Aug 12, 2025
This designation as an obligated entity is the result of international commitments assumed by Costa Rica. The country, a member of GAFILAT (the Latin American chapter of the FATF), implements the organization's 40 Recommendations, which urge the regulation not only of financial institutions but also of certain high-risk Designated Non-Financial Businesses and Professions (DNFBPs). Therefore, since 2019, the National Council for the Supervision of the Financial System (CONASSIF) has issued specific regulations (SUGEF Agreement 13-19) requiring casinos, real estate developers, and other activities contemplated in Articles 15 and 15 bis of Law 7786 to register with SUGEF within a specified period.
Registration is not a mere bureaucratic procedure, but an essential requirement for a business to operate normally within the banking system. In fact, the law prohibits banks from maintaining accounts or conducting transactions with obligated companies that have not registered. A concrete example: in 2022, SUGEF warned that it would close the bank accounts of casinos that did not complete their registration or submit the required information within the established deadline. This measure was a clear reminder that a hotel or casino that fails to register and comply with anti-money laundering regulations could be excluded from the formal financial system, jeopardizing its basic operations.
Main compliance obligations for hotels and casinos
Entering the obligated subject regime entails a series of compliance obligations that hotels, casinos, and tour operators must implement to align with Law 7786, SUGEF Agreement 13-19, and the guidelines of the ICD's Financial Intelligence Unit. The most important ones are summarized below:
Registration with SUGEF: The first step is to register the company with SUGEF as a non-financial entity. This registration is mandatory and a sine qua non condition for continuing to operate normally in the national banking system. Banks are prohibited from maintaining accounts or business relationships with entities that should have registered but have not done so. Therefore, if your hotel or casino has not yet registered, you should do so immediately to avoid the closure of bank accounts or the denial of financial services.
Prevention Policy and Manual: A Money Laundering, Terrorism Financing, and Arms Proliferation Financing Risk Prevention Manual tailored to the business's operations is required. This manual must include the internal policies and procedures the hotel or casino will follow to comply with Law 7786 and SUGEF regulations. It must be a comprehensive document, approved by the company's highest authority (e.g., the board of directors), periodically updated, and communicated to all relevant personnel. Essentially, the manual establishes a roadmap for how the organization prevents and detects illicit transactions on a daily basis.
Risk analysis based on a risk approach: The company must conduct an institutional risk assessment to identify potential avenues through which its business could be used to launder money or finance illicit activities. For example, a hotel casino must analyze risks such as managing large amounts of cash, the possibility of receiving clients with unknown or high-profile (VIP) clients, and the purchase of gaming chips with suspicious intentions. A tour operator selling properties within a resort will assess risks in real estate transactions, payment methods, foreign clients, etc. Based on this analysis, controls proportional to the level of risk identified must be implemented, according to the risk-based approach promoted by international recommendations and local regulations.
Know Your Customer (KYC policies): It is mandatory to establish formal customer identification and due diligence procedures (Know Your Customer). This involves collecting and verifying customer information before establishing significant business relationships. In a hotel with a casino, for example, frequent gamblers or high-rollers must be identified and recorded; in a tourist real estate development, property purchasers or investors must be identified and recorded. Law 7786 requires not only identifying the customer but also the beneficial owner in the case of legal entities, as well as applying enhanced measures for higher-risk customers or Politically Exposed Persons (PEPs).
Additional Controls and Policies: In addition to the KYC manual and policies, regulations require specific procedures for: classifying each client's risk, managing high, medium, or low-risk profiles; policies for handling Politically Exposed Persons (PEPs); controls over new technologies or payment methods that could be used for money laundering; controls when delegating functions to third parties (for example, agents or brokers who recruit clients for the hotel); and control over branches or subsidiaries abroad, if any. All of these guidelines must be documented in internal procedures.
Monitoring and reporting suspicious transactions: The hotel or casino is legally required to monitor unusual or suspicious transactions and report them promptly to the ICD, specifically to the Financial Intelligence Unit (FIU) operating within the ICD. This includes reporting any transaction whose amount or characteristics raise suspicions of possible illicit origin, as well as any attempts to carry out unusual transactions that have been rejected by the company.
