Costa Rica Gaming Authorisation

REQUIREMENTS

Incorporate the local company

Entity — Incorporate a Sociedad Anónima (S.A.) or S.R.L. at the National Registry with local registered office and resident agent (attorney). Then register with Tax Authority (D-140).

Territorial tax — Only Costa Rican-source income is subject to corporate income tax. Foreign-source income is outside scope — though check exceptions for certain passive income in multinational groups. Current top CIT band ~30%.
 

Obtain the municipal business license (patente comercial)

What it is — A mandatory municipal license to carry out any lucrative activity in the chosen canton. This is your operative “permit” in practice.

Legal basis — Código Municipal, Ley 7794, plus each municipality’s licensing regulation. Requirements vary by canton.

Typical filings — Application form, corporate personería, ID for legal rep, proof of address, tax stamps, zoning/land-use clearance (uso de suelo), lease or title for premises. Some cantons publish their lists online.

Activity line — Register the activity as centro de procesamiento de datos / servicios en línea rather than “gambling”. The “data-processing license” terminology reflects a municipal business license for that activity.

Core registrations if you’ll employ staff or keep an office

Social security — Employer registration with CCSS and occupational risk insurance with INS. Required for any local employees.

Local compliance add-ons — Health & safety, signage, and fire-safety clearances may be requested by the canton for physical offices. Municipal regs make issuance conditional on meeting all applicable requirements.
 

Data protection program — mandatory

Law 8968 + Regulation — Implement a privacy program aligned to Costa Rica’s data-protection law and its regulation; PRODHAB enforces. Register applicable personal-data databases with PRODHAB where required. Non-compliance has led to fines.

Artifacts — Inventory of databases, privacy policy, consent/notice flows, DSR procedures, processor agreements, security measures, and a breach-response plan referencing Law 8968.

AML/CFT expectations

Legal landscape — There’s no gambling-specific AML regulator in CR, but Law 8204 and its regulations set the general AML/CFT framework and create the national FIU. Even if you’re not a “designated” entity locally, payment partners will require a credible AML/KYC program.

Program essentials — KYC and age checks for all players, sanctions and PEP screening, risk-based monitoring, suspicious-activity escalation, record-keeping, and independent testing. Map to Law 8204 standards.
 

Banking & payments

Local banks — Expect refusal for online-gambling processing without a formal offshore license. Plan for offshore EMI/PSP, card-acquirers in licensed jurisdictions, or crypto rails with strong compliance controls.

Contract stack — PSP/EMI agreements, fraud tools, chargeback handling, and clear prohibited-market geoblocking.
 

Platform, RNG, and game compliance

Technical controls — Even without a CR regulator, B2B partners and target markets expect RNG certifications, game fairness attestations, uptime/security SLAs, and change-management. Document these in vendor files and T&Cs.
 

Website, product, and customer-facing policies

Terms & Conditions — Contracting entity, eligibility, account rules, bonus terms, house rules per vertical, self-exclusion, complaints, governing law, and market-availability disclaimers.

Responsible gaming — Age limit 18+, self-exclusion tools, session/time-out limits, RG links, and proactive messaging — essential for PSP due-diligence even if not mandated locally.

Geo-controls — Block Costa Rica and any prohibited or licensed markets you’re not authorized to serve. Document logic in your compliance matrix.

Immigration & corporate governance

Directors/owners — Non-residents may own and direct CR companies. If anyone will work in-country, obtain the proper immigration category before commencing work.

Governance pack — Share register, board minutes, resident-agent mandate, powers of attorney, internal approvals for opening PSP/EMI accounts, and policy adoption minutes.

Evidence pack most PSPs ask for

Corporate docs (incorporation certificate, personería vigentísima), municipal license, lease, KYC for UBOs and directors, AML policy, RG policy, privacy program summary, technical overview, and geoblocking statement.