This section presents a detailed analysis of the operation, achievements and objectives of simplification and digitalisation, which are undertaken to develop and implement a one-stop shop. The analysis is based on the principles and best practices that the OECD promotes in terms of administrative simplification and digitalisation processes in one-stop shops for investment. The analysis of simplification is based on the blocks of the digital procedures pyramid.
Review of Costa Rica’s One‑Stop Shop for Investment
Abstract
This chapter describes in detail the operation of Costa Rica's VUI, analysing its functionality; organisation; the presentation of procedures; and the description of the route proposed by the one-stop shop for an entrepreneur to obtain information on the procedures for setting up a business.
In addition, it presents a comparative analysis of the one-stop shop regarding essential elements identified by the OECD for the establishment and operation of a digital procedures.
The OECD will make use of reports such as Best Practice Principles for Regulatory Policy: One-Stop Shops for Citizens and Business (OECD, 2021) and the Guide to Improve the Regulatory Quality of State and Municipal Formalities and Strengthen Mexico’s Competitiveness (OECD, 2012) (see Box 2.1 and Box 3.1), among others, to carry out the evaluation and recommendations.
The guide has three basic objectives:
reduce resolution times by better organising the evaluation and review procedures
facilitate compliance with procedures and give certainty to entrepreneurs
provide a process overview, placing entrepreneurs and businesspeople at the centre.
The guide offers 26 specific recommendations for improvement that can be implemented in the short term in the processes and areas of:
opening of a company (6)
construction permit (5)
property registration (4)
bidding (2)
pre-counter factors and regulatory transparency (5)
efficiency in procedure management (4).
The recommendations come from best practices in Canada, Italy and Spain, as well as examples of high performance in Mexico.
The guide has been successfully implemented in the municipalities of Mérida (100%), Hermosillo (96%) and San Luis Potosí (87%), among others.
Source: (OECD, 2012[1]).
Costa Rica's VUI is an effort led by PROCOMER, with the participation of COMEX and the MEIC.
One of the core objectives of the VUI is to centralise, streamline and simplify digital procedures for entrepreneurs and investors who wish to set up business in Costa Rica. Therefore, it has been working to define and simplify the procedures required for investment since 2017. PROCOMER has launched a simplification strategy due to the complexity of the procedures associated with attracting investment.
As a result of the investigation carried out by the OECD and the reporting of preliminary findings, PROCOMER set out to classify the procedures using a more consistent approach to life events and to present them in a process overview. The following table shows the classification of the VUI processes.
The procedures mentioned in Table 3.1 have different levels of digitalisation.
It is worth mentioning that a digital procedure performed entirely on line requires applicants to have a digital signature. In Costa Rica, most citizens do not have a digital signature, so they have to go to an office to prove their identity and obtain their password to access digital procedures. Although the procedures are not completely digital, the improvements they present are a major step towards reducing administrative burdens.
Managing these procedures enables those interested to obtain requirements on line, send their documents through the VUI and apply on line. This makes the application process easier, eliminates visits to offices and speeds up response times, since the system allows resolutions to be monitored in order to meet previously established deadlines.
The VUI offers other procedures separately from the processes, which were digitalised at the request of the agencies when PROCOMER was simplifying and digitalising procedures at the request of the government bodies.
Business licence procedure
The business licence procedure is very important for initiating a business activity in Costa Rica, since it allows companies to obtain the sanitary operating permit, the land use permit and the registrations required according to the economic activity. Payment can be made on line. This procedure can be carried out through the portal, but only for participating municipalities. At the end of the procedure, the entrepreneur obtains a licence that allows the company to start operating.
Sanitary operating permit procedure (PSF)
This procedure is required for any individual or legal entity to carry out any industrial, business or service activity. The operating authorisation may be granted for a period of one to five years, depending on the economic activity.
The PSF can be managed in the 82 health areas.
There has been significant progress in digitalising this procedure. PROCOMER could consider increasing the procedure's level of digitalisation to enable the procedure to be tracked on the platform and eliminate the use of e-mail.
Application for admission to the free trade zone regime and authorisation as a public service customs agent
This procedure can be completed in the VUI, which implies that there has been significant progress in its level of digitalisation. For the procedure, there are series of guides for investors wishing to apply for entry into the free trade zone regime, walking them through requesting tax support and incentives to carry out their economic activity. As this procedure involves several requirements and authorisations, the guides are very useful for advising stakeholders.
The guides contain online forms to fill out, advice via e-mail, and legal support for each step. According to the information provided by PROCOMER, payment is made outside the platform.
