Gambling License in Costa Rica: Requirements, Cost & Process 2026

Unlike Curaçao, Malta, or the Isle of Man, Costa Rica does not issue a purpose-built gambling authorization. Instead, operators obtain a municipal data-processing permit — a general business license (typically from the municipality of San José) that authorizes commercial data processing. The permit does not reference gambling at all. Operators rely on the absence of any national law prohibiting online gambling directed at foreign players to argue that running a sportsbook or casino platform is lawful under this permit.

The practical consequences are significant:

• Payment processing — Most tier-1 banks and card networks do not accept a data-processing permit as evidence of a gambling license. Operators typically rely on alternative PSPs, cryptocurrency gateways, or offshore merchant accounts.
• Player trust — Without a recognized regulatory seal, building player confidence requires greater investment in branding and third-party certification (e.g., eCOGRA, iTech Labs RNG audits).
• Market access — Regulated markets such as the EU, UK, and US require local licenses; a Costa Rican data-processing permit provides no right of access to these markets whatsoever.
• Legal exposure — Because there is no gambling regulator, there is also no regulatory backstop. Disputes, fraud allegations, and player complaints have no national authority to escalate to.

The table below compares the Costa Rica data-processing model against three established gambling license jurisdictions:

The Costa Rica model offers the lowest entry cost and fastest setup time, but trades regulatory credibility and banking access for that convenience. For operators targeting grey or unregulated markets and primarily using cryptocurrency or alternative payment methods, the cost-benefit calculation may favour Costa Rica. For operators targeting European players or seeking mainstream payment processing, a Curaçao, Malta, or Isle of Man license is the appropriate choice.

Costa Rica’s grey area traces back to Law No. 3 of 1922, a gambling statute written to regulate land-based gambling halls and lottery-style games — decades before the internet existed. Because the law never addressed online wagering, early operators in the 1990s began incorporating in Costa Rica and serving foreign players under municipal data-processing permits. In 2012, the legislature considered a bill that would have created a formal online gambling licensing regime with a dedicated regulatory body, but the legislation stalled and was never enacted. As of 2026, no subsequent law has filled the gap, leaving the data-processing permit model as the de facto operating framework.

Initial setup costs are covered in the Packages section above. Below are the recurring costs after year one.

*Colocation or dedicated server in a Costa Rican data centre is required for operators hosting gambling platforms on local infrastructure. This requirement stems from Executive Decree 39231, which governs data-processing companies in Costa Rica.

A note on permit renewal costs: Some online guides claim the municipal permit carries no annual renewal fee. In practice, municipalities charge $1,000–$5,000 depending on the declared capital base.

At minimum, recurring annual costs run $6,300/year excluding server infrastructure, or $9,300/year with local platform hosting.

Costa Rica remains one of the most accessible entry points for operators who need to launch quickly and preserve capital during the early growth phase.

• 0% tax on offshore-sourced revenue — Costa Rica operates a territorial tax system. Income generated from players outside the country is not subject to domestic corporate income tax, capital gains tax, or VAT. For operators serving exclusively international markets, the effective tax rate on gross gaming revenue is zero. Companies must still file annual returns and pay a nominal corporate tax of roughly $400–$500 per year.
• Low operating costs — Company formation fees, annual maintenance, and local legal representation cost a fraction of what regulated jurisdictions charge. Total first-year setup typically ranges from $11,000 to $18,000, with ongoing annual costs of $6,300–$9,300 — compared to six-figure budgets for Malta or the Isle of Man.
• Fast setup timeline — A Costa Rican data-processing company can be incorporated and fully operational in as little as eight weeks. Company incorporation takes 3–5 weeks, and the municipal data-processing permit adds a further 4–8 weeks. This is dramatically faster than regulated markets, where a Malta Gaming Authority licence can take 12–18 months.
• 100% foreign ownership permitted — Non-resident shareholders and directors can own the entire entity. There is no requirement for local shareholders, local directors, or Costa Rican nationals on the board. The only local requirement is a registered agent (a Costa Rican attorney).
• No minimum capital requirement — Costa Rica imposes no statutory minimum share capital for either an S.A. or an S.R.L. This removes the capital lock-up that jurisdictions like Malta (€100,000+) or the Isle of Man require before operations can begin.
• No mandatory software testing or certification — No RNG or game-math certifications are required before launch. Operators are free to integrate any platform provider without pre-approval from a regulator. While voluntary certifications (eCOGRA, iTech Labs) are recommended for player trust, they are not a legal prerequisite.
• OECD member country — Costa Rica is an OECD member, which signals a baseline of institutional stability, rule of law, and international cooperation on tax transparency. This matters for banking relationships, correspondent banking due diligence, and investor confidence.

