كوستاريكا KYC, KYB & AML compliance checklist
قائمة عملية وموثقة بالمصادر لتنفيذ متطلبات KYC وKYB وAML في كوستاريكا.
- تاريخ آخر مراجعة
- تاريخ آخر مراجعة:
- الإصدار
- الإصدار 1.0
إجابة مباشرة
ما الذي تغطيه قائمة الامتثال الخاصة بـ كوستاريكا؟
تحوّل قائمة كوستاريكا قواعد KYC وKYB وAML الأساسية إلى 11 مجالات رقابية و33 فحوص تنفيذ، وتشمل الجهات المختصة وواجبات الإبلاغ والأدلة الواجب الاحتفاظ بها.
حقائق تنظيمية أساسية
- National FIU
- Unidad de Inteligencia Financiera (UIF) within the Instituto Costarricense sobre Drogas
- Core AML framework
- Law 7786, reformed by Laws 8204, 8719, 9387 and 9449, plus sector regulations
- Financial-sector rule
- CONASSIF 12-21 for Article 14 entities
- Articles 15 and 15-bis rule
- SUGEF 13-19 registration and risk-based controls for covered activities
- Suspicious reports
- Directly, immediately and confidentially to UIF, including attempts and regardless of amount
- US$10,000 controls
- Special identification and reporting/data duties apply to defined cash operations and international electronic transfers; this is not a ROS threshold
- AML record retention
- At least 5 years from the applicable transaction or relationship trigger
- RTBF beneficial ownership
- 15% or more participation under the current decree, plus control by other means and senior-manager fallback
- Sanctions timing
- Freeze without delay and communicate a positive match to UIF within no more than 24 hours
- Privacy authority
- Agencia de Proteccion de Datos de los Habitantes (PRODHAB)
- FATF status
- GAFILAT member; not named on the FATF public lists reviewed 1 August 2026
تفاصيل التنفيذ
متطلبات وإجراءات الامتثال في كوستاريكا
افتح كل مجال لمراجعة المتطلب وإجراء التنفيذ المقترح والأدلة الواجب الاحتفاظ بها والمصدر الأساسي.
01Scope, authorities and licensingClassify the entity under Article 14, Article 15, Article 15-bis or outside those categories before choosing the rulebook.3 عناصر+
Article 14 financial institutions are supervised under CONASSIF 12-21 by the competent financial superintendency.
- إجراء التنفيذ
- Map the legal entity and each product to SUGEF, SUGEVAL, SUPEN or SUGESE and capture market-specific lineamientos as well as the common rule.
- الأدلة الواجب الاحتفاظ بها
- Perimeter memo, authorization, supervisor register, rule inventory and launch approval.
- المصدر الأساسي
- Law 7786 art. 14; CONASSIF 12-21 arts. 1-4
Covered activities under Articles 15 and 15-bis must register with SUGEF and comply with SUGEF 13-19.
- إجراء التنفيذ
- Test money transfer, third-party fund management, exchange, credit and listed non-financial activities; obtain registration before using products or accounts for the registered activity.
- الأدلة الواجب الاحتفاظ بها
- Activity analysis, application, SUGEF registration, registered accounts, conditions and renewals.
- المصدر الأساسي
- Law 7786 arts. 15, 15-bis and 15-ter; SUGEF 13-19
Only legally authorized entities may conduct financial intermediation.
- إجراء التنفيذ
- Assess whether the model habitually takes public funds for lending or investment at its own risk; obtain SUGEF authorization where required and do not rely on AML registration alone.
- الأدلة الواجب الاحتفاظ بها
- Funds-flow diagram, Law 7558 analysis, SUGEF correspondence and authorization.
- المصدر الأساسي
- Organic Law of the BCCR, Law 7558 arts. 116 and 119
02Governance and risk assessmentThe control framework must be approved, risk-based and appropriate to the applicable supervisory category.3 عناصر+
Obliged entities must identify and assess customer, product, channel and geographic LC/FT/FPADM risks.