Technical pronouncements on groundwater
The procedure provides a technical opinion on the hydrogeological conditions of a site and/or the analysis of vulnerability, threat and danger of contamination of productive or construction projects to be carried out by public or private entities, or individuals.
The procedure has an advanced level of digitalisation. It provides data for carrying out the procedure in the VUI, which is the requested format for the procedure's management and legal basis. PROCOMER could consider increasing the procedure's level of digitalisation to enable it to be tracked and resolutions provided in the VUI, not by e-mail. The goal is for applicants to complete the entire process in the VUI.
Management of requests for technical criteria on the presence/absence of wetlands
This procedure has an advanced level of digitalisation. It is important in enabling institutions that issue permits, authorisations, licences and opinions on environmental viability to obtain a technical report on wetland criteria. This procedure is necessary to initiate construction or develop a new project.
As in the previous cases, the procedure's level of digitalisation could be improved by enabling tracking and notifications of the procedure in the VUI.
Wastewater treatment system location permit (STAR in Spanish)
The STAR procedure allows various requirements for opening an business to be completed on line. The procedure is necessary to start company operations. It has an advanced level of digitalisation. Once the stakeholder meets all the requirements, a resolution is issued within 22 calendar days.
The procedure's level of digitalisation could be increased if resolutions could be downloaded from the VUI, rather than being sent by e-mail. In addition, when printing resolutions, security mechanisms should be in place to ensure that all authorities consider the documents to be valid.
"Authorisation and registration of stationary tanks for self-consumption of fuel" (self-consumption tank storage)
This procedure can be managed online, so it has an advanced level of digitalisation. However, some of the procedures that are key requirements to obtain this authorisation cannot be managed in the VUI. Instead, the VUI provides links to where these procedures can be managed, along with regulatory support.
The first challenge for efficiently digitalising a procedure is implementing the regulatory improvement tool for administrative simplification. Bureaucracy should not be digitalised. It is necessary to analyse in detail what citizens are required to do, to question each of these requirements and, where possible, emulate national and international best practices to manage procedures.
In order to simplify administration, which can impact procedure management, the agencies responsible must be consulted so that they can be mapped and the bottlenecks and reworks confirmed. Additionally, it is necessary to consult with businesspeople and citizens who have carried out the procedures to identify the processes that represent the greatest administrative burdens and are the most inconvenient to them.
Risk-based regulation is one of the main principles that should be employed when implementing administrative simplification strategies. This principle should also be the basis for the strategy for improving inspections and/or verifications.
It is rare that governments have the human and financial resources to implement a regulatory process where all applications are inspected or verified to the same extent or depth. This is not just expensive but also ineffective. The Costa Rican government, through its agencies, must apply risk criteria, as well as proportional regulation, to provide a more comprehensive, high-quality regulatory process. Applying these principles not only reduces the costs associated with monitoring and surveillance, but also makes regulation more effective and less cumbersome. In short, agencies must ensure that procedures and their monitoring are science-based, targeted, effective and efficient (OECD, 2015[3]). In this sense, if a procedure is too cumbersome and does not meet the objective of public policy because it encourages non-compliance, it will probably be necessary to reformulate the scope of the instrument.
Designing and delivering regulation in a risk-focused and risk-proportionate manner is an essential approach to improve efficiency, strengthen effectiveness and reduce administrative burdens.
"Risk" is understood to be the combination of the probability of damage of any kind, and the potential magnitude and severity of this damage. Risk-based regulation crucially aims to focus on outcomes rather than specific rules and processes.
The adoption of risk-based regulatory approaches is unevenly distributed across countries and regulatory functions, and often limited to stages of the regulatory policy cycle, sectors, etc.
Risk assessment is useful for prioritising regulatory efforts, and adapting the choice and design of regulatory instruments within and across regulatory domains. It is not just a case of knowing the level of risk, but also the characteristics of each risk in order to plan the appropriate regulatory response.
Barriers to adopting risk-based regulation include resistance in institutions with a "risk-averse" culture, public pressure, path dependence, lack of necessary tools and resources, etc. and an overestimation of how effective "non-risk-based" regulation really is.
As a first (useful) step, risks can be prioritised by sector or activity type. However, when data for risk analysis and prioritisation are available, a more differentiated, data-driven approach to risk assessment and selection is essential.
Risk should be assessed in an objective and data-driven manner. Significant progress has been made in recent years, including through the use of machine learning to improve data analysis. Many jurisdictions and services have introduced new risk-based tools and practices, including in the context of COVID-19.