Most competitor guides present Costa Rica as an unqualified opportunity. It is not. Operators who commit without understanding the constraints risk wasted capital and operational paralysis — particularly around banking and payment processing.

• Persistent banking challenges — This is the single most significant practical obstacle for Costa Rica gambling operators. Local banks routinely decline corporate accounts linked to online gambling, and international payment processors treat a data-processing permit as insufficient evidence of a gambling licence. Operators must rely on alternative PSPs, cryptocurrency gateways, or offshore merchant accounts — all of which carry higher fees and greater counterparty risk.
• Limited jurisdictional recognition — A Costa Rican data-processing authorisation is not recognised as a gambling licence by any regulated market. It provides no right of access to the EU, UK, US, Australia, or any jurisdiction that requires a local gaming licence. Operators targeting these markets must obtain separate licences in each territory.
• No formal player-protection framework — Costa Rica does not mandate responsible gambling tools, self-exclusion registers, deposit limits, or cooling-off periods. Operators who fail to implement these voluntarily face reputational risk and may be excluded from affiliate networks and comparison sites that require evidence of player-protection measures.
• Reputational concerns with partners and players — Premium affiliate networks, white-label providers, and sophisticated players increasingly distinguish between licensed and unlicensed jurisdictions. A Costa Rica data-processing permit does not carry the trust signal of an MGA, UKGC, or even a Curaçao licence. Operators must invest more heavily in third-party audits, provably fair technology, and brand building to compensate.

Note: The current permissive environment depends on the absence of prohibitive legislation. If Costa Rica enacts a formal online gambling law — which is a matter of when, not if — operators structured around the data-processing permit may face mandatory re-licensing, new capital requirements, or forced closure. A contingency plan for migration to a regulated jurisdiction should be part of every operator’s risk framework.

Two government bodies are directly relevant to online offshore operators:

Two additional bodies — the Ministry of Public Security (MoPS) and the Junta de Protección Social (JPS) — oversee land-based casino permits and the state lottery monopoly respectively. Neither body regulates online gambling directed at foreign players, and neither issues permits relevant to offshore operators. Their jurisdiction is limited to domestic, physical gaming venues and the national lottery system.

• Law 8204 (2001) — AML Law — Costa Rica’s primary anti-money laundering statute. Establishes customer due diligence, suspicious-transaction reporting, and record-keeping obligations for all regulated entities, including companies holding a data-processing permit. Administered by the ICD under Law 8204.
• Law 9050 (2012) — Casino & Electronic Betting Tax — Imposes a specific tax on land-based casinos and electronic betting terminals. Does not apply to online gambling operators holding a data-processing permit, but establishes the legislative precedent for taxing gaming activity in Costa Rica. Full text at SCIJ.

Other legislation governs land-based casinos (including the original Law No. 3 of 1922, which predates the internet entirely) and the state lottery monopoly. None of these statutes address online gambling directed at foreign players — a gap that defines the regulatory grey area operators must navigate.

As explained in the data-processing permit section above, Costa Rica has no legislation that expressly authorises or prohibits online gambling directed at foreign players. Operators incorporate a Costa Rican entity, obtain a municipal data-processing permit, and rely on the absence of a prohibitive law to conduct gambling operations from Costa Rican territory. This is not a formal licence — it is a structural workaround that has persisted for over two decades because no legislature has moved to close or formalise it.

