Question Presented
Whether, and under what operating constraints, Costa Rica is a suitable jurisdiction for Web3 projects as of 2026-07-28, including software and protocol development; token issuance and fundraising; custodial and non-custodial wallets; exchange and OTC activity; staking, lending and yield products; stablecoins and payments; NFTs and marketplaces; and DAO-linked governance.
Executive Summary
- Costa Rica is generally viable for Web3 software development, protocol engineering, IP holding and genuinely non-custodial services, but it is not a regulation-free crypto jurisdiction. The perimeter is activity-based and can combine financial, securities, AML, consumer, tax, privacy and company-law rules. [Constitution, arts. 28 and 46; Laws Nos. 7,558, 7,732, 7,786 and 7,472.]
- Cryptoassets are not legal tender. Costa Rican legal payment media are BCCR-issued notes and coins. Parties may contractually agree to deliver or accept cryptoassets as consideration or a settlement method, provided the transaction is lawful and the agreement addresses valuation, timing, network finality, fees, refunds and failure events. [Law No. 7,558, arts. 43-46; Civil Code, arts. 1007-1008 and 1022-1023.]
- Law No. 10,961 has been enacted, but the official SINALEVI note states that its amendments take effect on 2026-09-19. Businesses that exchange, transfer, custody, administer or control virtual assets for customers, or provide financial services around issuance or sale, should prepare for VASP registration and AML/CFT controls, subject to final-text and implementing-rule confirmation. [Law No. 10,961; official amendment note to Law No. 7,786; official legislative text and PGR-OJ-090-2025 for readiness only.]
- SUGEF registration under the AML framework must not be described as a product approval, banking charter, securities authorization or blanket operating licence. A separate reserved activity remains subject to its own supervisor and legal requirements. [Law No. 7,786; official legislative materials; PGR-C-196-2024.]
- A token can be a “valor” where it is a patrimonial right susceptible to securities-market trading and has the object or effect of obtaining resources from the public. Public offers require SUGEVAL authorization unless an exception applies; mass solicitation, Internet marketing and investor count are material facts. [Law No. 7,732, art. 2; CONASSIF Regulation on Public Offerings.]
- Custodial exchange, customer-asset administration, lending, guaranteed or marketed yield, pooled staking and stablecoin issuance are the highest-risk models. Financial intermediation exists where public funds are habitually captured and deployed, for the intermediary’s own account and risk, into credit or securities. [Law No. 7,558, art. 116; PGR-C-196-2024.]
- A DAO should not be treated as a substitute for a Costa Rican legal person. Use a recognized S.A. or S.R.L. wrapper, preserve legally effective organs and representatives, and analyze ultimate natural-person ownership and control under the beneficial-ownership regime. [Commercial Code, art. 17; Law No. 9,416; Executive Decree No. 44,390-H.]
- Crypto does not neutralize tax, consumer or privacy obligations. Revenue and gains can be taxable in money or in kind; taxable services remain subject to VAT analysis; retail interfaces require clear and truthful Spanish-language information; and linkable wallet data can be personal data. Ordinary PII should not be written to immutable public chains. [Income Tax Law No. 7,092; VAT Law No. 6,826; Law No. 7,472; Decree No. 37,899-MEIC; Law No. 8,968.]
- The preferred risk-controlled structure is a Costa Rican development/services company that does not hold customer assets, issue investment-like tokens, promise returns or operate customer-facing exchange/custody. Issuer, custodian, VASP and yield functions should be separately analyzed, segregated and gated on classification, filings, banking, AML, tax and final-law verification. [Synthesis of controlling authorities; see Section C.12.]
Bottom line
Costa Rica is a defensible base for development and non-custodial Web3 operations. It is materially less suitable for launching a customer-facing exchange, custodian, token fundraising, lending/yield product or stablecoin without a dedicated regulatory workstream. The decisive variables are custody, control, use of customer assets, return promises, public solicitation and Costa Rican operational or customer nexus.
Analysis by Issue
Regulatory baseline, Costa Rican nexus and territorial reach
Conclusion. Costa Rica does not provide a single Web3 licence or blanket safe harbour. Classification follows the actual functions, counterparties and territorial connections. A development-only or truly non-custodial business can remain outside the core financial perimeter; the same entity can enter several regulated perimeters once it markets tokens, controls assets, transmits value or promises returns.
Rule. Costa Rican statutes regulate specified activities and effects. Securities law reaches public offers; the AML framework reaches specified obliged activities; BCCR law reserves financial intermediation and protects monetary issuance; consumer and privacy rules attach to retail commerce and processing. The public-offering regulation addresses offers made from Costa Rica or directed to persons domiciled in Costa Rica.
Application. The strongest nexus exists where the Costa Rican entity signs user contracts, collects fees, controls protocol or interface, holds keys, employs decision-makers, maintains treasury, operates support, markets from Costa Rica or targets local users. A foreign governing-law clause or geoblock cannot displace a mandatory local statute where the conduct occurs in or is directed to Costa Rica.
