Costa Rica VASP Registration with SUGEF: What Law 10961 Requires and What Is at Stake

Costa Rica now has rules for virtual asset businesses — and they come with a deadline. Law No. 10961, published in the Official Gazette on 19 June 2026, brought Virtual Asset Service Providers (VASPs) into the AML/CFT regime of Law 7786 and requires them, for the first time, to register with SUGEF, the General Superintendency of Financial Entities. The law enters into force on 19 September 2026. Fewer than three weeks remain.

If your company exchanges, transfers, holds in custody or markets virtual assets in or into Costa Rica — or if you are an international platform with local customers — this article explains exactly what was enacted, who is covered, the penalties, and why the decisions that matter are taken before the registration window opens.

This article is backed by Corporación GC's ongoing engagements advising local and international virtual asset businesses under the new framework. To assess whether your operation is covered or to prepare your registration, visit our fintech and crypto regulatory practice or get in touch.

The essentials, in one minute

• Law 10961 added Article 15 quater to Law 7786: VASPs are now obliged subjects under the AML regime.
• They must register with SUGEF. Registration "does not represent an authorisation to operate": the Costa Rican model is a registration with supervision, without a licence.
• Without registration, no bank or supervised entity may maintain commercial relationships with the company. The registration works as the key to the financial system.
• The law applies from 19 September 2026, but the CONASSIF implementing regulation is still pending: there is no form, platform or registration window yet.
• Fines reach 50% of the transaction amount and one hundred base salaries, and final sanctions are published.
• The project is won in the preparation: the scope diagnostic and the adequacy of the structure can and should be executed today, so the file is submitted the day the window opens.

What exactly Costa Rica enacted

Law 10961 — the product of legislative file 25.340 — adds Article 15 quater to Law 7786 and amends Articles 16, 16 bis, 25, 33, 33 bis, 81, 86 and 123. The chosen model is a mandatory registration with SUGEF, coupled with risk-based supervision of anti-money laundering, counter-terrorist financing and counter-proliferation controls.

It is worth fixing the exact nature of the figure from the outset, because the market is full of offers that describe it inaccurately. Article 15 quater says it in plain words:

"Registration with the Superintendency does not represent an authorisation to operate."

The law leaves prudential regulation, market conduct and investor protection outside its scope. Any provider offering you a Costa Rican "crypto license" is selling a legal figure that current legislation simply does not contemplate. The correct word — in the proposal, in the contract and before the supervisor — is registration.

The registral nature of the filing makes it anything but a formality. The same article provides:

"The entities described in Article 14, as well as the subjects registered under Articles 15, 15 bis, 15 ter and 15 quater, may not maintain commercial relationships where those carrying out the activities of this article are not duly registered with the General Superintendency of Financial Entities."

And the amended Article 81 sanctions the obliged subject that maintains commercial relationships with an unregistered VASP. Read it in operational terms: registration is the condition of access to the Costa Rican banking system. An unregistered exchange is, quite literally, left without an account.

Who must register

Article 15 quater defines a VASP as any natural or legal person who, as a business, performs for itself or on behalf of third parties one or more of the following: the exchange between virtual assets and legal tender, or between forms of virtual assets; transfers of virtual assets; their custody, deposit, administration or control by any means; and financial services related to the issuance, marketing, offer or sale of virtual assets. In practice, that covers exchanges, crypto exchange houses and OTC desks, crypto payment processors, custodians and managed wallets, and token issuance platforms.

Two points separate a serious scope opinion from a hasty reading. The "as a business" condition excludes personal use and, as a rule, leaves out the merchant that simply accepts crypto as payment for its own goods or services — though the line becomes thin when that merchant habitually converts, holds or moves customers' assets. And the words "for itself or for third parties" deserve care: a company that habitually buys and sells virtual assets with its own funds, as its line of business, sits inside the zone the statute covers even before it has a single customer.

The connecting factor is territorial. The law instructs SUGEF to ensure that persons habitually carrying out these activities without being registered do not operate in Costa Rican territory, whatever their legal domicile. A foreign structure serving the local market is covered. For groups with several entities — a Costa Rican company and a Panamanian one, for instance, a frequent arrangement in this sector — the first serious exercise is mapping which activity is performed under which entity, because that map determines who must register and what is described to SUGEF.