Specifically, the COVID-19 crisis has highlighted the barriers that regulation can pose to crisis response when it is disproportionate to risk, or when trade-offs between different risks are not adequately provided for. It has also demonstrated the importance of allowing and managing regulatory flexibility in emergency situations and leveraging new technologies.
New technologies can facilitate data sharing and improve analysis, including through the use of a combination of public and private data, but this requires trust and privacy issues to be properly managed.
Source: (OECD, 2015[3]).
The VUI has used several methodologies to identify the procedures necessary for investing in and starting a business in the country, and to simplify and include them on the VUIʼs platform. One of these methodologies is the “FENIX” (in Spanish) strategy outlined below (Figure 1.6):
Strengthen: Alignment and awareness-raising are carried out among senior institutional executives and public officials; the process or procedure is specifically mapped; and the baseline or duration of the process and improvement initiatives found are defined.
Standardise: The process is re-engineered, resulting in an improved process. Additionally, the technical requirements of the process that will later help its digitalisation are highlighted.
Normalise: If the process improvement requires a regulatory reform of a legal nature, it is carried out at this stage.
Technological implementation: Actions are validated and carried out to make the procedure available in digital format: software enablement, development, quality control, testing, staff training and deployment.
Excel: Improvement is continuously sought. Therefore, when all stages of a process have concluded, new opportunities for improvement may be identified that require going through one or more stages again. The path to excellence is encouraged among institution officials.
The FENIX strategy has helped form interdisciplinary teams within the public and private sectors to identify the main opportunity areas to improve the country's competitiveness by simplifying the processes required for investment.
Another methodology that the VUI has implemented is Lean Six Sigma, which consisted of reviewing processes, identifying opportunity areas and implementing improvement strategies. In the analysis stage, the steps that a procedure must follow and its requirements were reviewed and simplified to optimise the procedure.
In addition, when developing the VUI, the “Six Sigma” methodology was applied as a tool to optimise processes. This methodology aims to implement a process to ensure that variations during operation are minimised. The Six Sigma model seeks to optimise each of the processes, minimising errors. In the case of procedures, it aims to introduce the possibility of discretion in their management. Thus, one of the main objectives of the Six Sigma model is productivity, which can result in a reduction in response times.
Another methodology used to build the VUI was known as DMAIC (D=Define, M=Measure, A=Analyse, I=Improve, C=Control). Each of these letters stands for a phase of improvement, in which several tools are implemented. The DMAIC improvement project cycle is shown in Figure 1.7.
Finally, the “Kanban” board was used, which allows a project’s progress to be viewed and monitored: the VUI in this case.
The work carried out to simplify and design the VUI has allowed for significant progress to be made, which is reflected in Figure 3.1 and Figure 3.2:
Source: Prepared by PROCOMER.
Source: Prepared by PROCOMER.
In summary, various methodologies have been implemented to develop the VUI that promotes investment and offers simplified and digitalised procedures, at both the central government level and the local or subnational government level.
The OECD has identified a number of elements that are essential for establishing a 100% digital, i.e. end-to-end digital, one-stop shop. In this report, these elements are defined as the blocks of the digital procedures pyramid. The OECDʼs experience of working on the simplification and improvement of high-impact procedures to improve the business environment in Latin American governments has made it possible to identify these key elements.1 Table 3.2 shows the proposed definition of 100% digital procedures used in this report, and Figure 3.3 contains the proposed blocks of the digital procedures pyramid.
The blocks of the digital procedures pyramid are a series of key components that must interact with a digital one-stop shop in order to achieve 100% digital procedures as defined in Table 3.2. Each block represents a series of specific functions for the purpose of managing end-to-end digital procedures. The blocks are:
procedures and services registry
digital signature
georeferenced map
payment engine
inspection platform
digital file.
Below is a description of the blocks and an appraisal of the current state of the blocks for a one-stop shop. To meet the objective of establishing 100% digital procedures for the one-stop shop, the pyramid blocks must be consolidated as follows:
Their use should be cross-cutting between the institutions involved.
Communication between institutions should be efficient and enable systems to be interoperable.
The platform should be fed with continuous information and constitute a dynamic system.
Information should be safeguarded with security protocols that provide legal certainty.
Competencies and attributions should be defined and the control and protection of information should not be violated in communication between institutions.
The work presented below is the result of several meetings with the VUIʼs team and three investigations conducted by the OECD in which meetings were held with the agencies responsible for the blocks of the digital procedures pyramid.
