Costa Rica CR

The Costa Rica sanctions-architecture exposure this cycle is defined by a second consecutive wave of unilateral US Treasury action rather than by any change to the underlying multilateral or EU listing posture. On 22 January 2026, OFAC designated the Picado Grijalba network, five individuals and five Costa Rica-based entities, for cocaine-trafficking and money-laundering, following an earlier 18 August 2025 action that designated former Vice Minister of Public Security Celso Manuel Gamboa Sanchez, his law firm, and a football club he used as laundering vehicles for the proceeds of selling counter-narcotics intelligence to trafficking targets. Read together, the two designation waves describe a documented state-capture vector operating through a senior former security official, layered onto a wider narcotics-trafficking financial architecture that runs through the port of Moin, a transshipment and laundering node amid rising violence in the Limon region.

The Gamboa designation is the more structurally significant of the two under the F1 state-capture filter: a former Vice Minister of Public Security selling operational intelligence to the trafficking networks he was nominally tasked with countering is not an isolated integrity lapse but evidence that financial-crime networks achieved direct access to the state own counter-narcotics apparatus. The Picado Grijalba action five months later, naming five further Costa Rica-based entities, indicates that the underlying trafficking-finance network survived the removal of a single high-profile node, consistent with the architecture-over-incident principle this monitor applies: individual designations expose components of a laundering apparatus without necessarily dismantling the apparatus itself.

Two structural developments partially offset this picture. First, Costa Rica repealed its constitutional prohibition on extraditing nationals (Ley 10730, reforming Article 32 of the Constitucion Politica) for narco-trafficking and terrorism cases; approximately twenty extradition requests for Costa Rican nationals have followed, and the first transfer, Gamboa himself, was completed in March 2026. This closes a historic impunity channel that sanctions designations alone cannot address: naming an individual under OFAC authority does not remove them from the jurisdiction that shields them from prosecution, whereas the extradition-bar repeal does. Second, the GAFILAT Fourth Round Enhanced Follow-up upgraded the Costa Rica technical-compliance rating on Recommendation 17 to Compliant and on Recommendations 22 and 28 to Largely Compliant, a trajectory that, alongside the extradition reform, supports reading the Costa Rica sanctions-architecture posture as improving at the structural level even as enforcement volume against it increases.

What has not changed is the transatlantic divergence in listing philosophy. No EU Council or OFSI sanctions designation corresponding to either OFAC action has been identified this cycle; the sanctions-regime-divergence tracker records that OFAC has issued two rounds of unilateral Costa Rica-related designations in the past twelve months with no parallel EU or UK action. This is consistent with a broader pattern in which the United States applies targeted, network-specific designation authority to Costa Rica while EU and UK sanctions architecture, oriented more toward jurisdiction-wide or thematic listing, has not engaged with the jurisdiction at the same granularity. For obliged entities operating across US, EU, and UK sanctions perimeters, the practical consequence is calibration risk rather than compliance conflict: SDN-list screening will surface Costa Rica-linked exposure with no EU or OFSI-list counterpart, requiring firms to maintain entity-specific rather than jurisdiction-wide due-diligence triggers for Costa Rica.

The Moin seaport dimension carries direct correspondent-banking relevance. The Moin node is identified as a transshipment and laundering point, meaning that banks maintaining correspondent relationships with Costa Rica trade-finance and port-adjacent commercial customers carry elevated exposure to the same network the two designation waves have targeted. Affected-firm-type tags across both actions include banks and the broader cross-sector category, and the correspondent-bank customer-typology tag attached to the Picado Grijalba designation indicates that this network laundering method specifically implicated correspondent banking channels rather than purely cash-based trafficking proceeds.

Consistent with this cycle three-pillar balance, the sanctions actions and the extradition reform are entirely AML and predicate-offence driven; no counter-terrorist-financing or counter-proliferation-financing dimension has been identified in the Costa Rica exposure this cycle, and the domain data is correspondingly weighted toward narcotics-trafficking and money-laundering typologies rather than the CTF/CPF pillars this monitor also tracks.

Outlook

The near-term signal to watch is whether OFAC extends the Picado Grijalba designation wave to remaining network associates, as the interpreter lead-signal assessment anticipates; a third wave would reinforce the reading that the Costa Rica narcotics-finance architecture is larger than the entities named to date. Separately, whether the extradition-bar repeal begins to function as a durable deterrent, beyond the initial Gamboa transfer, will depend on how the roughly twenty pending extradition requests are resolved over coming cycles. Absent EU or UK designations paralleling the two OFAC waves, the transatlantic listing divergence identified this cycle is likely to persist as a standing feature of the Costa Rica sanctions-architecture profile rather than a transitional anomaly.