Limits / counterarguments. No single official source supplies an all-purpose territorial test for every Web3 activity; each regime must be applied separately. No directly controlling reported Costa Rican judgment on crypto-token or DeFi classification was located in the accessible official repositories, limiting precedent-based certainty.
Legal status of cryptoassets, payment, contracting and stablecoin issuance
Conclusion. Cryptoassets are not legal tender or BCCR currency. They may function as property, contractual consideration or an agreed settlement medium. A creditor is not compelled to accept them merely because the debtor offers them. A stablecoin designed to circulate as money presents separate Article 44 risk and should not be launched from Costa Rica without a written BCCR-focused opinion.
Rule. Article 43 of Law No. 7,558 provides: “El medio de pago legal de la República estará constituido por los billetes y las monedas emitidos y puestos en circulación por el Banco Central de Costa Rica.” Article 46 gives those notes and coins unlimited discharge power. Article 44 gives BCCR exclusive issue rights and restricts other instruments that may circulate as money. Civil Code Articles 1007-1008 require consent and formalities; Article 1022 gives contracts force between the parties.
Application. The lower-risk method is to state debt and tax invoice in colones (or, where appropriate, recognized foreign currency) and permit crypto as an optional settlement method. Define token/chain, price source and timestamp, confirmations, gas/fees, wrong-chain transfers, forks, chain halts, refunds, sanctions screening and when the monetary obligation is discharged. Do not market a token as Costa Rican currency, legal tender, a deposit, cash equivalent or government-backed without an exact legal basis.
Limits / counterarguments. Article 48 on foreign-currency obligations does not classify crypto as foreign currency. Article 44 has no located official reported stablecoin holding; application depends on design, redemption, reserves, circulation and marketing. Contractual freedom cannot validate a prohibited financial, securities, AML or consumer practice.
Law in force on 2026-07-28
Conclusion. Before 2026-09-19, Law No. 10,961 is not yet effective. Existing Law No. 7,786 nevertheless applies to currently covered activities, contains criminal-law references to virtual assets and supports existing SUGEF registration and AML/CFT duties for activities already enumerated by law.
Rule. The current SINALEVI consolidation of Law No. 7,786 contains an official note stating that Law No. 10,961 will reform several provisions and enters into force on 2026-09-19. Current SUGEF materials distinguish AML registration from prudential or product authorization.
Application. A Web3 business cannot use the transition window to ignore general AML risk. Fiat on-ramps, fund transfer, third-party asset administration, payment services and bank relationships may already trigger current law or bank requirements. Map the legal entity accepting the customer, key control, fiat flows, fees and whether customer funds enter the project’s patrimony.
Limits / counterarguments. Registration under an AML statute does not prove that another reserved activity is lawful. A bank account or registration does not validate token classification, custody terms or public solicitation.
Law No. 10,961 effective 2026-09-19: readiness analysis
Conclusion. Projects performing exchange, transfer, custody, deposit, administration or control of virtual assets, or financial services around issuance, marketing, offer or sale, should assume a VASP-registration and AML/CFT workstream may apply from 2026-09-19 unless final official text or rules establish an exclusion. Registration should be treated as AML supervision, not general authorization.
Rule. Enactment, publication and effective date are verified through official publication metadata and the SINALEVI amendment note. Detailed readiness is based on official legislative text for proposed Article 15 quater and PGR-OJ-090-2025, which discuss CDD/UBO, risk-based controls, records, suspicious reports, new-technology risk assessment, SUGEF registration, transfer originator/beneficiary information, CONASSIF rulemaking and coordination with other supervisors. These are not substituted for the final signed text.
Application. Likely covered models include custodial exchanges, business OTC desks, recoverable wallets, transfer services, key-control/escrow arrangements, customer-asset administration and financial services around token issuance. A DeFi frontend becomes higher risk where it controls upgrades or keys, determines listings, routes trades, takes transaction-linked fees, freezes assets or owns the customer relationship. Pure code publication, self-custody tools, nodes and own-account mining are lower risk but can cross the line when paired with customer-facing functions.
Limits / counterarguments. As of 2026-07-28, no final VASP-specific implementing instrument was located in current SUGEF/CONASSIF repositories. The final Gazette PDF was not retrievable in this research environment. No threshold, filing form, transition deadline or technical travel-rule specification is asserted unless verified in a current official instrument.
Securities law: token characterization and fundraising
Conclusion. A token, SAFT, governance right, tokenized receivable, yield-bearing instrument or fractional NFT can be a “valor” despite on-chain form or utility branding. Public solicitation should not begin until the instrument and offering route have written classification. A private-offer route requires controlled offerees, channels, records, warnings and, where applicable, accreditation.
Rule. Article 2 of Law No. 7,732 treats a public offer as an express or implied offer to issue, place, negotiate or trade values among the investing public. It defines a value as a patrimonial right susceptible to securities-market trading that has the object or effect of obtaining resources from the public. Only authorized persons may make a public offer, subject to exceptions. The regulation uses mass communication/Internet solicitation and investor number as relevant presumptions and regulates private offers.
