Costa Rica Crypto Regulation July 2025

Regulation Name: Proyecto de Ley Reforma a la Ley sobre Estupefacientes, Sustancias Psicotrópicas, Drogas de uso no autorizado, Actividades Conexas, Legitimación de Capitales y Financiamiento al Terrorismo
Date Of Release: 02 July 2025
Region: Costa Rica
Agency: Costa Rican Legilative Assembly

Costa Rican Crypto Regulations

Proyecto de Ley Expediente 22.837, originally proposed by the Executive on December 9, 2021, seeks to amend Law No. 7786 — the law addressing narcotics, money laundering, terrorism financing, and related activities. The key change is the addition of Article 15 quáter, which formally brings Virtual Asset Service Providers (VASPs) under the country’s AML/CFT legal framework. The initiative also aims to strengthen SUGEF’s KYC platform to improve risk profiling and data collection.

Definition of Virtual Assets and VASPs  

Article 15 quáter introduces precise definitions:

1. Activo Virtual (Virtual Asset): Any digital representation of value that can be traded or transferred online, but is not recognized as legal tender in Costa Rica.

2. Proveedor de Servicios de Activos Virtuales (VASP): A person or entity (individual or juridical) acting—as themselves or on behalf of third parties—in activities such as:

  a. Exchange between virtual assets and legal tender, or among virtual assets.

  b. Transfers of virtual assets.

  c. Custody, administration, or control of virtual assets.

  d. Issuance, marketing, offers, or sales of virtual assets.

Mandatory Registration with SUGEF & Supervision  

The bill mandates that all VASPs must register with the Superintendencia General de Entidades Financieras (SUGEF). This registration is not a license to operate, but rather a compliance checkpoint to ensure alignment with AML/CFT norms.

Once registered, VASPs fall under risk-based supervision by SUGEF. The regulator is empowered to apply differentiated oversight—such as requiring compliance officers—based on each entity’s size, structure, and volume of operations.

Customer Due Diligence & KYC Enhancements  

Registered VASPs must implement comprehensive KYC and customer identification measures, gathering reliable information to pinpoint clients and beneficial owners. Enhanced due diligence is obligatory when dealing with Politically Exposed Persons (PEPs)—both domestic and foreign. VASPs must also record and verify the source of funds for such clients.

Recordkeeping & Risk Management Controls  

The proposed law requires detailed record retention, enabling reconstructability of all customer transactions. Entities must conduct ongoing risk assessments and internal controls to address AML/CFT and weapons proliferation risks, including scrutiny over new products and jurisdictions identified as high-risk.

International Transfers & Travel Rule Alignment  

VASPs must apply enhanced controls on cross-border virtual asset transfers, aligning with FATF’s “Travel Rule.” This includes capturing origin and destination information and sharing same with counterparties and regulators.

Suspicious Transaction Reporting  

VASPs are obligated to report suspicious activity promptly and confidentially to the Unidad de Inteligencia Financiera (ICD)—the Financial Intelligence Unit administered by the drug enforcement institute. Reporting mechanisms must preserve confidentiality and guard against retaliation.

Public Registry & Engagement Restrictions  

SUGEF is tasked with maintaining a public, up‑to‑date registry of all registered VASPs. Other regulated entities—such as banks and financial institutions—are prohibited from conducting business with unregistered VASPs. This ensures that only supervised providers interface with the formal financial system.

Enforcement & Sanctions  

Bill 22.837 extends the penalties framework of Law 7786 to include VASP-related violations. Non-compliance may result in fines ranging from two to one hundred base salaries, based on severity. SUGEF is empowered to freeze funds linked to illicit activity and to escalate serious breaches to judicial authorities.

Strengthening Sugef’s Technological Platform  

A significant supplemental goal of the reform is to upgrade SUGEF’s “Know Your Customer” information systems. This includes integrating key client data (e.g. legal representation, address, activity, and source of funds) into a centralized platform to support robust risk profiling and monitoring.

Legislative Status & Outlook  

As of July 1, 2025, the Legislative Assembly approved Bill No. 22.837 in its first debate, with unanimous support from the 41 congress pieces present. The proposal, however, may be sent back to first debate for further modifications before final approval.

Conclusion  

This bill represents a foundational step toward formally regulating VASPs in Costa Rica. By embedding virtual assets into the same legal perimeter as other regulated financial services, the bill aims to ensure compliance with international AML/CFT standards (specifically FATF Recommendations 15, 7, and 12), while preserving user protections and financial access.

Read the full bill:

Procuraduría General de la República – SCJ Legal Opinion OJ‑090‑2025

Asamblea Legislativa – Bill 22.837 PDFs

Read about the product: Transact Comply

Empower your organization with ZIGRAM’s integrated RegTech solutions – Book a Demo