesses that provide crypto-related services to third parties. The reform does not turn Costa Rica into a fully licensed digital asset hub, but it does create clear compliance expectations for exchanges, custody providers, virtual asset transfer services and other VASP activities.

This guide explains the new Costa Rica crypto regulation in practical terms: what changed, who may need to register with SUGEF, what a VASP is, how AML obligations work, what foreign companies should review and how investors should approach Costa Rica after Bill No. 25,340.

What Changed in 2026?

The biggest change is simple: Costa Rica is no longer approaching crypto only through general law. Bill No. 25,340 introduces a specific AML framework for businesses that provide virtual asset services.

For a foreign investor or crypto founder, this does not mean that Costa Rica has banned crypto. It means the country is asking a more serious question: who is providing crypto services, who are their clients, where do the assets come from, where are they going, and what controls are in place to prevent financial crime?

Before Bill No. 25,340 After Bill No. 25,340
No specific VASP framework. A VASP framework is introduced through Article 15 quater of Law 7786.
Crypto businesses operated in a less defined regulatory environment. Covered crypto businesses must review SUGEF registration and AML obligations.
AML expectations existed but were less specific for virtual assets. VASPs must implement KYC, beneficial ownership, recordkeeping, reporting and risk controls.
Greater uncertainty for banks and counterparties. More legal clarity, but also more compliance responsibility.

AG Legal Insight

The practical question for a crypto business is no longer only whether Costa Rica allows crypto. In most cases, the more important question is whether the company’s activity falls within the definition of a Virtual Asset Service Provider and whether it is ready to operate under AML supervision.

What Is Bill No. 25,340?

Bill No. 25,340 is a reform to Costa Rica’s Law 7786, the country’s main law on money laundering, terrorist financing and related financial crime matters. The reform adds a new Article 15 quater that specifically addresses Virtual Asset Service Providers.

The purpose of the bill is not to promote speculation, approve every token, or create a special tax regime for crypto. Its purpose is more concrete: to bring certain crypto businesses into Costa Rica’s anti-money laundering and counter-terrorist financing system.

The bill follows the international direction set by the Financial Action Task Force, known as FATF or GAFI, especially Recommendation 15 on virtual assets and VASPs. Costa Rica had been under pressure to close this gap as part of its international AML compliance commitments.

Issue What the New Framework Does
Main reform Adds Article 15 quater to Law 7786.
Primary target Virtual Asset Service Providers, or VASPs.
Supervisor SUGEF supervises AML/CFT compliance under a risk-based approach.
Main obligations KYC, beneficial ownership, risk assessment, recordkeeping, transaction monitoring and suspicious transaction reporting.
Legal tender status Virtual assets are not recognized as legal tender or foreign currency by the Central Bank of Costa Rica.
Next step CONASSIF must issue implementing regulations to define scope, thresholds, exclusions and technical details.

Yes. Cryptocurrency is not prohibited in Costa Rica. Individuals and businesses may generally hold, receive, transfer or agree to use crypto assets in private transactions, as long as the underlying activity is lawful.

What changed with Bill No. 25,340 is not the basic legality of crypto. What changed is the treatment of businesses that provide crypto services to others. If a company exchanges crypto, holds crypto for clients, transfers virtual assets, administers virtual assets or provides services connected to the issuance or sale of virtual assets, it must now review whether it qualifies as a VASP.

For foreign founders, this distinction is essential. Costa Rica may still be a viable jurisdiction for certain crypto and blockchain businesses, but the structure must be designed with compliance, tax, banking and corporate substance in mind. The starting point is usually choosing the right legal vehicle and understanding how companies in Costa Rica are incorporated, managed and maintained.

Simple Answer

Crypto is legal in Costa Rica, but crypto service providers may now be regulated as VASPs for AML compliance purposes.

No. Bitcoin is not legal tender in Costa Rica. The Costa Rican colón remains the official currency, and the Central Bank of Costa Rica does not recognize Bitcoin, stablecoins or other virtual assets as legal tender or foreign currency.

This is one of the most important differences between Costa Rica and countries that have adopted a more aggressive legal tender model. Costa Rica is not requiring businesses to accept Bitcoin, and the new law does not turn crypto into official money.

The new regulation is about supervision and compliance. It focuses on the businesses that provide services involving virtual assets, not on declaring crypto as national currency.

Important Distinction

Costa Rica’s new crypto regulation is not a legal tender law. It is an AML, supervision and VASP registration framework.

How Does Costa Rica Define Virtual Assets?

Under the approved text, a virtual asset is a digital representation of value or funds that can be traded or transferred digitally and can be used for payments or investments.

