CR · run world-payments-2026-07-04 v13.3.0
content: ai_generated 127 sources retrieved model claude-sonnet-5 ·

Costa Rica

CR schema world-payments-v1 trajectory: not recorded

Last updated · 14 modules · 64 sourced findings · 127 sources in the cumulative register

14Modulesbaseline.modules[]
64Findingsmodules[].findings[]
25Tier-1 sourcesrun_metadata.t1_source_count
Confidence mix (sums to 14 rendered modules; click to filter)

Jurisdiction brief

Lead Signal

Costa Rica has formally brought virtual asset service providers into its anti-money-laundering perimeter, publishing Legislative Decree No. 10961 (Article 15 quater of Law 7786) in La Gaceta on 19 June 2026. The measure requires VASPs to register with SUGEF and comply with AML/CFT obligations; registration is explicitly not an operating licence, but its practical effect is to close off banking access for any VASP that fails to register, since regulated financial institutions are now restricted from servicing unregistered VASPs. That access-gate dynamic functions as a de facto market-access control even though the registration itself is not a licence. The change sits alongside Costa Rica's existing general supervisory gateway: absent a dedicated fintech statute, Article 15 Bis of Law 7558 already subjects financial-intermediation and public-fundraising activity to SUGEF supervision, and the new VASP regime layers onto that pre-existing baseline rather than replacing it. The distinction between bank and non-bank actors matters here: Decree 10961 targets non-bank payment and e-money intermediaries operating as VASPs, while the banking-access gate itself is administered by bank payment-service providers that remain the gatekeepers of settlement access.

14 of 14 modules
Signal
Density

Selections OR within a group, AND across groups. Press / to search.

#

Costa Rica has no comprehensive fintech/PSP licensing statute; SUGEF Art. 15 Bis (Law 7558) is the general supervisory gateway. Legislative Decree 10961 (Art. 15 quater, Law 7786), published 19 June 2026, formally brings VASPs into a supervised-but-not-licensed AML/CFT registration regime with SUGEF (Expediente 25.340, unanimous approval May 2026).

Movement — NEWVASP AML registration regime establishedFirst cycle capturing this development
Open gap — wpm-int-2Fintech Framework Bill status has not progressed publicly since the 29 April 2025 committee approval (14+ months stalled); no forward enactment timeline was identified.no under-indexing note recorded
Standing sub-brief210 words · last cycle wpm-2026-08-05

Licensing, Authorisation & Market Access

Costa Rica has no comprehensive fintech or payment-institution licensing statute. In the absence of one, Article 15 Bis of Law 7558 operates as a general supervisory gateway, subjecting financial-intermediation and public-fundraising activity to SUGEF oversight regardless of the specific instrument involved. That gateway has now been supplemented by a VASP-specific regime: Legislative Decree No. 10961, adding Article 15 quater to Law 7786, was published in La Gaceta on 19 June 2026 and requires virtual asset service providers to register with SUGEF and meet AML/CFT compliance obligations. The drafters were explicit that registration is not an operating licence, yet its practical effect functions as a market-access control, since regulated financial institutions are now restricted from servicing any VASP that has not completed registration. The underlying reform, Expediente 25.340, passed unanimous second-debate approval on 25-26 May 2026 before proceeding to presidential signature and Gazette publication.

Periodic update · new data 2026-08-11 · run wpm-2026-08-05

Licensing, Authorisation & Market Access

Costa Rica created its first VASP-specific market-access gateway this cycle. Legislative Decree No. 10961, amending Article 15 quater of Law 7786 and published in La Gaceta on 19 June 2026, requires virtual-asset service providers to register with SUGEF as a condition of continued access to Costa Rica's regulated financial system (wpm-2026-W32-002). The decree is explicit and important on a specific point: this registration is an AML/CFT compliance requirement, not an operating licence in the conventional licensing-and-authorisation sense. For a bank-PSP entity, the distinction matters less in practice, since banks already operate inside a supervised perimeter; for a non-bank virtual-asset service provider, the distinction matters a great deal, because the firm now faces a compliance-registration obligation without the accompanying prudential or conduct licensing framework a full licensing regime would typically carry.

This VASP-specific gateway sits on top of a broader, pre-existing supervisory backstop. Article 15 Bis of Law 7558 already subjects financial-intermediation and public-fundraising activity generally to SUGEF supervision, in the continued absence of a dedicated Costa Rican fintech statute (wpm-2026-W32-001). Non-bank payment and crypto-asset firms operating in Costa Rica have therefore been navigating a general supervisory gateway even before the VASP-specific registration regime existed, and Decree 10961 should be read as adding a targeted layer onto that general architecture rather than establishing market access from scratch.

