Snap Compliance
Solution Partners Consulting Partners
Contact us

Language

EN ES PT
Start free
CONASSIF 4-16 · Corporate governance · Costa Rica

Show your supervisor that your corporate governance actually works

The Corporate Governance Regulation does not ask for a manual on a shelf: it makes your institution responsible for proving that its framework is effective. Snap Compliance turns each principle into controls, assessments and evidence your board can review.

See what it requires Talk to a specialist

At a glance

What it governs

Corporate governance

How financial institutions are directed and controlled: the board, committees, senior management, risk, compliance, audit and transparency. They are qualitative standards reflecting sound international practices (art. 1).

Who must comply

SUGEF, SUGEVAL, SUGESE and SUPEN

Banks, finance companies, savings and credit cooperatives, mutuals, exchange houses, brokerages, insurers and pension fund operators, among others, plus holding companies and members of financial groups (art. 2).

Issued by

CONASSIF

CONASSIF approved it and each superintendency supervises it in its own institutions; the superintendents may issue guidelines to apply it (art. 49).

Key milestone

January 1, 2026

In force since June 2017. Since 2026, anyone who served as a director of the institution or its group for more than nine of the last twelve years no longer counts as independent (art. 16 bis).

Read the official text: CONASSIF 4-16

What it requires

What CONASSIF 4-16 requires

The regulation is principles-based, not a closed checklist: each institution applies it according to its size, ownership structure, complexity and risk profile (art. 4). These are its core obligations.

A board that answers for everything

It is accountable for strategy, risk management, financial soundness and the governance structure; it delegates tasks, but not responsibility. It approves the strategic framework, internal control and continuity plans, and follows up on recommendations from the supervisor and auditors (arts. 5 and 8).

Corporate culture and Code of Conduct

It sets corporate values, promotes a risk culture, communicates the Code of Conduct to all staff and sets disciplinary measures for breaches. The code defines acceptable and unacceptable behavior (arts. 10 and 11).

A written risk appetite

The board approves the risk appetite and communicates it through a Risk Appetite Statement with quantitative and qualitative considerations, risk levels and types, and limits. It must be available to the supervisor (arts. 12 and 13).

Independent directors and a fit profile

Unless the law provides otherwise, at least two independent directors, under the criteria of article 16 bis. Members must show integrity, training and experience, and the board assesses its own performance, its committees and its members every year (arts. 16, 16 bis, 17 and 21).

Technical committees with minutes

The Audit and Risk committees are mandatory, with the exceptions the rule sets, and are chaired by an independent director. The Nominations and Remuneration committees include at least one. Each committee has its own rules and keeps minutes of its deliberations (arts. 24 to 28).

Independent risk, compliance and internal audit

A risk unit led by a chief risk officer who reports to the board; a compliance function independent from senior management; and an internal audit that assesses internal control, risk and governance. These are the three lines of defense (arts. 3, 32 to 38).

Conflicts of interest and related parties

An approved policy to identify, prevent, disclose and manage conflicts of interest, with a duty to abstain. Related-party transactions are reviewed for risk and carried out on the same terms as with third parties (arts. 8.7 and 23).

Corporate Governance Code and annual disclosure

The institution drafts and publishes its Corporate Governance Code and discloses its governance framework every year, on its website or another easily accessible channel: committees, directors, remuneration, significant holdings and related-party transactions (arts. 42 and 43).

Consequences

What happens if you fall short

The regulation sets no fines of its own. Corporate governance is part of each superintendency's assessment, and the institution is the one that must prove its framework is effective (art. 4). According to the regulation's recitals, when weaknesses appear the supervisor requires improvements and corrective measures, and the board must respond promptly to its observations and requests (art. 8.14). The institution also defines the internal consequences of breaching regulations, action plans, policies and codes (art. 36).

How we help

How Snap Compliance helps

Compliance Agent, the Corporate Governance Management module, runs CONASSIF 4-16 as a living compliance model: the regulation enters its regulations catalog, each obligation gets its control, assessment and owner, KRIs track the pulse, action plans organize improvements, and the dashboard shows the board where the institution stands. Cross-framework mapping lets a single control answer this regulation and other rules you already follow, such as CONASSIF 12-21. Risk Copilot is designed for risk management, with dynamic matrices under ISO 31000 and COSO ERM, inherent and residual risk calculation and control suggestions. The Whistleblower Channel is designed so employees can raise concerns anonymously, with a tracking code. Decisions remain with the board; the platform organizes the evidence.

