Costa Rica Crypto Compliance Checker
Check Your Business Compliance Status
Use this tool to evaluate how well your crypto business complies with current Costa Rican regulations and upcoming requirements.
Trying to launch a crypto project and wondering if Costa Rica is a safe place to set up shop? The short answer: you can operate, but the rules are fuzzy. The Central Bank says Bitcoin isn’t legal tender, yet private crypto trades are allowed. Meanwhile, a new bill is pushing virtual‑asset service providers (VASPs) into an AML‑CFT framework without granting them a formal licence. Below is a practical guide that cuts through the jargon, shows what you must do today, and flags the risks that could bite you tomorrow.
Quick Takeaways
- Cryptocurrencies are not legal tender in Costa Rica, but private transactions are permitted.
- Bill 22.837 (July2025) will require VASPs to register with SUGEF and follow AML‑CFT rules.
- Setting up a company is fast: no share‑capital minimum, no local director requirement.
- Compliance hinges on KYC, transaction‑record keeping, and risk assessments aligned with FATF standards.
- The gray area remains: registration does not equal government approval, so legal certainty is limited.
Current Legal Landscape
Cryptocurrency is a digital representation of value that can be transferred electronically but is not recognized as legal tender in most jurisdictions occupies a murky spot in Costa Rica. In October2017 the Central Bank of Costa Rica (Banco Central de Costa Rica, BCCR) clarified that Bitcoin and similar assets are not backed by law and do not count as official currency. That statement means the bank will not regulate crypto the way it regulates the colón, but it also does not ban private use.
Because there is no dedicated crypto law, businesses fall back on existing financial‑services regulations and the country’s anti‑money‑laundering (AML) framework. The Superintendencia General de Entidades Financieras (SUGEF) is the financial regulator that oversees banks, securities firms, and now, under the upcoming bill, virtual‑asset service providers is the authority that would supervise any crypto‑related activity.
Bill 22.837: Bringing VASPs Under AML‑CFT Oversight
On 2July2025 the Legislative Assembly debated Bill 22.837 a reform to the law on illicit substances that adds Article15quáter, defining virtual assets and extending AML‑CFT obligations to VASPs. The bill’s key definitions are:
- Activo Virtual: any digital representation of value that can be traded or transferred online but is not legal tender.
- Proveedor de Servicios de Activos Virtuales (VASP): individuals or entities that exchange virtual assets for legal tender, transfer virtual assets, provide custody, or issue/market virtual assets.
Under the proposal, every VASP must register with SUGEF. Registration is a compliance checkpoint, not a licence; the regulator will monitor using a risk‑based approach, focusing on client identification, record‑keeping, enhanced due diligence for politically exposed persons, and regular risk assessments.
How to Operate Legally Today
- Incorporate a Costa Rican legal entity
- File incorporation paperwork with the National Registry maintains the official list of companies and legal entities in Costa Rica.
- No minimum share capital is required for a crypto‑service company.
- Secure a legal address
Virtual offices are acceptable; you do not need a physical office or resident director.
- Open a corporate bank account
Choose a local bank that is comfortable with crypto‑related cash flow. Most banks will ask for a clear AML policy.
- Develop an AML‑CFT program
Align your policies with FATF Recommendations global standards for anti‑money‑laundering and counter‑terrorist financing. Include KYC procedures, transaction monitoring, and reporting mechanisms.
- Register with SUGEF (once Bill 22.837 is enacted)
Submit the registration form, attach your AML manual, and provide details on your technology stack and client onboarding flow.
- Maintain ongoing compliance
- Keep transaction logs for at least five years.
- Review risk assessments quarterly.
- Report suspicious activity to the Financial Intelligence Unit (UIF) promptly.
Why Crypto Projects Flock to Costa Rica
The country offers a rare blend of low‑cost licensing, political stability, and solid tech infrastructure. Here are the headline benefits:
- Tax incentives: No corporate income tax on foreign‑source profits for most crypto‑related activities.
- Simple incorporation: The process can be completed in under a week, and you can operate without a local director.
- Gaming license synergy: Existing gambling licences can be paired with VASP registration, making Costa Rica especially attractive for GameFi and crypto‑casino platforms.
- High‑speed internet: Nationwide fiber and 4G/5G coverage support demanding blockchain nodes and decentralized applications.
Risks and Uncertainties
Even with these perks, the gray‑area status carries real hazards:
- Lack of legal protection: If a dispute arises, courts have limited precedent for crypto‑specific cases.
- Regulatory change: Future governments could tighten licensing, impose capital requirements, or even ban certain services.
- Enforcement discretion: While registration with SUGEF is mandatory under the new bill, the regulator can still suspend operations if AML standards are not met.
Best practice is to build a compliance program that can scale up if the legal framework becomes stricter. Keep an eye on legislative updates and maintain a dialogue with local counsel.
Practical Checklist for Crypto Start‑ups
| Step | Current Requirement (Pre‑Bill) | Post‑Bill 22.837 Requirement |
|---|---|---|
| Company registration | Mandatory with National Registry | Same |
| Bank account | Mandatory; banks may request AML policy | Same, but banks will expect SUGEF registration proof |
| AML/CFT program | Strongly recommended | Legally required; must follow FATF standards |
| VASP registration | Not required (optional) | Compulsory for any entity offering exchange, custody, or issuance services |
| Ongoing reporting | Voluntary SARs to UIF | Mandatory SARs; periodic compliance audits |
Next Steps & Troubleshooting
If you’ve already incorporated and need to register as a VASP, start by drafting a detailed AML manual and gathering the documentation SUGEF requests (company bylaws, tech architecture diagram, KYC workflow). Common hiccups include:
- Bank reluctance: Provide a clear risk‑assessment report and evidence of FATF‑aligned policies.
- Missing client‑beneficiary data: Use reputable KYC providers that can verify both the end user and the ultimate beneficiary.
- Regulatory lag: Keep a copy of the bill’s text and monitor the official gazette for the final decree; until then, operate under the “registration is not authorization” clause.
In every case, engage a local law firm experienced in fintech and crypto. Their insight can turn a vague gray area into a workable compliance roadmap.
Frequently Asked Questions
Is cryptocurrency legal in Costa Rica?
Cryptocurrencies are not illegal, but they are not recognized as legal tender. Private transactions are allowed, and businesses can operate under general financial‑services rules.
Do I need a licence to run a crypto exchange?
A specific crypto licence does not exist yet. However, once Bill 22.837 is in force, you must register as a VASP with SUGEF and meet AML‑CFT standards. Registration is not a licence but it is required to operate legally.
What AML measures are mandatory?
You must identify clients and ultimate beneficiaries, keep transaction records for five years, perform enhanced due diligence on politically exposed persons, and file suspicious activity reports to the UIF. All measures must align with FATF Recommendations.
Can I set up a crypto company without a local director?
Yes. Costa Rica allows foreign‑owned entities with a virtual office. No resident director or minimum share capital is required, which keeps startup costs low.
What are the biggest risks of staying in the gray area?
The main risks are regulatory uncertainty, limited legal precedent in courts, and the possibility of future stricter rules that could require additional licences or higher capital.
