Central America and the Caribbean
Mexico and South America
Laws and regulations by countryFor banks, cooperatives, brokerages, pension fund operators, insurers and every obligated entity under articles 14 to 15 quater: what the law requires, which rules apply to you, and how Snap Compliance turns those obligations into a program that works.
At a glance
Framework law
Costa Rica's law on narcotics, related activities, money laundering (legitimación de capitales) and terrorist financing. Its current text comes from the comprehensive reform made by Law 8204, which is why many still call it by that number.
Financial supervision
Directs SUGEF, SUGEVAL, SUGESE and SUPEN, and approves the regulations that apply the law in each market.
Prevention regulations
12-21 governs the financial institutions under article 14 (it used to be called Acuerdo SUGEF 12-21). 13-19 covers those under articles 15 and 15 bis.
Financial intelligence
The ICD's Financial Intelligence Unit receives suspicious transaction reports: through UIF Directo for article 14 institutions, and through UIF Reportes for those under articles 15 and 15 bis.
Beneficial ownership
Legal persons declare their beneficial owners in the Transparency and Beneficial Ownership Registry run by the Central Bank. The regulatory threshold is a stake of 15% or more.
Personal data
Governs the processing of the personal data that due diligence collects. The supervisory authority is PRODHAB.
Who is obligated
Law 7786 splits obligated persons across five articles. The article determines which rules apply and who supervises.
Art. 14
Those regulated, supervised and overseen by SUGEF, SUGEVAL, SUPEN and SUGESE, plus every company in the financial groups those bodies supervise.
Art. 15
Currency exchange and transfers; traveler's checks and postal money orders; substantial systematic fund transfers; management of funds, including trusts, by non-intermediaries; cross-border remittances; and credit card issuers and operators. They register with SUGEF, and registration is not a license to operate.
Art. 15 bis
Casinos; professional real estate buying and selling; dealers in precious metals and stones; non-profit organizations that send or receive money from high-risk jurisdictions; lawyers, notaries and accountants when acting for clients in real estate transactions, asset management or the buying and selling of legal persons; trust service providers; credit providers; and pawnshops.
Art. 15 ter
When they take part in real estate transactions, manage client assets or are involved in buying and selling legal persons, they are supervised by the Prevention Area of the National Notary Directorate (Dirección Nacional de Notariado).
Art. 15 quater
Businesses that exchange virtual assets for money or for one another, transfer them, safeguard them, or provide services tied to their issuance or offer. Law 10961 brought them in: they register with SUGEF, document their risk assessment, and apply due diligence, transfer controls and suspicious transaction reporting. CONASSIF sets the detailed conditions by regulation.
By sector
The law obligates by activity, not by industry: the article that applies to your organization determines which rules it follows and who supervises it.
Art. 14
State-owned commercial banks, banks created by special laws, private banks, non-bank finance companies and savings and loan mutual associations are article 14 institutions supervised by SUGEF.
Solutions for this sector
Art. 14
Brokerage firms (puestos de bolsa), investment fund management companies and the other entities overseen by SUGEVAL are article 14 institutions.
Solutions for this sector
Art. 14
Supplementary pension fund operators, supervised by SUPEN, are article 14 institutions.
Solutions for this sector
Art. 14
Insurers, reinsurers and intermediaries are article 14 institutions, with SUGESE's own rules.
Solutions for this sector
Arts. 14 · 15 bis
Whether SUGEF supervises a cooperative changes which rules apply, but it does not exempt it from AML obligations.
Solutions for this sector
Arts. 15 bis · 15 ter
Professional and habitual real estate buying and selling is an article 15 bis activity, with no minimum amount to become obligated.
Solutions for this sector
Arts. 15 · 15 bis · 15 quater
No company is obligated because of its industry: only if it carries out an activity under articles 15, 15 bis or 15 quater.
Solutions for this sector
SUGEF classifies it as Type 1, 2 or 3 based on its size, customers, activity, transaction volume, payment instruments and geographic exposure. Type 1 appoints a compliance officer and undergoes an external audit; Types 2 and 3 appoint a liaison. The organization's own risk assessment is repeated every year, every two or every three years, depending on the type.
How we solve it
Reading the rules is the first step. What a supervisor reviews is a program that works and leaves evidence.
We implement the prevention program with your team —technology, training and documentation— and organize the evidence for the supervisor. Institutions that complete the program receive the Fortaleza AML seal. It is a Snap Compliance seal, not a certification.
17 editable files built on Law 7786 and its regulation, CONASSIF 12-21, CONASSIF 11-21 and SUGEF 13-19: due diligence matrix, customer file, governance, controls, third parties and training.
See the toolkitScreening of customers and beneficial owners against lists and news, risk matrices and AML monitoring on a single platform. Your team decides; the platform does the heavy lifting.
See the platformInside the platform
This is how Snap Compliance tracks your portfolio's risk, closing by closing: from the full picture to the client who moved and the reason behind every change.
