Virtual asset regulation and tokenization in Costa Rica

A business planning virtual asset services in Costa Rica should start by distinguishing preventive SUGEF registration from permission for its underlying business. The 2026 reform expressly brings VASPs into the anti-money-laundering framework, while securities issuance, deposit taking or another financial service may raise additional requirements.

The project should explain what it does for customers, where it operates and who controls assets. This establishes the relevant duties under Law 10961, the registration procedures that must be checked and the banking arrangements to prepare without assuming that registration guarantees market access.

What Law 10961 adds to the preventive framework

Law 10961, published on 19 June 2026, added Article 15 quater to Law 7786. Its final clause provides for commencement three months after publication. The reform introduces specific AML, counter-terrorist and proliferation-financing duties for virtual asset service providers, VASPs; it does not create a general prudential license.

The definition requires business activity and covers individuals or legal entities acting on own account or for others. It includes exchange, transfer, custody, administration or control, and financial services connected with issuance or offerings. The law does not recognize the assets as legal tender or Central Bank-recognized foreign currency. Actual functions, rather than product branding, determine the analysis.

How SUGEF, CONASSIF and SUGEVAL divide responsibilities

The General Superintendency of Financial Entities, SUGEF, handles registration and risk-based preventive supervision. The National Council for Supervision of the Financial System, CONASSIF, develops conditions, scope and thresholds. Suspicious reports go to the Financial Intelligence Unit of the Costa Rican Drugs Institute, UIF-ICD. Article 15 quater delimits these responsibilities.

Where activity falls within another superintendency's remit, the law preserves that regulation and supervision. For securities, SUGEVAL's published framework distinguishes issuers, brokerage firms, funds and custodians. Preventive registration does not replace permissions those activities may require or make SUGEF the approving authority for every tokenized instrument.

What to check before applying for VASP registration

The law expressly states that registration does not constitute authorization to operate. It requires keeping registration information current, provides for a central register and requires registered providers to contribute to SUGEF's supervision costs. Financial entities and other obliged entities may not maintain commercial relationships with providers required to register that have not done so, and refusal to register is punishable by a fine of two to one hundred base salaries. This does not establish an automatic right to a bank account after registration.

Territorial scope requires attention: SUGEF must address habitual unregistered activity within Costa Rican territory, irrespective of legal domicile or operating location. Local incorporation does not confer universal access to foreign customers, and a foreign license does not automatically replace registration. CONASSIF may also limit or prohibit obliged entities' operations involving providers not subject to AML regulation in any jurisdiction. Consortium Legal highlights the need to assess cross-border structures and financial access by business model.

The SUGEF rules page, consulted on 16 October 2026, retains SUGEF Agreement 11-18 on registration, which covers only Articles 15 and 15 bis; it contains no procedure specific to Article 15 quater. The Act allowed up to three months for implementing rules. On 28 September 2026, CONASSIF resolved to put to public consultation an amendment of SUGEF Agreement 13-19 extending the AML rules to VASPs, with a USD 1,000 threshold for occasional customers and transfers and six months to adapt from its entry into force. It is a proposal pending approval; no fees, forms or registration deadlines are assumed.

Why tokenization does not replace rights over the asset

Where rights and placement constitute securities, market rules and registration of persons and products in the National Securities and Intermediaries Register require assessment. A contractual return promise alone does not resolve the entire classification. The issuer, obligation, transferability, promotion and product service providers must be identified.

SUGEVAL's annual review of its 2024-2028 Strategic Plan, dated June 2025, announces a securities tokenization proof of concept and, at that date, only the start of capacity building. This establishes supervisory exploration, not an authorized commercial platform or universal DLT-based recognition of rights. Ownership of real estate or of an equity interest still requires checking formalities and registers; transferring a token does not itself establish compliance.

Preparing controls and virtual asset transfers

Article 15 quater requires customer and beneficial-owner identification and due diligence, reconstructable records, technology and product assessment, politically exposed person controls and confidential reporting of suspicious transactions, including attempts. Incoming and outgoing transfers require information under FATF standards and applicable implementation. The due diligence threshold is for CONASSIF to set; the USD 1,000 figure in the amendment under consultation does not apply unless it is approved and published.

Compliance must reflect size, structure and risk. The law contemplates a compliance officer or an authorized differentiated structure. The September 2026 notarial alert warns about VASP-linked companies used to create an appearance of lawfulness and the absence of real activity. It does not prohibit all foreign investment: purpose, participants and transaction evidence require examination.

What to resolve before launching the service

Before commencing operations, prepare a description of activities, beneficial owners, customers, transfers and controls, and compare it with SUGEF’s current procedure. A statutory duty does not establish an application form, an approval deadline or a prudential authorization absent from the published instructions.

Where the model offers investment rights, also assess its SUGEVAL classification and the documentation governing issuance and transfer. The current Act in SINALEVI and the supervisory catalog should be checked before launch. This review did not establish a dedicated operational procedure under Article 15 quater.

To understand how this framework applies to your project, discuss your case with our team.