Costa Rica Gambling License: Why It’s Not a License in the Usual Sense

There is no gambling license in Costa Rica, and no gambling regulator to issue one. Operators hold a cantonal commercial permit, or patente, for a data-processing business. No fee schedule, license term or renewal cycle exists, because no gaming authorization exists. Law 3 of 1922 prohibits games of chance. Law 9050 taxes betting data processing at 57 to 113 base salaries yearly, by headcount. Corporate tax reaches 30% on income sourced in Costa Rica only. One condition separates the jurisdiction from every licensed alternative: banks may not serve an internet casino until it registers with the financial superintendency.

Online gambling operators choose Costa Rica for speed and the absence of vertical-by-vertical approval. One company can run casino, sportsbook, poker and crypto products, and no statute dictates where the servers sit. The trade-off lands at the payment layer. Acquirers price the missing license into every decision, so a turnkey iGaming platform carries more weight here than in a licensed market. The permit buys time to market. It does not buy the document a PSP compliance officer expects.

Costa Rica License Quick Facts

1. 01

   Gaming regulator — none. No authority licenses or supervises online gambling.

2. 02

   Primary laws — Law 3 (Games Law, 1922); Law 9050 (2012) and Decree 39231-MSP-MH (2015); Law 7786 as amended by Law 8204 (AML); Law 8968 (data).

3. 03

   Permit obtained — municipal patente for data processing, issued by the canton.

4. 04

   Permit term — indefinite while taxes and declarations stay current.

5. 05

   Application fee — no statutory fee; cantonal tariff laws set the charge on gross income.

6. 06

   Annual duty on betting data processing — 57, 85 or 113 base salaries by headcount (₡26.3m–₡52.2m).

7. 07

   Casino duty (land-based) — 10% of net income, plus 60% of a base salary per table, monthly.

8. 08

   Corporate income tax — 30% top rate, territorial basis; about 40.5% combined once dividends are paid.

9. 09

   Setup timeline — 4–8 weeks to an operating company and permit; banking is longer.

10. 10

    Corporate form — S.A. or S.R.L. registered with the National Registry.

11. 11

    Hosting — no location requirement in law.

12. 12

    Player funds — no segregation or protection rule exists.

13. 13

    Mandatory AML registration — yes, with SUGEF, before any bank will open an account.

What Is the Costa Rica Gambling License?

Costa Rican law starts from prohibition: Article 1 of the 1922 Games Law bans every game where loss or gain depends on chance. Article 2 permits card games without staking and games of physical skill. Two carve-outs follow. Casinos need Ministry of Public Security authorization and sit only in four-star hotels, on no more than 15% of the floor area. Lotteries belong to the Junta de Protección Social. Online play sits outside all of it, on the reading that no game occurs locally when stake and settlement happen abroad.

That silence is the whole model, because no traditional gambling regime was ever built to replace it. A municipality does not assess game fairness, RNG certification or player protection, having no mandate to do so. Executive Decree 39231-MSP-MH is widely cited as the source of a data processing license, but it creates no permit at all. Its 28 articles govern casino authorization and the Law 9050 tax, and impose no infrastructure, hosting or server condition of any kind. Curaçao, by contrast, licenses the gambling activity and lists the holder on a register any acquirer can check, so no register in Costa Rica names the game offering.

Permissions an operator may actually hold in Costa Rica:

• Municipal data-processing patente — the cantonal commercial permit for receiving and processing data; the document the market calls a Costa Rican data processing license.
• Casino authorization (Ministry of Public Security) — land-based tables and machines inside a qualifying four-star hotel.
• JPS lottery concession — state lotteries and domestic betting products, closed to private operators.
• SUGEF registration under Article 15 bis — mandatory AML registration for casinos operating physically or over the internet from Costa Rica.
• PRODHAB database registration — required where personal-data holdings are distributed, transferred or commercialised.

Why Operators Choose the Costa Rica License

1. 01

   No gaming authority sits between incorporation and launch.

   You register a company in Costa Rica, file for tax and apply for the municipal permit in parallel rather than in sequence. A prepared file produces an operating company and a patente in 4 to 8 weeks. No probity hearing, no system audit and no pre-launch technical inspection stand in the way.

2. 02

   Territorial taxation still applies to active foreign revenue.