Formal regulation of online gambling in Costa Rica is likely a matter of when, not if. The 2012 bill that would have established a dedicated gaming authority and licensing framework stalled, but growing international pressure — from the FATF, OECD, and regional bodies such as GAFILAT — continues to push Costa Rica toward formalising oversight of its substantial online gambling sector. Any future legislation would likely introduce licensing fees, compliance requirements, and potentially a dedicated regulator, bringing Costa Rica closer to the Curaçao model.

Operators relying on the current data-processing permit model should have a contingency plan. If formal regulation is enacted, existing operators will likely face a transition period to apply for a new licence — but there is no guarantee of grandfathering. Building robust AML/KYC infrastructure, maintaining clean corporate records, and operating transparently will position your business favourably regardless of how the regulatory landscape evolves.

Costa Rican law recognises several commercial entity types, but two dominate the online gambling sector: the Sociedad Anónima (S.A.) and the Sociedad de Responsabilidad Limitada (S.R.L.). Both provide limited liability, yet they differ materially in governance flexibility, transferability of ownership interests, and the perception of international banking partners.

Other entity types (S.C.S., S.C.A., S.N.C., branch of a foreign company) exist but are rarely used in online gambling. For most operators expecting growth or outside investment, the S.A. is the preferred vehicle — it issues shares, permits unrestricted transfers, and is the structure international banks recognise most readily. Costa Rica imposes no minimum paid-up capital requirement and permits 100% foreign ownership across both entity forms.

• Physical office — Costa Rica requires your company to maintain a registered address in-country. Banking partners and payment processors increasingly distinguish between a permanent office (dedicated commercial premises with staff) and a temporary or virtual address. A permanent, staffed office substantially improves your chances of opening a merchant account with an international acquirer.
• Servers located in Costa Rica — Under Executive Decree 39231, companies providing online gaming services to players outside Costa Rica must host their gaming servers on Costa Rican territory. Compliance requires a contract with a local data centre or colocation provider and supporting documentation for due-diligence reviews.
• Geo-blocking of Costa Rican residents — The implicit basis of Costa Rica’s de facto licensing framework is that operators serve foreign markets, not the domestic population. Geo-blocking Costa Rican IP addresses is an operational prerequisite, not merely best practice — see geo-blocking details above for implementation guidance.
• AML/KYC programme — Although Costa Rica does not mandate a formal gaming licence, the country’s anti-money-laundering laws apply to online gaming entities. A documented AML and KYC programme is required for banking relationships and is reviewed by correspondent banks that process your transactions — full details in the AML/KYC section.

All documents submitted to Costa Rican public bodies must be in Spanish; foreign-language originals require a certified translation by an authorised Costa Rican translator (traductor público autorizado). The document set spans company formation records, identity verification, and tax registration.

• Articles of Incorporation (Escritura de Constitución) — Notarised before a Costa Rican notary and registered with the Registro Nacional de Costa Rica. Must state the company’s corporate purpose (referencing online gaming or internet-based services), capital structure, share or quota distribution, and the identity of directors and the legal representative.
• Government-issued IDs for all directors, shareholders, and UBOs — Passports or national identity documents for every person holding a position or ownership interest. Certified copies are standard; some banks require apostilled originals.
• D-140 Form & NIT — The official registration declaration filed with the Ministerio de Hacienda to register the entity as a taxpayer. Submission of the D-140 triggers issuance of the company’s Número de Identificación Tributaria (NIT) — the fiscal identification number required for every subsequent tax filing, invoicing obligation, and bank account opening in Costa Rica.
• UBO Declaration (Declaración de Beneficiario Final) — Under Law 9416, all Costa Rican legal entities must file an annual beneficial ownership declaration identifying every natural person who ultimately owns or controls ≥15% of the entity. This is filed electronically with the Banco Central de Costa Rica’s registry and must be updated within 15 business days of any ownership change.