The bank-PSP versus non-bank-PI/EMI distinction is worth stating plainly for this module. A bank offering virtual-asset-adjacent services already sits inside SUGEF's prudential perimeter under Law 7558 and its associated banking regulation; for such an entity, Decree 10961 adds an AML-specific registration step but does not change its fundamental licensing status. A non-bank virtual-asset service provider, by contrast, may have had no direct SUGEF relationship at all prior to 19 June 2026; for that category of firm, the decree is the first point of formal regulatory contact with Costa Rica's financial supervisor, and the compliance build required, customer due diligence, recordkeeping, and eventually travel-rule and suspicious-transaction-reporting infrastructure once CONASSIF's implementing regulation lands, is proportionately larger.

The legislative history is worth noting for market-entry timing purposes. The underlying reform vehicle, Expediente 25.340, achieved unanimous approval at second legislative debate on 25 and 26 May 2026, after which presidential signature and Gazette publication were required before a three-month countdown to entry into force began running (wpm-2026-W32-004). That countdown places full entry into force in mid-to-late September 2026. A firm assessing market entry into Costa Rica's virtual-asset or crypto-adjacent payments space should treat the period between publication and that date as a compliance-preparation window rather than as a grace period in which the underlying obligation does not yet exist in principle.

The market-access consequence of non-registration is the more commercially significant fact for a non-bank PI/EMI-type entrant. Because regulated financial institutions are the counterparties through which SUGEF registration becomes practically enforceable, an unregistered virtual-asset service provider risks losing, or never obtaining, the banking relationships needed to operate at all, converting what is formally an AML registration into a functional market-access licence. No change to Costa Rica's land-based or traditional payment-licensing categories was identified this cycle; the market-access development is confined to the virtual-asset-service-provider segment specifically.

Outlook

The CONASSIF implementing regulation and the full entry into force of Decree 10961 around 19 September 2026 are the two events that will determine how onerous this new market-access gateway actually is in practice. Watch for whether the regulation specifies a workable registration timeline for existing, currently-unregistered virtual-asset service providers, or whether it creates an abrupt compliance cliff that forces smaller non-bank entrants to exit or consolidate.

Sources and findings (5)
  1. T3https://practiceguides.chambers.com/practice-guides/banking-regulation-2025/costa-ricaretrieved
  2. T3https://glclegal.com/blog/fintech-in-costa-rica/retrieved
  3. T1https://www.bccr.fi.cr/en/administrative-proceduresretrieved
  4. T3https://glclegal.com/blog/fintech-in-costa-rica/retrieved
  5. T3https://payatlas.com/regulator/sugef-cr-4835retrieved

#

Consumer/depositor protection rests on the Deposit Guarantee Fund Law (No. 9816) for private banks, SUGEF's disclosure/advertising regulation (SUGEF 10-07), and general consumer-protection law administered via the National Consumer Commission. State-owned banks carry a full sovereign deposit guarantee; private-bank protection is a distinct, less-standardised scheme.

Standing sub-brief141 words · last cycle wpm-2026-07-04

Conduct, Safeguarding & Financial Promotions

State-owned banks in Costa Rica carry a full sovereign deposit guarantee via the Central Bank, while private-bank deposit protection is a distinct, less-standardised scheme under the Deposit Guarantee Fund Law No. 9816. Conduct and financial-promotions rules run through SUGEF 10-07 (the Regulation on Disclosure of Information and Advertising of Financial Products and Services), alongside CONASSIF 4-16 on corporate governance and CONASSIF 6-18 on financial information. The World Bank's Costa Rica Financial Sector Assessment recommends that authorities establish a strong financial-consumer-protection framework based on a clear institutional mandate and dedicated resources, implying the current mandate is fragmented rather than centrally vested.

No periodic updates recorded against this sub-brief.

Sources and findings (4)
  1. T3https://www.expatfocus.com/costa-rica/guide/costa-rica-bankingretrieved
  2. T3https://practiceguides.chambers.com/practice-guides/banking-regulation-2025/costa-ricaretrieved
  3. T3https://glclegal.com/blog/fintech-in-costa-rica/retrieved
  4. T1https://documents1.worldbank.org/curated/en/099054203292320084/pdf/SECBOS092d6c9a0e4096d3013bc7e8afc1f.pdfretrieved

#

Costa Rica has no stablecoin-specific or comprehensive VASP licensing law in force. The BCCR does not treat cryptoassets as legal tender but does not prohibit private use. A VASP AML/CFT registration reform (building on Bill 22.837) has been reported as enacted around May 2026, requiring SUGEF registration for AML/CFT supervisory purposes only — explicitly not an operating licence. A BCCR digital-colón CBDC initiative remains at the research stage since 2021 with no pilot launched.