The objective of the procedures and services registry is to have a website that includes the Costa Rican government's entire collection of procedures and services. The information on the procedures should be accurate, up to date and consistent with that of other existing information mechanisms. Finally, information should be provided in everyday language and organised by life events. The MEIC procedures registry portal should be the baseline for the VUI, since this portal should be the only source of official information; as such, the VUI should communicate with the MEIC procedures registry. The registry should include all procedures managed within the central administration, including deconcentrated or decentralised organisations.
The official procedures and services registries or catalogues are a basic tool for developing digital procedures, since they should be the main source of information and the only information channel for citizens. To this end, it is necessary to include within the regulatory framework the considerations that indicate that this registry will be the only source of information for procedures management, in addition to the channels through which users may file complaints or report practices that are not permitted by law.
Such registries must include truthful, complete and clear information expressed in everyday language and based on the regulatory framework of the government entity, i.e. procedures or services that do not have a solid regulatory framework must not be requested.
In 2002, the Costa Rican government issued the Law for the Protection of Citizens from Excess Administrative Requirements and Procedures, which empowers the MEIC, through the Directorate for Regulatory Improvement, to be the governing body for the simplification of procedures and regulatory improvement and to ensure compliance with the law.
Although the citizen protection law is a great step forwards in terms of the simplification and presentation of procedures, it does not consider the need for a single procedures and services catalogue or registry as the only source of information, or the fact that agencies are unable to request additional requirements or procedures to those included in the registry.
According to OECD recommendations (OECD, 2012[4]), procedures and services registries must comply with the information quality principles, which are: truthful, complete and clear information; the same information at all access points; and a commitment to certainty in the procedure.
Through investigations and desk research, it was found that there are several sources of information on procedures and services in Costa Rica. Each portal presents the information in a different way and, in many cases, the procedures have different names with coinciding requirements.
The different webpages that promote procedures and services present the information in different ways. Some attempt to follow the principles of life events or vital facts that would facilitate the search for information (see Box 2.3). However, other pages present the procedures by the agency in charge or the name of the procedure. This obliges stakeholders to know prior information to identify the requested procedure.
In most portals, to locate the procedure you must search for it or the agency responsible for it by name. Some have a search function that allows you to locate it. However, the options to search by keywords under which the procedures can be located need to be improved, since it is not easy to obtain information if the official name under which the procedure is registered is not known. To review how to strengthen the communication in government portals, we recommend consulting (OECD, 2023[5]).
In the absence of a single procedures and services registry at the central level, the VUI must provide information on the procedures it promotes, which were updated to improve their presentation following OECD investigations. Nevertheless, the way in which these processes are presented needs to be improved by adopting a life events approach and by providing information in everyday language. It is worth mentioning that based on the research work carried out by the OECD, only some cases of information portals on procedures that promote one-stop shops and publish an access link were found. Such is the case of the Ministry of Health – Calderas (ministeriodesalud.go.cr) and MINAE (https://energia.minae.go.cr/?p=9925).
The VUI presents information on the procedures related to the opening of a company in a process overview that allows the investor to consult the procedures that may be required. It is worth mentioning that it is necessary to read the guides, manuals or even the legal basis of each procedure in order to identify whether the procedures apply to the various economic activities to be set up.
Once the user is clear on the procedures to be followed according to the guides, the VUI walks the user through managing these procedures.
The OECD promotes a decision tree classification model that allows applicants to define the required procedures by economic activity, so that by making a few decisions, the applicant can establish the route of procedures to follow within the VUI (see Figure 3.4 for an example of a digital one-stop shop with a decision tree). As mentioned in previous sections, the VUI has combined the required procedures to start a business, which constitutes a life event by itself, into a single interaction with citizens. However, it is possible that as more procedures from different sectors are incorporated, it will be necessary to identify a series of paths or life events for investment. For example, green investments may require specialised procedures in addition to those already incorporated in the VUI. In this case, a life event approach must be adopted that is based on decision trees that allow the entrepreneur to identify the designed route based on their project's characteristics: in other words, to identify not just the most general procedures, but those more specialised in a critical path provided by the VUI.
Evaluation summary
Table 3.3 summarises the evaluation of the procedures and services registry under the MEIC, which is responsible for registering procedures and services at the central level.
Source: (Ayuntamiento de Puebla, 2024[6]).
Georeferenced map
The objective is to have a website containing a georeferenced information system or spatial data infrastructure that citizens, businesspeople and public officials can consult on line for decision-making purposes. Information must be up to date and interoperate between different government agencies and with the digital one-stop shop for mutual benefit.