- إجراء التنفيذ
- Approve an enterprise assessment and translate it into risk appetite, customer scoring, due-diligence levels, scenarios and review frequency.
- الأدلة الواجب الاحتفاظ بها
- Methodology, data, national-risk inputs, approval, validation and change log.
- المصدر الأساسي
- CONASSIF 12-21 arts. 5-13; SUGEF 13-19
The compliance function must have suitable authority, independence, resources and reporting access.
- إجراء التنفيذ
- Appoint the required officer or liaison for the entity category, document deputies and conflicts, and provide direct escalation to the governing body.
- الأدلة الواجب الاحتفاظ بها
- Appointment, fit-and-proper evidence, role profile, minutes, budget, training and escalation log.
- المصدر الأساسي
- Law 7786 arts. 14-15-bis; CONASSIF 12-21 arts. 14-22; SUGEF 13-19
Controls must be tested and deficiencies remediated under the applicable audit and review rules.
- إجراء التنفيذ
- Schedule independent, internal or external review as required, assign accountable owners and validate closure with evidence.
- الأدلة الواجب الاحتفاظ بها
- Audit plan, reports, management responses, remediation tracker and closure tests.
- المصدر الأساسي
- CONASSIF 12-21 arts. 23-27; SUGEF 13-19
03Natural-person KYC and representativesCDD must establish identity, authority, purpose, source and expected behaviour using reliable evidence.3 عناصر+
Customers must be identified and verified, especially at relationship opening and for cash transactions above US$10,000.
- إجراء التنفيذ
- Capture official identity, domicile, occupation, purpose, expected activity and source of funds; authenticate evidence and resolve inconsistencies before activation.
- الأدلة الواجب الاحتفاظ بها
- Identity record, verification result, profile, source evidence, reviewer and exceptions.
- المصدر الأساسي
- Law 7786 art. 16; CONASSIF 12-21 arts. 28-36
Representatives and signatories must be identified and their authority validated.
- إجراء التنفيذ
- Verify the natural person, obtain the current mandate or power, confirm its scope and link it to the represented customer and beneficial owners.
- الأدلة الواجب الاحتفاظ بها
- Representative KYC, power, National Registry check, scope analysis and expiry control.
- المصدر الأساسي
- Law 7786 art. 16(c); CONASSIF 12-21 arts. 28-36
CDD must continue throughout the relationship and activity must remain consistent with the known customer and risk profile.
- إجراء التنفيذ
- Set risk-based refresh and event triggers, update source and beneficial-owner information and investigate material deviations.
- الأدلة الواجب الاحتفاظ بها
- Review schedule, event alerts, updated file, discrepancy resolution and approval.
- المصدر الأساسي
- CONASSIF 12-21 arts. 28-38; SUGEF 13-19
04KYB, RTBF and beneficial ownershipAML beneficial-owner CDD and the entity's own RTBF filing are related but distinct obligations.3 عناصر+
CDD must identify the natural persons who ultimately own or control the customer or receive the benefit.
- إجراء التنفيذ
- Verify legal existence, purpose and authority; trace direct and indirect ownership, voting and control by other means to natural persons.
- الأدلة الواجب الاحتفاظ بها
- Registry certificate, constitutional documents, ownership chart, voting analysis, declarations and corroboration.
- المصدر الأساسي
- CONASSIF 12-21 arts. 3 and 29; Law 7786 art. 16
RTBF identifies 15% or greater direct or indirect participation and also requires control-by-other-means and senior-manager fallback analysis.
- إجراء التنفيذ
- Do not treat 15% as the sole test; calculate holdings and voting rights, assess appointment and other control and document the exceptional fallback.
- الأدلة الواجب الاحتفاظ بها
- Cap table, indirect calculation, control memo, fallback rationale and reviewer sign-off.