Open gap — wpm-int-1No confirmed enactment date (presidential signature / La Gaceta publication) for the VASP AML/CFT registration reform (Amendment 25.340) was available in source material; status should be tracked to confirm actual in-force date.no under-indexing note recorded
Standing sub-brief176 words · last cycle wpm-2026-07-04

Stablecoins & Digital Money

Amendment No. 25.340 to Law 7786, adding Article 15 quater and formally bringing virtual asset service providers into Costa Rica's AML/CFT framework with mandatory SUGEF registration, was passed unanimously by the Legislative Assembly on 27 May 2026. As of late June 2026 it awaits presidential signature and publication in La Gaceta and has not been enacted; the registration is explicitly not an operating licence. SUGEF's registration/deregistration regime under Articles 15 and 15-bis of Law 7786 exists for AML/CFT purposes only and creates no general VASP authorisation; token issuance, custody rules and exchange licensing remain unregulated. The BCCR's digital-colón CBDC initiative, announced in 2021, remains recorded as "Research" status with no pilot or wholesale programme launched.

No periodic updates recorded against this sub-brief.

Sources and findings (6)
  1. T1https://www.fatf-gafi.org/content/dam/fatf-gafi/fsrb-fur/GAFILAT-Costa-Rica-Follow-Up-Report-2023.pdf.coredownload.pdf
  2. T4https://www.zigram.tech/resources/cr-crypto-regulation-july-2025/retrieved
  3. T4https://www.eglobalcentraluk.com/costa-rica-crypto-company-setup-2026-what-you-need-to-know/retrieved
  4. T2https://cbdctracker.org/currency/costa_rica-costa_rica_cbdcretrieved
  5. T4https://www.privacy-solutions.com/blog/costa-rica-crypto-company-formation/retrieved
  6. T4https://gofaizen-sherle.com/crypto-license/costa-ricaretrieved

#

Costa Rica's operational-resilience posture was shaped decisively by the April 2022 Conti/Hive ransomware campaign against government systems, which triggered a national state of emergency. IT/outsourcing risk management for the regulated financial sector sits under CONASSIF 5-17, complemented by a 2023-2027 national cybersecurity strategy backed by US government support for a national SOC.

Horizon · 2027-12-31 (±multi_year)Costa Rica 2023-2027 national cybersecurity strategy concludesin_force · TT3
Standing sub-brief142 words · last cycle wpm-2026-07-04

Operational Resilience & Critical Infrastructure

Beginning 17 April 2022, a Conti/Hive ransomware attack hit nearly 30 Costa Rican government institutions, including the Ministry of Finance and the state Social Security Fund, prompting a declared state of emergency. CONASSIF 5-17, the Regulation of Information Technology Management, is the operative IT and operational-resilience regulation applicable to SUGEF-supervised financial entities, alongside CONASSIF 16-22 on consolidated supervision. Following the 2022 attack, Costa Rica released a 2023-2027 national cybersecurity strategy including mandatory cybersecurity personnel in every government ministry, with the U.S. State Department committing $25 million to build a national Security Operations Center.

No periodic updates recorded against this sub-brief.

Sources and findings (4)
  1. T3https://en.wikipedia.org/wiki/2022_Costa_Rican_ransomware_attackretrieved
  2. T3https://www.centerforcybersecuritypolicy.org/insights-and-research/costa-rican-cybersecurity-policy-with-minister-paula-bogantes-dcp-s2-e7retrieved
  3. T3https://practiceguides.chambers.com/practice-guides/banking-regulation-2025/costa-ricaretrieved
  4. T1https://documents1.worldbank.org/curated/en/099054203292320084/pdf/SECBOS092d6c9a0e4096d3013bc7e8afc1f.pdfretrieved

#

Costa Rica is the only known jurisdiction to impose central-bank price controls on both merchant discount rates and interchange/interchange-reimbursement fees for card schemes, under Legislative Decree 9831 (2020), implemented and progressively tightened by BCCR through annual ordinary reviews. This regime is currently the subject of active litigation from Visa and Mastercard (see W7).

Standing sub-brief147 words · last cycle wpm-2026-07-04

Scheme & Network Compliance

Under Legislative Decree/Law No. 9831 (2020), the BCCR sets maximum acquisition and interchange reimbursement fees for card schemes; the domestic acquiring cap sits at 1.95% and interchange at 2.0%, with separate and historically higher cross-border caps under Article 46. Costa Rica is described as the only known jurisdiction imposing central-bank price controls on both merchant discount rates and interchange fees. Starting 24 November 2020, the BCCR set maximum interchange fees for domestic cards at 2.0% and maximum MDR at 2.5%, and has gradually ratcheted down both caps over a four-year period through mandatory annual ordinary reviews.

No periodic updates recorded against this sub-brief.

