Q COSTA RICA — Banks and other financial institutions must notify clients within one minute whenever funds move in their accounts, according to the banking Superintendency, the Superintendencia General de Entidades Financieras (SUGEF).
The SUGEF, an autonomous, specialized oversight body under the Central Bank of Costa Rica (BCCR), said the notification aims to ensure clients are promptly informed of transactions; if they do not recognize a transaction, they can contact the bank immediately to seek a resolution.
Furthermore, these institutions are required to submit information and documentation regarding any detected instances of cyber-fraud to the Superintendency, so that these cases can be tracked and followed up on.
These provisions are part of Sugef Agreement 5-26, titled “Reglamento sobre los aspectos mínimos de control para prevenir y reducir las estafas informáticas” (Regulation on Minimum Control Aspects to Prevent and Reduce Cyber-Fraud).
The regulation also aims to strengthen consumer protection and ensure that digital services are more secure. It has been in effect since August 11 of this year.
The rules go beyond faster notifications. For high-risk transactions, institutions must:
- Mandate the use of two-factor authentication for high-risk transactions.
- Establish emergency protocols for handling cyber-fraud incidents.
- Implement the ability to block financial services in the event of suspicious transactions.
- Provide mechanisms that allow clients to temporarily block their own financial services.
- Monitor for suspicious transactions to detect attempted fraud.
- Develop digital security education programs to help clients identify and prevent potential cyber-fraud.
Analysis: Faster alerts help, but customers still need a clear response path
A notification delivered in under a minute could give customers a quicker chance to flag unauthorized activity. That speed matters most when an alert is easy to understand and tells the recipient what to do next. The regulation’s emphasis on emergency procedures and customer-controlled temporary blocks points to a broader goal: not just identifying suspicious activity, but giving people a way to respond.
The new requirements also place responsibility on financial institutions to detect and manage risk, rather than relying entirely on customers to notice problems. Transaction monitoring, stronger authentication for higher-risk activity, and reporting suspected fraud to Sugef are meant to reinforce one another.
The announcement does not specify how alerts must be delivered, what counts as a high-risk transaction, or how quickly a bank must act after a customer reports suspicious activity. Those details will matter in practice.
A fast alert is useful, but its value depends on whether customers can recognize it as legitimate and reach the bank through a reliable channel.
For customers, the practical takeaway is to keep contact details current, pay attention to transaction notifications, and use the bank’s official channels to report anything unfamiliar.