   Income from players outside Costa Rica falls outside the 30% corporate charge, provided the revenue is genuinely foreign-source. Law 10,381 narrowed this in 2023 for foreign-source passive income of non-qualified entities inside a multinational group. Active operating income was left on the territorial side of the line.

3. 03

   Verticals are not licensed one at a time.

   Sports betting in Costa Rica needs no separate approval, and neither do casino, poker or crypto casino products. All types of gambling run under one company for no extra fee. Gibraltar charges £50,000 to £200,000 a year for each vertical, banded by gross gaming yield.

4. 04

   No statute fixes where the platform runs.

   The Isle of Man requires registration and gameplay systems on the island, and Kahnawake ties hosting to its own territory. Nothing obliges an operator to host servers in Costa Rica, and no data residency rule or real-time reporting link applies to online gaming systems. Latency and disaster recovery become engineering decisions rather than license conditions.

Costa Rica Gambling License Costs in 2026

No license fees are published anywhere, which surprises most operators pricing this route. Cost assembles from three unrelated mechanisms: a cantonal patente on declared local gross income, an annual tax keyed to headcount, and fixed corporate charges. None of it scales with gaming revenue, brand count, vertical count or player numbers. Article 19 of Decree 39231-MSP-MH sets the headcount base by contrato realidad. Anyone in a dependent working relationship counts, even when they are not reported to social security or declared to the tax authority. Figures below use the 2026 base salary of ₡462,200, unchanged for a sixth year.

Cost line	2026 amount	What it covers
Municipal patente	Cantonal factors from 0.075% to 0.18% of annual gross income, with a floor near ₡115,550	The commercial license to operate the data-processing activity
Law 9050 annual tax, up to 50 staff	57 base salaries — ₡26,345,400 (≈US$58,300)	Receiving and processing data that generates electronic bets
Law 9050 annual tax, 51–99 staff	85 base salaries — ₡39,287,000 (≈US$86,900)	Same charge, second headcount band, paid quarterly
Law 9050 annual tax, 100+ staff	113 base salaries — ₡52,228,600 (≈US$115,500)	Same charge, third band; not deductible against income tax
Legal-entity tax (Law 9428)	₡69,330–₡231,100 by gross income, due 31 January	Registry existence of the company, active or dormant
PRODHAB canon	US$200 per registered database, payable in January	Regulation and administration of the declared database
Corporate income tax	Up to 30% on Costa Rican-source income; 15% on dividends	Profit attributable to activity inside the country

Unscheduled costs decide the real number. The base layer is notarial incorporation, the registry edict, a local address and accounting through TRIBU-CR, the tax platform live since 6 October 2025. Above it sit the AML file, an accountant’s assurance report and external audit for companies in the highest supervisory tier. Gambling companies based in Costa Rica carry employer social charges of 26.83% from 1 January 2026, up from 26.67%. Two reporting bridges make the headcount tax hard to sit outside. The social security fund reports every worker hired by these companies to the tax authority each January, and the municipality reports the permits it issued, by name and ID number. A structure with no dependent workers in Costa Rica at all lands near US$25,000 to US$45,000 in year one.

How to Get a Costa Rica Gaming License

Nobody runs a file, and that is the difficulty. What the market calls obtaining a data processing license in Costa Rica is really three parallel tracks, which inverts the sequence described in most online gambling license guides. The National Registry of Costa Rica incorporates the company, the municipality grants land use and the patente, and the tax, AML and beneficial-ownership registrations follow the company’s tax identity. Each track has its own clock and its own rejection grounds. Sequencing them badly is the most common reason a launch date slips by a month.

• Register a Costa Rican company, an S.A. or S.R.L., by notarial deed, including the registered email address the Companies Registry now requires.
• Obtain municipal land-use approval for the address where the activity will be declared.
• File the patente application describing the data-processing activity in Spanish, with corporate and shareholder documents.
• Register the company for tax in TRIBU-CR and confirm the economic activity code.
• Register with SUGEF under Article 15 bis, with the AML manual, risk procedures and source-of-funds description.
• Enrol in the Financial Intelligence Unit reporting platform and complete the customer-information center file.
• File the annual beneficial-ownership declaration through the Central Bank platform during April.
• Assemble the PSP and banking file before approaching any acquirer.

Four to eight weeks is realistic to start a gambling business in Costa Rica, from incorporation to issued permit. Banking takes two to six months and drives most delays. Three obstacles cause most slippage. The declaration filed with the beneficial-ownership register needs the legal representative’s Costa Rican digital signature, issued only to nationals and residency-card holders. Apostilled shareholder documents arrive late, and the registered-email obligation under Law 10,597 blocks registry filings until it is met.