The georeferenced map is a spatial data infrastructure that allows users to obtain georeferenced information on the premises and area in which a company intends to set up or build. The georeferenced information should allow for a geographic analysis for decision-making; for example, to verify whether the economic activity to be set up is compatible with the land use according to urban development plans. Regarding the use of the georeferenced map, it is important to inform users that the search results do not constitute any type of authorisation and are for informative purposes only.
The georeferenced map should present at least the following information:
risk atlas (civil protection)
types of risk to which the premises are exposed, such as safety, environmental, health, etc.
provision of water and sanitation services
land or cadastral information
socio-economic information
road, commercial and industrial infrastructure.
Cadastral information on the premises should include information on the current buildings and the premises' dimensions. With regard to safety issues, the georeferenced map can provide information on safety figures by area, which can indicate whether an area is safe or if there is criminal activity.
The OECD investigations found that the Costa Rican government has various sources of georeferenced information. The different systems that provide this information are described below.
In order to support geospatial information, Costa Rica created a regulatory framework that obliges agencies to publish the information. This obligation stems from the law establishing the National Geographic Institute (IGN). In addition, Costa Rica published Executive Decree No. 37773-JP-H- MINAE-MICITT that established the National Territorial Information System (SNIT) and Executive Decree No. 42120-JP that established the Costa Rican Spatial Data Infrastructure (IDECORI). Presidential directive 011 of January 2023 was also issued, which makes it mandatory to publish geospatial information in SNIT.
The information published on the SNIT portal is intended to encourage public officials to use data for decision-making. As at 28 March 2023, the georeferenced information is published in computer systems and organised by different themes, such as:
the country's basic cartography
aerial photographs of the National Geographic Institute
environmental information from the National Geo-environmental Information Centre of MINAE
meteorological data from the National Meteorological Institute (IMN)
cadastral and mining region information from the Directorate of Geology and Mines of MINAE
data on the regularisation of public services from the Public Services Regulatory Authority (ARESEP)
the Land Register and National Register's cadastral map
information from the Water Directorate; the National Service of Underground Water, Irrigation, and Drainage (SENARA); the Institute of Aqueducts and Sewerage; and information on risk management from the National Commission for Risk Prevention and Emergency Response
land use change of the National Centre for High Technology (CENAT).
It also publishes soil information from the Ministry of Agriculture and Livestock (MAG) and the National Institute of Innovation and Transfer in Agricultural Technology (INTA); planning information from MIVAH, INVU, ICT and the Ministry of Culture and Youth (MCJ); information on educational facilities from the Ministry of Public Education (MEP); and population data from the National Institute of Statistics and Censuses (INEC), as well as other municipal information.
Each computer system integrated into the SNIT has a domain name and a URL address to facilitate the connection with the SNIT geo portal, which conforms to the standards of the Open Geospatial Consortium (OGC). It can be consulted through web viewers, which allow layered information to be integrated.
Although georeferenced information is available, the institutions update the information in ranges of years in some cases. For example, the cartographic base was updated in 2017. Therefore, to keep geospatial databases up to date, these databases must be updated more regularly, and mechanisms for interoperability with the agencies responsible for the data at its source must be identified, so that information can be updated in real time.
Costa Rica's georeferenced information is based on the following regulatory framework:
Law No. 59 on the Creation and Organisation of the National Geographic Institute of 4 July 1944 and its amendments (CONGRESO CONSTITUCIONAL DE LA REPÚBLICA DE COSTA RICA, 1991[7]).
Law No. 8905 of 7 December 2010 amending Article 2 of Law No. 5695 on the Creation of the National Registry and its amendments, and Law No. 59 on the Creation and Organisation of the National Geographic Institute of 4 July 1944 and its amendments (ASAMBLEA LEGISLATIVA DE LA REPÚBLICA DE COSTA RICA, 1944[8]).
Executive Decree No. 37773-JP-H-MINAE-MICITT of 7 May 2013 on the Establishment of the National Territorial Information System (SNIT) (PRESIDENTA DE LA REPÚBLICA, 2013[9])
Executive Decree No.42120-JP of 18 November 2019 on the Establishment of the Spatial Data Infrastructure of Costa Rica (IDECORI) (PRESIDENTE DE LA REPÚBLICA and MINISTRA DE JUSTICIA Y PAZ, 2019[10]).
