Costa Rica CR

Lead Signal

Costa Rica has opened a public consultation on amending Acuerdo Sugef 13-19, the instrument that would bring virtual-asset service providers directly under the AML customer-identification and suspicious-activity-reporting regime supervised by Sugef. The proposal was published through La Gaceta Alcance N.164/N.187 on 5 October 2026 by the National Council for Supervision of the Financial System (CONASSIF), and press reporting as of 23-24 October 2026 confirms the consultation remains open. As drafted, virtual-asset operators would need to identify their clients at a reported threshold around US$1,000, attribute wallet addresses to verified clients, retain records of their operations, and report suspicious transactions to Sugef and the financial intelligence unit. This is a structural development rather than an enforcement incident: Costa Rica currently has no operative AML customer-identification or reporting rule for virtual-asset operators beyond the bare registration duty created by Law 10961, so the amendment would be the first substantive supervisory layer placed on the sector.

Commentary accompanying the proposal is notably explicit that registration under the amended framework would not constitute an operating authorization or license, a distinction that matters for how the market and counterparties read compliance signals once any registration regime takes effect. The consultation's closing date and final text were not reachable through primary-tier sources this pass, so the standing position rests on secondary press and commentary rather than the official gazette or regulator portal directly.

Other Developments

No other Costa Rica-specific material met the bar. Sanctions exposure, beneficial-ownership and corporate-transparency architecture, enabler-jurisdiction dynamics, conflict-finance nexus, compliance-technology posture, the broader AML/CTF regime, and commercial-activity findings for Costa Rica were all assessed and found stable, with no new material movement to report. The published standing positions for those areas remain in force unchanged.

Cross-Monitor Connections

The Sugef 13-19 amendment sits at the intersection of financial-integrity supervision and digital-asset market structure: a jurisdiction moving a previously unsupervised VASP population into an identification-and-reporting perimeter is the kind of structural change that affects how illicit-finance typologies routed through virtual-asset rails get surfaced, independent of whether any single enforcement action follows. Where other monitors track commodity flows, state-capture dynamics, or information operations that obscure illicit money movement, a jurisdiction newly imposing customer-identification duties on VASPs changes the friction such flows encounter if they transit Costa Rican-registered virtual-asset operators. No cross-jurisdictional linkage beyond Costa Rica itself was evidenced, and the connections above are offered as structural orientation rather than an asserted finding of cross-border flow.

Outlook

The consultation is expected to progress toward a final text within the fourth quarter of 2026, as scheduled, though the record does not establish whether the comment period has closed or whether CONASSIF has set a definitive adoption date, so this should be read as the proposal standing at the consultation stage rather than as enacted law. Should the amendment be adopted substantially as drafted, Costa Rica-registered virtual-asset operators would move from a bare registration duty to a full identification, record-keeping and suspicious-activity-reporting obligation, which is a meaningful compliance-architecture shift for that sector specifically. Subsequent reporting should be watched for the gazetted final text, the effective date, and any penalty provisions attached to non-compliance, none of which were available in the material reviewed.

Lead Signal

Costa Rica has moved to close a long-flagged gap in its anti-money-laundering architecture for virtual asset service providers. Following the June 2026 enactment of Law 10961, which added Article 15 quater to the base AML statute Law 7786 and placed virtual asset service providers under the supervision of the national financial supervisor SUGEF, the National Council for Financial System Supervision opened a public consultation in early October 2026 on a draft amendment to Acuerdo SUGEF 13-19. The draft would operationalise the new registration requirement with risk-based customer due diligence, new-product and new-technology risk assessment, and suspicious-transaction reporting duties for registered virtual asset providers. The statutory registration requirement itself is well evidenced in the official gazette, but the substantive content of the draft amendment currently rests on secondary press reporting rather than the consultation text itself, so the shape of the final rule should be treated as probable rather than settled.

This is best read as a remediation step rather than a new vulnerability. Costa Rica's virtual-asset sector had sat for years in a supervisory vacuum, a posture long associated with a non-compliant rating against the Financial Action Task Force's Recommendation 15 on new technologies. The consultation does not create a licensing regime, and commentary accompanying the statutory change has been explicit that registration with SUGEF is not an authorisation or permit to operate, but it does create the first formal AML perimeter around virtual asset activity in the jurisdiction.

