Costa Rica: technology regulation at a glance

Framework: Law No. 7786 (AML/CFT Act, as proposed to be amended by Bill 22.837 to encompass VASPs under SUGEF); general commercial law; SUGEVAL Securities Market Law for token offerings with securities characteristics; Ministerio de Hacienda private letter ruling on crypto taxation (2023, ongoing applicability)

Cryptocurrency is legal in Costa Rica as a private intangible asset freely exchangeable under general commercial law, but the Central Bank (BCCR) does not recognize it as legal tender. Bill 22.837, passed in its first legislative debate on 2 July 2025, amends the AML Law (No. 7786) to formally define virtual assets and VASPs and to require their registration with SUGEF for AML/CFT compliance, marking the first legally binding framework for the sector. No standalone VASP license or comprehensive crypto market law was yet in force as of early 2026, though a second bill (Proyecto de Ley 23.415, Cryptoassets Market Law) is under separate legislative review.

Framework: National AI Strategy (ENIA 2024-2027) led by MICITT; no enacted AI law, multiple bills pending in the Legislative Assembly

Costa Rica became the first Central American country to adopt a National Artificial Intelligence Strategy (ENIA 2024-2027) in October 2024, establishing ethical and governance principles for AI use across public and private sectors. No binding AI legislation has been enacted; at least three AI-specific bills remain under active debate in the Legislative Assembly as of 2026. The country relies on the ENIA strategy, existing data-protection law (Law 8968), and voluntary alignment with OECD AI principles while comprehensive legislation is pending.

Framework: Law No. 8968, Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales (2011), with implementing Regulation (Executive Decree No. 37554-JP), enforced by the Agencia de Protección de Datos de los Habitantes (PRODHAB) under the Ministry of Justice and Peace.

Costa Rica has an omnibus, GDPR-precursor data-protection law in force since 2011 (Law 8968), making it one of the first Latin American countries to enact such a regime. It applies to automated and manual personal-data files in both the public and private sectors and is supervised and enforced by a dedicated authority, PRODHAB. A comprehensive reform bill (No. 23097) to modernize and align the law with the EU GDPR has been before the Legislative Assembly since 2022 but is not yet enacted.

Framework: Ley Orgánica del Banco Central de Costa Rica (Law 7558, incl. 2020 reform / Article 15 Bis); BCCR Reglamento del Sistema de Pagos; BCCR Reglamento del Sistema de Tarjetas de Pago (December 2025); supervised by BCCR, SUGEF, and CONASSIF

Costa Rica operates a partially-formed digital payments and fintech regulatory framework. The Central Bank (BCCR) governs the SINPE instant payment infrastructure and in December 2025 issued a comprehensive Payment Card System Regulation setting interchange fee caps and EMV standards. SUGEF supervises payment and fintech entities under existing banking law (Article 15 Bis of Law 7558), but a dedicated standalone Fintech Framework Law (Bill 23093) had passed committee in April 2025 and had not yet been enacted by the full Legislative Assembly as of May 2026.

Framework: Law 10008, 'Ley para atraer trabajadores y prestadores remotos de servicios de carácter internacional' (enacted 2021, regulated July 2022), administered by the Dirección General de Migración y Extranjería (DGME); supplemented by Law 9996 for longer-term investor/rentista/pensionado residency

Costa Rica operates a dedicated digital nomad immigration sub-category, 'Estancia para Trabajadores Remotos', established by Law 10008 and in force since mid-2022. The visa grants remote workers a one-year legal stay, renewable once for a maximum of two years, with full exemption from Costa Rican income tax on foreign-sourced earnings. Applicants must demonstrate at least $3,000/month in foreign-sourced income and hold qualifying international health insurance.

Framework: Digital Services and E-Commerce Governance Law (Law 23,184, approved April 2026, not yet in force); Data Protection Law No. 8968 (2011); Cybercrime Law; SUTEL (telecom regulator) and MICITT (Ministry of Science, Innovation, Technology and Telecommunications)

Costa Rica currently operates under sector-specific rules, a 2011 data-protection law, cybercrime statutes, and consumer-protection provisions, rather than a comprehensive online-safety regime. In April 2026 the Legislative Assembly approved a DSA-inspired Digital Services and E-Commerce Governance Law (23,184) in its second (final) debate, which will enter into force 12 months after publication in the Official Gazette; a separate bill (25,336) to ban children under 14 from social media is advancing in committee. Freedom House scored the country 86/100 in its 2025 Freedom on the Net report, placing it among the world's most open online environments with no government censorship or blocking.

Framework: Ley sobre Delitos Informáticos (Law 9048, 2012) + MICITT National Cybersecurity Strategy 2023-2027 + proposed Ley de Ciberseguridad (Expediente 23292, pending)

Costa Rica currently lacks a comprehensive, enacted cybersecurity law; the primary statutory instrument is the 2012 cybercrime law (Law 9048), supplemented by a non-binding National Cybersecurity Strategy 2023-2027 and sector-level obligations. A dedicated Ley de Ciberseguridad (Exp. 23292) has been under Legislative Assembly debate since 2022 and was under active plenary consideration in 2024-2025, but had not been enacted as of early 2026. The 2022 Conti ransomware emergency, the largest cyberattack in Central American history, catalysed both the strategy and the legislative push.

Framework: Código de Comercio (Commercial Code); Registro Nacional (National Registry); PROCOMER Ventanilla Única de Inversión (VUI); Law 10729 (2025 registry reform)

Costa Rica permits 100% foreign ownership in most sectors with no statutory minimum share capital requirement. Companies are registered through the Registro Nacional, and since 2025 the PROCOMER-led Ventanilla Única de Inversión (VUI) one-stop digital portal coordinates filings across multiple agencies. Following 2025 digitalization reforms, the typical formation timeline has been reduced to 5-7 business days.