The VUIhas not integrated the information sources listed above into its procedure management system, on the basis that they are not needed to guarantee its service. It has also been suggested that the agencies in charge of the procedures in question should be responsible for managing these information systems. However, to the extent that applicants and agencies require geospatial information for decision-making, or to complete procedures, incorporating these systems into the VUI would add value. In this case, the VUI could serve as a data viewer, without assuming responsibility for the information itself.
According to the digital procedures model promoted by the OECD as part of its digital procedures pyramid, geospatial information helps investors make decisions. Table 3.4 thus presents a summary of the OECD evaluation of the existence and use of a georeferenced map according to the information available to the Costa Rican government.
Evaluation summary
Payment engine
The aim of this system is to offer a digital solution with online payment options for charges payable by users for procedures, with these costs credited instantly to payee institutions. The digital one-stop shop should include this feature.
The aim of the payment engine is to enable businesspeople, entrepreneurs or investors to make instant payments for procedures, with the option of paying by credit or debit card, or, if desired, generating a payment request on the platform, which could be used to make the payment at a bank, government cashier's office or another type of counter. The payment engine should also accept electronic transfers.
The purpose of a digital payment engine is to generate a unique code or automatic payment reference that enables the payment, and the taxpayer making it, to be instantly identified. This should also be reflected in the fiscal records of the relevant government body in real time, without the taxpayer having to submit proof of payment to complete the procedure. In addition to instant payment, instant one-click invoicing should be possible through the generation of tax receipts.
PROCOMER developed a payment gateway for VUCE that makes it possible to pay the duty or tax related to each procedure via the one-stop shop. The VUI implemented the same solution to make payments by bank transfer through the Central Bank of Costa Rica.
The process for paying for procedures is as follows:
1. Upon completion of any process or procedure, the system prompts the user to make the required payment.
2. The bank generates the payment reference.
3. The platform displays the items to be paid for or cancelled.
4. The user selects the payment method.
5. National System of Electronic Payments (SINPE) transfer.
6. The user enters the values and information required by the payment method on the platform.
7. The user confirms the payment.
8. The platform automatically sends the proof of payment by e-mail.
SINPE supports secure, instant payment. In the case of payments for municipality-level procedures, the bank reconciliation must be issued before the payment can be credited. In the case of procedures with payment amounts that require calculation, a digital calculator is not available; instead, public officials determine the fees payable. Not all bank cards are currently accepted; payment must go through the Central Bank.
Table 3.5 presents a summary of the evaluation of the existence and use of a payment engine by the VUI.
Evaluation summary
Digital signature
The aim is to have a system that allows citizens and public servants to use a digital signature on files. The signature must have legal certainty and security features permitting its widespread use. The digital one-stop shop should allow the use of digital signatures.
Today, the use of technology is an inescapable reality. This means that transactions, services and procedures must be carried out online. Organisations, businesses and governments must ensure that these processes are secure in order to offer citizens a sense of certainty and confidence. Using digital signatures as a means of digital identification ensures that the interaction between the government and citizens is lawful and secure.
An digital signature is a unique digital chain. It is equivalent to a handwritten signature but in the digital world, representing a guaranteed way of signing something in digital format and acting as the access key to authenticating a person's identity digitally. A digital signature should enable citizens to initiate procedures online without having to go to a physical counter.
To implement a digital identity system with attributes of certainty and security, the OECD published the Recommendation of the Council on the Governance of Digital Identity to enable member countries to develop digital identities.
To develop an inclusive, user-centred digital identity, the OECD recommends that:
Adherents design and implement digital identity systems that respond to the needs of users and service providers.
Adherents prioritise inclusion and minimise barriers to access to and use of digital identity.
To strengthen the governance of digital identity, the OECD recommends that:
Adherents take a strategic approach to digital identity and define roles and responsibilities across the digital identity ecosystem.
Adherents protect privacy and prioritise security to ensure trust in digital identity systems.
Adherents align their legal and regulatory frameworks and provide resources to enable interoperability.
To enable cross-border use of digital identity, the OECD recommends that:
Adherents identify the evolving needs of users and service providers in different cross-border scenarios.
Adherents co-operate internationally to establish the basis for trust in other countries' digital identity systems and issued digital identities.
In addition, the OECD has identified the characteristics that a digital signature must have to implement procedures that are 100% digital. These are:
assurance of the identity of a signatory
assurance of the integrity of a signed document, i.e. the ability to ensure that the signed document is exactly the same as the original and has not been altered or tampered with
assurance of non-repudiation of the signed document. This is based on the unique and exclusive character of the data used by the signatory when signing, meaning they cannot later claim not to have signed the document.
