Countries › Costa Rica › Guide › 10. Capital markets and finance › Financial consumer protection and credit information in Costa Rica: fraud refunds, disclosure and the SUGEF credit bureau

Financial consumer protection and credit information in Costa Rica: fraud refunds, disclosure and the SUGEF credit bureau

Argentina. For full detail on Argentina, go to The Argentine Thread.

Last verified: 2026-10-30 · Status: Changing

Since April 2026 supervised financial entities are strictly liable for money taken from customer accounts by unauthorised third parties, must resolve fraud claims within 30 days and refund within 10 days, with SUGEF reviewing any rejection. Lenders must disclose how interest is computed and itemise statements, and workers can have loan installments deducted from pay. SUGEF's credit information centre can be consulted only with the borrower's written authorisation, also by non supervised lenders.

Key facts

Window for a customer to claim an unauthorised transaction	30 calendar daysLey 10889 art. 3, as of 2026-10-30 · in force
Time for the entity to resolve a fraud claim	30 (plus up to 10 business days once) calendar daysLey 10889 art. 3, as of 2026-10-30 · in force
Borrower consent needed to consult SUGEF credit data	Yes, written textLey 7558 art. 133, as of 2026-10-30 · in force

The rule

1. SUGEF supervised financial entities answer, regardless of fault, for losses from the taking of money from accounts or inadequate custody of funds by an unauthorised third party, by any mechanism, unless a legal exemption applies.Ley 10889 (Ley 7472 art. 35), art. 1, 2026-03-23 official text · verified 2026-10-30 · changed: Added by Ley 10889 of 23 Mar 2026, in force 22 Apr 2026 (La Gaceta 73, Alcance 40).

2. The customer may claim within 30 calendar days of the event, with a copy of the OIJ police report; the entity has 30 calendar days (extendable once by 10 business days) to investigate, must show its controls and systems were not breached, and may reject only on proven self fraud, intent or transfers between the customer's own accounts. Rejections go to SUGEF, which validates them within 10 business days; accepted claims are refunded within 10 calendar days with related interest and charges reversed.Ley 10889, art. 3, 2026-03-23 official text · verified 2026-10-30

3. Entities must offer 24/7 channels to report and block products, give a receipt code immediately, block electronic transactions at once and confirm the block; they are liable for unauthorised transactions after the report.Ley 10889, art. 3 and 4, 2026-03-23 official text · verified 2026-10-30

4. Lenders must give prior written information on how the rate is determined, itemise principal, interest, default interest, charges and commissions in statements, show the rate charged and not change terms unilaterally; non supervised lenders may, with authorisation, consult the SUGEF credit information centre and must give MEIC portfolio data on request.Ley 7472, art. 44 bis, 1998-12-14 official text · verified 2026-10-30

5. Workers may ask the employer to deduct loan installments from pay, up to the unseizable limit, and employers may not refuse authorised deductions; lenders must accept proof of repayment capacity beyond gross salary.Ley 7472, art. 44 ter (added by Ley 9859, reformed by Ley 9918), 2020-11-11 official text · verified 2026-10-30

6. A supervised entity may consult SUGEF on an applicant's debts only with the applicant's written authorisation, must give the applicant a copy, and staff who leak or falsify the data face three to six years in prison.Ley 7558, art. 133, 1995-11-03 official text · verified 2026-10-30

7. The BCCR and MEIC publish a financial competition index comparing all credit products, updated weekly, and every lender must link to it.Ley 7472, art. 36 ter, 2020-06-16 official text · verified 2026-10-30

Worked example

A small business customer loses ₡2,000,000 to an account takeover. It files the bank's claim form within 30 days with the OIJ report and the bank blocks the channels at once. The bank has 30 days to show its controls and systems were sound and that the customer acted with intent or self fraud; if it cannot, it refunds within 10 days and reverses any interest triggered. If it rejects, SUGEF reviews the file within 10 business days.

Step by step

Report suspected fraud immediately through the 24/7 channel and keep the receipt code.
File the OIJ complaint and the bank claim within 30 calendar days.
For lenders: update claim procedures, forensic logging and SUGEF reporting to Ley 10889.
Obtain written authorisation before any credit bureau query.

Common traps

The 30 day claim window runs from the event, not from discovery.
Banks are liable for transactions after the customer's report even if the original fraud is disputed.
Non supervised lenders get credit bureau access only with borrower authorisation and must provide portfolio data to MEIC.

Sources

← Deposit guarantee and bank resolution in Costa Rica: ₡6,000,000 per person per entityPayments, card fees and virtual assets in Costa Rica: BCCR fee caps, SUGEF registration and the 2026 crypto rules →

Get rule changes weekly

Free. One email a week from The LatAm Thread.

One more step after you press the button: we take you to Substack, where your email is already filled in. Confirm there to start. No spam, unsubscribe anytime, we never share your address. By subscribing you agree to the privacy policy.