DeFi protocol frontend in Costa Rica

Superintendencia General de Entidades Financieras (SUGEF): The General Superintendency of Financial Institutions. SUGEF is responsible for supervising financial entities and enforcing AML/CFT regulations for many obligated subjects.

Virtual asset service providers in Costa Rica are not yet explicitly classified as 'obligated subjects' under Law 7786; the proposed amendment (Expediente 22.837) that would explicitly include them remains pending and has faced procedural setbacks.

Registration: With SUGEF as an "obligated subject" (if the activity falls under their scope) or potentially with the Financial Intelligence Unit (Unidad de Inteligencia Financiera - UIF) depending on the exact classification.

Full AML/KYC Program: Implementation of robust Know Your Customer (KYC), Customer Due Diligence (CDD), Enhanced Due Diligence (EDD), and Transaction Monitoring policies and procedures.

AML Officer: Appointment of a designated AML Compliance Officer.

Reporting: Obligation to report suspicious transactions (SARs/STRs) to the UIF.

Conduct a comprehensive money laundering risk assessment.

Status: If the custody provider holds virtual assets on behalf of clients and/or provides services that enable the transfer or exchange of these assets, they would likely also fall under the "obligated subject" category, especially if they control the private keys for clients.

Requirements: Similar to exchanges – full AML/KYC program, AML officer, reporting, record-keeping, risk assessment.

If processing fiat currency payments (even if crypto-related): They would likely fall under existing payment service provider regulations and certainly under AML/CFT laws as obligated subjects.

If purely crypto-to-crypto transactions (e.g., facilitating payments in crypto without fiat conversion): This remains a grey area in many jurisdictions without specific VASP licensing. However, the global trend is to bring such services under AML/CFT scrutiny if they involve value transfer and could be used for illicit purposes. SUGEF's interpretation would be key.

Local Presence: Generally, any company operating and generating income in Costa Rica needs to be incorporated locally and have a local registered office and local representation (e.g., a local legal representative). This is standard corporate law, not crypto-specific. For AML purposes, having a local AML officer is also typical.

Law No. 7786, "Law on Narcotics, Psychotropic Substances, Drugs of Unauthorized Use, Related Activities, Money Laundering and Financing of Terrorism" (Ley sobre Estupefacientes, Sustancias Psicotrópicas, Drogas de Uso No Autorizado, Actividades Conexas, Legitimación de Capitales y Financiamiento al Terrorismo), as amended. This is Costa Rica's foundational AML/CFT law.

Law No. 10.363, "Law on the Regulation of Virtual Asset Service Providers" (Ley de Regulación de Proveedores de Servicios de Activos Virtuales). This law established the legal framework for VASPs, bringing them under Law 7786's AML/CFT scope. However, the operational AML/CFT obligations and registration mandate became enforceable only after SUGEF's implementing regulation (SUGEF 2-2024) came into effect on November 16, 2024.

Regulations issued by SUGEF: While Law 10.363 sets the legal framework, the Superintendent General of Financial Entities (SUGEF) is responsible for developing specific regulations. The key implementing regulation, SUGEF 2-2024 ("Reglamento para la Inscripción y Supervisión de los Proveedores de Servicios de Activos Virtuales"), was issued and became effective on November 16, 2024. It details registration, CDD, transaction monitoring, STR, and record-keeping requirements for VASPs.

Identification and Verification of Customer Identity:

Physical residential address

Identification number (e.g., national ID card, passport number)

Contact information (e.g., phone number, email address)

Source of funds/wealth (as part of Enhanced Due Diligence (EDD) for high-risk clients, which may include scrutiny of large transactions as a contributing factor to the risk assessment).

Verification through reliable, independent source documents, data, or information (e.g., government-issued ID, utility bills).

For Legal Entities:

Legal name, legal nature or type of entity (naturaleza jurídica), and proof of incorporation/registration (copia certificada de la personería jurídica).

Registered office address (domicilio o dirección física de la sede social).

Corporate identification number (número de identificación), which in Costa Rica commonly serves as the tax identification number (cédula jurídica / Número de Identificación Tributaria).

Names of directors, partners, and senior management.

Identification of Beneficial Owners (BOs): VASPs must identify and verify the identity of all natural persons who ultimately own or control the legal entity (typically those holding 25% or more of shares or voting rights, or otherwise exercising control).

Nature of business and purpose of the business relationship.

Purpose and Intended Nature of the Business Relationship: Understanding why the customer wants to use the VASP's services.

Ongoing Due Diligence:

Regularly monitoring transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile.

Keeping customer information, documents, and data up-to-date.

Periodically reviewing the risk categorization of customers.

Risk-Based Approach (RBA): VASPs must apply CDD measures on a risk-sensitive basis. This means applying enhanced due diligence (EDD) for higher-risk customers, transactions, or business relationships (e.g., Politically Exposed Persons (PEPs), cross-border correspondent relationships, complex/unusual transactions). Simplified due diligence (SDD) may be applied in specific lower-risk scenarios.

Trigger: Any transaction, attempted transaction, or activity where the VASP suspects or has reasonable grounds to suspect that the funds or assets are proceeds of criminal activity (including money laundering) or are related to terrorist financing.

Reporting Body: The report must be submitted to the Unidad de Inteligencia Financiera del Instituto Costarricense sobre Drogas (UIAD), which is Costa Rica's FIU.

No Tipping Off: VASPs and their employees are prohibited from disclosing to the customer or any third party that an STR has been, or will be, filed.

September 2021: SUGEF Circular SGF-0036-2021 reiterates that virtual assets are not legal tender and are not regulated by SUGEF unless they fall under existing regulated activities.

January 2022: SUGEF continues to issue warnings regarding the risks of virtual assets.

Outcome: SUGEF maintains that virtual assets are not regulated financial products or services under its supervision. Financial institutions are advised to exercise extreme caution when dealing with virtual assets and to ensure compliance with existing AML/CFT regulations if handling any related transactions. This means that if a bank facilitates transactions involving crypto, it must still comply with its existing AML obligations.

November 2021: BCCR reiterates that cryptocurrencies are not legal tender in Costa Rica and highlights risks associated with their use.

Costa Rica's regulatory stance on cryptocurrencies has evolved from mere cautionary statements to active legislative development, with Bill No. 22.837 on virtual assets advancing in the legislative assembly.

Example (illustrative, not specific to last 3 years due to public data scarcity): News reports over the years have documented OIJ investigations into cybercrime and fraud where victims sent crypto to scammers, or where crypto was used to move illicit funds.