On-shore VASP in Costa Rica

Superintendencia General de Entidades Financieras (SUGEF): The General Superintendency of Financial Institutions. SUGEF is responsible for supervising financial entities and enforcing AML/CFT regulations for many obligated subjects.

Virtual asset service providers in Costa Rica are not yet explicitly classified as 'obligated subjects' under Law 7786; the proposed amendment (Expediente 22.837) that would explicitly include them remains pending and has faced procedural setbacks.

Registration: With SUGEF as an "obligated subject" (if the activity falls under their scope) or potentially with the Financial Intelligence Unit (Unidad de Inteligencia Financiera - UIF) depending on the exact classification.

Full AML/KYC Program: Implementation of robust Know Your Customer (KYC), Customer Due Diligence (CDD), Enhanced Due Diligence (EDD), and Transaction Monitoring policies and procedures.

AML Officer: Appointment of a designated AML Compliance Officer.

Reporting: Obligation to report suspicious transactions (SARs/STRs) to the UIF.

Maintenance of transaction and client records for a specified period is now predominantly governed by electronic invoicing systems and specific monthly reporting obligations to the General Directorate of Taxation, fundamentally altering the methods and specific requirements for record-keeping in Costa Rica.

Conduct a comprehensive money laundering risk assessment.

Capital Requirements: There are no specific capital requirements for crypto-specific licenses as such licenses don't exist. However:

If an entity's operations are interpreted as falling under the scope of existing financial institution activities (e.g., holding client funds, providing certain payment services in fiat), then the capital requirements applicable to traditional financial institutions or payment service providers regulated by SUGEF would apply. These can vary significantly depending on the type of financial service.

For entities purely operating as "obligated subjects" under AML without being a licensed financial institution, there isn't a direct prescribed minimum capital, but demonstrating financial soundness and having adequate resources to implement AML controls is implicitly expected.

Local Presence: Generally, any company operating and generating income in Costa Rica needs to be incorporated locally and have a local registered office and local representation (e.g., a local legal representative). This is standard corporate law, not crypto-specific. For AML purposes, having a local AML officer is also typical.

Law No. 7786, "Law on Narcotics, Psychotropic Substances, Drugs of Unauthorized Use, Related Activities, Money Laundering and Financing of Terrorism" (Ley sobre Estupefacientes, Sustancias Psicotrópicas, Drogas de Uso No Autorizado, Actividades Conexas, Legitimación de Capitales y Financiamiento al Terrorismo), as amended. This is Costa Rica's foundational AML/CFT law.

Law No. 10.363, "Law on the Regulation of Virtual Asset Service Providers" (Ley de Regulación de Proveedores de Servicios de Activos Virtuales). This law established the legal framework for VASPs, bringing them under Law 7786's AML/CFT scope. However, the operational AML/CFT obligations and registration mandate became enforceable only after SUGEF's implementing regulation (SUGEF 2-2024) came into effect on November 16, 2024.

Regulations issued by SUGEF: While Law 10.363 sets the legal framework, the Superintendent General of Financial Entities (SUGEF) is responsible for developing specific regulations. The key implementing regulation, SUGEF 2-2024 ("Reglamento para la Inscripción y Supervisión de los Proveedores de Servicios de Activos Virtuales"), was issued and became effective on November 16, 2024. It details registration, CDD, transaction monitoring, STR, and record-keeping requirements for VASPs.

Identification and Verification of Customer Identity:

Identification of Beneficial Owners (BOs): VASPs must identify and verify the identity of all natural persons who ultimately own or control the legal entity (typically those holding 25% or more of shares or voting rights, or otherwise exercising control).

Risk-Based Approach (RBA): VASPs must apply CDD measures on a risk-sensitive basis. This means applying enhanced due diligence (EDD) for higher-risk customers, transactions, or business relationships (e.g., Politically Exposed Persons (PEPs), cross-border correspondent relationships, complex/unusual transactions). Simplified due diligence (SDD) may be applied in specific lower-risk scenarios.

Trigger: Any transaction, attempted transaction, or activity where the VASP suspects or has reasonable grounds to suspect that the funds or assets are proceeds of criminal activity (including money laundering) or are related to terrorist financing.

Reporting Body: The report must be submitted to the Unidad de Inteligencia Financiera del Instituto Costarricense sobre Drogas (UIAD), which is Costa Rica's FIU.

SUGEF Circular 001-2022 "Reglamento para la Inscripción y Supervisión de los Proveedores de Servicios de Activos Virtuales" (Regulation for the Registration and Supervision of Virtual Asset Service Providers). This circular directly addresses the registration and AML/CFT obligations of VASPs, including requirements for information sharing consistent with the Travel Rule. It was published in La Gaceta, the official Costa Rican government gazette.

Collection of Information (Art. 24): VASPs must obtain and maintain information on the originator and beneficiary for all virtual asset transfers equal to or greater than USD $1,000 (or its equivalent in other currencies or virtual assets), regardless of whether the other party is another VASP or an unhosted wallet. For transfers below this amount, only basic information (e.g., name of the client) is typically required.

Transmission of Information (Art. 25): For virtual asset transfers equal to or greater than USD $1,000 (or its equivalent in other currencies or virtual assets) to another regulated VASP, the sending VASP must securely transmit the required originator and beneficiary information to the receiving VASP.

For transfers to or from unhosted wallets, the VASP is responsible for collecting and retaining the information from its own customer, but cannot transmit information to an unhosted wallet directly.

If cryptocurrencies are considered movable assets or intangible goods for tax purposes in Costa Rica, capital gains tax may apply, but the specific treatment and determination of taxable gains must be derived from detailed local frameworks that account for all sources of income (including salary, dividends, and crypto) as they are continuously refined by regulatory authorities.

Rate: The standard capital gains tax rate in Costa Rica is 15%. This applies to gains realized from the sale of shares, real estate, and other movable assets, provided it is not part of a habitual commercial activity.

Individuals: Progressive income tax rates apply, ranging from 0% to 25% for employment income or professional services. If deemed a business activity, the progressive rates for "rentas de actividades lucrativas" would apply.

Businesses: Corporate income tax rates typically range from 10% to 30%, depending on the size of the business's gross income.

General Principle: Costa Rica's Value Added Tax (VAT), known as Impuesto al Valor Agregado (IVA), applies to the supply of goods and services within the national territory. The standard rate is 13%.

Exchange fees charged by cryptocurrency exchanges operating in Costa Rica for converting fiat to crypto, crypto to fiat, or crypto to crypto are not subject to VAT under current Costa Rican tax interpretation.

Regulator Name: Superintendencia General de Entidades Financieras (SUGEF)

Outcome: SUGEF maintains that virtual assets are not regulated financial products or services under its supervision. Financial institutions are advised to exercise extreme caution when dealing with virtual assets and to ensure compliance with existing AML/CFT regulations if handling any related transactions. This means that if a bank facilitates transactions involving crypto, it must still comply with its existing AML obligations.