Sources and findings (5)
  1. T1https://www.bccr.fi.cr/en/payments-system/general-information/cardsretrieved
  2. T4https://laweconcenter.org/resources/the-consequences-of-caps-on-cross-border-payment-fees-in-costa-rica/retrieved
  3. T4https://truthonthemarket.com/2024/10/30/what-the-imf-gets-wrong-about-costa-ricas-payment-card-caps/retrieved
  4. T1https://www.bccr.fi.cr/marco-legal/DocReglamento/Reglamento-sistemas-tarjetas-de-pago.pdfretrieved
  5. T3https://ticotimes.net/2024/10/04/visa-and-mastercard-sue-costa-ricas-central-bank-over-fee-capsretrieved

#

Costa Rica's principal cross-border payment corridors are outbound remittances to Nicaragua and inbound remittances from the United States, both intermediated primarily through banks/MTOs and correspondent banking/SWIFT rather than any regional instant-payment linkage. Domestically, SINPE and SINPE Móvil dominate retail rails; SINPE-TP extends contactless rails into public transport.

Open gap — wpm-int-4Corridor coverage under-indexes Central American rail linkages beyond the CR-Nicaragua corridor (e.g., Panama, Honduras) and does not address regional instant-payment scheme participation.Emerging-market/regional rail coverage beyond the CR-NI corridor is thin, consistent with the methodology's flagged emerging-market-rails under-indexing risk.
Standing sub-brief153 words · last cycle wpm-2026-07-04

Payment Corridor Dynamics

The cost of sending money from Costa Rica to Nicaragua doubled from about 3% in 2015Q4 to more than 6% in 2023Q1, a steeper trajectory than the regional Latin America average of 5.8%. The World Bank Remittance Prices Worldwide database tracks the US-to-Costa Rica corridor with typical costs in the 1.8-2.1% range at the $200-$500 send-value tier, materially cheaper than the CR-Nicaragua corridor. Bank letters of credit remain the most common and secure trade-payment method, and the free convertibility of the colón alongside the absence of remittance controls encourages open-account relationships where credit risk is minimal.

No periodic updates recorded against this sub-brief.

Sources and findings (4)
  1. T1https://blogs.worldbank.org/en/peoplemove/remittances-latin-america-still-growingretrieved
  2. T1https://remittanceprices.worldbank.org/corridor/United%20States/Costa%20Ricaretrieved
  3. T3https://mobility-innovators.com/costa-rica-launched-national-electronic-payment-system-for-public-transportation/retrieved
  4. T2https://www.trade.gov/country-commercial-guides/costa-rica-trade-financingretrieved

#

Costa Rica's banking sector is highly concentrated (top-5 banks ~80% of assets), led by two state-owned banks holding 44% of assets, alongside foreign-owned private banks (BAC Credomatic/Grupo Aval, Scotiabank transitioning to Davivienda). A growing but still-fragmented non-bank fintech sector (estimated 45-120 firms) operates without a dedicated licensing regime, and no BigTech currently operates domestically.

Standing sub-brief183 words · last cycle wpm-2026-07-04

Industry Structure & Commercial Dynamics

Bank-asset concentration among the largest five banks in Costa Rica stands at 80%; the two largest, state-owned Banco de Costa Rica and Banco Nacional de Costa Rica, together account for 44% of total banking-sector assets. The World Bank counts approximately 45 fintech entities, mostly specialised in payments and transfers, while The Fintech Times' 2026 estimate places the figure as high as 120 firms across payments, lending, wealthtech and insurtech, with no BigTech currently operating domestically. Davivienda Group completed its acquisition of Scotiabank's Costa Rica, Colombia and Panama banking operations under an agreement announced 6 January 2025; final regulatory approvals were received 24 November 2025 and the transaction closed 1 December 2025, with the operational switch to Davivienda Group effective 3 December 2025.

No periodic updates recorded against this sub-brief.

Sources and findings (5)
  1. T1https://documents1.worldbank.org/curated/en/099054203292320084/pdf/SECBOS092d6c9a0e4096d3013bc7e8afc1f.pdfretrieved
  2. T1https://documents1.worldbank.org/curated/en/099054203292320084/pdf/SECBOS092d6c9a0e4096d3013bc7e8afc1f.pdf
  3. T3https://thefintechtimes.com/the-fintech-landscape-of-central-america-costa-rica-in-2026/retrieved
  4. T4https://grokipedia.com/page/List_of_banks_in_the_Americasretrieved
  5. T1https://s1.q4cdn.com/250184606/files/doc_financials/2025/ar/33049d4a-947a-4652-8295-227b69ca763a.pdfretrieved

The dominant live payments litigation in Costa Rica is the Visa/Mastercard challenge to the BCCR's interchange/MDR fee-cap regime under Law 9831, contesting the central bank's jurisdiction over cross-border card transactions. A parallel legislative effort to strip the BCCR of authority over cross-border fees is opposed by the BCCR president.

