Financial Integrity Monitor

Costa Rica CR

Domains (D1–D6)
4
Sources
15
Role actions
8
Horizon <90d
2
Jurisdiction profile
CleanTier BRisk: IncreasingMixed

Costa Rica's AML/CFT regime rests on Law 7786 (as amended), supervised by SUGEF/CONASSIF for financial institutions and by the DNN and SUGEF for DNFBPs, with a non-public beneficial-ownership registry (RTBF, Decree 41040-H) and FIU functions housed within the Costa Rican Drug Institute (ICD).

MoreGAFILAT's Fourth Round enhanced follow-up (Feb 2024) recorded technical-compliance upgrades (R17 to Compliant; R22, R28 to Largely Compliant) but flagged residual DNFBP customer-due-diligence gaps ahead of the Fifth Round evaluation.

Key deficiencies
  • DNFBP (notary/lawyer/accountant) CDD gaps for company-formation 'contributions' under Recommendation 22
  • Free-trade-zone and Caribbean port customs oversight vulnerable to trade-based money-laundering concealment in agricultural export flows
  • Non-public beneficial-ownership registry (RTBF) whose effectiveness remains untested ahead of the Fifth Round evaluation
  • Absence of a dedicated virtual-asset service provider (VASP) licensing and supervisory regime
Recent developments (18m)
  • OFAC designated a Costa Rican narcotrafficking network and an affiliated law firm under EO 14059 (Aug 2025)
  • OFAC designated the Picado Grijalba narcotics-trafficking network and Costa Rican front companies (Jan 2026)
  • Costa Rica's OIJ arrested ex-Security Minister/Supreme Court Justice Celso Gamboa Sánchez on a US drug-trafficking extradition request (Jun 2025)
  • Legislative Assembly narrowly failed to strip President Chaves' immunity over an alleged influence-peddling investigation (Sept 2025)
  • EU Commission's Dec 2025 high-risk third-country list update did not add Costa Rica, keeping it off the EU HRTC list
Weekly brief

Lead signal

Lead Signal

Read full brief

Lead Signal

Costa Rica registered two rounds of unilateral U.S. Treasury sanctions action this cycle, both assessed at High confidence from Tier 1 sourcing. In August 2025, OFAC designated Celso Manuel Gamboa Sanchez, a former Vice Minister of Public Security, together with his law firm and a soccer club, under Executive Order 14059 for facilitating narcotics-trafficking-linked money laundering. In January 2026, a second action designated five Costa Rican nationals and five Costa Rica-based entities connected to the Luis Manuel Picado Grijalba cocaine-trafficking network under the same authority. Both actions carry a severity_preliminary rating of CRITICAL in the interpreter record, reflecting the direct implication of a former senior security official and a coordinated multi-entity network rather than an isolated individual designation. No corresponding European Union Council or UK OFSI designation against either set of targets has been identified, a divergence consistent with a broader pattern of US-led autonomous listing against Costa Rica-linked narcotics money laundering that the interpreter record flags as worth sustained tracking rather than a one-off enforcement episode.

Other Developments

Professional and commercial vehicles as laundering fronts. The January 2026 OFAC action named a law firm and a sports club as facilitation vehicles, alongside several Costa Rica-based entities used for storage and transport within the cocaine-trafficking network. Because the designated facilitators include a law firm — a category of professional gatekeeper whose services carry an inherent presumption of legitimacy — the finding illustrates the architecture-over-incident principle directly: the exposure is structural, professional-services capture, rather than confined to the individual transaction chain the designation formally targets. This is consistent with an enabler-jurisdiction characterization assessed at Assessed confidence.