- المصدر الأساسي
- Law 9416 art. 5; Executive Decree 44390-H arts. 8-10
Covered legal persons and structures must file accurate RTBF declarations annually and on applicable changes under the current schedule.
- إجراء التنفيذ
- Use Central Directo, track the current joint-resolution filing period, submit event-driven updates and reconcile declarations with corporate and AML records.
- الأدلة الواجب الاحتفاظ بها
- RTBF declaration, BCCR receipt, source documents, change log and reconciliation.
- المصدر الأساسي
- Law 9416 arts. 5-7; Executive Decree 44390-H; Joint Resolution MH-DGT-ICD-RES-0020-2024
05PEPs, EDD and remote onboardingPEPs and higher-risk customers require management attention, source analysis and intensified monitoring.3 عناصر+
Systems must determine whether a customer or beneficial owner is a PEP and cover relevant family members and close associates.
- إجراء التنفيذ
- Screen at onboarding and continuously, research the public function and relationship, and document the classification and review period.
- الأدلة الواجب الاحتفاظ بها
- Screening, role research, relationship map, disposition and review date.
- المصدر الأساسي
- CONASSIF 12-21 arts. 3 and 39-41; General Regulation to Law 7786
PEP and other high-risk relationships require enhanced measures.
- إجراء التنفيذ
- Obtain senior approval, establish source of wealth and funds, set intensified monitoring and refresh and document why the relationship is accepted or continued.
- الأدلة الواجب الاحتفاظ بها
- Approval, wealth and funds evidence, monitoring plan, reviews and exceptions.
- المصدر الأساسي
- CONASSIF 12-21 arts. 39-43; SUGEF 13-19
Remote onboarding must meet the same identification and accountable risk outcomes as other channels.
- إجراء التنفيذ
- Use permitted reliable sources, bind identity to the session, test impersonation and presentation attacks and govern vendors and fallback.
- الأدلة الواجب الاحتفاظ بها
- Method approval, vendor due diligence, device and liveness evidence where used, tests and exceptions.
- المصدر الأساسي
- CONASSIF 12-21 arts. 32-36 and applicable superintendency lineamientos
06Monitoring, ROS and confidentialitySuspicion and attempts must be reported immediately, confidentially and independently of threshold-data reports.3 عناصر+
Reasonable suspicion must be reported directly, immediately and confidentially to UIF, including attempted operations and regardless of amount.
- إجراء التنفيذ
- Escalate promptly, record the knowledge time and grounds, submit through the secure current channel and preserve the receipt and supplements.
- الأدلة الواجب الاحتفاظ بها
- Alert, analysis, decision timeline, ROS, UIF receipt, supplement and access log.
- المصدر الأساسي
- Law 7786 art. 25; Executive Decree 40018 arts. 1-4
Unusual activity must be analysed against the customer's known profile before a documented ROS decision.
- إجراء التنفيذ
- Deploy risk-based scenarios, collect available facts without delaying an immediate report, document the conclusion and keep monitoring after filing.
- الأدلة الواجب الاحتفاظ بها
- Scenario inventory, alerts, case file, rationale, tuning and quality assurance.
- المصدر الأساسي
- CONASSIF 12-21 arts. 46-52; SUGEF 13-19
Customers and unauthorised persons must not be informed of a ROS or related analysis.
- إجراء التنفيذ
- Restrict case access, separate servicing communications from reporting decisions and train staff on confidentiality and lawful supervisor access.
- الأدلة الواجب الاحتفاظ بها
- Access roles, confidentiality acknowledgements, training, communications and incident log.
- المصدر الأساسي
- Law 7786 art. 25; Executive Decree 40018
07Threshold data, wires, payments and agentsUS$10,000 transaction data, payment-system participation and suspicious reporting are separate controls.3 عناصر+
Defined cash operations and electronic transfers from or to another country at US$10,000 or more require the applicable record and information reporting treatment.