The law also makes clear that this definition does not mean virtual assets are recognized as legal tender in Costa Rica or as foreign currency by the Central Bank.

In practical terms, the focus is not whether a token is “money” in the traditional sense. The focus is whether it can move value, be exchanged, be transferred, be held for others, or be used in a way that creates financial crime risk.

What Is a VASP Under Costa Rican Law?

A Virtual Asset Service Provider, or VASP, is a person or company that performs certain virtual asset activities as a business, either for itself or on behalf of another person or entity.

The definition is broad enough to cover many crypto business models. A company does not need to call itself an exchange to fall within the scope of the law. What matters is the activity it actually performs.

Crypto-Fiat Exchange

Exchange between virtual assets and legal tender currencies.

Crypto-to-Crypto Exchange

Exchange between one or more forms of virtual assets.

Virtual Asset Transfers

Services that transfer virtual assets for users or third parties.

Custody and Administration

Custody, deposit, administration or control of virtual assets by any means.

Issuance-Related Services

Financial services related to the issuance, commercialization, offer or sale of virtual assets.

Own Account or Client Services

The analysis may apply whether the activity is performed for the business itself or for a third party.

CONASSIF will define the operational scope of these activities through implementing regulations. Those regulations will be especially important for understanding registration obligations, exclusions, thresholds and technical compliance requirements.

Do VASPs Need to Register With SUGEF?

Yes. Covered VASPs must register with the Superintendencia General de Entidades Financieras, known as SUGEF.

SUGEF will supervise these providers for AML/CFT compliance under a risk-based approach. VASPs must also keep their registration information updated and may be included in a centralized registry.

This registration is important, but it must be understood correctly. The law states that registration with SUGEF does not represent an authorization to operate. It is not a banking license, a securities license or a general approval of every product, token or service offered by the company.

What SUGEF Registration Means

  • The VASP becomes visible to the AML supervisor.
  • The VASP must comply with AML/CFT obligations.
  • The VASP may be subject to information requests, inspections and sanctions.
  • The registration may be published in a centralized VASP registry.
  • The registration does not automatically validate every business activity.

AML, KYC, Recordkeeping and Reporting Obligations for VASPs

A VASP in Costa Rica will need more than a basic corporate structure. It will need a real compliance program. This includes documented policies, trained personnel, internal procedures, risk analysis and evidence that the controls actually work.

For a crypto exchange, custody provider, wallet operator or fintech business, AML crypto compliance in Costa Rica should be reviewed before launch, not after the company is already operating. A Costa Rican entity that looks clean on paper can still face problems if it cannot explain its clients, its transactions, its source of funds or its risk controls.

Compliance Area What It Means in Practice
Customer identification The VASP must identify customers using reliable and independent information.
Beneficial ownership The VASP must understand who ultimately owns or controls a client or legal structure. In Costa Rica, this should be reviewed together with corporate transparency duties and UBO reporting obligations.
Customer due diligence The VASP must apply risk-based due diligence before and during business relationships.
Transaction records Records must be sufficient to reconstruct transactions and must be available to authorities when required.
Politically exposed persons The VASP must apply controls for politically exposed persons, also known as PEPs.
New technologies The VASP must review risks from new products, services, technologies and business practices.
High-risk jurisdictions Enhanced controls may apply when clients, counterparties or transactions involve higher-risk countries.
Suspicious transaction reports Suspicious transactions and attempted suspicious transactions must be reported confidentially and without delay to the Financial Intelligence Unit of the ICD.
Confidentiality The VASP must protect the confidentiality of suspicious transaction reports and related information.

The Travel Rule and Virtual Asset Transfers in Costa Rica

Virtual asset transfers are one of the areas where the new law may have the greatest operational impact. The approved text requires VASPs to obtain and maintain information consistent with international FATF standards, including information related to the origin and destination of transfers.

In the crypto compliance world, this is commonly known as the Travel Rule. It generally requires regulated providers to collect and transmit certain information about the originator and beneficiary of qualifying virtual asset transfers.

For exchanges, custodians, wallet infrastructure providers, OTC desks and transfer platforms, this may require changes to onboarding, data architecture, blockchain analytics, transaction monitoring, compliance workflows and user agreements.

Why This Matters

A crypto business that cannot identify, document and monitor transfer information may face regulatory problems, banking difficulties and commercial friction with regulated counterparties.

Trusts, Fiduciary Structures and Virtual Assets in Costa Rica

Bill No. 25,340 is also relevant for trusts and fiduciary structures. The approved text states that when certain regulated activities involve the administration of trusts that include virtual assets, they will be subject to the regulation and supervision established under Article 15 quater, as further developed by CONASSIF.

