Costa Rica -- Licensing Requirements Regulatory Overview

**Superintendencia General de Entidades Financieras (SUGEF):** The General Superintendency of Financial Institutions. SUGEF is responsible for supervising financial entities and enforcing AML/CFT regulations for many obligated subjects.

Virtual asset service providers in Costa Rica are not yet explicitly classified as 'obligated subjects' under Law 7786; the proposed amendment (Expediente 22.837) that would explicitly include them remains pending and has faced procedural setbacks.

**Registration:** With SUGEF as an "obligated subject" (if the activity falls under their scope) or potentially with the Financial Intelligence Unit (Unidad de Inteligencia Financiera - UIF) depending on the exact classification.

**Full AML/KYC Program:** Implementation of robust Know Your Customer (KYC), Customer Due Diligence (CDD), Enhanced Due Diligence (EDD), and Transaction Monitoring policies and procedures.

**AML Officer:** Appointment of a designated AML Compliance Officer.

**Reporting:** Obligation to report suspicious transactions (SARs/STRs) to the UIF.

**Record-keeping:** Maintenance of transaction and client records for a specified period.

**Risk Assessment:** Conduct a comprehensive money laundering and terrorism financing risk assessment.

**Status:** If the custody provider holds virtual assets on behalf of clients and/or provides services that enable the transfer or exchange of these assets, they would likely also fall under the "obligated subject" category, especially if they control the private keys for clients.

**Requirements:** Similar to exchanges – full AML/KYC program, AML officer, reporting, record-keeping, risk assessment.

**If processing fiat currency payments (even if crypto-related):** They would likely fall under existing payment service provider regulations and certainly under AML/CFT laws as obligated subjects.

**If purely crypto-to-crypto transactions (e.g., facilitating payments in crypto without fiat conversion):** This remains a grey area in many jurisdictions without specific VASP licensing. However, the global trend is to bring such services under AML/CFT scrutiny if they involve value transfer and could be used for illicit purposes. SUGEF's interpretation would be key.

**Requirements:** Similar to exchanges and custody providers if deemed an obligated subject. Additionally, if they handle fiat, they might need to comply with general financial service regulations, which could entail higher capital requirements and specific operational licenses from SUGEF, depending on the scope of fiat activities.

**Capital Requirements:** There are no specific capital requirements *for crypto-specific licenses* as such licenses don't exist. However:

If an entity's operations are interpreted as falling under the scope of existing financial institution activities (e.g., holding client funds, providing certain payment services in fiat), then the capital requirements applicable to traditional financial institutions or payment service providers regulated by SUGEF would apply. These can vary significantly depending on the type of financial service.

For entities purely operating as "obligated subjects" under AML without being a licensed financial institution, there isn't a direct prescribed minimum capital, but demonstrating financial soundness and having adequate resources to implement AML controls is implicitly expected.

**AML/KYC Requirements:** This is the most crucial aspect. Obligated subjects must implement comprehensive AML/CFT programs that include:

Customer identification and verification (KYC).

Ongoing monitoring of business relationships.

Identification and reporting of suspicious transactions.

Internal controls, policies, and procedures.

Designation of a compliance officer.

**Local Presence:** Generally, any company operating and generating income in Costa Rica needs to be incorporated locally and have a local registered office and local representation (e.g., a local legal representative). This is standard corporate law, not crypto-specific. For AML purposes, having a local AML officer is also typical.

**Legal Opinion/Classification:** Obtain a legal opinion to determine if the specific business model falls under the definition of an "obligated subject" according to Ley 7786 and its implementing regulations (e.g., SUGEF Agreement 13-10).

**Company Incorporation:** Incorporate a legal entity in Costa Rica.

**Registration with SUGEF/UIF:** If classified as an obligated subject, register the entity with the relevant authority (SUGEF or UIF, depending on the exact classification and type of obligated subject).

**AML Program Development:** Develop and implement a robust AML/CFT manual, policies, and procedures tailored to the specific business and its identified risks. This includes KYC protocols, transaction monitoring systems, record-keeping, and reporting mechanisms.

**Appointment of AML Officer:** Appoint a qualified AML Compliance Officer.

**Training:** Ensure staff are adequately trained on AML/CFT policies and procedures.

**Ongoing Compliance:** Continuously monitor compliance, conduct internal audits, and submit required reports (e.g., suspicious transaction reports, periodic compliance reports) to the authorities.

**Ley 7786 - Ley sobre Estupefacientes, Sustancias Psicotrópicas, Drogas de Uso no Autorizado, Actividades Conexas, Legitimación de Capitales y Financiamiento al Terrorismo (Law on Narcotics, Psychotropic Substances, Unauthorized Drug Use, Related Activities, Money Laundering and Financing of Terrorism):**

This is the fundamental AML/CFT law in Costa Rica.

**URL:** While direct government links can change, it's typically found on the official legislative information system or legal databases. A reliable source for the consolidated text (though not always the absolute latest official version) is often available from legal firms or parliamentary sites. Search for "Ley 7786 Costa Rica" on the website of the Asamblea Legislativa or La Gaceta (the official gazette).

*Example (may require navigating for the latest consolidated text):* Sistema Costarricense de Información Jurídica (SCIJ) - search for Ley 7786

**Acuerdo SUGEF 13-10 - Reglamento sobre Legitimación de Capitales, Financiamiento al Terrorismo y Financiamiento de la Proliferación de Armas de Destrucción Masiva Aplicable a los Sujetos Obligados por los Artículos 15 y 15 bis de la Ley 7786 (Regulation on Money Laundering, Financing of Terrorism and Financing of the Proliferation of Weapons of Mass Destruction Applicable to Obligated Subjects under Articles 15 and 15 bis of Law 7786):**

This is SUGEF's detailed regulation for implementing AML/CFT for various obligated subjects. It explicitly mentions virtual assets in its risk assessment guidance.

