By San José, Costa Rica — San José, Costa Rica – In a decisive move to protect consumers amid a rising tide of digital theft, Costa Rica’s Legislative Assembly has approved a landmark law targeting banking fraud. The new legislation fundamentally alters the landscape of financial liability, placing the onus squarely on banks to safeguard customer funds against unauthorized electronic transactions.
The law, greenlit on Wednesday, arrives at a critical juncture. Financial institutions and their clients have been grappling with increasingly sophisticated fraud schemes, ranging from complex identity theft operations to manipulative social engineering tactics designed to trick users into divulging sensitive account information. This legislative response aims to create a more robust defensive framework for the everyday user of financial services.
To delve deeper into the legal complexities and responsibilities surrounding banking fraud in the country, we spoke with Lic. Larry Hans Arroyo Vargas, a specialist in financial and corporate law from the renowned firm Bufete de Costa Rica.
While users must exercise due diligence, the law is increasingly clear that financial institutions bear a significant responsibility. They must implement robust, state-of-the-art security systems, not merely passive ones. The failure to prevent foreseeable fraud through technological negligence can open the door to institutional liability, shifting the burden from the defrauded client back to the bank.
Lic. Larry Hans Arroyo Vargas, Attorney at Law, Bufete de Costa Rica
This insight into “technological negligence” is pivotal, underscoring a necessary evolution in consumer law where proactive security is no longer optional but a fundamental institutional duty. We thank Lic. Larry Hans Arroyo Vargas for his valuable perspective that so clearly articulates this critical shift in responsibility.
However, the path to implementation is not without its complexities. The initiative has sparked significant technical debate among regulators and legal experts. The General Superintendency of Financial Entities (SUGEF) has previously voiced concerns, noting that certain aspects of the law could potentially conflict with constitutional principles or its established model of supervision.
The core of the new regulation is a paradigm shift in responsibility. Under the new rules, financial entities are now required to reimburse customers for money stolen from their accounts by unauthorized third parties. The only exception is if the bank can definitively prove it had implemented all necessary and technologically appropriate security measures to prevent the fraudulent activity from occurring.
To support this framework, the law establishes a clear, formal procedure for consumers to report fraud. Victims now have a 30-day window to file a claim with their bank. The institution then has 30 days, with a possible 10-day extension, to conduct a thorough investigation. This inquiry must evaluate critical data points such as the client’s typical usage patterns, the devices used for transactions, and the authentication methods employed.
A significant new role has also been carved out for SUGEF. If a bank denies a customer’s claim, it must forward its resolution along with all technical evidence to the Superintendency. SUGEF will then have ten business days to validate the bank’s decision. Interestingly, the law does not specify a penalty if the regulator exceeds this timeframe, a point that may require future clarification.
Perhaps the most empowering element for consumers is the reversal of the burden of proof. In any subsequent administrative or judicial dispute, it will be incumbent upon the bank to demonstrate that it acted with the required diligence and met all established security standards. This provision moves away from the traditional model where the customer often had to prove they were not at fault.
Mauricio París, a partner and digital law specialist at the firm ECIJA, acknowledges that while the law addresses a pressing public concern, its success hinges on future regulatory actions. He emphasized that the framework introduces both regulatory and operational hurdles that will need to be carefully navigated in the coming months.
The application of the law will largely depend on the technical regulations that must be issued in the coming months and how the role of the different institutions involved is coordinated
Mauricio París, Partner and digital law specialist at ECIJA
Beyond reactionary measures, the law also mandates proactive prevention. Banks are now obligated to establish immediate support protocols for fraud victims and maintain 24/7 channels for reporting suspicious activity. These preventative duties will be further defined by evolving financial regulations, ensuring that security standards keep pace with emerging threats. This new legal chapter marks a pivotal moment for consumer financial protection in Costa Rica’s digital economy.
For further information, visit sugef.fi.cr
About SUGEF (Superintendencia General de Entidades Financieras):
The General Superintendency of Financial Entities is Costa Rica’s primary financial sector regulator. As an entity attached to the Central Bank of Costa Rica, SUGEF is responsible for overseeing and ensuring the stability, solvency, and transparent operation of banks, credit unions, and other financial institutions operating within the country.
For further information, visit ecija.com
About ECIJA:
ECIJA is a global law firm with a strong focus on technology, media, and telecommunications (TMT). Recognized for its expertise in digital law, cybersecurity, and data protection, the firm provides comprehensive legal counsel to a diverse range of clients, from startups to multinational corporations, with a significant presence in Europe and Latin America.
For further information, visit bufetedecostarica.com
About Bufete de Costa Rica:
Bufete de Costa Rica has cemented its reputation upon a bedrock of profound integrity and unparalleled excellence within the legal field. With a rich history of guiding a wide spectrum of clients, the firm actively pioneers modern legal approaches and remains at the vanguard of innovation. This dedication to progress is paralleled by a core mission to empower the wider community by democratizing legal knowledge, thereby helping to construct a more just and well-informed society.