This matters because Costa Rica is often considered for escrow, fiduciary, corporate and asset-holding structures. If virtual assets are involved, the analysis must include not only contract law and fiduciary duties, but also AML supervision, beneficial ownership, transaction monitoring, reporting and possible registration issues.

Banking Reality for Crypto Companies in Costa Rica

The approval of a VASP framework does not automatically solve the banking challenge for crypto businesses in Costa Rica. Local banks may still be cautious with crypto-related companies due to risk appetite, correspondent banking concerns, limited operational familiarity with crypto models and enhanced due diligence requirements.

A serious crypto structure should not be incorporated first and explained to banks later. Banking strategy should be part of the legal design from the beginning. The ownership structure, source of funds, compliance program, client profile, operating jurisdictions and transaction flows can all affect whether a bank is willing to work with the company.

Practical Banking Warning

SUGEF registration should not be interpreted as a guarantee that a Costa Rican or foreign bank will open or maintain an account for a crypto business. Banking feasibility must be analyzed separately.

Crypto Tax in Costa Rica: Territorial Source and Economic Substance

Costa Rica generally follows a territorial-source tax system. In simple terms, a company is not taxed only because it exists in Costa Rica. The analysis depends on where income is generated, where the activity is performed, where value is created, where management decisions are made and whether the income is considered Costa Rican-source income.

This is especially important for crypto businesses because many of them operate across borders. A Costa Rican company may have foreign users, offshore infrastructure, international contractors, decentralized technology or management functions located outside the country. For that reason, Costa Rica crypto tax planning should be reviewed together with corporate structure, operational substance and compliance obligations.

Lower Tax Exposure May Apply When:

  • Operations occur outside Costa Rica.
  • Key infrastructure is located offshore.
  • Management functions are outside Costa Rica.
  • The company can demonstrate real foreign substance.
  • Income is not Costa Rican-source under applicable rules.

Tax Risk May Increase When:

  • Services are performed in Costa Rica.
  • Operational staff are located locally.
  • Management decisions occur in Costa Rica.
  • Users or clients are served from Costa Rica.
  • The business has local infrastructure, employees or economic substance.

Crypto tax treatment should be reviewed before choosing Costa Rica as a jurisdiction for an exchange, wallet, custody service, token platform, treasury company, OTC desk or Web3 operating entity.

Penalties for Non-Compliance Under Costa Rica’s New Crypto Regulation

The reform also updates the sanction framework under Law 7786. VASPs and other covered persons may face penalties if they fail to register, fail to identify customers, fail to maintain records, fail to report suspicious transactions, refuse to provide information to authorities or maintain business relationships with unregistered covered providers.

The sanctions may include:

  • Fines ranging from 5% to 50% of the total transaction amount in certain cases.
  • Fines ranging from two to one hundred base salaries for specific compliance failures.
  • Late payment surcharge if a fine is not paid within the legal term.
  • Publication of final sanctions by supervisory authorities.
  • Inspection, information request and enforcement powers by competent authorities.

Business Impact

Compliance should be treated as a founder-level and board-level issue. In a crypto business, weak AML controls can affect licensing, banking, investors, counterparties and long-term viability.

What Foreign Crypto Companies Should Know About Costa Rica

Foreign crypto businesses should not assume that Costa Rica’s new regulation applies only to local companies serving local clients. A foreign group may need legal review if it uses a Costa Rican company, operates from Costa Rica, has management in Costa Rica, hires local personnel, targets Costa Rican users or administers virtual asset structures through a Costa Rican nexus.

This is especially important for crypto exchanges, OTC desks, wallet and custody providers, token issuers, fintech companies, blockchain businesses and Web3 startups evaluating Costa Rica as part of their international structure. In these cases, advice from a crypto lawyer in Costa Rica should focus not only on incorporation, but also on AML obligations, tax exposure, banking feasibility, beneficial ownership, contracts and operational substance.

  • Crypto exchanges evaluating a Costa Rican entity.
  • OTC desks serving Latin American clients.
  • Wallet and custody providers.
  • Token issuers using Costa Rican corporate vehicles.
  • Web3 and blockchain startups with founders or management in Costa Rica.
  • Fintech companies integrating crypto payments or settlement rails.
  • Trust, escrow or fiduciary structures holding virtual assets.
  • International groups seeking tax or operational flexibility.
  • Companies operating in other regulated or high-risk sectors, including gaming or online betting models that may also require separate review of a gambling license or gaming-related compliance structure.