Other Developments

A long-standing casino obligation provides useful context for the new virtual-asset perimeter. Costa Rican casinos, whether physical or internet-based, have been designated AML-obliged entities under Article 15 bis of Law 7786 since 2017, and have been supervised under the same Acuerdo SUGEF 13-19 framework since December 2020. This is not a development of the current cycle but a standing feature of the regime, confirmed directly from SUGEF's own training materials. It is worth noting because it demonstrates that SUGEF already has an operating model for bringing non-bank, high-cash-intensity obliged entities into its supervisory perimeter, a model the virtual-asset consultation appears to be extending to a new sector rather than inventing from scratch.

Costa Rica's broader standing with the regional mutual-evaluation process remains unchanged but is approaching a new test. The jurisdiction is not on the Financial Action Task Force's list of countries with strategic deficiencies, and no grey-listing or black-listing development occurred. However, the Latin American Financial Action Task Force body has listed a possible onsite visit for its Fifth Round Mutual Evaluation of Costa Rica for 1 November 2026, with a possible plenary discussion around July 2027. This evaluation would reassess the country's technical compliance and effectiveness against the full set of international AML/CTF recommendations, several of which remained below full compliance at the 2015 Fourth Round evaluation.

Cross-Monitor Connections

The virtual-asset registration and consultation activity sits squarely at the intersection of financial-crime supervision and digital-asset market structure: the same Article 15 quater registration requirement and the same draft SUGEF 13-19 amendment are material to institutions tracking Costa Rica's crypto licensing and market-access posture, since the AML registration gateway is, at present, the only formal regulatory foothold a virtual asset provider has in the jurisdiction. The absence of a parallel licensing or consumer-protection regime means the AML perimeter is currently doing double duty as the primary point of regulatory contact for the sector, a dynamic worth tracking jointly rather than treating the AML and market-structure threads as independent.

Outlook

The SUGEF 13-19 consultation was still open as of late October 2026, with no confirmed closing date or adoption timeline independently verified; secondary reporting has referenced a short consultation window and unresolved questions on compliance-officer appointment criteria for registered providers. Whether the amendment is adopted substantially as drafted, and whether it is adopted before the possible November 2026 GAFILAT onsite visit, are both open questions worth monitoring together, since a credible operationalisation of the Article 15 quater registration regime ahead of the onsite visit would be a relevant data point for the Fifth Round evaluation's assessment of Recommendation 15 compliance.

Lead Signal

Costa Rica's financial-integrity architecture moved on two fronts in October 2026. CONASSIF approved Acuerdo 2055-2026 unanimously and in firm vote on 5 October 2026, at its session 2055-2026, publishing the measure in Gazette Supplement No. 138 on 14 October 2026. The agreement amends the securities-offering regulation to require issuers to disclose, in prospectuses, any shareholder, direct, indirect or linked through an economic group, holding 10 percent or more of the issuer. Investment managers and administrators face new fit-and-proper screening covering experience, background and international sanctions and watch-list exposure. The measure took effect on publication, with a six-month compliance window for already-registered issuers, and it reads as a deliberate beneficial-ownership tightening in the securities-market segment of the AML perimeter.

Alongside this, the Virtual Asset Service Provider registration duty created under Ley 10961, in force since 19 September 2026, remains in an implementation gap. As of 2 October 2026 CONASSIF had not published, or even opened consultation on, the implementing regulation that would give the registration duty an actual form, platform or window. Costa Rica therefore has a binding legal obligation with no operative mechanism behind it, a structural condition rather than a single incident.

Other Developments

Fintech governance under discussion. The Banco Central de Costa Rica board, at its ordinary session of 16 September 2026, considered consolidating governance of the fintech sector under CONASSIF rather than retaining direct administration at the central bank. No instrument has been adopted and the matter remains at the deliberation stage, but if carried through it would centralise payments, fintech and crypto AML supervisory architecture under a single body.

Standing sanctions exposure. The U.S. Treasury's Office of Foreign Assets Control designated five Costa Rican nationals and five Costa Rica-based entities in connection with narcotics trafficking and money laundering. This action predates the current reporting window and is carried forward unchanged as a standing fact rather than a new development.