VASP registration reform closes a FATF gap. Costa Rica's Legislative Assembly unanimously approved Amendment No. 25.340 to Law No. 7786 on 27 May 2026, inserting a new Article 15 quater that brings virtual-asset service providers into the AML/CFT obligated-entity perimeter via mandatory SUGEF registration; the amendment was published as Legislative Decree No. 10961 in La Gaceta on 19 June 2026. The interpreter record treats this as closing a documented FATF Recommendation 15 gap on virtual-asset activity, though it is explicitly a registration-for-supervision regime rather than an operating licence, and the corroborating sourcing this cycle is Tier 3 professional-services commentary rather than a retrieved primary La Gaceta text. The reform's practical reach is still unsettled: SUGEF implementing regulations for VASP registration are expected within roughly three months of the gazette publication, but their issuance has not yet been confirmed, leaving open how customer due diligence, record-keeping and suspicious-transaction-reporting mechanics will actually operate in practice.

Comprehensive AML statute progressing, single-sourced. A Comprehensive AML Law, Bill 6593, is reported to have passed its third reading in the Legislative Assembly on 14 April 2026, replacing decree-level provisions dating to 2001. This claim carries only Low confidence this cycle, resting on a single Tier 3 source with no corroborating primary legislative record retrieved. Separately, Costa Rica is confirmed, at Assessed confidence from a Tier 1 FATF/GAFILAT source, to remain outside the FATF grey list while continuing in GAFILAT's enhanced follow-up process stemming from its 2015 Mutual Evaluation, with follow-up reporting through 2024.

Cross-Monitor Connections

The VASP registration reform is the clearest cross-monitor node this cycle. The same SUGEF registration requirement that closes the FATF R.15 gap for this monitor is the substrate for the Crypto Monitor's own crypto_licensing and cross_border_transfer findings, which read the identical Article 15 quater / Decree 10961 reform as a supervisory-perimeter expansion rather than an operating-licence regime. Neither monitor's registration record yet extends to a confirmed operating-licence framework for the underlying crypto-asset activity itself, a gap both this monitor's D5 tracker and the Crypto Monitor's own crypto_licensing module independently flag as the more consequential open question going into the next cycle. The World Payments Monitor's fintech-sector tracking, which records Costa Rica's growing domestic payments and lending fintech population, sits adjacent to this same reform: an expanding fintech and virtual-asset sector operating without a licensing framework, now newly subject to AML/CFT registration, is the structural condition this monitor's D5 and D7 findings and World Payments' product-innovation tracking are both, independently, describing from their respective lenses.

Outlook

The immediate items to watch are whether SUGEF issues the implementing regulations for VASP registration expected within roughly three months of the 19 June 2026 gazette publication, and whether Bill 6593's reported third-reading passage is corroborated by a primary legislative record next cycle. Continued unilateral OFAC designation activity against Costa Rica-linked narcotics-money-laundering targets, absent any EU or UK parallel action, is a sanctions-regime divergence pattern worth sustained tracking rather than a single-cycle anomaly. A third OFAC action against a Costa Rica-linked target without a parallel EU Council or OFSI listing would harden this observation from an assessed pattern into a more confidently structural finding.

weekly_brief_draft · JID CR
Domain intelligence (D1–D6)

D1 Sanctions

Sanctions

Continue reading

Costa Rica registered two distinct rounds of U.S. Treasury sanctions action this cycle, both assessed at High confidence from Tier 1 primary sourcing. In the first, OFAC designated Celso Manuel Gamboa Sanchez — a former Vice Minister of Public Security — together with his law firm and a soccer club, under Executive Order 14059, for facilitating money laundering tied to narcotics trafficking. In the second, five Costa Rican nationals and five Costa Rica-based entities connected to the Luis Manuel Picado Grijalba cocaine-trafficking network were designated under the same authority. Both actions carry a severity_preliminary rating of CRITICAL in the underlying interpreter record.

The architecture reading of these two actions is more significant than either taken as a discrete incident. A former senior security official's alleged direct involvement, channeled through ordinary professional and commercial vehicles — a law firm, a sports club — indicates that Costa Rica's sanctions exposure this cycle is not confined to informal or overtly illicit actors but extends into licensed, outwardly legitimate intermediary structures. This is the kind of enabler-adjacent finding that the sanctions domain and the enabler-jurisdictions domain jointly describe from different angles.

