Strict liability
The institution is liable for funds taken from its clients' accounts, regardless of fault (Law 7472, art. 35, as amended by Law 10.889).
Law 10.889 · SUGEF Regulation 5-26 · Costa Rica
Every fraud claim starts five deadlines. Keep them under control.
Law 10.889 makes your institution liable for funds taken from your clients, except for the legal exemptions. Find out for free where you stand and get the 22 artifacts to comply.
Free · Save and resume whenever you like · Results when you finish
The self-assessment and the toolkit documents are in Spanish, the language of the regulation.
What changed
The burden of proof now lies with your institution
Law 10.889 has been in force since April 22, 2026, and SUGEF Regulation 5-26 since September 11, 2026. When a client claims a transaction they did not authorize, your institution is liable even without fault, and it is the one that must prove its controls worked.
Reversed burden of proof
In administrative and judicial proceedings, the burden of proof is reversed in favor of the consumer (Law 10.889, arts. 6 and 7).
Only three grounds for rejection
Self-fraud, intent, or a transfer between accounts of the same holder, with evidence specific to the case (Law 10.889, art. 3, para. b).
The claim clock
Five deadlines that start running with the claim
-
On receipt
A tracking code with date and time, and an immediate block on the product (art. 4).
-
Day 30
Decide the claim, in calendar days; a single extension of up to 10 business days, notified in advance (art. 3).
-
If upheld
Credit the funds within 10 calendar days and remove interest and charges (art. 3).
-
If decided late
Compensation of one base salary to the client, even if the claim is not upheld (art. 5).
-
Day 120
The institution can no longer decide and must return the funds within 10 calendar days (art. 5).
An unauthorized transaction that happens after the claim is the institution's responsibility (art. 3).
Every deadline, with its traffic light
The claim deadline dashboard (toolkit artifact 8.1) calculates the five deadlines of each claim and flags in red the ones about to expire. Sample data.
SUGEF Regulation 5-26
What the regulation requires you to prove
Before rejecting a claim, the institution must prove it meets the regulation's minimum controls and that its systems were not breached (Law 10.889, art. 3; SUGEF Regulation 5-26, art. 8).
A strategy against cyber fraud, based on a risk assessment and approved by the Board (art. 3).
A statistical record of each case, with its typology, channel and authentication factors, available to SUGEF (art. 4).
Monitoring of transaction patterns, devices and behavior, with confirmation before an atypical transaction goes through (art. 12).
Two-factor authentication to log in, for risky transactions and for self-service (art. 13).
Notifications in under a minute, with evidence of each one and no shortened links in emails (arts. 15 and 16).
A threshold, set on a cost-benefit basis, below which the institution refunds without a detailed investigation (art. 11).
Free self-assessment
Find out in one session how your institution complies
98 questions: 11 for the initial profile and 87 across 10 domains, written from the literal text of the law and the regulation. Each question tells you which area of your institution has the answer, so you can save, check and resume.
Take the free self-assessmentWhat you get
- Conformity index, weighted by what costs your institution the most if it fails.
- Certainty index: how much of your result rests on confirmed information.
- Support index: how much of what you declare to meet you can prove.
- Findings prioritized in three waves, starting with those that have direct financial consequences.
- The toolkit artifact that closes each gap.
What it does not do
It does not estimate fines, because the regulation does not allow that figure to be built, and it does not review documents.
The toolkit
22 artifacts ready to adapt, with the exact citation of the regulation
You do not start from a blank page. Each document brings the obligation, its article and the fields your institution fills in: 15 Word documents and 7 Excel workbooks.
Run the claim from the first minute
Emergency protocol (4.3) · Claims procedure (4.1) · Claim form (4.2) · Deadline dashboard in Excel (8.1)
Decide what the law leaves to the Board
Anti-fraud strategy (3.1) · Below-threshold refund policy (3.2) · Threshold cost-benefit analysis (6.2) · Model resolution (7.1)
Back a rejection with evidence
Rejection and referral to SUGEF and the OIJ procedure (4.4) · Notifications (4.5) · Authentication and information protection (3.3)
Build the proof of your controls
Transaction monitoring and preventive blocks (3.4) · Risk assessment by channel (6.1) · Channel inventory (2.1) · Statistical record (2.2)
Sustain the program over time
Cyber hygiene program (3.5) · Training plan (7.2) · Account reporting (4.6) · Monitoring log (8.2)
It also includes the self-assessment guide (1.1), the implementation guide (G.1) and the catalog with the traceability of each control (C.1).
A date that did not wait
The emergency protocol has a legal deadline: October 22, 2026
The law gave six months from its entry into force to have in operation the protocol that all your staff apply when a client says they were defrauded, or are being defrauded. The protocol requires SUGEF's prior authorization and an update at least once a year (Law 10.889, art. 11 and Transitional Provision II; SUGEF Regulation 5-26, art. 10). Artifact 4.3 brings the eight immediate-response steps, aligned with the regulation's controls.
Price
The whole toolkit, in a single payment
USD 199
One-time payment
22 artifacts (15 Word and 7 Excel) · implementation guide · control-by-control traceability
Self-assessment: always free
Get the toolkitThe toolkit and the self-assessment are support tools and do not constitute legal advice. Each artifact must be reviewed, adapted and approved by the institution's compliance officer and legal team before use.
How it works
From the gap to the approved document, in three steps
-
Take the self-assessment
Free, in one session; each question tells you which area answers it.
-
Get the toolkit
Each finding tells you which artifact closes it.
