When you hear "cryptocurrency regulation in Costa Rica", you’re probably picturing a clear set of rules. In reality, the landscape sits in a legal gray zone: not outright banned, but also not fully defined. This article untangles the current framework, breaks down the July 2025 bill that tries to bring virtual‑asset service providers (VASPs) under anti‑money‑laundering supervision, and shows you how to operate safely while the rules keep evolving.

Current Legal Status: No Law, Some Guidance

Cryptocurrency regulation in Costa Rica is currently defined by a vacuum rather than a concrete statute. The Central Bank of Costa Rica (BCCR) clarified in October 2017 that Bitcoin and other digital tokens are not legal tender and have no backing from any law. Yet, private parties may still trade crypto assets freely. This creates a dual reality: individuals can buy, sell and hold coins, but businesses lack a specific licence to offer crypto‑related services.

The July 2025 Bill 22.837: First Steps Toward Structure

On 2July2025, the Legislative Assembly debated Bill22.837, officially titled “Proyecto de Ley Reforma a la Ley sobre Estupefacientes…”. The bill amends LawNo.7786 by adding Article15quáter, which formally defines “Activo Virtual” (Virtual Asset) and “Proveedor de Servicios de Activos Virtuales” (VASP). The definition reads: any digital representation of value that can be transferred online, but not recognized as legal tender.

Superintendencia General de Entidades Financieras (SUGEF) is tasked with supervising VASPs. Registration with SUGEF does not grant a government “authorization” to operate; it simply confirms that the entity complies with the country’s AML/CFT regime.

What Registration with SUGEF Actually Means

• Identify clients and ultimate beneficiaries.
• Retain detailed transaction logs for at least five years.
• Apply enhanced due‑diligence for politically exposed persons (PEPs) and high‑risk jurisdictions, following FATF recommendations.
• Perform regular risk assessments and keep internal controls up‑to‑date.
• Share suspicious‑activity reports with the authorities through a secure channel.

These requirements mirror the global AML/CFT standards but stop short of granting a formal operating licence. The risk‑based approach means that SUGEF will focus its inspections on entities handling large volumes or dealing with high‑risk customers.

Practical Steps for Crypto Start‑ups

1. Incorporate a legal entity via the National Registry. The process takes 3-5 business days and requires a local legal address.
2. Open a corporate bank account. While Costa Rica’s banks remain cautious, many fintech‑friendly institutions now accept crypto‑related businesses, especially if AML policies are robust.
3. Draft an AML/CFT policy that covers KYC, transaction monitoring, and reporting. Use the FATF’s 40‑point recommendation list as a checklist.
4. Register with SUGEF as a VASP. Submit identification documents, a description of services, and your AML program. Expect a review period of 30‑45 days.
5. Implement ongoing compliance: quarterly risk reviews, staff training, and regular updates to your KYC database.

Failure to meet these steps can lead to fines, asset freezes, or even criminal investigation under Costa Rica’s money‑laundering statutes.

Why Crypto Companies Love Costa Rica

The country offers a blend of low‑cost incorporation, minimal capital‑raising requirements, and a stable political environment. For GameFi projects, the local gaming licence can be combined with a VASP registration, allowing rapid market entry without needing a physical office or resident directors. Telecom infrastructure ranks among the best in Central America, ensuring reliable node connectivity for decentralized applications.

Tax incentives also play a role: foreign‑source income earned by a Costa Rican entity is generally taxed at a modest 15% corporate rate, with many crypto‑related profits qualifying as capital gains and thus benefiting from favorable treatment.

The Dark Side: Risks and Uncertainties

Operating in a gray zone means you lack explicit legal protection. If a dispute arises over a smart‑contract failure, Costa Rican courts may treat the transaction as a private contract without any statutory safeguards. Moreover, the pending legislation explicitly states that registration is not a licence, leaving businesses vulnerable to future regulatory shifts.

International partners may also hesitate. A U.S. bank, for instance, could deem a Costa Rican VASP “high‑risk”, limiting correspondent‑bank relationships. To mitigate, firms should adopt a proactive compliance posture-maintaining audit‑ready documentation and staying ready for tighter rules.

Future Outlook: From Gray to Clear?

Experts anticipate that Bill22.837 will be the seed for a more comprehensive crypto code. Possible future steps include:

• Introducing a dedicated crypto licence that separates VASP duties from traditional financial services.
• Setting minimum share‑capital thresholds to ensure financial resilience.
• Creating a crypto‑specific tax regime, potentially offering exemptions for blockchain‑based R&D.

Until then, the prudent approach is to treat Costa Rica as a “sandbox” - capitalise on the low entry barriers while building compliance systems that can be ported to stricter jurisdictions.

Regulatory Snapshot: Before vs. After Bill22.837

Frequently Asked Questions