Banking for Gambling Operators in Costa Rica: SUGEF Registration and High-Risk Merchant Barriers

Law 7786 is the AML statute amended by Law 8204. The regulation implementing its Article 15 bis covers casinos doing business through physical premises, or through networks such as the internet, from Costa Rica. That wording captures online gambling operations aimed entirely at players abroad. Registration with the financial superintendency is not optional, and the consequence of skipping it is immediate. Supervised financial entities may not open or continue a relationship with an unregistered obliged subject, and must stop service once a registration lapses.

The registration requirements set out in Agreement SUGEF 11-18 reach further into system design than operators expect. The applicant declares an AML manual, describes the commercial activity exhaustively and explains the origin of share and working capital. It also enrols in the Financial Intelligence Unit platform, completes the customer-information center file, and nominates IBAN accounts held in its own name. Those accounts are flagged for exclusive use, and routing unrelated flows through one is itself a breach.

Supervisory tier	What the operator must maintain	Reporting rhythm
Type 1 (higher complexity)	Compliance officer, internal audit, external audit, annual risk procedure	Supervisory data filing every two months
Type 2 (medium complexity)	Named liaison person, documented risk procedure	Risk procedure refreshed every two years
All tiers	Board-approved manual, client risk classification, monitoring and alerting	Suspicious-transaction reporting on detection

Three flows need mapping before the first acquirer conversation: where player deposits are collected, which entity receives merchant settlement, and how affiliate, provider and withdrawal payments cross borders. Operating an online gambling business from Costa Rica rarely comes with domestic banking, so most teams run offshore settlement rails and weight the cashier toward crypto. Neither choice removes an obligation. Wallet screening, sanctions checks and source-of-funds records still have to produce supervisor-shaped evidence, which is why AML and KYC tooling belongs in the build rather than the backlog.

Geo-Fencing Engineering: Automating the Block on Local Online Gambling Traffic

Operators must avoid serving Costa Rican residents, and the reason is legal rather than reputational. The 1922 prohibition still stands, and lotteries remain reserved to the state operator. A bill filed in May 2026 would make that operator the sole regulator of all games of chance, after the legislature’s security committee rejected an earlier reform in January 2026. Offering services to Costa Rican residents converts a lawful data-processing company into a participant in prohibited gaming, with the municipal permit as the first casualty.

An IP rule alone does not hold. Layered exclusion runs across casino and sportsbook products alike, checking IP and VPN reputation, phone-number country, document issuer, payment instrument origin, declared address, and behavioral signals in support tickets. Marketing is the exposure operators forget, since campaigns visible inside the country raise consumer-protection questions under the MEIC regime even where no local player is ever accepted. Each layer fails differently, so each needs its own logged decision:

• Registration blocked on local address, national ID or local phone prefix.
• Deposits blocked on locally issued cards, wallets and bank rails.
• Verification rejected where documents evidence residency.
• Marketing suppression lists excluding the territory from affiliate and paid traffic.
• Alerting on repeated circumvention attempts from the same device fingerprint.

Every one of those blocking decisions is itself personal-data processing, which is where the second obligation starts. Law 8968 and its 2013 regulation require databases used for distribution or commercialisation to be registered with Costa Rica’s data protection agency. The canon runs to US$200 per database each year, and access or rectification requests carry a five-business-day deadline. No statutory 72-hour breach clock exists, unlike the GDPR regime most target markets apply. Build to the stricter external standard anyway, since each player’s own law travels with them.

Technical Snapshot: Evidence Expected Before Launch

No supervisor will ask online gambling companies for a system audit before launch. The requesting party is commercial: the acquirer, the PSP, the game providers behind the lobby, and the correspondent bank. Their diligence arrives as a document request with a deadline, usually two to four weeks before contracting. The evidence below is what those reviews consistently ask for, and what the AML registration file already commits the operator to holding.