A second architectural observation is regime divergence. No European Union Council or UK OFSI designation against either the Gamboa network or the Picado Grijalba network has been identified this cycle. Two consecutive OFAC rounds against Costa Rica-linked narcotics money laundering, with no parallel multilateral or UK action, is consistent with a pattern of US-led autonomous listing against Costa Rica that the interpreter record's standing tracker treats as a watch item rather than a settled conclusion. Three-pillar balance requires noting that both actions sit squarely within the AML pillar; no CTF or CPF-specific signal was identified against Costa Rica this cycle, which is itself worth registering as an absence rather than silently passing over.

Outlook

The item to watch next cycle is whether a third OFAC action against a Costa Rica-linked target appears without a parallel EU Council or OFSI designation, which would harden the current sanctions-regime-divergence observation from an assessed pattern into a more confidently structural finding. Absent that, continued OFAC designation activity against professional and commercial vehicles operating inside Costa Rica should be read as sustained pressure on the same enabler architecture rather than as a series of unconnected events.

D2 Beneficial Ownership

Not covered

Beneficial Ownership is not yet covered for this jurisdiction in this report.

D3 Enabler Jurisdictions

Enabler Jurisdictions

Continue reading

The clearest enabler-jurisdiction signal this cycle is embedded within the January 2026 OFAC sanctions action: designated entities include a law firm and a sports club functioning as laundering-facilitation vehicles, alongside several Costa Rica-based entities used for storage and transport within a cocaine-trafficking network. This is a single sourced development this cycle, corroborated at High confidence from a Tier 1 U.S. Treasury source, but it has not been independently supplemented by additional enabler-specific findings this cycle — professional-services regulation, gatekeeper-obligation coverage, or company-formation-agent oversight were not otherwise sourced for Costa Rica this cycle.

The interpreter's key judgment treats this as continuity rather than escalation: Costa Rica continues to show enabler-jurisdiction characteristics via professional and commercial-vehicle facilitation of narcotics-linked money laundering, assessed at Assessed confidence. Given the thinness of sourcing beyond the single sanctions action, this sub-brief is flagged as limited-signal this cycle.

Outlook

Whether the newly-registering VASP population becomes a further enabler vector, or whether additional professional-services gatekeepers are named in future OFAC or GAFILAT-linked action, are the open questions carried into next cycle.

D4 Conflict Finance

Not covered

Conflict Finance is not yet covered for this jurisdiction in this report.

D5 Crypto / Digital Assets / Financial Innovation

Crypto / Digital Assets / Financial Innovation

Continue reading

Costa Rica's Legislative Assembly unanimously approved Amendment No. 25.340 to Law No. 7786 on 27 May 2026, inserting new Article 15 quater and bringing virtual-asset service providers into the AML/CFT obligated-entity perimeter through mandatory SUGEF registration. The amendment was published as Legislative Decree No. 10961 in La Gaceta on 19 June 2026. The interpreter record treats this, at Assessed confidence, as closing a documented FATF Recommendation 15 gap on virtual-asset activity — a structural remediation rather than a single enforcement event, consistent with the architecture-over-incident framing this monitor applies throughout.

The reform is explicitly a registration-for-supervision regime, not an operating licence: VASPs must register with SUGEF for AML/CFT purposes, but that registration does not itself authorise the underlying crypto-asset business activity. This distinction matters for how the finding should be read — Costa Rica has closed a supervisory-perimeter gap without yet building a licensing perimeter around the activity itself, leaving crypto companies free to incorporate and operate without a government-issued VASP licence even as their AML/CFT obligations tighten.

Sourcing for this cycle's headline development is Tier 3 professional-services commentary; no Tier 1 La Gaceta or SUGEF primary-text URL was retrieved, a gap the interpreter record flags explicitly.