- إجراء التنفيذ
- Implement exact category and aggregation logic, submit through the applicable supervisor format and keep the process separate from ROS assessment.
- الأدلة الواجب الاحتفاظ بها
- Rules, transaction extract, report file, receipt, exception and reconciliation.
- المصدر الأساسي
- Law 7786 arts. 20-24; CONASSIF 12-21 arts. 53-55
SINPE participation and payment services must comply with the BCCR Payment System Regulation and technical admission requirements.
- إجراء التنفيذ
- Classify the participant type, obtain affiliation or authorization, meet security and operating requirements and reconcile settlement and customer records.
- الأدلة الواجب الاحتفاظ بها
- BCCR approval, participant agreement, technical certification, settlement controls and incidents.
- المصدر الأساسي
- BCCR Payment System Regulation, edition 24, effective 12 December 2025
Agents, correspondents and vendors operate under the accountable entity's responsibility.
- إجراء التنفيذ
- Contract for CDD, monitoring, evidence access, audit, incident notice and exit; test samples and prohibit use outside authorized activities.
- الأدلة الواجب الاحتفاظ بها
- Due diligence, contract, training, monitoring, sample tests, incidents and exit plan.
- المصدر الأساسي
- CONASSIF 12-21; BCCR Payment System Regulation; applicable correspondent rules
08Targeted financial sanctionsCosta Rica requires direct list monitoring, freezing without delay and rapid UIF communication.3 عناصر+
All relevant persons must monitor applicable UN lists and freeze or immobilize funds or assets without delay on a positive match.
- إجراء التنفيذ
- Screen customers, beneficial owners, representatives, counterparties and assets on list updates and before relevant activity; freeze without prior notice.
- الأدلة الواجب الاحتفاظ بها
- List source, screening timestamp, match packet, freeze record and access controls.
- المصدر الأساسي
- Law 7786 art. 33-bis; Executive Decree 40018 arts. 6-7
A positive match and the freeze must be communicated to UIF within no more than 24 hours.
- إجراء التنفيذ
- Use the secure UIF platform, preserve the exact detection and freeze time and follow judicial or authority instructions for continuation or release.
- الأدلة الواجب الاحتفاظ بها
- UIF communication, timestamp, receipt, authority correspondence and release approval.
- المصدر الأساسي
- Executive Decree 40018 arts. 6-7
Sanctions controls must include owned, controlled and acting-on-behalf relationships, not only exact customer-name matches.
- إجراء التنفيذ
- Map ownership and control, use multiple identifiers, investigate potential matches and document false-positive decisions.
- الأدلة الواجب الاحتفاظ بها
- Ownership analysis, identifiers, screening result, escalation and reviewer approval.
- المصدر الأساسي
- Law 7786 art. 33-bis; Executive Decree 40018
09Records and regulator accessRecords must remain complete, secure and rapidly retrievable for the legally defined period.3 عناصر+
Identity, account, correspondence and transaction records must be retained for at least five years from the applicable trigger.
- إجراء التنفيذ
- Define triggers by record class, suspend deletion for investigations and authority requests and document any longer sector period.
- الأدلة الواجب الاحتفاظ بها
- Retention schedule, system rules, legal holds, deletion log and tested retrieval.
- المصدر الأساسي
- Law 7786 arts. 16(d)-(e) and 22
Records must permit reconstruction of transactions and the basis for CDD, risk and reporting decisions.
- إجراء التنفيذ
- Preserve source documents, versions, approvals, screening, alerts, communications and reports in an auditable sequence.
- الأدلة الواجب الاحتفاظ بها
- Complete sample file, immutable audit trail, version history and reconstruction test.
- المصدر الأساسي
- Law 7786 arts. 16-22; CONASSIF 12-21
Information must be available to UIF and competent supervisors through lawful and secure channels.
- إجراء التنفيذ
- Maintain current credentials, verify authority, index each production and preserve secure delivery and legal-hold evidence.
