Important Changes to Costa Rica VASP Regime

Costa Rica passed its first crypto-specific law in May 2026, and the vote was unanimous. Ley 10961, published in Alcance N°78 to La Gaceta N°113 (1),  creates an anti-money laundering registration regime for virtual asset service providers. It is not a license, and it does not make crypto legal tender. It takes effect on or around September 19, 2026.

For crypto projects registered in Costa Rica (or planning to) for crypto activities, this implies the necessity to appoint a Compliance Officer.

I Need VASP Compliance Advice

Who it affects

The law casts a wide net. If your business, as a business, does any of the following, you are in scope:

• Exchanges crypto for cash, or crypto for other crypto;
• Moves crypto on behalf of customers;
• Holds, custodies, or controls crypto for someone else;
• Helps issue, market, or sell crypto assets.

That covers exchanges, custodians, payment processors, and OTC desks. 

Even businesses trading on their own account may not be fully in the clear. The law’s wording (“for themselves”) goes further than the usual FATF language, and Costa Rica’s financial regulator, CONASSIF, still has to provide further clarification.

It’s still a registration, not a license

This is what doesn’t change, in comparison to before the law passed.

Registering with SUGEF, Costa Rica’s banking regulator, does not mean anything about your business model. There is no capital requirement and no fit-and-proper review beyond background checks on owners and beneficial owners.

Once the law is in force, banks and other regulated financial entities will be prohibited from doing business with unregistered VASPs. 

So registration is not legally mandatory in the sense of a license, it is mandatory in the sense that you cannot function without it. No registration means no local bank account, no payment rails, no way to operate.

This is a positive for projects who struggled with banking in the past, as this gives additional trustworthiness to financial institutions.

Requirements to foresee

The law adds a full set of AML obligations. In practical terms, that means:

• Customer and beneficial owner checks (KYC);
• A named compliance officer, or an approved alternative structure for smaller operations;
• Suspicious transaction reporting to Costa Rica’s financial intelligence unit;
• Transaction records detailed enough to reconstruct any transfer;
• Sanctions list screening, with a 24-hour freeze requirement for flagged accounts.

None of this needs to be built from scratch under pressure. 

CONASSIF has up to three months after the law’s effective date to publish the detailed rules, which gives affected businesses a real window to prepare rather than scramble.

This is where the September 19th of 2026 deadline comes from.

Sanctions for non-compliant VASPs

If you continue to run a VASP without registering properly once the law has passed, you incur the risk of financial and administrative sanctions.

Fines run from 2 to 100 base salaries for registration and compliance failures, and separately, 5% to 50% of the transaction amount for failures to report large transfers. 

The fines matter, but the bigger risk is losing your banking relationships entirely. In a business built on moving money, that is the failure mode that actually shuts you down.

Regarding cross-border structures

Some Costa Rican entities serve clients entirely outside the country.

The law does not clearly say whether that setup falls inside or outside the regime, and that question will likely only be settled once CONASSIF’s implementing rules land. If this describes your structure, it is worth a closer look now rather than an assumption either way.

LegalBison’s local office in Costa Rica is directly monitoring the situation, and will provide more information as the topic progresses.

Where LegalBison assists crypto projects

The rules are still being finalized, and Costa Rica will pursue in this direction. The Ley 10961 is the country’s guarantee to not fall into FATF’s Grey Zone, which would have disastrous consequences for the country.

Now is the best time to prepare. LegalBison closely monitors changes and provides live legal assistance to its clients.

Additionally, we help you appoint a compliance officer in line with regulatory requirements.

Existing Costa Rica projects are then invited to get in touch with us to ensure you are compliant with the updated regulations. For entrepreneurs and projects considering registering in Costa for their crypto ventures: rest assured that LegalBison’s compliance services will, moving forward, fully include compliance with the new framework.

Consult Your Crypto License

Reference: 

(1) https://www.imprentanacional.go.cr/pub/2026/06/19/ALCA78_19_06_2026.pdf