Outlook

SUGEF implementing regulations for VASP registration are expected within roughly three months of the 19 June 2026 gazette publication — their issuance, and the operational detail they will set for customer due diligence, record-keeping, and suspicious-transaction-reporting mechanics, is the primary item to watch next cycle. Corroboration of the reform against a primary La Gaceta or SUGEF text would also resolve this cycle's principal sourcing gap.

D6 Compliance Technology & Active Defence

Not covered

Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.

D7 AML/CTF Regime

AML/CTF Regime

Continue reading

Costa Rica's AML/CTF regime remains anchored in Law 8204/7786 under SUGEF and CONASSIF supervision, with the ICD functioning as financial intelligence unit. Two developments this cycle bear on the regime's trajectory. First, a Comprehensive AML Law, Bill 6593, is reported to have passed its third reading in the Legislative Assembly on 14 April 2026, replacing decree-level provisions dating to 2001; this claim carries only Low confidence, resting on a single Tier 3 source with no corroborating primary legislative record retrieved this cycle. Second, at Assessed confidence from a Tier 1 FATF/GAFILAT source, Costa Rica is confirmed to remain outside the FATF grey list while continuing in GAFILAT's enhanced follow-up process stemming from its 2015 Mutual Evaluation, with follow-up reporting extending through 2024.

Read together, these two findings describe a regime under active but incompletely-verified reform, operating against a backdrop of continuing multilateral follow-up rather than either grey-list escalation or a clean exit from enhanced monitoring. The interpreter's key judgment frames Bill 6593 as progressing but single-sourced, and this sub-brief carries that caution forward rather than treating the third-reading claim as settled.

Outlook

Corroboration of Bill 6593's legislative status against a primary Legislative Assembly record is the principal open item for next cycle, alongside whatever GAFILAT follow-up reporting emerges beyond the 2024 cycle already on record.

Regulatory horizon
Adopted2026-Q4 · ±half_year

Comprehensive AML Law (Bill 6593)

Passage of a single consolidated AML/CFT statute replacing older sectoral decree-level provisions.
In Force Pending2026-Q4 · ±quarter

VASP AML/CFT registration implementing regulations

VASPs move from unregulated status to mandatory SUGEF AML/CFT registration with CDD, STR-to-ICD, and record-keeping obligations.
2 dated · 3 pending date · baseline financial-integrity-2026-07-05
Role action cards
MLROHigh

Two rounds of OFAC narcotics-linked SDN designations against Costa Rica-connected individuals and entities, alongside a new VASP AML/CFT registration mandate.

Sanctions screening lists must be updated against the Gamboa and Picado Grijalba designations, and the newly-obligated VASP population represents a new category of reporting entity for onboarding and monitoring purposes.

3 evidence refs
ComplianceAssessed

Costa Rica closed a FATF R.15 gap via mandatory VASP registration, while a consolidated AML statute (Bill 6593) remains single-sourced.

The VASP registration reform expands the obligated-entity perimeter that compliance frameworks referencing Costa Rica should account for, though implementing regulations are still pending; Bill 6593's status should not yet be treated as settled given single-source sourcing.

2 evidence refs
LegalHigh

OFAC designations name a law firm and a sports club as laundering-facilitation vehicles connected to Costa Rica-linked narcotics trafficking.

Liability exposure attaches to professional and commercial intermediary structures, not only to direct transaction participants, in this enforcement pattern.

2 evidence refs
BoardAssessed

Sustained US unilateral sanctions pressure on Costa Rica-linked narcotics money laundering, with no parallel EU or UK designation activity.

This is a material reputational and financial-crime risk signal for institutions with Costa Rica exposure, and the sanctions-regime divergence itself is a strategic-level trend to monitor.

2 evidence refs
CTOAssessed

Costa Rica's VASP AML/CFT registration reform creates a new SUGEF-supervised technical compliance perimeter without a licensing regime for the underlying crypto activity.

Technical architecture supporting Costa Rica-exposed VASP operations will need to accommodate new CDD, record-keeping and reporting mechanics once SUGEF implementing regulations issue, without yet a corresponding activity-licensing standard.