Costa Rica sits outside the direct perimeter of the EU AML Package; as a non-EU/EEA jurisdiction, transposition obligations and the AMLA direct-supervision selection methodology do not apply to Costa Rica obliged entities. The directly relevant beneficial-ownership signal this cycle is domestic and, on the substantive registry mechanism, unchanged: the Costa Rica non-public RTBF beneficial-ownership registry, established under Decree 41040-H pursuant to Law 7786, carried no reported change this cycle, and the GAFILAT Fourth Round Enhanced Follow-up, which in February 2024 upgraded the Costa Rica technical-compliance rating on Recommendation 17 to Compliant and on Recommendations 22 and 28 to Largely Compliant, continues to flag persistent customer-due-diligence gaps in the DNFBP sector, notaries, lawyers, and accountants, that facilitate company formation, ahead of the jurisdiction Fifth Round evaluation. The residual weakness, in other words, sits at the professional-gatekeeper layer rather than in the registry architecture itself.

Globally, the EU AML Package sets the structural direction for beneficial-ownership and corporate-transparency supervision. It comprises three distinct instruments: the directly applicable AML Regulation (AMLR, Regulation (EU) 2024/1624); the sixth AML Directive (6AMLD), transposed at Member State level; and the AMLA Regulation (Regulation (EU) 2024/1620), which establishes the Anti-Money Laundering Authority and shifts a defined perimeter of cross-border obliged-entity supervision from purely national authorities toward a hybrid EU-level regime of direct and indirect supervision. This is standing structural backdrop rather than a Costa Rica-specific development this cycle; the interpreter carried no AMLA-specific horizon anchor for Costa Rica, consistent with the standing tracker assessment that the EU AML Package is not applicable to Costa Rica as a non-EU/EEA jurisdiction. The Costa Rica own beneficial-ownership trajectory is instead governed by its GAFILAT mutual-evaluation cycle and domestic registry design, not by the AMLA supervisory perimeter.

Outlook

The next material test for the Costa Rica beneficial-ownership architecture is not a new instrument but an evaluative one: the GAFILAT Fifth Round Mutual Evaluation, which will test whether the RTBF registry and DNFBP supervision function effectively against the CDD gaps already flagged in the Fourth Round follow-up, rather than simply re-rating technical compliance on paper. Absent a dedicated legislative fix to DNFBP company-formation CDD obligations before that evaluation, the gap identified this cycle is likely to persist as the primary open finding in the Costa Rica beneficial-ownership and transparency posture.

The Costa Rica profile as an enabler jurisdiction shifted this cycle less through new legislation on the professional-facilitator side than through a change to the state capacity to hold enabler-linked nationals accountable once identified. The Ley 10730 repeal of the constitutional prohibition on extraditing Costa Rican nationals, for narco-trafficking and terrorism cases, removes a structural safe-harbor mechanism that had historically allowed laundering-linked professionals and officials to remain functionally beyond the reach of foreign prosecution once inside Costa Rica territory. Approximately twenty extradition requests for Costa Rican nationals have followed the reform, and the first completed transfer, former Vice Minister of Public Security Celso Gamboa Sanchez, himself designated by OFAC in August 2025 for operating a law firm and a football club as laundering vehicles while selling counter-narcotics intelligence to trafficking targets, took place in March 2026.

The Gamboa case is the clearest illustration this cycle of the F3 enabler-jurisdiction filter capacity-versus-choice distinction: a former senior security official using a licensed law firm as a laundering vehicle is a professional-facilitator failure at the highest level of the state apparatus, not merely a capacity gap in supervising ordinary DNFBPs. That the extradition-bar repeal permitted his removal from Costa Rica jurisdiction to face prosecution abroad is itself evidence that the structural reform is functioning as intended in at least this first instance. The Gamboa designation customer-typology tag of politically-exposed-person is itself analytically significant: it flags that the compliance failure sits squarely within the PEP due-diligence obligations that banks and other obliged entities are expected to apply to former senior officials, rather than within a lower-risk retail-customer category.