Compliance Officer or Liaison: Depending on the size and complexity of the business, SUGEF requires the designation of a dedicated Compliance Officer, or at least a liaison, responsible for overseeing the day-to-day operations of the anti-money laundering program. This person, who may be a member of the management team with training in the subject, acts as a point of contact between SUGEF and the ICD, ensures the implementation of internal policies, and coordinates the reporting of suspicious transactions.
Periodic external audits: Part of ongoing compliance is the independent external assessment of the company's anti-money laundering program. SUGEF Agreement 13-19 requires non-financial obliged entities (such as casinos, real estate developers, etc.) to undergo periodic external audits of their compliance with anti-money laundering.
As you can see, the regulatory framework is broad and demanding. All of the above points are part of the "Risk Management System" that the hotel or casino must implement to manage the risk of money laundering. Obligations range from prevention (policies, manuals, controls) to the detection and reporting of suspicious activities, including periodic verification through audits.
Failure to comply with anti-money laundering obligations is not a viable option for hotels and casinos, as it exposes the business to serious legal, financial, and reputational risks. The main consequences of noncompliance include:
Administrative sanctions: SUGEF and the ICD have the authority to impose sanctions ranging from significant warnings and fines to the suspension or cancellation of the obligated party's registration. For example, regulations establish that those who fail to register in the anti-money laundering registry can face fines of tens of thousands of dollars.
Corrective Measures and Interruption of Operations: In addition to fines, the regulator may require immediate corrective measures. In extreme cases of serious or repeated noncompliance, the suspension of risk-related activities may be ordered. As we have seen, the SUGEF (Tax Administration Service) has warned that it may request banks to close the accounts of unregistered or non-compliant companies. Losing access to banking services for a hotel practically paralyzes its operations (it would be unable to process electronic payments, manage payroll, etc.). Likewise, canceling its registration with the SUGEF would make it illegal to continue operating in that sector until the deficiencies are resolved, which could translate into loss of income, customers, and business opportunities during the suspension period.
Criminal Investigations: If the violation goes beyond mere negligence and evidence of fraudulent aiding or abetting money laundering (through deliberate action or omission) is found, those responsible may face criminal consequences. Law 7786 criminalizes the crime of money laundering and penalizes not only the perpetrator of money laundering but also anyone, from a regulated entity, who intentionally aids by concealing reports or altering records to cover up illicit transactions.
Impact on the industry and the country: It's worth mentioning that widespread noncompliance in the sector could have macroeconomic repercussions. If Costa Rica were perceived as lax in its anti-money laundering oversight, it risks being placed on the gray lists of international organizations (FATF), which could lead to international sanctions or economic restrictions. This would affect not only the business involved but the national economy as a whole (less foreign investment, greater scrutiny of international transactions to and from the country, etc.).
Entering the regime for obligated subjects may seem bureaucratic, but it's ultimately about institutionalizing good practices that will protect your business and the country's financial system. Far from being a burden, implementing these measures strengthens the transparency and reputation of your hotel or casino, generating trust among investors, partners, and customers. On the contrary, ignoring these obligations carries risks that can range from sanctions and account closures to criminal implications in extreme cases, and even reputational damage that is difficult to reverse. Costa Rica, through the SUGEF (Tax Administration) and the ICD (Institutionalized Taxpayer Registry), has aligned its regulations with international standards to protect the tourism-financial sector from illicit activities, and hotels are no exception.
Adopting a culture of compliance not only satisfies the law and regulators, but also protects your company's reputation with your customers and society. A robust anti-money laundering program will allow you to focus on your core business—providing an exceptional guest experience—without regulatory setbacks. At the end of the day, compliance is not only a legal obligation, but also an ethical commitment to the country: your efforts contribute to Costa Rica remaining a trusted and transparent destination internationally. Take action on compliance; your hotel, your customers, and Costa Rica will thank you.
Sources:
Law 7786 (and amendments to Law 9449); SUGEF Agreement 13-19 (Regulations for the prevention of ML/FT in non-financial entities); Financial Intelligence Unit (ICD) guidelines; official SUGEF communications; Crowe Costa Rica – Executive Summary of SUGEF Regulation 13-19; EAS Latam – Regulatory compliance for hotels (technical blog); El Financiero – Casinos will be regulated by SUGEF; Focus Gaming News – SUGEF gives casinos notice.