Proper design and use of digital signatures can provide the following benefits:
digital identification of users, and the assurance they can carry out digital procedures securely
the creation and effective management of a digital file (see the subsection on digital files below).
Source: (OECD, 2023[11]).
In Costa Rica, the Ministry of Science, Innovation, Technology and Telecommunications is the regulatory body for digital signatures; however, the Central Bank is the institution responsible for implementing, registering and issuing digital signatures.
A digital signature consists of two certificates: an authentication certificate and a digital signature certificate for individuals, and an electronic agent certificate and electronic seal certificate for legal entities. Biometrics and fingerprints are collected for issuing certificates to ensure data security. The security mechanisms used for digital signatures are based on international standards.
The Central Bank created the Digital Authentication Manager (GAUDI in Spanish) to implement and validate digital signatures.
Costa Rican government institutions connect to GAUDI to use digital signatures.
The Costa Rican Central Bank charges 5 000 Costa Rican colones (just under USD 10) for digital signatures, which is costly obstacle for Costa Rican citizens.
The VUI uses a digital signature for public officials who need to sign resolutions. In the case of citizens, the VUI was created with the idea that all users should have a digital signature and that the system must enable access by all citizens, either with or without an digital tool for signature.
The following laws and policy guidance constitute the regulatory framework supporting the use of digital signatures in Costa Rica:
Law No. 8454 on Certificates, Digital Signatures and Electronic Documents (ASAMBLEA LEGISLATIVA DE LA REPÚBLICA DE COSTA RICA, n.d.[12])
Regulation to the Law on Certificates, Digital Signatures and Electronic Documents, Executive Decree No. 33018-MICIT (PRESIDENTE DE LA REPÚBLICA and MINISTRO DE CIENCIA Y TECNOLOGÍA, 2006[13])
Guidelines for Registration Authorities. Compliance characteristics of Registration Authorities (RA) of the National Organisation of Registered Certifiers of Costa Rica (Departamento de Certificadores de Firma Digital, Dirección de Gobernanza Digital and Ministerio de Ciencia, 2018[14])
Certificates Policy for the National Organisation of Registered Certifiers (Dirección de Gobernanza Digital, Certificadores de Firma Digital and Ministerio de Ciencia, 2022[15])
Policy on Official Formats of Digitally Signed Electronic Documents (Dirección de Gobernanza Digital, Certificadores de Firma Digital and Ministerio de Ciencia, n.d.[16])
National Digital Certification System Time-stamping Policy. (Dirección de Certificadores de Firma Digital and Ministerio de Ciencia y Tecnología, 2008[17]).
Table 3.6 presents a summary of the evaluation of the existence and use of digital signatures by the VUI.
Evaluation summary
Inspection platform
The aim is to develop a digital inspection management system to improve communication between institutions and citizens in the regulatory process, in order to make the process more transparent and trustworthy. The inspection platform should interoperate with the digital one-stop shop.
The inspection platform enables the digital management of the inspection process. It should enable the online scheduling of an inspection visit related to procedures, mainly those linked to processes to be integrated into a digital one-stop shop for investment. In addition, it should provide applicants with guidance on the standards to be met with regard to required inspections. Ideally, applicants should be able to obtain the checklists that will be used during inspections from the platform. The platform should provide citizens with information about, and the profile of, the appointed inspector, as well as the scheduled day and time of the inspection.
In addition to facilitating the inspection process for businesspeople and citizens, the platform makes the process transparent, eliminates discretion and facilitates the applicant's compliance with the technical specifications. The inspection platform aims to provide efficient services and transparent management, reduce time and administrative costs, create an environment of confidence through an inspectors' register, and provide information on the criteria to be checked during the inspection visit.
The Costa Rican government is in the early stages of creating a verification or inspection platform. Costa Rica has not defined a comprehensive verification or inspection process for all institutions, since this is considered part of the procedures of individual institutions.
To improve the inspection process, the Costa Rican government amended Article 15 of Law No. 7210 through Law No. 10234 of 4 May 2022, which legally established an integrated inspection mechanism, as follows:
"Where appropriate, public institutions that inspect businesses must manage relevant co-ordination mechanisms that enable such inspections to be conducted in an integrated manner. To this end, inspection bodies may share information and records, participate in joint alert systems, and co-ordinate field visits or field studies, especially in related regulatory areas. Such co-ordination should be carried out in accordance with the scope of competence of each of these bodies."