System area	Implementation requirement	Evidence requested
Corporate identity	S.A. or S.R.L. with registered email and current legal-entity tax	Registry certification, tax-payment receipt
Beneficial ownership	Annual declaration filed through the Central Bank platform	Filing confirmation, ownership chart to natural persons
AML program	Board-approved manual, risk methodology, client classification	Manual, risk procedure, accountant's assurance report
Transaction monitoring	Threshold and behavioral rules with recorded disposition	Alert sample, escalation log, reporting evidence
Player verification	Document, liveness and sanctions screening at onboarding	KYC policy, vendor contracts, rejection statistics
Payment segregation	Declared exclusive-use accounts separated from operating flows	Bank letters, account mapping, settlement diagram
Territorial exclusion	Layered geo-blocking across access, payments and verification	Rule configuration export, blocked-attempt reports
Data protection	Database registration, retention schedule, security controls	Registration code, canon receipt, incident procedure

Card acceptance is governed by PCI DSS, and the bar is higher than 2023-era policies assume. Version 4.0 introduced 64 new or updated requirements: 13 applied immediately, and the other 51 became mandatory on 31 March 2025. Version 4.0.1, published in June 2024, clarified wording without moving that date. Requirements 6.4.3 and 11.6.1 target client-side payment scripts, pulling the cashier iframe, tag manager and third-party pixels into assessment scope. Acquirers enforce this, not the standards body, so the penalty is repricing or a closed merchant account.

ISO/IEC 27001:2022 carries the second hard deadline. Annex A moved from 114 controls across 14 domains to 93 across four themes, adding 11 covering threat intelligence, cloud security, data masking and secure development. The transition period closed on 31 October 2025, and 2013-edition certificates are no longer valid. Recovering lapsed certification now means a full audit rather than a transition audit. With no gaming regulator behind the operator, that certificate is often the only independent attestation the gambling industry accepts in its place.

How the Costa Rica License Compares With Other Licenses

Ranking gambling jurisdictions by headline fee produces the wrong answer for Costa Rica, because its headline fee is close to zero and its binding constraint is not financial. The useful comparison is what each regime restricts: where systems may run, which gambling services are approved, who may hold shares, and what the license proves to a bank. Read the list below as a constraint map rather than a price list.

• Isle of Man (GSC) — £5,250 application, then £36,750/yr. 10–12 weeks. Constraint: on-island servers, two resident directors, local client bank account.
• Malta (MGA) — €5,000 application, €25,000/yr, plus €15,000–€375,000 compliance contribution (Type 1). 6–12 months. Constraint: verticals approved individually, €100,000 share capital.
• Curaçao (CGA) — €4,592 application, €47,450/yr (treasury plus CGA supervision). 3–6 months. Constraint: local company, physical office, local hiring.
• Kahnawake — $40,000 year one, then $20,000/yr. 8–12 weeks. Constraint: primary servers inside Mohawk Territory.
• Tobique (TGC) — from $36,000/yr. 4–8 weeks. Constraint: recognition narrow outside North America.
• Anjouan — from €17,000/yr. 4–8 weeks. Constraint: limited acquirer appetite on fiat rails.

Cost per license and cost per market are different measurements. Costa Rica scores well on the first and nothing at all on the second. Brazil’s R$30m five-year grant buys defined access to more than 200 million people, and a UK Gambling Commission license buys another market on comparable terms. Online casinos in Costa Rica buy a company and a permit, leaving every target market a separate legal question. International gambling brands that treat the permit as market access learn the difference at their first acquirer review.

How NuxGame Helps With the Costa Rica License

Applications stall in two places. The first is the AML file, where a generic manual meets a supervisor expecting it to describe the actual system, and an accountant to confirm it. The second is banking, where an acquirer reads “data processing” and asks what the gambling business actually does. The NuxGame legal team handles company registration, beneficial-ownership documentation, AML/CFT and responsible gambling policies, banking and PSP preparation, and the municipal filing, alongside the online casino platform itself. A platform-readiness review runs alongside, so the controls on paper already exist in the configuration.

Nothing about the deployment is dictated here, so every choice has to be justified to somebody else. Online gambling platforms are judged on evidence rather than on a regulator’s stamp, so hosting region, data residency, retention windows and account structure all resurface in a PSP questionnaire. The NuxGame team settles them before filing rather than during onboarding. Geo-exclusion rules, exclusive-use payment routing, monitoring thresholds and reporting exports are configured against the declared activity, and the casino API exposes the audit trail those reviews depend on.

Planning gambling operations in Costa Rica and unsure whether the permit will survive your acquirer’s diligence? The NuxGame team can review the corporate, AML and platform layers together — start with legal services and we will map the gaps before you file.