Incorporation alone does not answer the regulatory question. Authorities, banks, investors and counterparties will look at the real business model: who controls the company, where decisions are made, who the clients are, what services are provided and how assets move.

Does a Costa Rican Company With Fully International Operations Need SUGEF Registration?

One of the most important questions for foreign founders is what happens when a company is incorporated in Costa Rica, but the business is operated entirely outside Costa Rican territory and does not use Costa Rican sources.

The key point is that Bill No. 25,340 regulates activities. It does not automatically turn every Costa Rican company that is connected to a crypto group into a VASP. Therefore, if a Costa Rican company is only established as a passive holding vehicle or corporate structure, and it does not operate the exchange, does not provide custody, does not transfer virtual assets for clients, does not sign contracts with users, and does not generate its operational income in Costa Rica or using Costa Rican sources, it should not need to register with SUGEF as a VASP.

When SUGEF VASP Registration Should Not Be Required

A Costa Rican company should generally not require SUGEF VASP registration when all of the following apply:

  • The Costa Rican company does not operate the exchange or crypto platform.
  • The Costa Rican company does not sign contracts with clients or users.
  • The Costa Rican company does not provide custody, transfer, administration or control of virtual assets.
  • The Costa Rican company does not provide issuance-related financial services involving virtual assets.
  • The operational activity, clients, infrastructure, personnel and income are outside Costa Rica.
  • The Costa Rican company acts only as a holding, investment or passive corporate vehicle.

The analysis changes if the Costa Rican company is the entity that actually provides the VASP service. For example, if the Costa Rican company signs the client contracts, operates the exchange, controls the platform, receives the fees, provides custody, transfers assets for users or manages the business from Costa Rica, SUGEF registration may be required even if the clients are located abroad.

Scenario Likely SUGEF VASP Registration Analysis
Costa Rican company is only a passive holding company. Registration should not be required if it does not perform VASP activities.
Costa Rican company owns shares in a foreign crypto operating company. Registration should not be required if the Costa Rican company does not provide crypto services to clients.
Costa Rican company signs contracts with users of the exchange. Registration risk increases because the Costa Rican company may be the service provider.
Costa Rican company operates the platform or receives service fees. Registration may be required if the activity falls within the VASP definition.
Management, personnel or operational control are in Costa Rica. A detailed regulatory review is necessary because substance may connect the activity to Costa Rica.

In practice, the difference between a passive Costa Rican company and a regulated VASP will depend on contracts, governance, operational control, flow of funds, client relationship, management functions and actual business conduct. A structure designed only on paper may not be enough if the real activity shows that the Costa Rican company is providing virtual asset services.

AG Legal Position

A Costa Rican company with all operations, clients, infrastructure and income outside Costa Rica should not need SUGEF VASP registration if it does not sign client contracts and does not operate or provide the exchange, custody, transfer or other VASP service. The analysis changes when the Costa Rican company is the actual service provider.

Costa Rica VASP Compliance Checklist

Businesses that may qualify as VASPs should begin preparing before the implementing regulations are finalized. The following checklist is a practical starting point for founders, legal teams and compliance officers.

Initial VASP Readiness Checklist

  • Map the business model and identify whether the company performs exchange, transfer, custody, administration, control, issuance-related, commercialization, offer or sale services involving virtual assets.
  • Determine whether the Costa Rican entity or Costa Rican operations create a registration obligation.
  • Confirm whether the Costa Rican company is active or passive in the structure.
  • Review whether the Costa Rican company signs client contracts or receives operating income.
  • Review shareholder, director, officer, participant, associate and beneficial owner information.
  • Design a customer identification and verification procedure.
  • Create a beneficial ownership identification process.
  • Prepare a customer risk rating methodology.
  • Develop enhanced due diligence procedures for high-risk clients, PEPs, high-risk countries and unusual activity.
  • Implement transaction monitoring rules and escalation workflows.
  • Prepare suspicious transaction reporting procedures for the Financial Intelligence Unit of the ICD.
  • Adopt confidentiality controls to prevent unauthorized disclosure of suspicious transaction reports.
  • Review Travel Rule readiness and transfer information requirements.
  • Prepare recordkeeping policies that allow transaction reconstruction.
  • Review third-party vendor reliance, blockchain analytics tools and compliance outsourcing agreements.
  • Assess whether a compliance officer or differentiated compliance structure will be required.
  • Prepare for information requests, inspections and supervisory reviews.
  • Review banking strategy and cross-border account options.
  • Update terms of service, privacy policies, custody terms, risk disclosures and client agreements.

