Crypto Travel Rule in Costa Rica: What VASPs Need to Know

Crypto Travel Rule in Costa Rica: What Data Must Travel With Every Virtual Asset Transfer Under Law 10961

---

The crypto travel rule in Costa Rica is one of the most misunderstood — and technically demanding — obligations facing Virtual Asset Service Providers (VASPs) under the country’s new AML framework. Law No. 10961 requires VASPs to collect, verify and transmit originator and beneficiary data for every qualifying virtual asset transfer, in line with FATF Recommendation 16. The concept is simple to state and genuinely hard to implement — especially when the counterparty is a foreign provider, a self-hosted wallet, or a platform that hasn’t yet integrated a compliant messaging protocol.

What is the travel rule and why does it matter in Costa Rica?

The travel rule originates from FATF Recommendation 16, which requires financial institutions to transmit identifying information about the originator and beneficiary alongside every funds transfer. In 2019, the Financial Action Task Force (FATF) formally extended this requirement to Virtual Asset Service Providers, recognizing that crypto transfers carry the same money laundering and terrorism financing risks as traditional wire transfers.

With the enactment of Law No. 10961, effective September 19, 2026, Costa Rica brings VASPs into its AML framework under Law 7786. This means VASPs registered with SUGEF — Costa Rica’s financial superintendency — must comply with the travel rule on the same terms already enforced in the EU, the United States, the United Kingdom, Singapore and Japan.

The core idea hasn’t changed since the rule first applied to banks: create a traceability chain that lets authorities reconstruct the flow of funds when needed. What’s new is that the chain now covers Bitcoin, Ethereum, stablecoins and any other virtual asset moving between regulated providers.

What data must “travel” with each transfer

Under the FATF standard — which CONASSIF’s implementing regulations will localize for Costa Rica — the originator VASP must collect, verify and transmit a minimum dataset to the beneficiary VASP before the transaction settles, or at the latest simultaneously. This exchange happens off-chain, not as part of the blockchain transaction itself.

What makes virtual assets different from bank wires is that a wallet address alone does not identify a person. That’s why the travel rule requires this information to move between providers through secure channels — not as visible data on the blockchain — and why the beneficiary VASP must verify the data before releasing funds to the recipient.

The threshold: when does the obligation kick in?

The FATF recommends a USD/EUR 1,000 threshold: below that amount, travel rule requirements are lighter (though not absent — transactions that appear linked can be aggregated). Jurisdictions, however, have adopted very different thresholds:

• The European Union, under the Transfer of Funds Regulation (TFR), applies a €0 threshold for transfers between crypto-asset service providers — the rule applies to every transfer, regardless of amount.
• The United States (FinCEN) keeps its long-standing USD 3,000 threshold.
• The United Kingdom applies £1,000 domestically and a zero threshold for cross-border transfers.

Costa Rica’s specific threshold has not been set yet. Law 10961 delegates to CONASSIF the issuance of implementing regulations defining — among other operational details — the transaction thresholds that trigger enhanced due diligence and the concrete mechanics of the travel rule. Until those regulations are published, the FATF standard (USD 1,000) is the working reference, but the final threshold could differ.

Unhosted wallets and the unknown counterparty problem

The travel rule works relatively smoothly when both parties to a transfer are regulated VASPs: there is an originator that collects the data, a beneficiary that receives it, and a secure channel between them. The challenge arises when the counterparty is a self-hosted wallet (also called an unhosted or non-custodial wallet) — a wallet not controlled by any regulated provider.

In that scenario, there is no beneficiary VASP to transmit data to. Jurisdictions have responded differently: some require the originating VASP to collect the beneficiary’s data anyway and retain it on file; others require the customer to prove ownership of the destination wallet; the EU restricts certain transfers to unverified wallets above specific amounts.

CONASSIF’s regulations will need to define how Costa Rica handles this scenario. What is already clear is that VASPs operating here need an internal protocol addressing transfers to self-hosted wallets — this is one of the points SUGEF is likely to examine when verifying compliance.

The technical layer: messaging protocols

Complying with the travel rule is not only a policy matter — it requires technical infrastructure to exchange data securely with other VASPs. The information is not sent by email and is not appended to the blockchain transaction. In practice, the industry has developed specialized protocols that let VASPs exchange data using the standardized IVMS101 format (InterVASP Messaging Standard).

Integrating one of these protocols involves technical development, counterparty agreements, and validation that the system meets encryption and data-retention requirements. For a mid-sized or smaller VASP in Costa Rica, this can be the most expensive and complex part of the compliance build — an area where legal and technical advice need to work together from day one.

