Costa Rica

Regulations

• Can financial institutions use AWS?

  Yes. Financial institutions in Costa Rica are permitted to use cloud services, provided that they comply with applicable legal and regulatory requirements, such as those described below. 

• Who are the financial regulators?

  The Consejo Nacional de Supervisión del Sistema Financiero or “CONASSIF” (National Council for Supervision of the Financial System) is responsible for providing uniformity and integration to the regulation and supervision activities of the Costa Rican financial system. CONASSIF directs and supervises activities of regulators within the Costa Rican financial system, including:

  • The Superintendencia General de Entidades Financieras or “SUGEF” (General Superintendence of Financial Entities) is responsible for the authorization and supervision of financial institutions in Costa Rica which include banks, non-banking financial institutions, credit unions, foreign exchange market institutions, and other financial institutions.
  • The Superintendencia General de Valores or “SUGEVAL” (General Superintendence of Securities) is responsible for the regulation and supervision of the stock markets.
  • The Superintendencia General de Seguros or “SUGESE” (General Superintendence of Insurance) is responsible for the authorization and supervision of entities and individuals involved in acts or contracts related to insurance, reinsurance, public offering of insurance, and any insurance business.
  • The Superintendencia de Pensiones or “SUPEN” (Pension Funds Superintendence) is responsible for the supervision of the pension regime, regulation and oversight of the plans, funds, and managers related to the national pension system.
    
  • The Agencia de Protección de Datos de los Habitantes or “PRODHAB” (Data Protection Agency) is responsible for the compliance of data protection regulations by individuals and legal entities. 

• What regulations apply to financial institutions using AWS?

  Financial institutions in Costa Rica may be subject to a number of different legal and regulatory requirements when they use cloud services. Key legislation and guidelines for institutions regulated under the superintendencies directed by CONASSIF include:

  • CONASSIF Agreement 5-17: or “CONASSIF 5-17” General Regulation for the Management of Information Technology and its guidelines.
  • SUGEF Agreement 2-10: or “SUGEF 2-10” Administrative Regulations for Risk Management.
    

  Customers that have questions about the applicable regulations and guidelines, and how these may apply to their use of AWS services, can reach out to their account representative.

  Regulations are changing rapidly in this space, and AWS is working to help customers proactively respond to new rules and guidelines. AWS encourages its financial institutions customers to obtain appropriate advice on their compliance with all regulatory and legal requirements that are relevant to their business, and local regulations, guidelines and laws.

• Key considerations for financial institutions using AWS

  AWS is committed to offering customers a strong compliance framework and advanced tools and security measures that customers can use to evaluate meet, and demonstrate compliance with applicable legal and regulatory requirements.

  Financial institutions who are using or planning to use AWS services can take the following steps to better understand their compliance needs:

  1. Consider the purpose of the workload(s) under consideration and the relevant categories of data in order to anticipate which legal and regulatory requirements may apply.

  2. Assess the relevant workload(s) in light of requirements from the superintendencies regulated by CONASSIF, and the data privacy and protection requirements from PRODHAB.
  

  3. Review the AWS Shared Responsibility Model and map AWS responsibilities and customer responsibilities according to each AWS service that will be used. Customers can also use AWS Artifact to access AWS’s audit reports and conduct their assessment of the control responsibilities.

  Customers who have further questions about how AWS services can enable their security and compliance needs, or who would like more information, can contact their account representative.

• Key data privacy and protection considerations for financial institutions using AWS

  Financial institutions in Costa Rica using AWS services should consider applicable privacy requirements, including the ones set by PRODHAB:

  • Ley de Protección de la Persona frente al tratamiento de sus datos personales - Nº 8968
  • Reglamento a la Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales - N° 37554-JP

  Data transference of Personal Information outside Costa Rica is authorized, provided that they comply with applicable legal and regulatory requirements. 

Resources