Snap Compliance modules

Corporate Governance Management Risk Management Anonymous Whistleblowing Channel

Other regulations in Costa Rica

Ley 7786 · SUGEF · SUGEVAL · SUPEN · SUGESE

Law 7786: AML compliance in Costa Rica

Ley 10.889 · SUGEF

Law 10.889 and SUGEF 5-26: free assessment and toolkit

Ley 8968 · PRODHAB

Law 8968: data protection in Costa Rica

Ley 9416 · BCCR · DGT

Law 9416: beneficial ownership and RTBF in Costa Rica

All regulations in Costa Rica

Frequently asked questions about CONASSIF 4-16

What is Acuerdo CONASSIF 4-16?
It is the Corporate Governance Regulation of Costa Rica's financial system, formerly called Acuerdo SUGEF 16-16. CONASSIF approved it on November 8, 2016, it was published in La Gaceta 235 on December 7, 2016, and it has been in force since June 2017. It sets principles, not closed checklists: qualitative standards that reflect sound international practices (art. 1). With Compliance Agent, each principle is managed as a control with its own assessment and evidence.
Which institutions does the Corporate Governance Regulation apply to?
It applies to institutions supervised by the four superintendencies (art. 2): banks, non-bank finance companies, savings and credit cooperatives, mutuals and exchange houses under SUGEF; brokerages, investment fund managers, exchanges and other entities under SUGEVAL; insurers, brokers and agencies under SUGESE; and pension fund operators under SUPEN. It also covers holding companies and members of financial groups and conglomerates, where the holding company's governance code is binding on the whole group (art. 44).
How many independent directors does CONASSIF 4-16 require?
Unless the law provides otherwise, at least two (art. 16). Article 16 bis defines the independent director and lists who does not qualify: persons related to the institution, anyone with significant business ties to it in the prior year, anyone representing a shareholder with a significant holding, or anyone in senior management in the last five years. Since January 1, 2026, neither does anyone who was a director for more than nine of the last twelve years. With Compliance Agent, each criterion becomes an assessed control.
Which committees does CONASSIF 4-16 require?
The Audit Committee is mandatory for every institution in article 2, and so is the Risk Committee, with exceptions such as non-financial issuers; both are chaired by an independent director (arts. 25 and 26). The regulation also governs the Nominations and Remuneration committees, which must include at least one independent director (arts. 27 and 28). The compliance committee does not come from this regulation but from CONASSIF 12-21. Compliance Agent tracks the tasks and action plans that come out of each committee.
What must the Risk Appetite Statement include?
Under article 13, quantitative and qualitative considerations; the level and types of risk the institution is willing to take within its risk capacity; and business or operational limits. The definition in article 3 adds measures on earnings, capital and liquidity, plus statements on reputational, conduct and money laundering risk. The board approves it, it is communicated across the institution and it must be available to the supervisor. With the KRIs in Compliance Agent, each limit is tracked with an indicator.
What are the three lines of defense in CONASSIF 4-16?
Article 3 defines them. The first is the business lines, which manage risk day to day within the approved appetite. The second is the risk unit and the compliance function, which monitor, report and answer directly to the board (arts. 32 to 37). The third is an independent internal audit that assesses internal control, risk and governance (art. 38). Risk Copilot is designed for the second line, with dynamic matrices of inherent and residual risk.
What does CONASSIF 4-16 require on conflicts of interest and related parties?
A board-approved policy to identify, prevent and manage conflicts of interest, which defines the situations, requires disclosure and requires abstaining from decisions when a conflict exists (art. 23). Related-party transactions are reviewed for risk and carried out on the same terms as with third parties (art. 8.7). Relevant changes in those transactions are reported to the supervisor within three business days, absent another deadline (art. 8.11), and disclosed every year (art. 43.9). Compliance Agent records every control in that policy.
What corporate governance information must the institution publish every year?
Article 43 requires disclosure on the website or another easily accessible channel, every year and whenever there are relevant changes: the Corporate Governance Code, audited financial statements, objectives, significant holdings, the remuneration policy for the board and senior management, the board's composition and independence criteria, the committees, and related-party transactions over the last year. The dashboard in Compliance Agent brings together the status of the controls behind that disclosure.
Does CONASSIF 4-16 apply the same way to a small cooperative and a large bank?
Not entirely. Article 4 asks each institution to design its framework according to its size, ownership structure, legal nature, complexity, strategy and risk profile, and makes it responsible for proving the framework is effective. Some minimums do not bend: the Audit Committee cannot be waived on proportionality grounds, and the Risk Committee is mandatory except for the cases in article 26. Compliance Agent starts from a configurable methodology and matrix, so the compliance model reflects each institution's real scale.
Does CONASSIF 4-16 require a whistleblowing channel?
It does not use that name, but it asks for two mechanisms. The board encourages employees and other stakeholders to freely raise concerns about illegal or unethical practices without their rights being compromised (art. 41.5). And the customer service policy ensures that inquiries, complaints and reports are handled, with records and statistics (art. 41.2). Snap's Whistleblower Channel is designed for the first: anonymity, a tracking code and a workflow for the Ethics Committee.

Would your program withstand a supervisor's review today?

We review with you where your institution stands against these rules and what it still needs to demonstrate compliance.

Talk to a specialist

Free self-assessment · Chile

How ready is your organization for Chile's Law No. 21.719?

Answer the questions that apply to your organization and see its blocking findings, its gaps by domain and its estimated exposure, with an action plan in Word. Available in Spanish.

16 domains · 45 to 90 minutes · save and resume 46 days until enforcement

Start the self-assessment (in Spanish)