Standing sub-brief187 words · last cycle wpm-2026-07-04

Legal & Litigation

Visa and Mastercard argue that Law 9831 grants the BCCR authority only over domestic transactions and that its regulations impermissibly extend to participants located outside Costa Rica, calling the caps a form of "price control"; Mastercard has stated that Costa Rica is the only country imposing such unilateral measures. A bill under review in the Legislative Assembly aims to remove the BCCR's authority to regulate cross-border card transactions and is supported by Visa and Mastercard, but opposed by the BCCR president, who argues eliminating the caps would have an economic impact comparable to the VAT. Judiciary data shows only 85 cyber-fraud trials in 2024, with 44 acquittals and 41 convictions, mostly suspended sentences, and an average total criminal-process time of over four years, despite a surge in complaints.

No periodic updates recorded against this sub-brief.

Sources and findings (4)
  1. T3https://ticotimes.net/2024/10/04/visa-and-mastercard-sue-costa-ricas-central-bank-over-fee-capsretrieved
  2. T3https://ticotimes.net/2024/10/04/visa-and-mastercard-sue-costa-ricas-central-bank-over-fee-capsretrieved
  3. T3https://qcostarica.com/cybercriminal-businesses-plague-costa-rica-scams-grew-668-in-4-years-with-just-a-handful-of-convictions/retrieved
  4. T4https://laweconcenter.org/resources/regulating-payment-card-fees-international-best-practices-and-lessons-for-costa-rica/retrieved

#

Merchant acquiring in Costa Rica operates through bank-affiliated gateways subject to SUGEF oversight, with acquiring/interchange fees capped by BCCR regulation. Riskier or ecommerce-ineligible merchant categories face ad hoc bank-level rejection rather than a codified high-risk-MCC framework, and select MCCs (fuel, EV charging, tolls, regulated transport, charities) are carved out of the standard acquiring fee cap.

Standing sub-brief117 words · last cycle wpm-2026-07-04

Merchant Acquiring & Risk

Payment gateways in Costa Rica are not banks; they operate in conjunction with an acquiring bank and, subject to SUGEF oversight, have permission only to process collections, while only the bank can approve or reject the final transaction, often without disclosing rejection reasons. The domestic maximum acquiring commission of 1.95% carries explicit carve-out exceptions for service stations, electric-vehicle charging services, tolls, ARESEP-regulated transport services, and charitable organisations.

No periodic updates recorded against this sub-brief.

Sources and findings (3)
  1. T3https://elcolectivo506.com/online-payment-processing-in-costa-rica-what-small-business-owners-need-to-know/?lang=enretrieved
  2. T1https://www.bccr.fi.cr/marco-legal/DocReglamento/Reglamento-sistemas-tarjetas-de-pago.pdfretrieved
  3. T4https://truthonthemarket.com/2024/10/30/what-the-imf-gets-wrong-about-costa-ricas-payment-card-caps/retrieved

#

SINPE Móvil is Costa Rica's flagship retail payment innovation, achieving near-universal adult engagement since its 2015 launch, alongside a 2015-era EMV/contactless migration mandate and the SINPE-TP transit-payment rollout. CBDC work remains at research stage; open banking/open-finance rulemaking is under discussion but not yet formalised; institutional Bitcoin ETF access entered the banking system in 2025.

Movement — CHANGEDFraud typology growth documentedNew complaint/loss statistics collected
Open gap — wpm-int-5Open banking/open-finance formal rulemaking in Costa Rica is reported as 'under discussion' with no published consultation timeline or expected in-force date identifiable from current sources.no under-indexing note recorded
Standing sub-brief198 words · last cycle wpm-2026-08-05

Product Innovation & Market Development

SINPE Movil, Banco Central de Costa Rica's mobile-payments scheme, has reached near-universal penetration: more than 80% of Costa Ricans aged 15 and over were active users as of 2025, generating in excess of 65 million transactions a month. That adoption level is also associated with lower cash withdrawals and reduced bank non-interest expenses, a structural feature of the retail-payments environment rather than a new development this cycle.

Periodic update · new data 2026-08-11 · run wpm-2026-08-05

Product Innovation & Market Development

SINPE Movil, the Banco Central de Costa Rica's instant-payment rail, is the dominant product-innovation story in Costa Rica's payments market, and its scale is now large enough to generate its own distinct risk profile. Over eighty percent of Costa Ricans aged fifteen and older are active users, and the rail processes more than sixty-five million transactions a month on 2025 data (wpm-2026-W32-005). This is not a new-product-launch story so much as a maturity story: an account-to-account instant-payment scheme that has moved from innovation to default national payment behaviour, correlating, per the underlying research, with reduced cash withdrawals and lower bank non-interest expense.

That scale has produced a fraud-typology surface commensurate with the rail's reach. SIM-recycling schemes locally described as comando PASE and WhatsApp verification-code takeover scams are reported to have driven 25,498 fraud complaints between 1 January 2025 and 30 March 2026, with instant-transfer fraud losses reported near three billion Costa Rican colones (wpm-2026-W32-006). This figure carries a Low-confidence rating in the underlying research and rests on a single Tier-4 aggregator source; no Tier-1 central-bank or supervisory publication of these statistics has been located this cycle, and the figures should be treated as indicative rather than confirmed pending independent verification.