1 evidence refs
RiskAssessed

A sanctions-regime divergence pattern (US-only designation activity) and continued enabler-jurisdiction characteristics are both open risk-exposure signals for Costa Rica.

Exposure concentration in Costa Rica-linked narcotics-trafficking-adjacent counterparties should be assessed independent of EU/UK sanctions-list status, given the demonstrated US-only listing pattern.

2 evidence refs
OperationsAssessed

Sanctions-screening lists require updates for the Gamboa and Picado Grijalba network designations.

Transaction-monitoring and screening workflows referencing Costa Rica-linked counterparties should incorporate both designation rounds from this cycle.

2 evidence refs
AuditAssessed

Bill 6593's reported passage and Costa Rica's continuing GAFILAT enhanced follow-up status both remain only partially corroborated this cycle.

Audit documentation referencing Costa Rica's AML statutory basis should flag Bill 6593 as unconfirmed pending a primary legislative record, while GAFILAT follow-up status is Tier 1 sourced and confirmed.

2 evidence refs
Decision lens
MLRO

Two rounds of OFAC narcotics-linked SDN designations against Costa Rica-connected individuals and entities, alongside a new VASP AML/CFT registration mandate.

Compliance

Costa Rica closed a FATF R.15 gap via mandatory VASP registration, while a consolidated AML statute (Bill 6593) remains single-sourced.

Legal

OFAC designations name a law firm and a sports club as laundering-facilitation vehicles connected to Costa Rica-linked narcotics trafficking.

Board

Sustained US unilateral sanctions pressure on Costa Rica-linked narcotics money laundering, with no parallel EU or UK designation activity.

CTO

Costa Rica's VASP AML/CFT registration reform creates a new SUGEF-supervised technical compliance perimeter without a licensing regime for the underlying crypto activity.

Risk

A sanctions-regime divergence pattern (US-only designation activity) and continued enabler-jurisdiction characteristics are both open risk-exposure signals for Costa Rica.

Operations

Sanctions-screening lists require updates for the Gamboa and Picado Grijalba network designations.

Audit

Bill 6593's reported passage and Costa Rica's continuing GAFILAT enhanced follow-up status both remain only partially corroborated this cycle.

Shared evidence: 3 refs
Scenario sketches

AMLA supervisory-perimeter transition as a structural precedent

Illustrative orientation only: as the AMLA Regulation (Reg (EU) 2024/1620) moves the EU toward direct and indirect AMLA supervision of cross-border obliged entities, alongside the directly-applicable AMLR (Reg 2024/1624) and per-state 6AMLD transposition, the resulting hybrid EU-level/national supervisory model could become a reference architecture non-EEA jurisdictions cite when designing their own obligated-entity perimeters, including registration-only regimes such as Costa Rica's newly-enacted VASP framework. This is an illustrative structural sketch, not an observed development in Costa Rica.

Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.

Standing trackers (T1–T6)
TrackerStatusNote
T1 · Russian Sanctions-Evasion ArchitecturestableNo CR-specific Russian sanctions-evasion or Houthi/Yemen-channel signal surfaced this cycle.
T2 · EU AML Package / AMLAno_changeNot applicable — Costa Rica is autonomous and outside the EEA; AMLR/6AMLD/AMLA have no direct application to CR this cycle.
T3 · FATF Grey ListstableCosta Rica is not on the FATF grey list; remains in GAFILAT's enhanced follow-up process from its 2015 Mutual Evaluation.
T4 · Beneficial-Ownership Register StatusimprovingCR's RTBF registry is being extended in practice to newly AML/CFT-obligated VASPs.
T5 · Crypto & Digital-Asset IntegrityimprovingVASP AML/CFT registration reform enacted, closing the FATF R.15 gap on virtual-asset activity.
T6 · Sanctions Regime DivergencewatchOFAC issued two rounds of unilateral narcotics-related designations against CR targets; no corresponding EU-Council/OFSI designations identified, consistent with a US-led autonomous-listing pattern.
Registers