FATF and GAFILAT standing. Costa Rica remains outside both the FATF call-for-action list and the increased-monitoring list, and continues under GAFILAT's enhanced follow-up process against its 2024 mutual evaluation ratings of 17 Compliant and 20 Largely Compliant. No change in this status occurred this cycle.

Commercial activity, thin signal. Aggregator data describes a Costa Rican fintech sector of 123 companies, 28 of them funded, with cumulative venture funding of 70.4 million dollars and three acquisitions recorded to date. No single dated transaction within this window was independently verified against a primary source, so this remains background texture rather than a dated finding.

Cross-Monitor Connections

The CONASSIF beneficial-ownership tightening intersects directly with corporate-transparency questions that the World Payments Monitor and the data-protection monitor track from their own angles, particularly where investment-firm ownership disclosure touches entities also active in payments or data processing. The VASP registration implementation gap is the same underlying fact the crypto monitor examines from a licensing-architecture perspective and the World Payments Monitor notes via its Sentinel feed; here the emphasis is the AML-supervisory consequence of a statute in force without an operative registration mechanism. The prospective BCCR-to-CONASSIF governance transfer, if it proceeds, would be a structural supervisory-architecture event relevant to any monitor tracking fintech or crypto oversight in Costa Rica.

Outlook

The CONASSIF implementing regulation for VASP registration is expected in Q4 2026, though this estimate carries quarter-level uncertainty and industry has no confirmed registration platform, threshold schedule, or fee structure to work from as scheduled. Whether the regulation closes the current gap before year end will determine whether Costa Rica's VASP AML perimeter becomes operationally real or remains a paper obligation into 2027. The BCCR governance question remains at the discussion stage, and its resolution either way will shape how fintech and crypto supervision in Costa Rica is organised going forward. The securities-market beneficial-ownership tightening under Acuerdo 2055-2026 is now in force, with the six-month compliance window for registered issuers the next milestone to watch.

Lead Signal

Costa Rica enacted its first AML/CFT registration perimeter for virtual asset service providers this cycle. Law N.246 10961, published in La Gaceta Alcance N.246 78 on 19 June 2026, added Article 15 quater to Law 7786, the countrys core AML/CFT statute, obliging VASPs engaged in exchange, transfer, custody or control, or issuance-related financial services to register with SUGEF and comply with AML/CFT/CPF duties. The provision entered into force around 19 September 2026, three months after publication. Registration is explicitly not an operating licence, a structural choice that closes part of the FATF Recommendation 15 gap for virtual assets while leaving authorisation-level scrutiny thinner than a full licensing regime would provide. CONASSIF, the financial-system oversight body, is due to publish implementing regulations covering thresholds, scope, exclusions and technical requirements within three months of entry into force, expected around the fourth quarter of 2026; that regulation has not yet been published.

Other Developments

Penalty schedule under amended Article 81 is substantial. Breach of registration, customer-due-diligence or reporting duties under Article 15 quater carries penalties of 5% to 50% of the transaction amount, or 2 to 100 base salaries, scaled to gravity and recidivism, under Law 7786 Article 81 as amended by Law 10961 Article 3. Beneficial-ownership filing extension remains unconfirmed. Secondary legal commentary states that VASPs will also need to file annually into Costa Ricas existing Transparencia y Beneficiarios Finales beneficial-ownership registry with the Central Bank, extending BO-registry coverage to the new VASP population as Article 15 quater is implemented; this has not been independently confirmed against the gazette text. Illicit trade flagged as the countrys top criminal-financing channel. Costa Ricas Chamber of Commerce, through its Illicit Trade Observatory, estimated illicit trade at approximately CRC 1.6 trillion, roughly US$3.6 billion, reported 10 September 2026 as the countrys principal source of criminal financing, alongside an estimated CRC 664 billion, roughly US$1.5 billion, in forgone tax revenue; this rests on a single Tier-3 press account relaying a non-governmental trade-association estimate rather than a primary government or Chamber report. GAFILAT evaluation calendar shows forward movement. FATFs global assessment calendar lists a possible onsite period for Costa Ricas 5th-round mutual evaluation in November 2026 and a possible plenary discussion in July 2027, which would be the first assessment of the new VASP registration perimeters real-world effectiveness; Costa Ricas 4th-round evaluation rated it Compliant on 17 and Largely Compliant on 20 of the 40 FATF Recommendations, with no current grey-list status.