The product-innovation and fraud dimensions are connected rather than separate stories: an instant-payment rail's core value proposition, speed and near-universal reach, is also what SIM-recycling and verification-code takeover typologies exploit, since both attack vectors depend on intercepting or redirecting the authentication step that authorises an instant, largely irreversible transfer. A rail's adoption success and its fraud-typology exposure tend to scale together, and SINPE Movil's trajectory this cycle illustrates that dynamic directly.

The specific mechanics reported, SIM-card recycling that allows a fraudster to regain control of a victim's mobile number, combined with WhatsApp verification-code interception, target the two-factor and device-binding assumptions that instant-payment authentication typically relies on. If accurate, the reported complaint volume implies an average of roughly nineteen complaints a day over the fifteen-month window covered, though this arithmetic derives from the aggregator figure rather than from any independently confirmed periodisation, and should be read with the same low-confidence caveat as the underlying statistic.

For a payments entrant assessing Costa Rica, SINPE Movil's ubiquity functions as both an opportunity and a constraint: any account-to-account or wallet-based product entering the market must interoperate with, or compete directly against, a rail that already reaches the overwhelming majority of the adult population, and adoption economics for a new instant-payment product in Costa Rica should be modelled against that existing baseline rather than against a green-field payments landscape. No new product launch, open-banking initiative, or BNPL-adjacent development was identified for Costa Rica this cycle; the product-innovation signal is confined to the fraud-typology growth layered onto SINPE Movil's existing, already-mature adoption base. This module's overall read for the cycle is therefore one of a mature, dominant product facing a scaling fraud challenge rather than a market awaiting its next payments-innovation launch.

Outlook

The central open question for this module is whether Tier-1 verification of the SINPE Movil fraud-loss and complaint figures becomes available, since the current Tier-4 sourcing significantly limits confidence in the scale of the problem. Watch also for any Banco Central de Costa Rica response, authentication-hardening measures, liability-allocation rules, or public-awareness campaigns, targeting the SIM-recycling and verification-code takeover typologies specifically, given the rail's near-universal reach makes any systemic control failure correspondingly consequential.

Sources and findings (6)
  1. T1https://www.sciencedirect.com/science/article/pii/S2666143826000050retrieved
  2. T1https://www.bis.org/publ/bppdf/bispap152_d_rh.pdfretrieved
  3. T3https://littlepay.com/littlepay-announces-its-participation-in-costa-ricas-national-electronic-payment-system-for-public-transportation-sinpe-tp/retrieved
  4. T2https://cbdctracker.org/currency/costa_rica-costa_rica_cbdcretrieved
  5. T3https://thefintechtimes.com/the-fintech-landscape-of-central-america-costa-rica-in-2026/retrieved
  6. T4https://www.ainvest.com/news/costa-rica-crypto-market-reach-20-3-million-2025-2506/retrieved

#

SINPE Móvil-linked social-engineering fraud (SIM/phone-recycling scams and WhatsApp verification-code takeovers) is the dominant consumer-facing payments-fraud vector, with rapidly rising complaint volumes and losses but low criminal conviction rates. No mandatory APP-fraud reimbursement scheme comparable to the UK PSR model was identified in force.

Open gap — wpm-int-3No mandatory APP-fraud reimbursement scheme comparable to the UK PSR model was identified as in force in Costa Rica despite escalating SINPE Movil-linked fraud losses.no under-indexing note recorded
Standing sub-brief158 words · last cycle wpm-2026-07-04

Consumer Protection & APP Fraud

A SIM-recycling scam known as "Sinpe mediante comando PASE" and a newly prevalent WhatsApp verification-code takeover scam are driving fraud growth: 25,498 fraud complaints were recorded between 1 January 2025 and 30 March 2026, with reported instant-transfer fraud losses near ₡3 billion, up about 88% year-on-year. Financial consumer protection rules derive from the Law on the Promotion of Competition and Effective Consumer Defense and National Consumer Commission provisions, which apply generally to contractual terms and consumer protection but are not payments-fraud-reimbursement specific; no mandatory APP-fraud reimbursement scheme comparable to the UK PSR model was identified in force.

No periodic updates recorded against this sub-brief.