At the level of ordinary professional facilitators, notaries, lawyers, and accountants engaged in company formation, the picture is less resolved. The GAFILAT Fourth Round Enhanced Follow-up, while upgrading the Costa Rica technical-compliance rating on Recommendation 17 to Compliant and on Recommendations 22 and 28 to Largely Compliant in February 2024, continues to flag customer-due-diligence gaps specifically in company-formation channels ahead of the jurisdiction Fifth Round evaluation. This is the residual enabler weakness: the front-company and shell-vehicle infrastructure that laundering networks depend on is formed through exactly the DNFBP channels GAFILAT has not yet certified as adequately supervised. The extradition-bar repeal itself maps to FATF Recommendations 17 (extradition), 22 (DNFBP customer due diligence), and 28 (regulation and supervision of DNFBPs), the same three recommendations the GAFILAT Fourth Round follow-up rated; that the extradition-specific recommendation achieved full Compliant status while the DNFBP-focused recommendations remain only Largely Compliant is a precise illustration of where the Costa Rica enabler-jurisdiction reform has, and has not yet, reached full effect.

The Moin seaport corridor adds a further structural enabler dimension distinct from the professional-services layer. Its continued identification as a key transshipment and laundering node, against a backdrop of rising violence in the Limon region, indicates that the Costa Rica enabler exposure operates simultaneously at the professional-facilitator level, the DNFBP CDD gap, and at the logistics and trade-finance level, port-based transshipment, two distinct architectural weaknesses that the extradition reform does not directly address. Both OFAC actions this cycle carry affected-firm-type tags spanning banks and the broader cross-sector category, indicating that the compliance exposure created by the Costa Rica enabler-facilitator failures is not confined to a single obliged-entity type but extends across the full range of institutions that might unwittingly service the front-company infrastructure these networks depend on.

Read together, the Costa Rica enabler-jurisdiction trajectory this cycle is genuinely mixed rather than uniformly improving: the extradition-bar repeal is a structural, high-confidence improvement in the jurisdiction impunity profile, while the DNFBP CDD gap and the Moin corridor remain open structural weaknesses that GAFILAT and continuing OFAC designation activity, respectively, indicate have not yet been resolved.

Outlook

Whether the extradition reform functions as a durable structural change rather than a one-case demonstration will depend on how the roughly twenty pending extradition requests for Costa Rican nationals are resolved over coming cycles; a pattern of completed transfers beyond the initial Gamboa case would substantially strengthen the reading that Costa Rica has closed its historic enabler-jurisdiction impunity channel. On the professional-facilitator side, the GAFILAT Fifth Round Mutual Evaluation is the mechanism that will test whether the DNFBP company-formation CDD gap identified in the Fourth Round follow-up has been substantively addressed, rather than merely re-rated, and remains the most consequential unresolved enabler-jurisdiction question for Costa Rica going forward.

Costa Rica closed a long-flagged Financial Action Task Force Recommendation 15 gap this cycle by formally bringing virtual-asset service providers into its AML/CFT perimeter. Legislative Decree No. 10961, amending Law 7786 to add Article 15 quater, was published on 19 June 2026 and mandates that VASPs register with SUGEF, the financial-sector supervisor. The decree explicitly distinguishes registration from licensing, SUGEF registration is a supervisory-perimeter mechanism, not an operating authorisation, a distinction that matters for how firms and counterparties should read the reform: it establishes that VASPs fall under AML/CFT obligations and supervisory visibility, without simultaneously creating a prudential or conduct-licensing regime comparable to a full VASP authorisation framework.

The substantive content of the new obligations is not yet fixed. CONASSIF, the Costa Rica national financial-supervision council, is expected to publish the implementing regulation in the third quarter of 2026, following a three-month countdown from the decree publication date. Until that regulation is published, the precise KYC, customer-due-diligence, travel-rule, and suspicious-transaction-reporting requirements VASPs must meet remain undefined in practice, even though the statutory obligation to register already applies. This creates a defined but temporarily open compliance-design window: Costa Rica-domiciled VASPs know they must build AML/CFT infrastructure, but not yet precisely what infrastructure CONASSIF will require.

