Key Takeaways

• Costa Rica has introduced a regulatory framework for Virtual Asset Service Providers (VASPs).
• Businesses that qualify as VASPs will be required to register with the General Superintendency of Financial Entities (SUGEF).
• Registration does not constitute an operating license, but it is a mandatory compliance requirement for those within the scope of the law.
• Companies interacting with crypto-related businesses should strengthen their due diligence procedures.
• Businesses should verify that counterparties required to register with SUGEF have done so before entering into or maintaining commercial relationships.

Costa Rica has taken a decisive step toward regulating the virtual asset ecosystem. With the publication of Legislative Decree No. 10961, introducing Article 15 quater to Law No. 7786, Virtual Asset Service Providers (VASPs) are now formally incorporated into the country’s anti-money laundering (AML), counter-terrorist financing (CFT), and counter-proliferation financing (CPF) framework.

While the reform has been widely described as “crypto regulation,” its true purpose is more specific: establishing a compliance and supervisory framework for businesses operating with virtual assets, in line with international standards promoted by the Financial Action Task Force (FATF).

For companies operating in Costa Rica—or doing business with Costa Rican counterparties—this is a development that deserves immediate attention.

More Than a Crypto Law

Contrary to what many headlines suggest, the new legislation does not recognize cryptocurrencies as legal tender, nor does it create a licensing regime for crypto businesses. Instead, it introduces a regulatory framework focused on transparency, risk management, and the prevention of money laundering and terrorist financing.

Under the new law, businesses that qualify as Virtual Asset Service Providers—including those engaged in the exchange, transfer, custody, administration, or financial services related to virtual assets—will be subject to a series of AML compliance obligations and will be required to register with the General Superintendency of Financial Entities (SUGEF).

Importantly, the law expressly clarifies that this registration does not constitute an authorization or license to operate. Rather, it allows SUGEF to supervise compliance with AML obligations.

Why This Matters Beyond the Crypto Industry

One of the most significant aspects of the reform is that its practical implications extend well beyond cryptocurrency exchanges.

Businesses that accept cryptocurrency as payment, invest in digital assets, facilitate crypto transactions, provide blockchain-based financial services, or maintain commercial relationships with crypto service providers should carefully assess whether the new framework affects their operations.

Perhaps more importantly, companies should evaluate whether the businesses they transact with are themselves subject to the new registration requirements.

This represents a significant shift in corporate risk management. Just as companies routinely verify the legal standing, tax compliance, or beneficial ownership of their business partners, organizations engaging with virtual asset service providers should now incorporate regulatory compliance into their onboarding and due diligence processes.

A New Standard of Due Diligence

The reform introduces comprehensive compliance obligations for VASPs, including:

• Customer identification and Know Your Customer (KYC) procedures;
• Beneficial ownership verification;
• Risk assessments and ongoing monitoring;
• Recordkeeping requirements;
• Controls relating to politically exposed persons (PEPs);
• Monitoring of virtual asset transfers;
• Reporting of suspicious transactions to the Financial Intelligence Unit (UIF); and
• Internal compliance programs designed to mitigate AML and CFT risks.

These measures reflect Costa Rica’s intention to align its regulatory framework with internationally recognized AML standards while strengthening the integrity of its financial system.

Registration with SUGEF Is More Than a Formality

Although registration is not an operating license, it carries significant practical consequences.

The new legislation expressly provides that entities subject to Law No. 7786 may not maintain commercial relationships with Virtual Asset Service Providers that are required to register with SUGEF but have failed to do so.

In practical terms, registration is likely to become a key prerequisite for maintaining banking relationships, accessing regulated financial services, and establishing commercial credibility within the Costa Rican market.

Businesses should therefore begin asking questions that may not have formed part of their compliance procedures in the past:

• Does my counterparty qualify as a Virtual Asset Service Provider?
• Is registration with SUGEF required?
• Has the registration been completed?
• Have we documented our due diligence?

These questions are rapidly becoming an essential component of responsible corporate governance.