How the travel rule fits into Costa Rica’s broader FinTech compliance perimeter

It’s a mistake to treat the travel rule as an isolated technical checkbox. Under Law No. 10961, it is one obligation inside a wider AML/CFT compliance perimeter that SUGEF and CONASSIF apply to every registered VASP — and it interacts directly with the rest of a company’s regulatory build:

• KYC and customer due diligence: travel rule data collection only works if onboarding already captures verified identity information. A weak KYC process upstream means unreliable travel rule data downstream — see our full breakdown of AML, KYC and recordkeeping obligations for VASPs under Law 10961.
• Banking access: Costa Rican banks reviewing a VASP’s account application increasingly ask whether travel rule infrastructure is in place, since it directly affects the bank’s own correspondent banking and AML risk exposure — part of the broader banking reality for crypto companies in Costa Rica.
• Trusts and fiduciary structures: when a Costa Rican trust holds or transfers virtual assets on behalf of clients, the fiduciary administrator may itself need travel rule–compliant processes, which is relevant to escrow and trust structures involving virtual assets.
• Criminal exposure: a travel rule failure that facilitates the movement of illicit funds can escalate from an administrative fine into criminal exposure under Costa Rica’s money laundering framework for crypto and real estate.

In practice, this means a serious VASP compliance program cannot design its travel rule workflow in isolation. It has to be built alongside KYC policy, transaction monitoring, banking strategy and the company’s broader AML program — all under the same SUGEF/CONASSIF supervisory umbrella.

Penalties for non-compliance

There is also a criminal dimension that should not be underestimated: if a compliance failure facilitates a money laundering operation, exposure can escalate from administrative sanctions to criminal liability under Law 7786.

How AG Legal helps: VASP regulatory compliance

AG Legal advises exchanges, transfer platforms, custodians and fintechs operating with virtual assets in Costa Rica on the design and implementation of AML compliance programs under Law 10961, including:

• Risk assessment and determination of whether the business qualifies as a VASP under the law.
• AML/KYC program design tailored to the business model, including travel rule–specific controls.
• Guidance through the SUGEF registration process.
• Coordination with technical advisors for messaging protocol integration.
• Structuring banking strategy alongside compliance design, so the company isn’t left explaining its program to banks after incorporation.

Frequently Asked Questions

What is the crypto travel rule in Costa Rica?

It is the obligation — derived from FATF Recommendation 16 and incorporated into Costa Rican law by Law No. 10961 — requiring VASPs to collect, verify and transmit originator and beneficiary data for every virtual asset transfer above the applicable threshold.

What is the travel rule threshold in Costa Rica?

The FATF recommends USD/EUR 1,000 as the standard threshold. Costa Rica’s specific threshold will be defined by CONASSIF’s implementing regulations, which are still pending.

What happens when I send crypto to a self-hosted wallet?

Transfers to non-custodial (self-hosted) wallets present a challenge because there is no beneficiary VASP to receive the data. CONASSIF’s regulations will define the specific controls for this scenario in Costa Rica; in other jurisdictions, proof of wallet ownership or beneficiary data collection is typically required.

When does the travel rule take effect in Costa Rica?

Law 10961 takes effect on September 19, 2026. However, the operational mechanics of the travel rule depend on CONASSIF’s implementing regulations, which have not yet been published. VASPs should be preparing now.

Are stablecoins covered by the travel rule?

Yes. The FATF has explicitly stated that stablecoins are virtual assets subject to the same obligations, including the travel rule, and has flagged growing stablecoin use in illicit finance as a reason for continued scrutiny.

What penalties does a VASP face for non-compliance in Costa Rica?

Penalties can reach up to 50% of the transaction amount or between 2 and 100 base salaries. Non-compliance can also result in loss of SUGEF registration and, if it facilitates money laundering, criminal liability under Law 7786.

Does the travel rule apply on its own, or as part of a broader compliance program?

It applies as part of a broader AML/CFT compliance perimeter under SUGEF and CONASSIF supervision. It depends directly on the strength of a VASP’s KYC process and interacts with banking access, trust structures involving virtual assets, and the broader money laundering framework.

Recommended reading

• Crypto Regulation in Costa Rica 2026: Law 10961 VASP — Full Guide
• Money Laundering in Costa Rica: Crypto and Real Estate

This article is for informational purposes only and does not constitute legal advice for any specific case. Laws and their interpretation may change; always consult a lawyer before making decisions based on this content. Law No. 10961 was published in La Gaceta on June 19, 2026; CONASSIF’s implementing regulations are pending as of the date of this article.