The dates that govern the project

The decisive fact today is the third row: the CONASSIF regulation has not been published, and no public consultation draft is on record. We verified this on 1 September 2026 against SUGEF's register of regulations under consultation, which lists only proposals unrelated to virtual assets. That regulation will define thresholds, categories of registered subject, the filing platform and the documentary checklist. Until it exists there is no form and no registration window — which is why no firm can honestly guarantee a completed registration before September. Whoever promises one is quoting a procedure that does not yet exist.

What can be promised — and it is where the difference will be made between operating smoothly and queuing behind the market — is reaching 19 September with a complete file, ready for submission the day SUGEF opens the process.

The obligations under Article 15 quater

Items (a) through (j) impose the full FATF toolkit: due diligence on customers and ultimate beneficial owners, reconstructible transaction records, controls over politically exposed persons, over new technologies, over virtual asset transfers and over high-risk jurisdictions, immediate suspicious-transaction reporting to the FIU of the Costa Rican Drug Institute, and strict confidentiality over those reports. The body of the article adds structural burdens: a documented institutional risk assessment, the FATF Travel Rule on every transfer, immediate freezing of designated persons' funds, keeping registration data permanently up to date, and contributing to the cost of supervision.

For a platform already operating to international standards, none of this is conceptually new. The real work lies in landing it in Costa Rican form: a compliance manual, risk matrix and procedures drafted against the local statute, in Spanish, defensible before SUGEF. That localisation is regulatory craftsmanship — and a translated template is exactly the kind of document the supervisor spots on first reading.

Penalties: up to 50% of the transaction — published by name

Fines are payable within eight business days, with a 3% monthly surcharge, and final sanctions are published — adding a reputational cost in a business where correspondent banks and commercial partners screen sanction lists.

What you will be sold that does not exist

The international market is already quoting the "Costa Rican process", and several of the figures in those offers have no basis in any national statute. The "crypto license" is the first. The "legal manager" is another: Costa Rican law knows the legal representative, the resident agent and the compliance officer, each with its own legal basis and its own triggers, and the statute makes the compliance-officer requirement expressly risk-based, to be analysed case by case. When you compare proposals, ask that every charged figure have a name and a basis in a Costa Rican statute, and that every line item distinguish what is mandatory by law, what is regulation-dependent and what is optional. A quote that blends those columns is either overcharging you or promising what it cannot deliver.

The same goes for costs: the supervision levy for VASPs depends on the CONASSIF regulation, and no regulation has set it. Be wary of closed figures for fees that do not yet exist.

Why the filing is won before the window opens

Our practice in these projects — with local and international platforms — shows that the real timeline of a registration is decided by details that are invisible from abroad: how the application is signed and filed, the company's banking relationship, and the coherence between what the company will describe to SUGEF and what the other Costa Rican authorities have on record about it. Each of those fronts has a solution, and each becomes a serious blocker when discovered with the clock running. More than one structure that looks impeccable on corporate paper reaches our desk with one or several of these fronts unresolved.

That is why a serious project starts with a scope and feasibility diagnostic: it determines whether your model is covered by Article 15 quater, audits the corporate, tax and banking structure against what the supervisor will see, and delivers a roadmap separating what can be executed immediately from what is calendared against the regulation. Everything that depends on the statute already published — the adequacy of the structure and the compliance programme — can be executed today; the filing itself is triggered the day CONASSIF publishes the regulation and SUGEF opens the platform.

At a glance

Prepare your registration with counsel that has done the homework

Corporación GC advises local and international virtual asset businesses across the full cycle: scope opinion, adequacy of the structure, compliance programme and submission of the file the day the window opens. Our founding partner is a former justice of the First Chamber of Costa Rica's Supreme Court, and the team litigates daily before the country's financial supervisors and administrative courts. We also act as local regulatory counsel for international law firms and compliance advisors who bring clients to Costa Rica.

Does your company provide virtual asset services in or into Costa Rica? Contact us or visit our fintech and crypto regulatory practice. A scope assessment today is worth more than an urgent discovery on 19 September.

This article describes the framework in force as of 1 September 2026. The CONASSIF implementing regulation is pending; the operational requirements of the filing may change once it is published. We will update this guide the day the regulation is issued.