Real Case: Establishing a Costa Rican Corporate and Compliance Structure for an Offshore Gambling Business

Our first call with Client B lasted roughly ninety minutes and focused on the underlying operation rather than on jurisdictions. We needed to understand player geography, payment flow, revenue volumes, software stack, and which contractual and compliance gaps were already causing processor pressure.

The diagnosis showed a common pattern: a real gaming business sitting on top of no legal infrastructure. That meant the solution had to satisfy payment-processor due diligence quickly, not just produce a corporate certificate.

What we assessed

• Player geography and whether the business model fit jurisdictions that tolerate offshore gaming structures
• The due diligence expectations of the three active payment processors, two of which had already raised concerns
• The client’s budget of roughly USD 30,000-40,000 for legal, incorporation, and first-year maintenance costs
• The sequencing needed to finish before the 60-day deadline expired

We compared five jurisdictions directly against the client’s parameters. Malta and the Isle of Man offered stronger regulatory prestige, but both were too slow and too expensive. Curaçao was more achievable but still required a longer licensing track and a larger setup budget than the client could justify under the deadline.

Costa Rica was considered as a potential jurisdiction for establishing a corporate and administrative structure supporting the client’s international gambling business.

The jurisdiction provides established procedures for incorporating companies and registering commercial and tax activities.

However, incorporation in Costa Rica does not provide the legal certainty associated with obtaining a dedicated gambling operator licence from a recognised sector-specific regulator.

For an offshore gambling business, the legal assessment must consider the precise activities performed by the Costa Rican entity, including whether it acts as a technology provider, payment intermediary or direct gambling operator.

It must also address the gambling laws of the jurisdictions where players are physically located.

A corporate registration certificate, municipal business licence or tax registration should not be described as equivalent to a gambling authorisation.

Payment processors, acquiring institutions, software providers and affiliates remain responsible for their independent due diligence and may require evidence of gambling authorisation in relevant target markets.

Any acceptance of the structure by a commercial counterparty reflects that counterparty’s assessment and does not establish the legality of providing gambling services in other countries.

Why Costa Rica was the right choice

• A Costa Rican Sociedad Anónima may be established to conduct lawful commercial activities, including certain services connected with international online gambling.

  However, the absence of a dedicated Costa Rican offshore gambling licensing regime should not be interpreted as unconditional authorisation to operate an online casino or sportsbook.

  The legal assessment must distinguish between:

  • Companies providing data processing, technology or communications services connected with betting activities.
  • Companies directly accepting wagers, holding player balances, determining gambling outcomes or paying winnings.
  • Gambling activities offered to persons located in Costa Rica.
  • Cross-border gambling services offered to customers in foreign jurisdictions.

  Costa Rica’s Law No. 9050 regulates taxation of casinos and companies providing services connected with electronic betting. It does not establish a general offshore online casino licence.

  Moreover, under the applicable framework implementing Law No. 7786, certain casino activities conducted from Costa Rica, including activities carried out through the internet, may trigger registration and AML/CFT supervision requirements administered by the General Superintendency of Financial Entities (SUGEF).

  SUGEF expressly states that registration under Articles 15 and 15 bis of Law No. 7786 does not constitute authorisation to operate.

  Consequently, each proposed gambling business model requires a separate assessment of the legal activities performed in Costa Rica and the gambling legislation of the countries where customers are located.

• The company can be incorporated within roughly 2 to 4 weeks, which is fast enough for processor deadlines
• The cost profile is materially lower than Malta, Curaçao, or Isle of Man structures
• Processors and partners may assess a Costa Rican corporate structure when the documentation package is complete and the underlying business activities satisfy their due diligence requirements

The corporate structuring phase involved establishing a Costa Rican Sociedad Anónima (S.A.) and preparing constitutional documents consistent with the proposed business activities.

The company’s stated corporate purpose was intended to reflect its actual commercial functions, including relevant technology, data processing and administrative services.

However, including online gambling activities in the Articles of Incorporation does not establish that those activities are authorised under Costa Rican law or the laws of the company’s target markets.

The S.A. governance structure must also comply with the Costa Rican Commercial Code.

Under Article 181 of the Commercial Code, a Sociedad Anónima generally requires a board of directors comprising at least three members, holding the positions of President, Secretary and Treasurer.

Corporate management appointments, legal representation and registered office arrangements must comply with the applicable statutory provisions.

Where shareholders use nominee or intermediary arrangements, the company must nevertheless identify and disclose its ultimate beneficial owners in accordance with Costa Rican transparency legislation.

Law No. 9416 and the corresponding Registry of Transparency and Ultimate Beneficial Owners (Registro de Transparencia y Beneficiarios Finales, RTBF) require qualifying legal entities to report their ownership and controlling individuals.

Nominee arrangements cannot be used to conceal beneficial ownership from competent authorities or financial institutions conducting customer due diligence.

The corporate documentation must therefore accurately reflect the company’s actual ownership, management, commercial activities and regulatory obligations.

What we established

• A Costa Rican S.A. tailored to offshore gaming operations
• Articles of Incorporation reflecting the actual business model rather than a generic corporate purpose
• A workable director and shareholder structure with local administrative support

• Tax Registration and Business Activity Documentation: The company completed the applicable tax registration and business activity filings with the Costa Rican Ministry of Finance (Ministerio de Hacienda), based on its declared commercial operations.