A Window to Prepare

The law establishes that it will enter into force three months after its publication, while the National Council for the Supervision of the Financial System (CONASSIF) has an additional three months thereafter to issue the implementing regulations that will define many of the operational requirements.

This transition period offers businesses a valuable opportunity to review their operations, determine whether they fall within the scope of the new framework, and prepare for the compliance obligations that will follow.

Waiting until the regulations are issued may unnecessarily compress the time available to implement new compliance procedures, conduct internal assessments, and review relationships with existing counterparties.

Blue Zone Legal Insight

“Costa Rica’s new framework reflects a global trend toward greater transparency and accountability in the digital asset ecosystem. The objective is not to discourage innovation, but to ensure that businesses operating with virtual assets do so within internationally recognized compliance standards. Companies that prepare early will be better positioned to build trusted relationships with banks, investors, regulators, and commercial partners.”

— Eddy Pérez
Of Counsel | Fintech, Digital Assets & Financial Regulation
Blue Zone Legal

Is Your Business Affected?

Your organization should consider reviewing its compliance strategy if it:

• Accepts cryptocurrency as payment for goods or services.
• Invests in digital assets.
• Provides services involving the exchange, transfer, custody, or administration of virtual assets.
• Facilitates crypto-related transactions for clients.
• Maintains commercial relationships with crypto exchanges or other Virtual Asset Service Providers.
• Operates within the fintech, blockchain, Web3, or digital asset ecosystem.
• Receives funds from counterparties operating in the crypto industry.

If you answered “yes” to any of the above, now is the time to assess whether your business falls within the scope of the new framework and whether your current compliance procedures are sufficient.

Official Resources

📄 Official Legislative Decree No. 10961 (Spanish)

For readers wishing to review the complete legislative text, the official publication introducing Article 15 quater to Law No. 7786 is available below.

→ View Official Legislative Decree No. 10961 (Spanish)

📘 English Guide to Costa Rica’s New VASP Framework

Our team has prepared a practical English guide explaining the new legal framework and its implications for foreign investors, fintech companies, digital asset businesses, and international operators.

To receive your complimentary copy:

📧 Email us at: info@bluezonelegal.com

and subscribe to the Blue Zone Legal Newsletter to receive:

• The English Guide to Costa Rica’s New VASP Framework;
• Legal alerts affecting foreign investors and international businesses;
• Regulatory updates and practical compliance insights;
• Invitations to webinars, events, and exclusive publications from Blue Zone Legal.

We look forward to welcoming you to our community.

Our Recommendation

Costa Rica’s new VASP framework marks a significant milestone in the country’s evolving approach to digital assets.

While the implementing regulations are still pending, businesses should not wait to assess their exposure.

Companies should refrain from entering into or maintaining commercial relationships with Virtual Asset Service Providers that are required to register with SUGEF unless they have verified compliance with the applicable legal requirements.

Likewise, organizations interacting with crypto-related counterparties should implement enhanced due diligence procedures, document their compliance reviews, and ensure that appropriate risk management policies are in place.

In today’s regulatory environment, compliance is no longer merely a legal obligation—it is an essential component of sound corporate governance, responsible risk management, and sustainable business growth.

About Blue Zone Legal

Blue Zone Legal advises local and international businesses on corporate, financial, regulatory, real estate, immigration, and compliance matters in Costa Rica.

As the country’s regulatory landscape continues to evolve, our multidisciplinary team assists clients in navigating emerging legal frameworks affecting fintech, digital assets, foreign investment, and cross-border business operations.

Whether your organization operates within the virtual asset ecosystem or simply conducts business with crypto-related counterparties, we are ready to help you assess your obligations, mitigate regulatory risks, and prepare for the future with confidence.

© 2026 Blue Zone Legal®. All rights reserved.

The information contained in this blog is provided for informational purposes only and does not constitute legal advice, nor does it create an attorney-client relationship. Readers should not act upon this information without seeking appropriate professional counsel.

Quotations of this content may be used provided that proper credit is given to Blue Zone Legal and a direct link to the original publication is included.