Download: Guide to Costa Rica New VASP Regime Update

Does Costa Rica have a crypto license?

Costa Rica regulates crypto businesses, but license is not the correct term. Costa Rica does not issue a VASP operating license, and Ley 10961 does not create one. What it creates is a mandatory registration requirement: virtual asset service providers now have to sign up with SUGEF, Costa Rica’s financial supervisor, for AML/CFT oversight. Registration confirms a provider is on SUGEF’s radar, not that its business model has been approved.

What is Ley 10961 and when does it take effect?

Ley 10961 is the law that inserted Article 15 quater into Ley 7786, Costa Rica’s anti-money-laundering statute, bringing virtual asset service providers under SUGEF supervision for the first time. It passed the Legislative Assembly on 25 May 2026 and was published on 19 June 2026, and it enters into force roughly three months after publication, around 19 September 2026.

Who has to register with SUGEF as a VASP?

Any person or company that exchanges, transfers, custodies, or issues virtual assets as a business, for themselves or on behalf of a third party, falls within scope. That covers exchanges, custodians, wallet providers, and token issuers, and the “for themselves” wording reaches further than most founders expect. LegalBison’s briefing sets out the full picture of what is in scope and what is likely to sit outside it.

What happens if a VASP doesn’t register?

Article 81 sets fines for the most serious breaches, but the sharper consequence is the commercial isolation rule: every bank and registered financial entity in Costa Rica is barred from doing business with an unregistered VASP. In practice, an unregistered provider gets locked out of the banking system it needs to operate at all.

Does a Costa Rican company have to register if all its clients are abroad?

This is the least settled question in the law, and the honest answer is that the statute does not say either way. LegalBison’s briefing walks through the two-step test regulators are likely to apply, with a worked example of where the export-only argument holds up and where it doesn’t.

What should a crypto business do to prepare before September 2026?

Start with the classification question: confirm whether the business model falls within one of the four VASP activities, then build the AML/CFT documentation SUGEF will expect from day one. LegalBison’s briefing includes a one-page compliance checklist and the full filing pack most applicants will need to assemble.