Cross-Monitor Connections

The same statutory event is tracked by the crypto monitor as a licensing-and-classification development and by the world-payments monitor as a correspondent-banking consequence: Law 7786, as amended, now bars SUGEF-regulated banks from maintaining commercial relationships with VASPs required to register under Articles 15, 15 bis, 15 ter or 15 quater who are not duly registered. That banking-access bar functions as a de-risking lever independent of the underlying AML substance, and operators unable to register promptly face a practical banking-access consequence layered on top of the AML registration duty itself.

Outlook

The near-term marker is CONASSIFs implementing regulation, expected in the fourth quarter of 2026, which will determine the practical scope of SUGEFs VASP register, including de minimis thresholds and technical and fit-and-proper requirements. Over a longer horizon, the possible GAFILAT onsite in November 2026 and plenary discussion in July 2027 would provide the first independent assessment of whether the registration-without-licensing model closes the Recommendation 15 gap in substance as well as in statute. Whether the RTBF beneficial-ownership extension to VASPs is confirmed, and whether the Chamber of Commerce illicit-trade estimate is corroborated by a primary source, remain open questions that would sharpen Costa Ricas enabler-jurisdiction risk profile if resolved.

Lead Signal

Costa Rica has closed a longstanding FATF Recommendation 15 gap by formally bringing virtual asset service providers within AML/CFT obligated-entity status. New Article 15 quater of Law No. 7786, added by Legislative Decree No. 10961, was unanimously approved in the Legislative Assembly on 25 and 27 May 2026. VASPs must now register with SUGEF for AML/CFT supervisory purposes, though this registration is explicitly stated not to constitute an operating licence. This is an architecture-level shift: the country has extended its AML/CFT perimeter to a sector it had not previously reached, without simultaneously building a substantive licensing regime for that sector.

Other Developments

GAFILAT follow-up concludes with three upgrades. Costa Rica's enhanced follow-up process for its fourth-round mutual evaluation concluded with upgrades on Recommendation 17 from partially compliant to compliant, Recommendation 22 from partially compliant to largely compliant, and Recommendation 28 from non-compliant to largely compliant. This is a technical-compliance improvement across customer due diligence for financial institutions, DNFBP coverage, and regulation and supervision of DNFBPs respectively, reducing the count of identified deficiencies against Costa Rica's mutual evaluation. Comprehensive AML bill reported to pass third reading. A single legal-commentary source reports that Bill 6593, described as a comprehensive AML/CFT law, passed its third reading on 14 April 2026. This claim has not been independently corroborated, and the bill's scope and its relationship to the existing Law 7786 framework remain unverified this cycle; it is treated as an uncertain development pending confirmation against a primary legislative record.

Cross-Monitor Connections

The VASP AML/CFT registration reform is directly relevant to the crypto monitor's licensing coverage of Costa Rica, which is tracking the same Article 15 quater reform from a licensing-perimeter perspective; that monitor's crypto_licensing module is the appropriate venue for analysis of what the registration requirement does and does not confer in terms of operating authorisation. The world-payments monitor's AML/CFT and financial-crime module for this jurisdiction is supplied from this same D7 and D1 material and should be read as consistent with the account given here.

Outlook

The near-term question is whether Costa Rica's next GAFILAT or FATF assessment cycle will register the VASP AML/CFT reform as a further closure of outstanding technical-compliance gaps, building on the R.17, R.22 and R.28 upgrades already achieved. Separately, confirmation of Bill 6593's actual content, scope and legislative status against a primary source remains an open item; until that confirmation arrives, its relationship to the existing Law 7786 AML/CFT framework, and whether it represents a distinct overhaul or a related but separate instrument, cannot be stated with confidence.

Lead Signal

Costa Rica registered two rounds of unilateral U.S. Treasury sanctions action this cycle, both assessed at High confidence from Tier 1 sourcing. In August 2025, OFAC designated Celso Manuel Gamboa Sanchez, a former Vice Minister of Public Security, together with his law firm and a soccer club, under Executive Order 14059 for facilitating narcotics-trafficking-linked money laundering. In January 2026, a second action designated five Costa Rican nationals and five Costa Rica-based entities connected to the Luis Manuel Picado Grijalba cocaine-trafficking network under the same authority. Both actions carry a severity_preliminary rating of CRITICAL in the interpreter record, reflecting the direct implication of a former senior security official and a coordinated multi-entity network rather than an isolated individual designation. No corresponding European Union Council or UK OFSI designation against either set of targets has been identified, a divergence consistent with a broader pattern of US-led autonomous listing against Costa Rica-linked narcotics money laundering that the interpreter record flags as worth sustained tracking rather than a one-off enforcement episode.

