President Rodrigo Chaves-Robles signed new legislation this week requiring banks to compensate customers who are victims of fraud, shifting greater responsibility to financial institutions.

The measure, Law No.10,889, titled “Law for the Protection of Individuals in the Custody of Their Money Managed by Any Banking Entity, Whether Public or Private,” mandates that both public and private banks reimburse customers for losses resulting from fraudulent activity.

The law, which aims to establish fair conditions for both Costa Rican nationals and foreigners with active bank accounts in the country, was published on Wednesday in La Gaceta, the official government gazette, and took effect immediately.

The legislation amends the Law on "the Promotion of Competition and Effective Consumer Protection and the General Law of Public Administration." Under the reform, banks are now liable when a customer experiences unauthorized withdrawals.

The law also reverses the burden of proof. Previously, customers were required to demonstrate they were victims of fraud. Under the new framework, banks and financial institutions must prove the origin of the fraud, if any.

The measure establishes a formal process for filing claims. Customers must report incidents to their bank within 30 calendar days and file a complaint with the Judicial Investigation Organization (OIJ).

Banks are required to provide simple, accessible forms for claims and ensure continuous customer service, both in person and online.

Once a claim is submitted, the bank has 30 calendar days to investigate and issue a decision. The deadline may be extended once by up to 10 additional business days, provided the customer is notified in advance.

During the investigation, banks must demonstrate compliance with security standards set by the General Superintendency of Financial Institutions and show their systems were not compromised.

Banks must analyze factors including customer behavior patterns, devices used, network connections, authentication methods and any signs of unusual or suspicious activity.

Claims may be rejected only if they can prove specific circumstances, such as self-fraud, intentional misconduct by the customer or transfers between accounts owned by the same individual.

In such cases, the bank must submit a report with technical evidence to both the OIJ and SUGEF. Authorities then have 10 business days to determine whether the decision complies with regulations and is supported by sufficient evidence.

If SUGEF does not uphold the rejection, the bank must return the funds within a maximum of 10 business days. If the rejection is upheld, the customer may pursue legal action.

--------
What have you heard from expats who have been affected by banking fraud? We would like to know your thoughts on this story. Send your comments to news@amcostarica.com