Under Costa Rica’s Income Tax Law (Ley del Impuesto sobre la Renta), taxable income is defined exclusively as income with a Costa Rican source. Since a data-processing-permit operator’s revenue derives from international players — not from Costa Rican residents — this income is typically exempt from domestic corporate income tax. The result is an effective 0% corporate tax rate on offshore gambling revenue, making Costa Rica one of the most tax-efficient jurisdictions for online gaming operators targeting international markets.

While offshore revenue escapes corporate tax, operators maintaining a physical presence in Costa Rica still face several tax obligations on domestic-source income and local operations. The table below summarises the key taxes and their impact on a typical offshore gambling business.

The dividend withholding tax of 15% is the most significant ongoing consideration for operators extracting profits from their Costa Rican entity. Unlike corporate income tax — which can be avoided entirely through the territorial exemption — the withholding tax applies at the point of distribution regardless of income source. Operators should work with a qualified tax adviser to structure distributions efficiently, particularly when the parent company is domiciled in a jurisdiction that has a double-taxation agreement with Costa Rica.

Similarly, if your corporate structure involves intercompany royalties or management fees paid from the Costa Rican entity to a related company abroad, the 15–25% withholding on those payments can erode the tax advantage. Structuring these arrangements before incorporation — not after — avoids costly restructuring down the line.

Law No. 8204/2001 imposes a structured set of obligations on regulated entities. For online gambling operators holding a Costa Rica data-processing permit, the practical requirements are as follows:

• KYC verification — Collect and verify government-issued identification, proof of address, and source-of-funds documentation for every customer before allowing deposits or wagering. Enhanced due diligence applies to politically exposed persons (PEPs) and customers from high-risk jurisdictions.
• Transaction monitoring — Implement automated systems to flag unusual patterns — large single transactions, rapid deposit-withdrawal cycles, structuring below reporting thresholds, and activity inconsistent with a customer’s declared profile.
• Suspicious activity reporting (SAR) — File suspicious-transaction reports with the Instituto Costarricense sobre Drogas (ICD) within the statutory timeframe. Failure to report is a criminal offence under Law 8204.
• 5-year record retention — Maintain all customer identification records, transaction logs, and internal compliance documentation for a minimum of five years from the date of the last transaction or the end of the business relationship.
• Compliance officer appointment — Designate a local compliance officer (or responsible party) with authority to implement and enforce the AML programme, escalate suspicious activity, and liaise with the ICD.
• Staff training — Conduct regular AML/KYC training for all employees involved in customer-facing, payment-processing, or risk-assessment functions. Training must be documented and updated annually.
• Risk-based internal controls — Develop and maintain a written AML/CFT policy manual that defines risk categories, escalation procedures, and audit schedules. The policy must be proportionate to the scale and complexity of the operator’s business.

Failure to meet these obligations exposes the operator — and its officers — to administrative sanctions, fines, and potential criminal liability under Costa Rican law. In practice, enforcement intensity is lower than in jurisdictions such as Malta or Gibraltar, but non-compliance creates a material risk to banking relationships and PSP onboarding, which are already the most significant operational hurdles for Costa Rica-based gambling companies.

In practical terms, this status matters because acquiring banks and payment service providers assess jurisdictional risk as part of their onboarding process. A grey-listed jurisdiction triggers enhanced due diligence requirements — or outright refusal — from most financial institutions. Costa Rica’s current clean standing removes one potential barrier to banking access, though it does not eliminate scrutiny of the gambling sector itself.

However, FATF membership does not eliminate scrutiny. Costa Rica’s 2015 Mutual Evaluation identified several areas of concern — including the effectiveness of suspicious-transaction reporting and the supervision of designated non-financial businesses and professions (DNFBPs). Operators should not assume that a clean FATF status translates into relaxed compliance expectations from banking partners; it simply means the country-level risk factor is neutral rather than negative.

Fintech Simple can assist with preparing a bank-ready compliance pack that demonstrates adherence to FATF recommendations and Costa Rican AML law — a critical deliverable for any operator seeking to open corporate accounts or onboard with international payment processors.

Operators frequently discover that the regulatory freedom Costa Rica offers does not extend to its banking system. Even with a fully registered data-processing company, opening and maintaining banking relationships requires persistence and proper documentation.