The gap this decree closes is not abstract. General industry practice among Costa Rica-domiciled VASPs has, to this point, operated without any formal AML supervisor, meaning many smaller operators have not previously built KYC/CDD, travel-rule, or STR infrastructure at all. The implementing regulation will therefore represent a first-time build requirement for a meaningful share of the affected sector, rather than an incremental tightening of existing controls, a distinction relevant to assessing implementation timelines and near-term non-compliance risk once the CONASSIF regulation takes effect. The obligation is formally tagged in-force-pending under FATF Recommendation 15, with a control-gap signal marked partial pending the CONASSIF regulation, a precise acknowledgment that the statutory registration obligation exists today while the operative control framework does not yet fully exist. Affected-firm-type tagging spans crypto-asset operators specifically and the broader cross-sector category, and the VASP-counterparty customer-typology tag attached to the underlying claim indicates that obliged entities maintaining relationships with Costa Rica-domiciled VASPs, correspondent banks, payment processors, and other counterparties, should expect this registration status, once in force, to become a relevant due-diligence data point in assessing counterparty risk.

Set against the broader narcotics-finance and sanctions exposure documented elsewhere in the Costa Rica profile this cycle, the VASP reform is best read as a structural, forward-looking mitigant rather than a response to a documented crypto-specific laundering incident: none of the OFAC designations, the GAFILAT follow-up findings, or the Moin seaport enabler-node assessment this cycle identify a virtual-asset dimension to the Costa Rica narcotics-trafficking or money-laundering exposure. The VASP registration mandate instead pre-empts a Recommendation 15 gap that the FATF 2024 mutual-evaluation follow-up had already identified as a supervisory blind spot, closing the gap ahead of, rather than in response to, a documented crypto-channel exploitation of that blind spot.

A related supervisory-expectation gap remains open on the technology side of compliance: SUGEF has not yet published guidance on AI/ML-based transaction monitoring or perpetual-KYC expectations comparable to model-risk-management standards financial-crime supervisors in more developed digital-asset markets, such as FinCEN, have articulated. As CONASSIF finalises the VASP implementing regulation, whether it incorporates technology-specific supervisory expectations, or leaves them for a later phase, will materially affect how quickly the Costa Rica VASP sector builds monitoring capability appropriate to the risk profile SUGEF is now formally responsible for supervising.

Outlook

The single most consequential near-term event for this domain is the publication of the CONASSIF implementing regulation, expected in the third quarter of 2026, which will convert the registration mandate into an operative compliance regime with defined CDD, travel-rule, and reporting obligations. Firms and counterparties should expect the practical compliance burden on Costa Rica-domiciled VASPs to shift materially once that regulation takes effect, particularly for smaller operators that have not previously built AML/CFT infrastructure. Whether SUGEF or CONASSIF separately addresses the AI/ML transaction-monitoring and perpetual-KYC supervisory-expectation gap remains an open question that will shape how quickly the Costa Rica digital-asset AML architecture reaches parity with more mature comparator regimes.

SUGEF has not published AI/ML-based transaction-monitoring or perpetual-KYC supervisory guidance comparable to the model-risk-management expectations financial supervisors such as FinCEN have articulated in more developed markets. This is a supervisory-expectation gap rather than an enforcement finding: no Costa Rica-specific compliance-technology failure or active-defence deficiency was identified this cycle, and this domain status is recorded as watch rather than material change. The gap is relevant primarily as forward context for the VASP AML/CFT registration mandate introduced under Legislative Decree No. 10961: the CONASSIF implementing regulation, expected in the third quarter of 2026, is the mechanism through which SUGEF could, if it chooses, incorporate technology-specific supervisory expectations into the newly formalised VASP AML perimeter.

The broader Costa Rica financial-sector compliance-technology posture, including transaction-monitoring standards applicable to banks and other obliged entities beyond VASPs, was not independently assessed this cycle; the coverage gap reflects a general absence of published SUGEF guidance rather than a substantive negative finding. This domain accordingly carries limited signal this cycle: the observation is an absence, of published guidance, rather than a documented deficiency in existing systems. Absent any Costa Rica-specific enforcement action or active-defence deficiency this cycle, this domain remains appropriately flagged as thin rather than substantively assessed, consistent with the honesty-over-coverage principle applied across this monitor coverage.

Outlook

Whether the CONASSIF implementing regulation for VASP AML/CFT registration incorporates technology-specific supervisory expectations, such as AI/ML transaction-monitoring standards or perpetual-KYC requirements, will be the first concrete test of whether SUGEF intends to close this gap as part of the broader VASP-perimeter build-out, or leave technology-specific supervisory expectations for a later phase.