Other Developments

Professional and commercial vehicles as laundering fronts. The January 2026 OFAC action named a law firm and a sports club as facilitation vehicles, alongside several Costa Rica-based entities used for storage and transport within the cocaine-trafficking network. Because the designated facilitators include a law firm — a category of professional gatekeeper whose services carry an inherent presumption of legitimacy — the finding illustrates the architecture-over-incident principle directly: the exposure is structural, professional-services capture, rather than confined to the individual transaction chain the designation formally targets. This is consistent with an enabler-jurisdiction characterization assessed at Assessed confidence.

VASP registration reform closes a FATF gap. Costa Rica's Legislative Assembly unanimously approved Amendment No. 25.340 to Law No. 7786 on 27 May 2026, inserting a new Article 15 quater that brings virtual-asset service providers into the AML/CFT obligated-entity perimeter via mandatory SUGEF registration; the amendment was published as Legislative Decree No. 10961 in La Gaceta on 19 June 2026. The interpreter record treats this as closing a documented FATF Recommendation 15 gap on virtual-asset activity, though it is explicitly a registration-for-supervision regime rather than an operating licence, and the corroborating sourcing this cycle is Tier 3 professional-services commentary rather than a retrieved primary La Gaceta text. The reform's practical reach is still unsettled: SUGEF implementing regulations for VASP registration are expected within roughly three months of the gazette publication, but their issuance has not yet been confirmed, leaving open how customer due diligence, record-keeping and suspicious-transaction-reporting mechanics will actually operate in practice.

Comprehensive AML statute progressing, single-sourced. A Comprehensive AML Law, Bill 6593, is reported to have passed its third reading in the Legislative Assembly on 14 April 2026, replacing decree-level provisions dating to 2001. This claim carries only Low confidence this cycle, resting on a single Tier 3 source with no corroborating primary legislative record retrieved. Separately, Costa Rica is confirmed, at Assessed confidence from a Tier 1 FATF/GAFILAT source, to remain outside the FATF grey list while continuing in GAFILAT's enhanced follow-up process stemming from its 2015 Mutual Evaluation, with follow-up reporting through 2024.

Cross-Monitor Connections

The VASP registration reform is the clearest cross-monitor node this cycle. The same SUGEF registration requirement that closes the FATF R.15 gap for this monitor is the substrate for the Crypto Monitor's own crypto_licensing and cross_border_transfer findings, which read the identical Article 15 quater / Decree 10961 reform as a supervisory-perimeter expansion rather than an operating-licence regime. Neither monitor's registration record yet extends to a confirmed operating-licence framework for the underlying crypto-asset activity itself, a gap both this monitor's D5 tracker and the Crypto Monitor's own crypto_licensing module independently flag as the more consequential open question going into the next cycle. The World Payments Monitor's fintech-sector tracking, which records Costa Rica's growing domestic payments and lending fintech population, sits adjacent to this same reform: an expanding fintech and virtual-asset sector operating without a licensing framework, now newly subject to AML/CFT registration, is the structural condition this monitor's D5 and D7 findings and World Payments' product-innovation tracking are both, independently, describing from their respective lenses.

Outlook

The immediate items to watch are whether SUGEF issues the implementing regulations for VASP registration expected within roughly three months of the 19 June 2026 gazette publication, and whether Bill 6593's reported third-reading passage is corroborated by a primary legislative record next cycle. Continued unilateral OFAC designation activity against Costa Rica-linked narcotics-money-laundering targets, absent any EU or UK parallel action, is a sanctions-regime divergence pattern worth sustained tracking rather than a single-cycle anomaly. A third OFAC action against a Costa Rica-linked target without a parallel EU Council or OFSI listing would harden this observation from an assessed pattern into a more confidently structural finding.