• Local bank refusals — Most Costa Rican commercial banks decline to onboard companies whose primary activity is online gambling, citing internal risk policies regardless of the operator’s legal standing.
• International processor scrutiny — Global payment processors classify igaming as high-risk, leading to elevated processing fees, extended underwriting timelines, and rolling reserves that can lock up 5–10 % of monthly volume.
• Correspondent banking pressure — Even when a local bank agrees to service an igaming company, its US or European correspondent bank may flag the relationship during routine compliance reviews, triggering account closures with little notice.
• Chargeback vulnerability — Card-based deposits carry chargeback rates significantly above the industry average for gambling transactions, pushing acquirers to impose strict velocity limits or terminate merchant accounts.
• Currency conversion friction — Operators collecting revenue in multiple currencies face compounding conversion costs when settling into Costa Rican colones or repatriating funds to offshore accounts.

Experienced Costa Rica igaming operators do not rely on a single payment channel. Instead, they build a diversified payment stack that minimises dependency on any one banking partner or processor.

• Cryptocurrency as the primary workaround — Bitcoin, USDT, and other stablecoins bypass traditional banking entirely, enabling instant deposits and withdrawals without chargeback risk or correspondent bank interference.
• Offshore banking relationships — Banks in jurisdictions such as Belize, Puerto Rico, and certain Caribbean nations are more accustomed to igaming clients and offer USD-denominated accounts with fewer restrictions.
• E-wallet integration — Providers like Skrill, Neteller, and MuchBetter specialise in igaming payments and offer player-friendly deposit and withdrawal flows with built-in fraud screening.
• Specialist igaming PSPs — Payment service providers such as PayRedeem, Noda, and CashtoCode focus exclusively on gambling verticals, offering multi-currency acquiring, local payment methods, and chargeback management tools.
• Prepaid card and voucher solutions — Systems like AstroPay and Flexepin allow players in restricted banking environments to deposit using prepaid vouchers purchased at retail locations or online.
• Structured banking diversification — Maintaining accounts across multiple banks and jurisdictions ensures that a single account closure does not halt operations; experienced operators keep at least two active banking channels at all times.

The Costa Rica vs. Curaçao trade-off is nuanced. Costa Rica wins on cost and speed but lacks a formal gambling licence — which limits payment-processor acceptance and player trust. Curaçao’s reformed CGA framework (effective 2024) offers a recognised gaming licence at a higher price point, making it the natural next step for operators who have validated their product and need broader PSP and affiliate access. Malta and the Isle of Man sit at the premium end: high upfront investment, long timelines, but unmatched credibility in regulated European and Tier-1 markets.

Bottom line: Use Costa Rica to launch fast and prove your concept. Once revenue justifies the investment, layer on a Curaçao or Malta licence to unlock better banking, stronger affiliate partnerships, and access to regulated player pools.

• Proven track record since 2016 — More than 500 licenses issued for crypto, igaming, payment, and EMI clients worldwide. We have guided operators through Costa Rica’s data-processing permit process dozens of times and understand every step — from municipal filing nuances to inspector-visit preparation.
• Fixed, transparent pricing — No hourly billing surprises. Every package on this page is a flat fee that covers government charges, notary costs, and our professional service. You know exactly what you will pay before you sign.
• End-to-end support — From company incorporation and local director arrangements through bank account opening and AML policy drafting, we handle every element of the process so you can focus on building your platform.
• Dedicated account manager — You are assigned a single point of contact who knows your file inside out. No call centres, no ticket queues — direct access to the person managing your application.
• Multi-jurisdiction expertise — If your growth roadmap includes Curaçao, Isle of Man, Malta, or additional markets, we structure your Costa Rica entity with future expansion in mind and can run parallel licensing projects across jurisdictions.
• Ongoing compliance support — Licensing is not a one-time event. We provide post-licence advisory, annual permit renewals, AML programme updates, and regulatory monitoring so your operation stays compliant as rules evolve.