Official and International Sources to Monitor

Crypto businesses evaluating Costa Rica should monitor official regulatory publications and international AML standards. The final practical effect of Bill No. 25,340 will depend on presidential sanction, publication and implementing regulations.

Frequently Asked Questions About Crypto Regulation in Costa Rica

Is cryptocurrency legal in Costa Rica?
Yes. Cryptocurrency is not prohibited in Costa Rica. However, businesses that provide crypto-related services may now be subject to VASP registration and AML compliance obligations under Bill No. 25,340.
“`
Is Bitcoin legal tender in Costa Rica?
No. Bitcoin is not legal tender in Costa Rica. The Costa Rican colón remains the official currency, and virtual assets are not recognized as legal tender or foreign currency by the Central Bank of Costa Rica.
What is Bill No. 25,340 in Costa Rica?
Bill No. 25,340 is a reform to Law 7786 that creates a new Article 15 quater to regulate Virtual Asset Service Providers for anti-money laundering, counter-terrorist financing and proliferation financing purposes.
What is a VASP in Costa Rica?
A VASP is a person or company that, as a business, performs covered virtual asset activities such as crypto-fiat exchange, crypto-to-crypto exchange, virtual asset transfers, custody, administration, control or financial services related to the issuance, commercialization, offer or sale of virtual assets.
Do crypto exchanges need to register with SUGEF in Costa Rica?
Covered crypto exchanges that qualify as VASPs must register with SUGEF for AML supervision. CONASSIF regulations will define important operational details.
Does SUGEF registration authorize a crypto company to operate?
No. SUGEF registration is not an authorization to operate. It is a registration and AML supervision mechanism, not a general license approving every activity, product or token.
Does a Costa Rican company need SUGEF registration if all operations and income are abroad?
Not necessarily. If the Costa Rican company is only a passive holding or corporate vehicle, does not operate the exchange, does not sign contracts with clients, does not provide custody or transfer services, and all operations and income are generated outside Costa Rica, it should not need SUGEF VASP registration.
When would a Costa Rican company with foreign clients need VASP registration?
Registration may be required if the Costa Rican company is the entity that actually provides VASP services, signs client contracts, operates the platform, receives service fees, provides custody, transfers virtual assets or manages the virtual asset business from Costa Rica, even if the clients are located abroad.
Is a passive Costa Rican holding company a VASP?
A passive Costa Rican holding company should not be considered a VASP if it does not perform virtual asset services and only holds shares, investments or corporate ownership interests. The analysis changes if the company performs exchange, custody, transfer, administration or issuance-related services.
Do crypto custodians need to comply with the new law?
Yes, if they qualify as VASPs. The definition includes custody, deposit, administration or control of virtual assets by any means.
Does the new Costa Rica crypto law apply to foreign companies?
It may apply if the foreign company has a Costa Rican nexus, uses a Costa Rican entity, operates from Costa Rica, serves Costa Rican operations or performs covered VASP activities in a way that brings it within the scope of local regulation.
Are crypto gains taxable in Costa Rica?
They may be taxable depending on source, activity and substance. Costa Rica generally follows a territorial-source tax system, so the tax treatment depends on where the income is generated and where the business activity is performed.
Does Costa Rica follow FATF standards for crypto?
Bill No. 25,340 was designed to strengthen Costa Rica’s compliance with FATF Recommendation 15 on virtual assets and Virtual Asset Service Providers.
Can a Costa Rican company operate a crypto exchange?
Potentially yes, but the company must be reviewed for VASP registration, AML compliance, tax treatment, banking feasibility, user contracts, beneficial ownership and operational substance.
What should crypto companies do now?
Crypto companies should map their business model, determine whether they qualify as VASPs, prepare AML and KYC policies, review SUGEF registration implications, assess tax exposure and monitor CONASSIF implementing regulations.
“`

AG Legal advises founders, investors, exchanges, OTC desks, custody providers, fintech companies, blockchain startups, fiduciary structures and international groups on crypto regulation in Costa Rica, VASP registration, SUGEF compliance, AML and KYC policies, crypto tax and cross-border structuring.

Whether you are launching a crypto exchange, structuring a custody service, evaluating Costa Rica for a Web3 company or reviewing whether a Costa Rican company with international operations needs SUGEF registration, legal analysis should happen before incorporation, banking outreach, fundraising or go-live.

Schedule a Legal Consultation

Author: Gonzalo Gutierrez Acevedo

Last updated: June 2026. This article is provided for general informational purposes only and does not constitute legal, tax, accounting, financial or regulatory advice. Every crypto business model should be reviewed individually.

Posts

View More