Costa Rica Crypto Legal Gray Area: Risks, Bill 22.837, and VASP Rules

Imagine launching a decentralized exchange or a GameFi platform in one of Central America’s most stable democracies. You find that there are no specific laws banning your business. There is also no clear license granting you permission to operate. This is the reality for many cryptocurrency businesses in Costa Rica, a country where digital assets exist in a complex regulatory limbo. It is not illegal to use Bitcoin here, but it is not legal tender either. This "gray area" has made the nation a magnet for startups seeking low costs and minimal bureaucracy, yet it leaves operators exposed to sudden regulatory shifts and compliance uncertainties.

If you are considering setting up shop in San José, you need to understand exactly where the lines are drawn-and where they are missing. The landscape changed significantly in mid-2025 with new legislative moves, but the core ambiguity remains. Let’s break down what this means for your business model, your risks, and your bottom line.

The Core Definition: Not Money, But Not Illegal

To navigate the gray area, you first have to understand how the government views your product. In October 2017, the Central Bank of Costa Rica (BCCR) issued a definitive statement: cryptocurrencies like Bitcoin are not legal tender. They are not backed by the state, and they do not constitute official currency.

This distinction matters more than you might think. Because crypto is not legal tender, merchants are not obligated to accept it, and consumers cannot sue if a price fluctuates wildly during a transaction. However, the BCCR did not ban private transactions. Individuals can buy, sell, and hold digital assets freely between themselves. This creates a unique environment where peer-to-peer trading is permissible, but institutionalizing that trade requires careful navigation of existing financial laws.

For a startup, this means you cannot treat crypto like dollars. You cannot issue invoices in Bitcoin expecting standard commercial law protections. Instead, you are operating in a space where civil contract law applies, but without the safety net of banking regulations. This freedom attracts innovators but terrifies risk managers.

Bill 22.837: The Shift Toward AML Compliance

The static nature of the gray area began to shift on July 2, 2025. The Legislative Assembly passed the first debate of Bill 22.837, a landmark piece of legislation originally proposed in late 2021. This bill amends Law No. 7786, which covers narcotics and money laundering, to introduce Article 15 quáter. This addition formally brings Virtual Asset Service Providers (VASPs) under the country’s Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) framework.

Here is what you need to know about this change:

• Definition of Virtual Assets: The bill defines these as any digital representation of value that can be traded online but is not recognized as legal tender.
• VASP Scope: If you exchange virtual assets for fiat, transfer them, provide custody, or issue/marketing them, you are likely a VASP.
• Registration vs. Authorization: This is the critical nuance. VASPs must register with the Superintendencia General de Entidades Financieras (SUGEF), the national financial regulator. However, officials explicitly state that registration is not government authorization to operate. It is merely a declaration that you adhere to AML protocols.

This approach is a compromise. The government wants to prevent financial crime without stifling innovation through heavy-handed licensing. For you, this means you must implement robust Know Your Customer (KYC) procedures, identify beneficial owners, keep detailed transaction records, and monitor politically exposed persons (PEPs). Failure to do so could lead to severe penalties under anti-money laundering statutes, even if your crypto activity itself isn’t banned.

Who Regulates What? Navigating the Institutions

Because there is no single "Crypto Commission," you face a fragmented regulatory landscape. Three primary institutions hold sway over different aspects of your operation:

If you are issuing security tokens, SUGEF will view them as financial instruments subject to stricter scrutiny. If you are running a decentralized exchange, you fall under the VASP definition in Bill 22.837. If you are just holding assets in a corporate wallet, you still need a registered entity via the National Registry. The lack of a unified authority means you must ensure your compliance team understands all three frameworks.

Why Startups Choose Costa Rica Despite the Risk

Given the uncertainty, why do so many projects choose this jurisdiction? The answer lies in cost and speed. Costa Rica offers one of the most cost-efficient environments for virtual asset service providers in Latin America.

Unlike jurisdictions that require millions in deposited share capital or mandatory local directors, Costa Rica’s requirements are remarkably light. You do not need to maintain a physical office in the same way traditional banks do. The ease of incorporation allows you to get your legal entity up and running quickly. Furthermore, the country’s reputation for political stability and modern telecommunications infrastructure makes it a reliable base of operations.

Tax incentives also play a role. While the tax code is complex, foreign-sourced income often enjoys favorable treatment, and the overall burden on foreign investment is perceived as lower than in neighboring countries. For GameFi platforms and NFT marketplaces, the synergy between Costa Rica’s gaming licenses and the emerging VASP framework creates a streamlined path to market entry. You can launch faster and cheaper than in Europe or North America, provided you accept the inherent regulatory ambiguity.

The Hidden Dangers of the Gray Area

Freedom comes with a price. Operating in a gray area means you lack explicit legal protection. If a dispute arises with a user, courts may struggle to apply precedent because crypto-specific case law is virtually nonexistent. You cannot rely on the same consumer protections afforded to traditional financial instruments.

Moreover, the "registration is not authorization" clause in Bill 22.837 keeps a sword hanging over your head. Today, SUGEF may tolerate your operations if your AML controls are solid. Tomorrow, a new administration could interpret those same rules differently, effectively shutting you down without having ever granted you a formal license to begin with.

Banking relationships are another major hurdle. Even if you are compliant with SUGEF, local banks remain wary of crypto-related businesses. Opening a corporate bank account can be difficult. Many founders find themselves relying on fintech solutions or offshore banking, which adds complexity and cost to their treasury management.

Practical Steps for Market Entry

If you decide to proceed, follow this structured approach to minimize risk:

1. Incorporate Properly: Register your company with the National Registry. Ensure you have a valid legal address in Costa Rica. Do not skip this step; it is the foundation of your legal existence.
2. Implement AML/KYC Protocols: Before you launch, build internal controls that meet or exceed FATF recommendations. Identify clients, track transactions, and screen for high-risk jurisdictions. Document everything.
3. Register with SUGEF: Once operational, complete the VASP registration process. Treat this as a compliance obligation, not a license to print money. Keep your risk assessments updated regularly.
4. Secure Banking Partnerships: Approach banks early. Be transparent about your business model and your compliance measures. Have backup payment processors ready.
5. Monitor Legislative Changes: The regulatory landscape is evolving. Subscribe to updates from the Legislative Assembly and SUGEF. What is gray today may become black or white tomorrow.

Costa Rica remains an attractive option for those willing to navigate its complexities. It offers a balance of low barriers to entry and growing regulatory structure. But remember: you are building on shifting sand. Strong compliance is not just a legal requirement; it is your insurance policy against the next wave of regulation.