Costa Rica VASP regulation changed in 2026 when Law No. 10961 added Article 15 quater to Law No. 7786. The reform brings certain virtual asset service providers into Costa Rica’s AML/CFT/CPF framework and requires covered businesses to register with SUGEF. What matters, however, is the activity a company actually performs. Holding digital assets, using blockchain technology, or having “crypto” in a business description does not by itself answer whether Article 15 quater applies. Exchange, transfers, custody, control of virtual assets, and certain services connected with issuance or sale are much closer to the statutory perimeter.
Why Costa Rica VASP registration now needs an activity review
The reform is easy to oversimplify. A founder may hear that Costa Rica now regulates VASPs and assume that every crypto company follows the same registration path. Article 15 quater is narrower than that.
The law focuses on providers carrying out specified virtual asset activities as a business. This means the practical review starts with contracts, transaction flows, wallet permissions, settlement arrangements, and the way the company interacts with customer assets.
For founders researching VASP registration in Costa Rica, that distinction should come before incorporation or preparation of a compliance file. A software company that provides infrastructure without controlling assets may raise different questions from an exchange or custodial wallet, even if both describe themselves as crypto businesses.
The reform also separates registration from wider operating permissions. Article 15, quater, expressly states that registration with SUGEF does not represent authorization to operate. Other financial, payment, securities, tax, consumer, or foreign-market rules can still apply.
Which activities does Article 15 quater cover?
The statutory wording identifies several categories of virtual asset services. These categories should be read by looking at what the business actually does rather than at its marketing label.
An OTC desk, for example, may fall within exchange activity even if it does not operate a conventional public exchange. A wallet provider may enter the perimeter if it controls customer assets or private keys. A company involved in token issuance may need closer review where it also provides financial services connected with offering, marketing, or selling those assets.
| Business activity | Why Article 15 quater may apply | Question to examine |
| Fiat-to-crypto or crypto-to-crypto exchange | Exchange is expressly covered | Who executes and settles the exchange? |
| Virtual asset transfers | Transfers are listed activities | Who controls or initiates the movement? |
| Custodial wallet | Custody and control are covered | Does the provider control customer assets or access? |
| Token-related financial services | Certain issuance and sale services are covered | Is the company providing a financial service around the issuance or sale? |
Where the line becomes less obvious
Some business models are harder to classify because the technology and the regulated function do not always sit in the same company.
A non-custodial software provider may supply an interface while users retain control of their own assets. A blockchain analytics company may work entirely with transaction data and never execute transfers. A group structure may place customer contracts in one entity while another company provides infrastructure.
In these cases, labels are particularly unreliable. Calling a product “non-custodial” is useful only if the actual technical and contractual arrangements support that description. The same applies to businesses using terms such as “marketplace,” “protocol,” “gateway,” “broker,” or “infrastructure provider.”
Facts that should be mapped before deciding scope
- Which entity signs the contract with the user.
- Whether the company can access, move, freeze, or recover customer assets.
- Which entity executes an exchange or transfer.
- Whether fiat money enters or leaves the transaction flow.
- Who holds private keys or comparable control credentials.
- Whether the company performs the activity habitually in Costa Rica.
- Whether another financial regulator may also have authority over part of the service.
Registration does not turn a VASP into a generally licensed financial business
This distinction deserves special attention because “VASP license” is often used casually in commercial discussions.
Costa Rica’s reform creates a registration and supervisory framework focused on anti-money laundering, counter-terrorist financing, and counter-proliferation financing. It does not create a blanket crypto license that approves every product offered by the registered company. The law itself states that registration is not authorization to operate.
That difference matters when a business approaches banks, payment providers, or counterparties. SUGEF registration may become an important part of the compliance profile for a covered VASP, but a bank can still carry out its own customer due diligence, examine ownership, transaction flows, source of funds, customer markets, and financial capacity before deciding whether to provide an account. Registration does not compel a bank or EMI to accept the company.
It also does not replace authorization that may be required for another regulated service. If the product moves beyond the VASP perimeter into an activity supervised elsewhere, that separate analysis remains necessary.
Law 10961 also changes the compliance workload
Being within Article 15 quater means more than entering a company name on a register. The new framework brings covered providers into a set of preventive obligations dealing with customer identification, beneficial ownership, transaction records, higher-risk relationships, transaction monitoring, and related AML/CFT/CPF controls.
This changes how early-stage companies should prepare. Corporate documents need to match ownership records. The operating model should explain actual fund and asset flows rather than relying on a broad description such as “crypto services.” Compliance policies should correspond to the risks created by the product, customer base, technology, and geography.
The remaining implementation mechanics also matter. Recent legal commentary noted that the detailed CONASSIF regulation governing categories, thresholds, and filing documentation had not yet been issued immediately around the law’s effective date. Businesses preparing a submission therefore need to distinguish the statutory duties already created by Law 10961 from procedural details that still depend on implementing rules.
Foreign companies should not assume domicile settles the question
Article 15 quater can also matter to companies that were incorporated outside Costa Rica.
The statutory discussion focuses on carrying out covered activity as a business with a Costa Rican nexus rather than treating the place of incorporation as the only factor. A foreign group serving Costa Rican users may therefore need to examine whether its activities are performed habitually in Costa Rican territory and which entity is actually responsible for the covered service.
This becomes particularly important in group structures. One company may own the technology, another may contract with customers, and a third may handle custody or settlement. The analysis should follow those functions rather than assume the entire group shares one regulatory position.
Article 15 quater makes business-model accuracy more important
Costa Rica’s 2026 reform does not make every blockchain company a VASP, and it does not give registered providers a universal authorization to operate. It does something more specific: it identifies defined virtual asset activities and brings covered providers into SUGEF’s AML/CFT/CPF registration and supervisory framework.
For a company considering VASP registration in Costa Rica, the useful starting point is therefore a detailed map of what the business actually does. Exchange, transfer, custody, control, and issuance-related financial services deserve close attention, while software-only and other indirect models may require a more fact-specific review.
That approach also makes later compliance work more coherent. The entity named in the application, ownership information, transaction flows, customer due diligence, and technical controls should all describe the same real business. When those pieces line up, Article 15 quater becomes easier to assess as what it actually is: an activity-based regulatory perimeter rather than a generic label applied to every company working with digital assets.