- الأدلة الواجب الاحتفاظ بها
- Request, authority check, production index, delivery receipt and hold.
- المصدر الأساسي
- Law 7786 arts. 17-19 and 123; applicable supervisor rules
10Privacy, biometrics and transfersAML duties coexist with informed processing, security, confidentiality and transfer controls under Law 8968.3 عناصر+
Personal-data collection generally requires clear prior information and informed, express consent unless a legal exception applies.
- إجراء التنفيذ
- Map each KYC field to purpose and legal basis, provide the article 5 information, minimise optional data and keep ROS processing confidential.
- الأدلة الواجب الاحتفاظ بها
- Data inventory, legal-basis record, notice, consent where used and rights log.
- المصدر الأساسي
- Law 8968 arts. 4-7; Executive Decree 37554-JP
Sensitive and biometric information requires strict necessity, lawful grounds and proportionate security.
- إجراء التنفيذ
- Document necessity, limit collection, test accuracy and bias, encrypt templates, restrict access and implement a lawful fallback.
- الأدلة الواجب الاحتفاظ بها
- Necessity assessment, consent or exception, security design, testing, access and deletion logs.
- المصدر الأساسي
- Law 8968 arts. 9-11; Executive Decree 37554-JP arts. 35-37
Transfers to processors or third parties require valid authorization or another lawful basis and must preserve confidentiality and security.
- إجراء التنفيذ
- Map locations and subprocessors, contract for purpose limits, security, incident handling, deletion and regulator access, and assess each transfer.
- الأدلة الواجب الاحتفاظ بها
- Data-flow map, transfer assessment, contracts, subprocessor register and incident plan.
- المصدر الأساسي
- Law 8968 arts. 11 and 14; Executive Decree 37554-JP
11Fintech, virtual assets and practical evidence packsFintech and virtual-asset models must be classified by function rather than marketing label.3 عناصر+
Payment, stored-value, remittance and customer-fund models may trigger BCCR, SUGEF and Law 7786 requirements.
- إجراء التنفيذ
- Analyse custody, settlement, redemption, cross-border transfer, public-fund taking and third-party fund control; obtain each required approval before launch.
- الأدلة الواجب الاحتفاظ بها
- Product and funds flows, legal opinions, regulator correspondence, approvals and conditions.
- المصدر الأساسي
- Law 7558 arts. 116 and 119; Law 7786 arts. 14-15-bis; BCCR Payment System Regulation
No blanket conclusion should be drawn from using virtual assets; the exact activity and legal perimeter control.
- إجراء التنفيذ
- Test exchange, transfer, custody, administration, investment and payment functions against Articles 14-15-bis, securities, payments, consumer, tax and sanctions rules and record any regulatory uncertainty.
- الأدلة الواجب الاحتفاظ بها
- Dated perimeter memo, authority checks, risk assessment, customer restrictions and monitoring plan.
- المصدر الأساسي
- Law 7786; SUGEF 13-19; current BCCR and superintendency rules reviewed 1 August 2026
Every implemented control should have a compact and reviewable evidence pack.
- إجراء التنفيذ
- Assign an owner, applicability decision, procedure, system control, test, exception route and remediation date to every checklist row.
- الأدلة الواجب الاحتفاظ بها
- Control matrix, RACI, evidence links, test results, gaps, remediation and approval.
- المصدر الأساسي
- Recommended implementation control supporting Law 7786 and sector-rule compliance
سجل المصادر الأساسية
16 مصدرًا مستخدمًا في هذه القائمة
استخدم هذه الروابط للتحقق من التشريعات وإرشادات الجهات الرقابية وإجراءات الإبلاغ والبيانات الدولية.