View the full screen (opens in a new tab)
Twelve risk-matrix closings in a single view: how many clients moved to high risk, how many keep escalating without stepping back, and from which closing a new methodology applies.
View the full screen (opens in a new tab)
Every client with their twelve closings and a pattern that sets the priority: sustained escalation, recent deterioration, oscillating, or stable at the high level, a candidate for enhanced due diligence. The list exports to Excel in one click.
View the full screen (opens in a new tab)
The score at every closing, the subfactor that changed the level, and in which month. Each move opens its justification in Client Reclassification.
Snap Compliance screens with fictitious data.
FATF Recommendations
How Costa Rica implements each FATF Recommendation that falls on institutions and professionals: first, what Law 7786 and CONASSIF 12-21 require of an article 14 financial institution; then, of the other obligated entities.
Swipe to see all columns
| Recommendation | What is required | Legal basis |
|---|---|---|
| Financial institutions · article 14 Banks, finance companies, supervised cooperatives, mutuals, brokerages, investment funds, pension fund operators, insurers and the companies in their financial groups. Regulation: CONASSIF 12-21. | ||
| R.1 Assessing risks and applying a risk-based approach | Document a self-assessment of ML/TF/PF risk across customers, countries, channels, products and services, using the latest National Risk Assessment as an input and showing results at least once a year. Each customer is rated, at a minimum, as high, medium or low risk. | CONASSIF 12-21, arts. 24-25 · DE 36948, art. 14 |
| R.6 Targeted financial sanctions related to terrorism and terrorist financing | Continuously monitor the UN Security Council terrorist lists and, on a match, immediately freeze or immobilize the designated party's products and assets without prior notice, and report the result to the FIU within 24 hours at most. It also applies to articles 15, 15 bis and 15 quater. | Ley 7786, art. 33 bis |
| R.7 Targeted financial sanctions related to proliferation | The same monitoring and immediate freezing obligation applies to the Security Council lists on financing the proliferation of weapons of mass destruction. | Ley 7786, art. 33 bis |
| R.9 Financial institution secrecy laws | Banking, securities or tax secrecy does not prevent handing information to the authorities investigating these crimes, and requests from judges are met immediately. | Ley 7786, arts. 17 y 32 |
| R.10 Customer due diligence | Identify and reliably verify the customer, its beneficial owner and the source of funds, with no anonymous or fictitious accounts, applying simplified or enhanced due diligence according to risk. Information is updated according to that risk, at least every 60 months, drawing on SUGEF's CICAC. | Ley 7786, arts. 16 y 16 bis · DE 36948, arts. 14-20 · CONASSIF 12-21, arts. 27-37 |
| R.11 Record keeping | Keep customer and transaction records for at least five years —twice as long in certain cases, such as when a suspicious transaction was reported. Cash transactions and cross-border transfers of US$10,000 or more, single or adding up within the month, are recorded and reported to the superintendency within 20 calendar days after month-end. | Ley 7786, arts. 16 y 20-23 · DE 36948, art. 21 · CONASSIF 12-21, arts. 38 y 53-55 |
| R.12 Politically exposed persons | Identify PEPs as defined in the general regulation, have general management approve the relationship, and treat them as PEPs during their term and for up to eight years afterwards; presidents or heads of state, indefinitely. | DE 36948, arts. 22-24 · CONASSIF 12-21, art. 39 |
| R.13 Correspondent banking | The board approves every relationship with foreign correspondents and financial counterparties, after gathering information on their business, reputation, supervision and sanctions. Shell correspondents are prohibited, and each relationship is reassessed at least once a year. | CONASSIF 12-21, art. 44 |
| R.15 New technologies | Assess the risk before launching new products, services, business practices, channels or technologies, with board approval. | CONASSIF 12-21, art. 26 |
| R.16 Payment transparency | Every wire transfer, domestic or cross-border and of any amount, must carry the originator's name and identification, the beneficiary's name, and the account —or a unique reference— of both. The institution defines when to execute, reject or suspend one that arrives incomplete. | CONASSIF 12-21, art. 52 · DE 36948, art. 33 |
| R.17 Reliance on third parties | Relying on a third party to identify the customer and the beneficial owner is not allowed: the institution is solely and directly responsible, unless the third party is a supervised entity in its own Costa Rican financial group or conglomerate. | CONASSIF 12-21, art. 31 |
| R.18 Internal controls and foreign branches and subsidiaries | A compliance program with a committee chaired by a board member, a full-time principal and deputy compliance officer —unless an adjustment is authorized—, internal audit with an annual program, an annual external ML/TF/PF audit and annual training, applied in foreign branches and subsidiaries too. | Ley 7786, arts. 26-27 · CONASSIF 12-21, arts. 6-23, 32 y 58 |