  Where the company’s activities fall within Law No. 9050, specific tax registration and reporting obligations may apply to businesses involved in receiving and processing data associated with electronic betting.

  Such registrations and declarations are administered for tax compliance purposes and should not be described as a dedicated gambling operator licence.

  Filing documents with the Ministry of Finance does not constitute regulatory approval to operate an online casino or sportsbook.

  Where applicable, the company must also obtain municipal business authorisation and comply with relevant beneficial ownership, financial crime prevention and other statutory requirements.

  The documentation provided to payment processors should clearly distinguish the company’s incorporation, tax registration and municipal permissions from any sector-specific gambling authorisation required in its target markets.

Incorporation alone would not restore payment processing. The real deliverable was a clean, documented due diligence file that could be sent to processors, software partners, and future banking counterparts without exposing the business as improvised.

We therefore built the compliance and operating documents around the actual gaming model and the client’s player footprint.

Documents we prepared

• AML/CFT Policy with transaction-monitoring thresholds, PEP screening, and suspicious-activity escalation procedures
• Responsible Gambling Policy covering self-exclusion, deposit limits, and age-verification commitments
• KYC Procedure for onboarding, identity verification, and source-of-funds checks on higher-risk players
• Data Privacy Policy aligned with the client’s European player base
• Terms and Conditions, Bonus Policy, and Withdrawal and Payment Policy
• Certified corporate records, beneficial-owner declaration, director ID files, and applicable tax and business activity registration documents for processor due diligence

Because the payment-processor ultimatum left no slack, we ran the legal registration and the document buildout at the same time. That parallel sequencing is what shortened the project from a multi-month legal exercise into a nine-week operational recovery.

According to the reported project timeline, approximately nine weeks elapsed between the initial consultation and the restoration of the second payment processing relationship.

The primary payment processor is reported to have approved the submitted due diligence package during Week 8, while the second processor completed its review during Week 9.

However, the original case description also states that the client faced a 60-day deadline imposed by its payment processors.

Nine weeks correspond to approximately 63 calendar days, so the claim that the entire process was completed within the original 60-day deadline requires clarification.

The timeline should distinguish between the deadlines set by each processor and the actual dates on which the respective approvals were granted.

If an extension was obtained or the deadline was calculated from a later date, that should be explained in the case study.

Without this additional information, the documented result should be described as a nine-week project rather than a confirmed completion within 60 calendar days.

Following incorporation and completion of the payment-provider due diligence process, the company entered the ongoing corporate maintenance and compliance phase.

However, a Costa Rican Sociedad Anónima does not generally need to undergo a new incorporation or annual renewal of its commercial registration merely to retain its legal existence.

Instead, the company must comply with applicable recurring statutory obligations, including:

• Annual Corporate Tax: Payment of the tax on legal entities under Law No. 9428, where applicable.
• Tax Filings: Submission of applicable corporate income tax returns and other required tax declarations.
• Beneficial Ownership Reporting: Submission and updating of information through the Registry of Transparency and Ultimate Beneficial Owners (RTBF), in accordance with Law No. 9416.
• Municipal Business Permissions: Maintenance and renewal of applicable municipal authorisations where required by local regulations.
• Accounting Records: Maintenance of appropriate corporate and financial records.
• Sector-Specific Tax Obligations: Compliance with Law No. 9050 where the company’s activities fall within its scope.
• AML/CFT Compliance: Registration with SUGEF and fulfilment of related obligations where legally applicable.
• Payment Provider Requirements: Ongoing compliance with contractual, transaction monitoring, customer verification and reporting obligations.

The company must also maintain accurate information concerning its directors, legal representatives and registered office.

A certificate confirming the company’s registration or legal status should not be described as a dedicated gambling licence or evidence of gambling regulatory approval.

What post-incorporation setup involved

• An annual maintenance schedule for corporate renewal and tax obligations so the Certificate of Good Standing would remain valid for future reviews
• Introductions to two banking partners, including an EU-based EMI and an offshore bank experienced with gaming-sector clients
• Redundancy planning across payment infrastructure so the business was not dependent on one provider

• Ongoing AML/CFT and Responsible Gambling Controls: The company must maintain risk-based compliance procedures appropriate to its actual activities and the gambling regulations applicable in its target markets.

  These procedures should address customer identification, age verification, sanctions screening, transaction monitoring, suspicious activity escalation and periodic review of AML/CFT risks.

  Responsible gambling controls must include effective procedures for recording and enforcing customer self-exclusion requests, restricting access to gambling services and preventing prohibited transactions.

  Self-exclusion status should be checked and enforced whenever relevant customer access or gambling activity occurs, rather than relying solely on an annual player database review.

  Operators must apply the specific requirements of each jurisdiction in which they are authorised to provide gambling services, including applicable restrictions on marketing, deposits, player accounts and customer interaction.

  AML policy reviews should also be performed when material changes occur in the company’s activities, customer profile, transaction patterns or regulatory obligations.

• Guidance on when Terms and Conditions and other player-facing documents must be updated because of new markets, products, or regulatory changes