Application. High-risk facts include proceeds funding the team/protocol; repayment, redemption, revenue, fee, profit or treasury rights; promoter efforts marketed as value source; expected exchange listing; standardized units; economic governance; or pooled assets. A consumption token is lower risk if usable at launch, sold in use-aligned quantities, not investment-marketed, not redeemable for issuer assets and not financing development—but there is no automatic utility exemption. An airdrop can still support a public-offer or consumer analysis.
Limits / counterarguments. No official SUGEVAL crypto-token classification decision or controlling judgment was located. The concept is broad and fact-specific. A “not available in Costa Rica” legend is weak where the issuer operates from Costa Rica or local persons are actually solicited.
Financial intermediation, payments, custody, staking, lending and yield
Conclusion. Non-custodial software is substantially lower risk than a business receiving customer assets. Custody does not automatically equal financial intermediation, but risk becomes very high when customer value is pooled or deployed for the operator’s own account and risk into credit or securities. Lending, guaranteed yield, rehypothecation, maturity transformation and reserve-backed stablecoin issuance require authorization-level analysis before launch.
Rule. Article 116 of Law No. 7,558 defines financial intermediation as habitual capture of financial resources from the public for deployment, for the intermediary’s own account and risk, into credit or securities, regardless of contractual form or electronic record. PGR-C-196-2024 distinguishes this from administration of third-party funds where title does not enter the administrator’s patrimony and transfer occurs only on the owner’s instructions. Payment-system rules remain relevant to fiat rails and SINPE participation.
Application. A self-custody wallet/API that never controls assets is lower risk. A custodian or exchange should segregate assets, reconcile daily, state title and withdrawal rights, maintain incident controls and prohibit use absent a separately lawful model. Delegated staking with retained user control is lower than pooled staking with custody, liquid receipt tokens or marketed return. Lending/earn is very high risk where public assets are accepted, principal/maturity is promised or assets are lent/invested. Stablecoins add monetary issue, custody, reserve, redemption, consumer, securities and AML issues.
Limits / counterarguments. PGR-C-196-2024 is an official opinion, not a licence or judicial holding. Labels such as “not a deposit” do not control substance. SUGEF AML registration does not authorize intermediation, exchange, securities intermediation or payment-system participation.
Securities law: token characterization and fundraising
Conclusion. A token, SAFT, governance right, tokenized receivable, yield-bearing instrument or fractional NFT can be a “valor” despite on-chain form or utility branding. Public solicitation should not begin until the instrument and offering route have written classification. A private-offer route requires controlled offerees, channels, records, warnings and, where applicable, accreditation.
Rule. Article 2 of Law No. 7,732 treats a public offer as an express or implied offer to issue, place, negotiate or trade values among the investing public. It defines a value as a patrimonial right susceptible to securities-market trading that has the object or effect of obtaining resources from the public. Only authorized persons may make a public offer, subject to exceptions. The regulation uses mass communication/Internet solicitation and investor number as relevant presumptions and regulates private offers.
Application. High-risk facts include proceeds funding the team/protocol; repayment, redemption, revenue, fee, profit or treasury rights; promoter efforts marketed as value source; expected exchange listing; standardized units; economic governance; or pooled assets. A consumption token is lower risk if usable at launch, sold in use-aligned quantities, not investment-marketed, not redeemable for issuer assets and not financing development—but there is no automatic utility exemption. An airdrop can still support a public-offer or consumer analysis.
Limits / counterarguments. No official SUGEVAL crypto-token classification decision or controlling judgment was located. The concept is broad and fact-specific. A “not available in Costa Rica” legend is weak where the issuer operates from Costa Rica or local persons are actually solicited.
Financial intermediation, payments, custody, staking, lending and yield
Conclusion. Non-custodial software is substantially lower risk than a business receiving customer assets. Custody does not automatically equal financial intermediation, but risk becomes very high when customer value is pooled or deployed for the operator’s own account and risk into credit or securities. Lending, guaranteed yield, rehypothecation, maturity transformation and reserve-backed stablecoin issuance require authorization-level analysis before launch.
Rule. Article 116 of Law No. 7,558 defines financial intermediation as habitual capture of financial resources from the public for deployment, for the intermediary’s own account and risk, into credit or securities, regardless of contractual form or electronic record. PGR-C-196-2024 distinguishes this from administration of third-party funds where title does not enter the administrator’s patrimony and transfer occurs only on the owner’s instructions. Payment-system rules remain relevant to fiat rails and SINPE participation.
Application. A self-custody wallet/API that never controls assets is lower risk. A custodian or exchange should segregate assets, reconcile daily, state title and withdrawal rights, maintain incident controls and prohibit use absent a separately lawful model. Delegated staking with retained user control is lower than pooled staking with custody, liquid receipt tokens or marketed return. Lending/earn is very high risk where public assets are accepted, principal/maturity is promised or assets are lent/invested. Stablecoins add monetary issue, custody, reserve, redemption, consumer, securities and AML issues.
Limits / counterarguments. PGR-C-196-2024 is an official opinion, not a licence or judicial holding. Labels such as “not a deposit” do not control substance. SUGEF AML registration does not authorize intermediation, exchange, securities intermediation or payment-system participation.