- Law 7786 - current legal textSistema Costarricense de Informacion Juridica · Primary legislation
- CONASSIF 12-21 - Article 14 AML/CFT/CPF regulationSuperintendencia General de Entidades Financieras · Primary sector regulation
- SUGEF 13-19 - Articles 15 and 15-bis regulationSuperintendencia General de Entidades Financieras · Primary sector regulation
- Current SUGEF transversal regulations registerSuperintendencia General de Entidades Financieras · Official regulation register
- Executive Decree 40018 - ROS and targeted financial sanctionsSistema Costarricense de Informacion Juridica · Primary regulation
- Law 9416 - Tax Fraud Law and RTBFSistema Costarricense de Informacion Juridica · Primary legislation
- Executive Decree 44390-H - RTBF regulationSistema Costarricense de Informacion Juridica · Primary regulation
- Joint Resolution MH-DGT-ICD-RES-0020-2024 - RTBF filing rulesSistema Costarricense de Informacion Juridica · Primary administrative resolution
- RTBF 2025 official guideMinisterio de Hacienda · Official filing guidance
- Law 8968 - personal-data protectionSistema Costarricense de Informacion Juridica · Primary legislation
- Costa Rica data-protection legislation registerAgencia de Proteccion de Datos de los Habitantes · Official legislation register
- BCCR Payment System Regulation - edition 24Banco Central de Costa Rica · Primary payment regulation
- SUGEF warning and authorization guidance for unauthorised financial activitySuperintendencia General de Entidades Financieras · Official licensing guidance
- FATF Costa Rica country pageFinancial Action Task Force · Official country and follow-up source
- FATF black and grey listsFinancial Action Task Force · Official current-status source
- FATF Latin America regional body pageFinancial Action Task Force · Official GAFILAT membership source
إجابات مباشرة
أسئلة KYC وKYB وAML في كوستاريكا
Who receives suspicious-operation reports in Costa Rica?+
The UIF of the Instituto Costarricense sobre Drogas. Reports must be sent directly, immediately and confidentially through the current secure channel.
Are attempted suspicious operations reportable?+
Yes. Executive Decree 40018 expressly covers attempts, regardless of amount.
Is US$10,000 the Costa Rica ROS threshold?+
No. Suspicion has no monetary threshold. US$10,000 is relevant to defined cash and international-transfer identification and information-reporting controls.
What is the Costa Rica beneficial-owner threshold?+
The current RTBF regulation uses 15% or more participation, but control by other means and an exceptional senior-manager fallback must also be assessed.
How long must AML records be kept?+
At least five years from the applicable end-of-transaction or relationship trigger, subject to legal holds and any longer sector rule.
What is the sanctions reporting deadline?+
Freeze or immobilize without delay and communicate a positive match to UIF within no more than 24 hours under Executive Decree 40018.
Does SUGEF AML registration authorize financial intermediation?+
No. Article 15 or 15-bis registration is distinct from prudential authorization. Public-fund-taking and other regulated financial activities require separate analysis and approval.
How are fintech and virtual-asset businesses treated?+
Classification follows the activity, not the label. Test custody, exchange, transfer, payments, remittance, customer-fund management and investment functions against Law 7786, BCCR, SUGEF, securities and other rules.
Is Costa Rica on a FATF public list?+
Costa Rica was not named on the FATF call-for-action or increased-monitoring lists reviewed 1 August 2026, but remains subject to GAFILAT follow-up and risk-based controls still apply.
منهجية البحث والمراجعة
تحدد VOVE ID Compliance Research النطاق التنظيمي، وتحول الالتزامات إلى ضوابط تشغيلية، وتربط الادعاءات الجوهرية بالمصادر، وتسجل تاريخ وإصدار كل مراجعة.
General regulatory information, not legal advice, a licence decision or a substitute for the operative Spanish text, SUGEF/UIF instructions or regulator confirmation. Reviewed 1 August 2026. Confirm entity, activity, customer, transaction, reporting format, RTBF filing period, sanctions route, privacy role and later developments with qualified Costa Rican counsel and the competent authority before launch.