Sources and findings (5)
  1. T3https://ticosland.com/sinpe-fraud-rises-in-costa-rica/retrieved
  2. T3https://ticotimes.net/2026/05/12/costa-rica-oij-warns-of-new-whatsapp-verification-code-scamsretrieved
  3. T3https://ticotimes.net/2026/04/18/costa-rica-sees-ongoing-spike-in-digital-fraud-tied-to-travel-and-paymentsretrieved
  4. T3https://qcostarica.com/cybercriminal-businesses-plague-costa-rica-scams-grew-668-in-4-years-with-just-a-handful-of-convictions/retrieved
  5. T3https://glclegal.com/blog/fintech-in-costa-rica/retrieved

#

Costa Rica remains in GAFILAT's enhanced follow-up process from its 2015 Mutual Evaluation, with its most significant outstanding technical gap being VASP supervision (Recommendation 15, downgraded to Non-Compliant). The core AML/CFT legal architecture is Law 8204/7786, supervised jointly by SUGEF/CONASSIF and the ICD's Financial Intelligence Unit.

Standing sub-brief236 words · last cycle wpm-2026-07-04

AML/CFT & Financial Crime

The following intelligence on Costa Rica's AML/CFT posture is sourced from the Sentinel.gi feed and is carried here as cross-referenced provenance rather than original illicit-finance analysis; readers should consult Sentinel.gi directly for the underlying investigative detail. Recommendation 15 (New Technologies/VASPs) was downgraded from Compliant to Non-Compliant because Costa Rica lacked a risk-based approach or a supervisory/oversight entity for virtual asset service providers at the time of the relevant re-rating analysis. Costa Rica remains in GAFILAT's enhanced follow-up process from its 2015 Mutual Evaluation, with core AML/CFT legal architecture under Law 8204/7786, supervised jointly by SUGEF/CONASSIF and the ICD's Financial Intelligence Unit per SUGEF 13-19 and SUGEF 12-21. A VASP registration reform bringing virtual asset service providers into scope as AML/CFT obligated subjects, requiring mandatory SUGEF registration, is driven primarily by the need to close the FATF Recommendation 15 gap rather than to establish a fintech-specific licensing policy. Consistent with the parallel W2 correction, this reform passed the Legislative Assembly on 27 May 2026 but is not yet enacted, pending presidential signature and La Gaceta publication.

No periodic updates recorded against this sub-brief.

Sources and findings (7)
  1. T4sentinel.vasp-registration-reform-2026
  2. T?FIM (sentinel.gi) per-JID baseline profile — Costa Rica — Costa Rica's AML/CFT regime rests on Law 7786 (as amended), supervised by SUGEF/CONASSIF for financial institutions and by the DNN and SUGEF for DNFBPs, with a non-public beneficial-ownership registry (RTBF, Decree 41040-H) and FIU functions housed within the Costa Rican Drug Institute (ICD). GAFILAT's Fourth Round enhanced follow-up (Feb 2024) recorded technical-compliance upgrades (R17 to Compliant; R22, R28 to Largely Compliant) but flagged residual DNFBP customer-due-diligence gaps ahead of the Fifth Round evaluation.
  3. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: sourcing-thinness
  4. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: enforcement-absence
  5. T1FIM (sentinel.gi) sanctions_change_register (issue FIM-BASE-SANC-002) — Sanctions: OFAC listing
  6. T1FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-002) — Enforcement: OFAC (US Treasury) — Picado Grijalba narcotics-trafficking network and Costa Rican front companies
  7. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: political-constraint

#

Costa Rica's banking sector is highly concentrated (top-5 banks hold roughly 80% of assets; the two state-owned majors hold 44%), and the pending Davivienda Group acquisition of Scotiabank's Costa Rica, Colombia and Panama operations continues to work through final regulatory approvals. The new VASP AML registration duty under Decree 10961 layers an additional de facto access gate onto this concentrated banking landscape for crypto firms.

Movement — CHANGEDBanking-access gate tightening for VASPsNew de facto precondition identified
Standing sub-brief189 words · last cycle wpm-2026-08-05

Correspondent Banking, Settlement & Access

Costa Rica's banking sector remains highly concentrated: the top five banks hold roughly 80% of assets, and the two state-owned majors, BCR and Banco Nacional, together hold 44%. No Tier-1 SUGEF or CONASSIF source for these concentration figures was located this cycle, and the figures should be read as indicative.

Periodic update · new data 2026-08-11 · run wpm-2026-08-05

Correspondent Banking, Settlement & Access

Costa Rica's correspondent-banking and domestic-settlement access picture this cycle is defined by a widening asymmetry between bank and non-bank access to the regulated financial system, layered onto an already-concentrated banking sector. Costa Rica's banking sector is estimated to be concentrated, with the top five banks holding roughly eighty percent of sector assets and the two state-owned majors, Banco de Costa Rica and Banco Nacional, holding forty-four percent between them; this figure, however, rests on a Tier-4 source, and no Tier-1 SUGEF or CONASSIF publication of these concentration statistics has been located this cycle (wpm-2026-W32-007).