Enforcement actions

  • OFAC designated a network of notorious Costa Rican narcotics traffickers, including individuals based in Limón and San José, and an affiliated Costa Rican law firm, under Executive Order 14059 for their role in illicit drug trafficking. 18 Aug 2025
  • OFAC designated one of the Caribbean's largest narcotics traffickers, Luis Manuel Picado Grijalba, along with family members and several Costa Rican shell entities (a fishing association, a beauty salon, real-estate SAs) used to front and launder trafficking proceeds. 22 Jan 2026
  • Costa Rica's judicial police arrested former Security Minister and Supreme Court Justice Celso Gamboa Sánchez, together with an alleged accomplice, on a US DEA extradition request related to international drug trafficking, highlighting the penetration of narco-linked professional/political networks into senior state institutions. 23 Jun 2025

Sanctions changes

  • OFAC added Costa Rican narcotics-trafficking individuals and an affiliated law firm to the SDN list under the counter-narcotics EO 14059 program. 18 Aug 2025
  • OFAC designated the Picado Grijalba trafficking network and associated Costa Rican front companies under the illicit-drugs EO 14059 program. 22 Jan 2026
  • The European Commission's December 2025 update to the EU list of high-risk third countries (Delegated Regulations (EU) 2026/46 and 2026/83) added Russia, Bolivia and the British Virgin Islands and delisted several African states, but did not add Costa Rica, despite its recurrent appearance in US counter-narcotics money-laundering designations. 4 Dec 2025

Regulatory horizon (register)

  • GAFILAT Fifth Round Mutual Evaluation of Costa Rica
  • Next EU high-risk third-country list update cycle
  • Next US State Dept INCSR Vol. II money-laundering jurisdiction review

Active schemes

  • [HIGH] Cocaine trans-shipment concealed in Costa Rican agro-exports
  • [HIGH] Shell-company front networks laundering narco-proceeds
  • DNFBP gatekeeping gaps and regional 'banana route' laundering
  • Cross-border bank-stake acquisition using alleged fraud proceeds
Sources
  1. FATF
  2. GAFILAT / FATF
  3. FATF
  4. FATF
  5. US Treasury OFAC
  6. US Treasury OFAC
  7. European Commission (DG FISMA)
  8. UNODC / UNCAC Implementation Review Group
  9. OCCRP
  10. Bloomberg
  11. OCCRP
  12. OCCRP
  13. Bloomberg
  14. ICIJ
  15. FATF
Coverage gaps
Despite UNODC Container Control Programme training and port …
Despite UNODC Container Control Programme training and port scanning capacity-building, Costa Rica's Caribbean ports and free-trade-zone logistics chains remain a primary conduit for cocaine trans-shipment concealed in legitimate agro-exports, with a $70 million cocaine seizure inside a Costa Rica-origin pineapple shipment in Spain in late 2025.
GAFILAT's 2024 enhanced follow-up found that Costa Rica's DN…
GAFILAT's 2024 enhanced follow-up found that Costa Rica's DNFBP regulation for notaries, lawyers and accountants does not explicitly cover situations where such professionals organise 'contributions' for the creation, operation and management of companies, leaving Recommendation 22 only partially addressed even after re-rating.
In September 2025 Costa Rica's Legislative Assembly voted 34…
In September 2025 Costa Rica's Legislative Assembly voted 34-21 to strip President Rodrigo Chaves' immunity over an alleged influence-peddling investigation — a majority, but short of the two-thirds threshold required — leaving the sitting executive shielded from prosecution ahead of the 2026 general election.
No dedicated Costa Rican VASP/crypto-asset licensing framewo…
No dedicated Costa Rican VASP/crypto-asset licensing framework, nor sector-specific national risk-assessment publications for private banking, TCSP or fund management, were located in this baseline research pass; sector_rna_urls is left empty pending targeted follow-up.

Evidence

Confidence-tiered claims

No structured claims published for this jurisdiction yet.