Costa Rica's compliance framework, regulation by regulation

Five main fronts. Law 7786 and CONASSIF 12-21, to prevent money laundering; Law 10.889 and SUGEF Regulation 5-26, for electronic fraud; Law 8968, for personal data; Law 9416, to declare beneficial owners; and CONASSIF 4-16, for corporate governance. Each one has its own page, with what it requires and how Snap Compliance helps you meet it. Start with the one that weighs most on your institution today.

It depends on the regulation. CONASSIF directs the four superintendencies —SUGEF, SUGEVAL, SUPEN and SUGESE— and approves their regulations, such as CONASSIF 12-21 on money laundering prevention and CONASSIF 4-16 on corporate governance. SUGEF also supervises Law 10.889 on electronic fraud. The ICD's Financial Intelligence Unit receives suspicious transaction reports; PRODHAB oversees Law 8968; and the Central Bank runs the beneficial ownership register. Compliance Agent brings those obligations together in a single compliance model.

Law 7786 divides obligated parties across five articles. Article 14 covers the institutions supervised by SUGEF, SUGEVAL, SUPEN and SUGESE and the companies in their financial groups; article 15, financial activities outside the supervised system, such as remittances; article 15 bis, designated non-financial businesses and professions; article 15 ter, notaries; and article 15 quater, virtual asset service providers. The article determines which regulation your institution follows and who supervises it.

Since April 22, 2026, Law 10.889 makes institutions supervised by SUGEF liable, even without fault, for money that an unauthorized third party takes from their clients' accounts, and reverses the burden of proof in favor of the consumer. It allows only three grounds for rejection: self-fraud, intent, or a transfer between accounts of the same holder. Each claim triggers strict deadlines, and SUGEF Regulation 5-26 sets the minimum controls the institution must prove.

Law 8968, in force since September 5, 2011, requires informing people before collecting their data, obtaining the data subject's express consent except where the law allows otherwise, keeping data accurate and no longer than necessary, honoring the rights of access, rectification and erasure, and protecting the security and confidentiality of the information. PRODHAB supervises it and penalizes breaches with fines in base salaries. Compliance Agent manages it as part of your compliance model.

It is the register created by Law 9416 and run by the Central Bank of Costa Rica. In it, obligated legal entities declare all the holders of their capital and their beneficial owners: the natural persons who ultimately own or control them, by ownership from 15%. Only the Ministry of Finance and the ICD can query the register. For institutions under Law 7786, identifying the beneficial owner is part of due diligence, which the Due Diligence module documents in each file.

The Corporate Governance Regulation, CONASSIF 4-16, makes the Board responsible for the institution's strategy, culture and Code of Conduct. It requires a written risk appetite statement, independent directors with a suitable profile, technical committees with minutes, independent risk, compliance and internal audit functions, rules on conflicts of interest and related parties, and a Corporate Governance Code with annual disclosure. Compliance Agent tracks each principle as a control with its evidence.

Both implement Law 7786, but for different groups. CONASSIF 12-21, formerly SUGEF Agreement 12-21, is the prevention regulation for the financial institutions of article 14, applied by SUGEF, SUGEVAL, SUPEN and SUGESE. SUGEF 13-19 applies to those who register with SUGEF under articles 15 and 15 bis, such as remittance companies, real estate businesses, casinos or pawnshops. The Costa Rica Due Diligence Toolkit is built on both.

To the ICD's Financial Intelligence Unit, immediately and confidentially, including attempted transactions. Article 14 institutions under Law 7786 report through UIF Directo; article 15 and 15 bis parties, through UIF Reportes. No one may tell the client they were reported. Snap Compliance's AML monitoring compares each transaction with the client's profile and keeps every alert with its audit trail for the compliance officer's analysis.

With a single platform, Compliance OS. AML monitoring, Due Diligence and Scan Agent cover Law 7786 and CONASSIF 12-21; Compliance Agent handles the rest —Law 10.889, Law 8968 or CONASSIF 4-16— as controls with an owner, deadline and evidence, and shows the Board where the institution stands. For the documentary framework, the store's toolkits provide documents ready to adapt. Your team decides; the platform does the heavy lifting.