-
Adapt and approve
You fill in your institution's fields, and your compliance officer and legal team approve it.
On the platform
From the approved document to the control you follow every day
The toolkit gives you the documentary framework. To run it, the Corporate Governance Management module (Compliance Agent) tracks each obligation of Law 10.889 and SUGEF Regulation 5-26 with its control, owner, deadline and evidence, and shows the Board where the institution stands. Technical controls, such as two-factor authentication or notifications, live in your digital channels; the platform governs their compliance.
Corporate Governance Management
Why trust this toolkit
Built from the text of the regulation, not from a summary
Every citation is literal and was checked against the official text in force: SINALEVI and La Gaceta.
Where the regulation does not define something, we tell you. Those readings are marked as recommendations, and the decision belongs to your compliance officer and legal team.
We do not make up figures. If the regulation does not allow a fine to be calculated, the assessment does not estimate it.
Visible cut-off date: October 15, 2026. Log 8.2 records what SUGEF has not yet issued and the constitutional challenges pending against the law.
What we are asked most about Law 10.889
Who does Law 10.889 apply to in Costa Rica?
Law 10.889 applies to the supervised financial institutions defined in the Central Bank's Organic Law, Law 7558, whether public or private (art. 2). In practice, those supervised by SUGEF: public and private banks, savings and credit cooperatives, finance companies, mutual associations and other supervised institutions. SUGEF Regulation 5-26 applies to the same institutions. Snap Compliance's free self-assessment starts with an initial profile that confirms whether it applies to your institution and to what extent.
What does Law 10.889 change for financial institutions?
Two fundamental things change. The institution is liable for funds taken from its clients' accounts even without fault, when an unauthorized third party takes them (Law 7472, art. 35, as amended by Law 10.889). And the burden of proof is reversed in favor of the consumer, in administrative and judicial proceedings (arts. 6 and 7). That is why the institution must be able to prove its controls: the Law 10.889 toolkit brings the documents that support that proof.
How long does an institution have to decide an electronic fraud claim?
Thirty calendar days from when the person files the claim, extendable once by up to ten business days, with notice three days before the deadline (Law 10.889, art. 3). If it decides late, it pays one base salary in compensation, whether or not the claim is upheld; and at 120 calendar days without a decision, it loses the ability to decide and returns the funds within ten days (art. 5). The deadline dashboard in the Law 10.889 toolkit calculates these five deadlines for each claim.
In which cases can an institution reject a fraud claim?
Only in three: self-fraud, intent, or a transfer between accounts of the same holder, and always with evidence specific to the case (Law 10.889, art. 3, para. b). Before that, the investigation must show the institution meets the controls SUGEF requires and that its systems were not breached. The decision denying the claim goes with its evidence and a copy to the OIJ and SUGEF. Procedure 4.4 in the Law 10.889 toolkit organizes that file.
What does SUGEF Regulation 5-26 require?
It is the regulation of minimum controls against cyber fraud that Law 10.889 called for, in force since September 11, 2026. It requires a strategy approved by the Board, a statistical record of cases, multi-factor monitoring of transactions and devices, two-factor authentication, notifications in under a minute without shortened links, an emergency protocol authorized by SUGEF and a refund threshold. Compliance Agent tracks those controls with their owner and deadline.
When must the Law 10.889 emergency protocol be in operation?
The law gave six months from its entry into force on April 22, 2026 to have the victim-response protocol in operation: the deadline is October 22, 2026 (Transitional Provision II). It must be authorized in advance by SUGEF, updated at least once a year and applied by all staff (Law 10.889, art. 11; SUGEF Regulation 5-26, art. 10). Artifact 4.3 in the Law 10.889 toolkit brings the eight immediate-response steps.
Does the Law 10.889 self-assessment cost anything?
No. Snap Compliance's self-assessment is free and you can take it without buying the toolkit. It has 98 questions, 11 for the initial profile and 87 across 10 domains, written from the literal text of the law and SUGEF Regulation 5-26. It is completed in one session, and you can save it and resume it to check with the areas that have the information. When you finish you get your conformity, certainty and support indices, and the findings prioritized in three waves.
Does the self-assessment tell me how much a fine could be?
No. The sanctions of Law 7558, which Law 10.889 refers to (art. 14), are set as a percentage of each institution's equity, and the regulation does not define how several infringements add up. We prefer not to give you a figure the regulation does not allow us to build. We do explain the consequences per claim: restitution, compensation of one base salary and liability for transactions after the claim. The free self-assessment does that.
What does the Law 10.889 toolkit include and how much does it cost?
The Law 10.889 toolkit costs USD 199, as a one-time payment, and includes 22 artifacts: 15 Word documents and 7 Excel workbooks. Among them, the emergency protocol, the claims procedure and its form, the policies SUGEF requires, the Board's model resolution and the claim deadline dashboard. Each document brings the obligation, its article and the fields your institution fills in. They are in Spanish, the language of the regulation.
Are the toolkit documents legal advice?
No. The toolkit and the self-assessment are support tools to move faster, and they do not constitute legal advice. Each artifact must be reviewed, adapted and approved by your institution's compliance officer and legal team before use. Where the regulation does not define something, the document marks it as a recommendation so that your institution makes that decision. To then run each control day to day, there is Compliance Agent.
Your next claim already has a start date. Does your institution have the plan?
The toolkit and the self-assessment are support tools and do not constitute legal advice. Each artifact must be reviewed, adapted and approved by the institution's compliance officer and legal team before use.