Lead Signal

Costa Rica closed a long-flagged gap in its anti-money-laundering architecture this cycle. Legislative Decree No. 10961, amending Article 15 quater of Law 7786 and published in La Gaceta on 19 June 2026, brings virtual-asset service providers into a mandatory SUGEF registration regime for the first time (fim-2026-W32-001). The decree is explicit that SUGEF registration is not an operating licence, but it is the mechanism by which Costa Rica closes the FATF Recommendation 15 gap identified in its mutual-evaluation follow-up process. The architecture matters more than any single enforcement action here: Costa Rica has moved from having no dedicated AML supervisor for virtual-asset activity to having a registration gateway, even though the implementing detail, the CONASSIF regulation that will specify KYC, travel-rule, and suspicious-transaction-reporting infrastructure, remains pending, expected in the third quarter of 2026 (fim-2026-W32-006). Many smaller virtual-asset service providers domiciled in Costa Rica have operated to date with no formal AML supervisor at all, and the gap between the registration mandate now in force and the implementing regulation still pending is itself a supervisory window worth tracking.

Other Developments

Sustained unilateral sanctions pressure. The United States Treasury Office of Foreign Assets Control designated a cocaine-trafficking and money-laundering network centred on Costa Rica on 22 January 2026, naming five individuals and five Costa Rica-based entities, with the Moin seaport identified as a transshipment and laundering node amid rising violence in the Limon region (fim-2026-W32-002, fim-2026-W32-007). This followed an August 2025 designation of Celso Manuel Gamboa Sanchez, a former Vice Minister of Public Security, together with his law firm and a football club, for selling counter-narcotics intelligence to trafficking targets his ministry was meant to be pursuing (fim-2026-W32-003). Two rounds of unilateral OFAC action inside twelve months, against a former senior security official and a large trafficking network alike, is a sustained cadence rather than an isolated event, and no corresponding EU Council or OFSI designation has been identified alongside it. The pairing of a trafficking-network designation with a former security official designation illustrates how sanctions-architecture and state-capture risk can co-locate within a single enabler corridor.

Extradition-bar repeal reduces enabler function, unevenly. Ley N.10730, the 2025 reform to Article 32 of the Constitucion Politica, removed the constitutional prohibition on extraditing Costa Rican nationals in narco-trafficking and terrorism cases. Approximately twenty nationals have been the subject of extradition requests since, and the first transfer, Gamboa himself, was completed in March 2026 (fim-2026-W32-004). This materially reduces the historic function of Costa Rica as a safe haven for laundering-linked nationals. It sits alongside a more static picture at the professional-services layer: the Fourth Round enhanced follow-up of GAFILAT upgraded the rating of Costa Rica on Recommendation 17 to Compliant and on Recommendations 22 and 28 to Largely Compliant in February 2024, but continues to flag customer-due-diligence gaps in the notary, legal, and accounting channels used for company formation, ahead of the Fifth Round evaluation (fim-2026-W32-005, fim-2026-W32-008). The enabler-jurisdiction picture is therefore one of improvement at the state level and persistence of weakness at the gatekeeper level.

Cross-Monitor Connections

The Gamboa designation is a state-capture signal as much as a sanctions one: a former Vice Minister of Public Security monetising counter-narcotics intelligence sits squarely in the territory the World Democracy Monitor tracks as institutional compromise, and financial-integrity and governance-integrity readings of the same underlying fact should be read together rather than separately. The VASP registration regime also intersects directly with payments-monitor coverage of Costa Rica crypto-asset and stablecoin-settlement infrastructure: a de facto banking-access precondition for unregistered virtual-asset service providers is simultaneously an AML-architecture finding and a market-access finding, and the two monitors are tracking the same instrument from adjacent angles.

Outlook

The decisive item for the next cycle is the CONASSIF implementing regulation for Article 15 quater, expected in the third quarter of 2026; its content will determine whether the new VASP perimeter of Costa Rica closes the FATF R.15 gap in substance or only in form. The Fifth Round GAFILAT evaluation, not yet scheduled with precision, will test whether the persistent DNFBP customer-due-diligence weakness has been addressed or remains the residual enabler-jurisdiction risk it has been through the Fourth Round follow-up. Continued OFAC designation activity against Costa Rica-linked networks, absent so far any parallel EU or UK action, remains the clearest near-term signal of where sanctions-architecture risk concentrates.