*Example (navigate to Normativa -> Regulaciones):* SUGEF Official Website

*Direct link to Normativa (may change):* SUGEF Normativa – search for "Acuerdo SUGEF 13-10" within the listed regulations.

**Unidad de Inteligencia Financiera (UIF) - Financial Intelligence Unit:**

Responsible for receiving and analyzing suspicious transaction reports. While it doesn't issue licenses, it's a critical part of the AML ecosystem.

**URL:** Banco Central de Costa Rica - UIF

**Expectation of Profits:** Do purchasers have an expectation of generating a return or profit from their investment? This is often the most critical subjective element.

**Security Tokens (STOs/ICOs structured as investments):** These are almost certainly considered securities. If a token represents equity, debt, a right to profit-sharing, or a share in the project's future revenue, it would fall under SUGEVAL's jurisdiction.

**Utility Tokens (with investment characteristics):** This is a grey area. While marketed for accessing a product or service, if they are sold with an explicit or implicit promise of future value appreciation based on the issuer's efforts, or if they are purchased primarily for speculative investment rather than immediate utility, they could be deemed securities. The timing of utility (immediate vs. future promise) and marketing materials are crucial here.

**NFTs (Non-Fungible Tokens) (potentially):** While many NFTs are purely collectibles, if they are fractionalized, or if their sale is packaged as an investment in a collective asset with an expectation of profit generated by a third party's efforts (e.g., an NFT art fund), they could be classified as securities.

**Stablecoins (less likely, but possible):** Purely fiat-backed stablecoins used for payments are generally not seen as securities. However, if a stablecoin offering includes features like interest accrual or yield generation based on active management of underlying assets by the issuer, it could potentially cross into security territory, especially if marketed as an investment product.

**Payment Tokens (e.g., Bitcoin, Ethereum):** Generally, widely distributed and decentralized cryptocurrencies like Bitcoin and Ethereum are unlikely to be classified as securities by SUGEVAL, as they typically do not involve a "common enterprise" or profits derived from a specific issuer's managerial efforts in the same way an ICO token does. The Central Bank of Costa Rica (BCCR) has clarified they are not legal tender.

Issuers must register the offering and the tokens themselves with SUGEVAL.

This requires submitting a detailed prospectus, financial statements, legal opinions, and disclosing all material information about the issuer, the project, and the tokens.

Compliance involves significant costs, time, and ongoing reporting obligations.

**Private Placement:** The most common exemption for startups or smaller offerings. Offers made to a limited number of qualified investors (e.g., institutional investors, sophisticated individuals) or under specific conditions that do not constitute a "public offering" might be exempt from full registration. The exact criteria are defined in Law 7732 and subsequent regulations, often involving restrictions on advertising and the number of offerees/purchasers.

**Other specific exemptions:** Law 7732 also outlines other limited exemptions, such as offers to specific types of financial institutions or small-scale offerings below a certain monetary threshold (though these are often strictly defined).

**Registered Securities:** Secondary trading of registered securities must occur through authorized stock exchanges (e.g., Bolsa Nacional de Valores - BNV) or licensed brokers regulated by SUGEVAL.

**Unregistered/Exempt Securities:** Tokens initially offered under an exemption (e.g., private placement) are subject to transfer restrictions. They typically cannot be freely traded in the public market for a certain period, and subsequent sales may only be permissible to other qualified investors or through specific channels that maintain the private placement nature.

**Unlicensed Platforms:** Any platform facilitating the secondary trading of securities without proper authorization from SUGEVAL would be operating illegally.

Cryptocurrencies are not legal tender in Costa Rica.

Platforms offering crypto investments are not regulated by SUGEVAL or SUGEF (the banking regulator) unless they fall under existing financial laws (e.g., if they are structured as investment funds or security offerings).

Investors are exposed to high risks (volatility, fraud, lack of investor protection) when dealing with unregulated crypto entities.

The nascent nature of the crypto market in CR.

Many projects might choose to structure themselves to fall outside the current securities framework or operate from offshore jurisdictions.

**Ley Reguladora del Mercado de Valores (Law 7732):** The primary legislation governing securities in Costa Rica.

*Official link (usually through the Legislative Assembly's repository):*

Search for "Ley Reguladora del Mercado de Valores, Ley 7732" on the Costa Rican Legislative Assembly's website or official legal databases.

A common public repository for CR laws is `pgrweb.pgr.go.cr/scij/Busqueda/Normativa/Normas/nrm_texto_completo.aspx?param1=NRTC&nValor1=1&nValor2=28243&nValor3=33475&strTipM=TC` (Note: This specific URL may change, always verify with official sources).

**Superintendencia General de Valores (SUGEVAL) - Official Website:** Provides information on registered entities, regulations, and investor warnings.

Look for "Alertas al Inversionista" or "Comunicados de Prensa" for warnings related to unregulated investments.

**Banco Central de Costa Rica (BCCR) - Official Website:** Has issued statements regarding the status of cryptocurrencies as legal tender.

As of July 2025, the Costa Rican Legislative Assembly approved debate on a specific bill regulating 'criptoactivos' and VASPs, and by 2026 the country is one of the last without mandatory crypto licensing, but searches for 'criptoactivos' or 'monedas virtuales' remain useful for tracking evolving AML and regulatory developments under SUGEF and ICD oversight.

**Proyecto de Ley para Regular las Actividades de Finanzas Descentralizadas (Fintech Bill 23.033):** While not yet law, it represents the ongoing legislative effort.

*Official link through the Legislative Assembly's website:* Search for "Expediente 23033" on `https://www.asamblea.go.cr/`