Onto that structure, Legislative Decree No. 10961 layers a fresh access precondition specific to virtual-asset service providers. Regulated Costa Rican financial institutions are now positioned to restrict or decline banking relationships with virtual-asset service providers that have not completed SUGEF registration under the decree's Article 15 quater regime, converting what is formally an AML/CFT registration requirement into a practical determinant of correspondent and domestic banking access for that segment (wpm-2026-W32-003, wpm-2026-W32-002). This is the bank-versus-non-bank asymmetry that is this module's analytical spine: a bank already operating inside SUGEF's supervisory perimeter faces a comparatively small incremental compliance step, while a non-bank virtual-asset service provider, which may have had no prior SUGEF relationship at all, now faces a binary access question, register, or risk losing the banking relationships the business depends on.

That asymmetry is compounded by the underlying banking sector's concentration. In a market where five banks, two of them state-owned, hold the overwhelming majority of assets, a non-bank virtual-asset firm that loses or fails to establish a banking relationship with one of a small number of major counterparties has correspondingly few alternative paths to regulated banking access within Costa Rica. Settlement concentration risk follows from asset concentration in a fairly direct way: if a non-bank virtual-asset service provider's banking relationship sits with one of the two state-owned majors, or with one of the remaining members of the top five, the loss of that single relationship removes access to a correspondingly large share of Costa Rica's domestic settlement infrastructure at once, rather than being one of several roughly equal alternatives.

For a foreign payments or crypto-asset firm assessing Costa Rica as an entry market, the practical due-diligence question this cycle is not only whether the firm itself can register with SUGEF under Decree 10961, but which of Costa Rica's five major banks, if any, is willing to bank an entity in the process of completing that registration, given that registration itself is not instantaneous and the intervening period is where access risk is concentrated. This access-asymmetry dynamic is a payments-market-structure finding distinct from, though closely related to, the AML-architecture reading of the same instrument; the two readings should be tracked together as CONASSIF's implementing detail is finalised.

No new development regarding cross-border correspondent-banking relationships specifically, or regarding Costa Rica's access to international payment corridors and settlement networks, was identified this cycle; the access dynamic in focus is the domestic bank-to-VASP relationship rather than Costa Rica's own correspondent relationships with foreign banks.

Outlook

Watch for whether CONASSIF's implementing regulation, expected in the third quarter of 2026, specifies a transition period for virtual-asset service providers currently without a banking relationship, or whether it leaves banks free to decline service to unregistered firms immediately upon the regime's full entry into force around 19 September 2026. Independent, Tier-1 verification of the banking-sector concentration figures would also materially improve confidence in how acute the access asymmetry described here actually is in practice.

Sources and findings (4)
  1. T2https://www.privacyshield.gov/ps/article?id=Costa-Rica-us-banksretrieved
  2. T3https://www.cov.com/en/news-and-insights/insights/2025/05/correspondent-banking-related-risks-arising-from-cartels-designations-as-terrorist-organizationsretrieved
  3. T3https://www.cov.com/en/news-and-insights/insights/2025/05/correspondent-banking-related-risks-arising-from-cartels-designations-as-terrorist-organizationsretrieved
  4. T2https://www.trade.gov/country-commercial-guides/costa-rica-trade-financingretrieved

#

Costa Rica-specific commercial activity in the trailing 12 months is comparatively thin relative to processor-level regional M&A (e.g., Evertec's broader Latin American acquisition programme); the clearest Costa Rica-specific event in-window is a nearshore technology-services acquisition. Deal value for that transaction is undisclosed.

Standing sub-brief59 words · last cycle wpm-2026-08-05

Commercial Intelligence (M&A, Investment & Product)

Davivienda Group's acquisition of Scotiabank's Costa Rica, Colombia and Panama operations, announced 6 January 2025, remains pending final regulatory approvals this cycle, with no new development recorded and the deal value not publicly disclosed.

Outlook

Resolution of the pending regulatory approvals is the marker to watch; no new timeline was disclosed this cycle.

No periodic updates recorded against this sub-brief.

Sources and findings (2)
  1. T3https://nearshoreamericas.com/evertec-acquires-brazilian-rival-dimensa/
  2. T1https://s1.q4cdn.com/250184606/files/doc_financials/2025/ar/33049d4a-947a-4652-8295-227b69ca763a.pdfretrieved
No modules match.

Filters combine as OR inside a group and AND across groups.

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for Costa Rica
FieldValue
trust.lawyer_review.statusnever_reviewed
trust.lawyer_review.reviewernot recorded
trust.content_sourceai_generated

Provenance and declared absence

Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is.

Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page.

Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; per-module RAG traffic light; derived_scores = {"legal_accessibility": {"per_product": {"account_to_account": "regulated"}}}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-08-11. A year-precision row is never promoted into a tighter band.

Orphan deltas: 2 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card.

Envelope: baseline resolved at jurisdiction_json.baseline; 14 module(s), 64 finding(s), 144 source(s) in the cumulative register.