| R.19 Higher-risk countries | Enhanced due diligence for customers and transactions linked to countries the FATF lists as high-risk. Failing to apply these controls is sanctioned. | CONASSIF 12-21, arts. 25 y 29 · Ley 7786, art. 81 |
| R.20 Reporting of suspicious transactions | Watch for transactions outside the customer's usual pattern, with systems that alert when activity exceeds the declared profile, and report every suspicious transaction, including attempts, immediately and confidentially to the ICD's FIU through UIF Directo. | Ley 7786, arts. 24-25 · DE 36948, arts. 34-36 · CONASSIF 12-21, arts. 46-50 |
| R.21 Tipping-off and confidentiality | No one may tell the customer or third parties that a report was filed. Reporting does not create administrative, civil or criminal liability unless willful misconduct or gross negligence is proven. | Ley 7786, arts. 18 y 25 · CONASSIF 12-21, art. 48 |
| R.26 Regulation and supervision of financial institutions | SUGEF, SUGEVAL, SUGESE and SUPEN supervise their institutions' compliance and can impose sanctions, under CONASSIF's direction. | Ley 7786, arts. 14, 28 y 81 · Ley 7732, arts. 169 y 171 |
| R.35 Sanctions | Fines of 0.5% to 2% of equity for failures in due diligence, record keeping, PEPs, suspicious transaction reporting or the compliance program, among others, and for dealing with article 15, 15 bis or 15 quater businesses that lack a current registration. Final sanctions form a public-interest list. | Ley 7786, art. 81 |
| Articles 15, 15 bis, 15 ter and 15 quater Financial activities outside the supervised system, DNFBPs, notaries and virtual asset service providers. | ||
| R.14 Money or value transfer services | Legal persons that carry out currency exchange, systematic fund transfers or cross-border remittances without being supervised institutions register with SUGEF —which does not license them to operate— as single-purpose companies, and comply with SUGEF 13-19. | Ley 7786, art. 15 · SUGEF 11-18 · SUGEF 13-19 |
| R.15 New technologies | Virtual asset service providers register with SUGEF, document their risk assessment and apply due diligence, the transfer rules and suspicious transaction reporting. | Ley 7786, art. 15 quater · Ley 10961 |
| R.22 DNFBPs: Customer due diligence | Casinos, real estate agents, precious metals and stones dealers, lawyers, notaries, accountants and the other article 15 bis businesses meet the due diligence and record-keeping obligations of article 15. | Ley 7786, arts. 15 bis y 15 ter · DE 41016 · SUGEF 13-19 |
| R.23 DNFBPs: Other measures | Those same businesses report suspicious transactions to the FIU and apply the high-risk country and confidentiality controls. | Ley 7786, arts. 15 bis, 15 ter y 25 · DE 41016, arts. 29-30 |
| R.28 Regulation and supervision of DNFBPs | SUGEF registers and supervises the article 15 bis DNFBPs on a risk basis. The National Notary Directorate supervises notaries. | Ley 7786, arts. 15 bis, 15 ter y 81 · DE 41016, art. 6 · SUGEF 11-18 y 13-19 |
| Transparency and financial intelligence Rules that reach every legal person, and the unit that receives the reports. | ||
| R.24 Transparency and beneficial ownership of legal persons | Legal persons declare their beneficial owners in the Central Bank's RTBF from a 15% stake, and obligated persons may not keep companies with bearer shares as customers. | Ley 9416, arts. 5-14 · DE 44390-H · Ley 7786, art. 16 f) |
| R.25 Transparency and beneficial ownership of legal arrangements | In a trust (fideicomiso), each party —settlor, trustee, beneficiary and protector, if any— counts as a beneficial owner, and the trust is registered in the RTBF. | Ley 9416, art. 5 · DE 44390-H, arts. 10 y 18 |
| R.29 Financial intelligence units | The ICD's FIU receives and analyzes reports, refers its findings to the Public Prosecutor's Office and exchanges information with its foreign counterparts. | Ley 7786, arts. 123-125 |
Only the Recommendations that fall on institutions and professionals are listed. The rest —criminalization, powers of the authorities, international cooperation— are the State's responsibility.
Titles as they appear in the FATF Recommendations.
Around the AML program
Supervised institutions follow the Corporate Governance Regulation (Acuerdo CONASSIF 4-16, formerly SUGEF 16-16). Separately, Law 9699 makes legal persons criminally liable for bribery, foreign bribery and other offenses, and since the Law 10373 reform, for money laundering too. Adopting a crime prevention model is optional, but it is one of the circumstances that allow the judge to reduce the penalty by up to 40%, and the company is not liable if a subordinate or an intermediary committed the offense by fraudulently circumventing that model.
Due diligence collects data on customers and beneficial owners. Its processing is governed by Law 8968 and its regulation (DE 37554-JP), with PRODHAB as the supervisory authority.
Frequently asked questions
We review with you where your institution stands against these rules and what it still needs to demonstrate compliance.
Talk to a specialistLucia
Virtual assistant · Snap Compliance
Before we start
I'm Lucia. I'll be assisting you here and helping you with whatever you need from Snap Compliance.
We process your data in accordance with the applicable laws and regulations.