During its fact-finding missions, the OECD identified that the Costa Rican government does not have a register of inspectors and inspections which would make it possible for citizens to verify that a person visiting their premises is authorised to carry out inspections. When citizens need a verification of the people acting as inspectors, they are able to check their credentials and confirm whether the holder is authorised to perform with the relevant agency. Individual institutions have defined the inspection processes for each procedure in their regulations. As such, there is no single inspection model that is used across the entire Costa Rican government and its institutions.
According to the OECD model, a digital one-stop shop for investment that complies with the blocks of the digital procedures pyramid requires an inspection platform that allows citizens to provide feedback on inspections. This enables possible areas of opportunity to be identified, based on which training can be provided for inspectors in accordance with competency frameworks, allowing for better qualified inspectors. In addition, there should be a body of properly trained multidisciplinary inspectors with the ability to review different aspects relating to commercial premises, thus reducing the administrative burdens resulting from procedural paperwork and various different inspections.
Table 3.7 summarises the evaluation of the existence and use of an inspection platform as promoted by the OECD and proposed for implementation by the Costa Rican government, first at the central level and then integrated into the VUI.
Evaluation summary
Digital file
The aim is to have a computer system that generates a digital file enabling citizens to store the minimum information necessary to manage procedures and that makes it possible to submit background details just once, avoiding duplication and reprocessing between different institutions. Digital files must be inter-institutional and interoperable and should be used by the digital one-stop shop.
The main aim of a digital file is to offer citizens and businesspeople the possibility of storing, in a single digital repository with official validity, any data and documents they submit alongside the documents issued by the authorities. In other words, businesspeople or citizens should not be asked to provide information or documents that are in the digital file, and all government agencies should have access to that file, in accordance with their remit, through the interoperability of databases.
The digital file should safeguard the information citizens provide to authorities, enabling access to it and thus avoiding repeated requests for this information. Data and documents stored in digital files can be generated in physical as well as digital form, enabling their consultation by institutions authorised to access them as well as by citizens themselves.
In the case of digital one-stop shops for business procedures, the use of an advanced digital signature is proposed to make it simple for people to register and generate a digital file, thus guaranteeing that their legal identity will be recognised without the need to enter government offices.
Proper design and use of digital files can provide the following benefits:
one-time submission of data and documents by citizens to complete forms and provide access to information on each user's history
the interoperability of data, which reduces requirements and thus the administrative burden on users
the elimination of the need to present documents to prove criteria such as legal identity or domicile for each interaction
the provision of information that can also be used for multiple purposes by government agencies.
The VUI has a digital file which was developed so that citizens can store their documents and data and officials can easily consult this information.
The data included in the VUI's digital file are: applicant's name, official identification, address, proposed business activity and e-mail address. This is the same for an individual or a legal entity.
To generate a digital file, the applicant's digital identity must be certified either by means of a digital signature or by going to an office to create a user name and password.
The Costa Rican government approved Law No. 8220 on the Protection of Citizens from Excessive Administrative Requirements and Procedures, which covers the single submission of documents in its Article 2. This Article states: "Information submitted by an individual to a public service entity, body or official may not be requested again by them, either for the same procedure or for another one in the same entity or body. Likewise, no public entity, body or official may request information from the individual that is issued by, or in the possession of, one or more of its own offices."
The digital file within the VUI serves as a repository of information or electronic folder that the applicant can use to manage procedures and group together the applications he or she is making.
The digital file has a life span of five years in the VUI. Once this time has elapsed, information must be stored by the agencies responsible.
The digital file aims to make it possible for users to submit general information just once, and store any application outcomes together in the digital folder.
The VUI created its own regulation for the operation of a one-stop shop investment system, which centralises the procedures and permits with which companies wishing to set up and operate in Costa Rica must comply. With respect to the digital file, it sets out the following: "Article 14. Electronic file and storage of information. For all acts or processes to be carried out electronically in the VUI, the System will create an electronic file containing all electronic documents generated when processing the application. The security and integrity of each electronic document included in the electronic file must be maintained by means of the mechanisms defined by the administration.
Furthermore, the regulation considers the following important points:
The company's legal representative shall have free access to the electronic file, which will be available for consultation on line.
The VUI will retain each electronic file on line for five years, unless public institutions require a longer period.
Upon expiration of the aforementioned term, files will be transferred to the institutions that were involved in the processing of each application so that they may handle them accordingly.
Regarding the management and maintenance of electronic files, the provisions of the corresponding regulation, alongside the provisions of the Governing Board of the National Archive, shall apply.
Administrative and judicial authorities will be able to consult the electronic files stored in the VUI System directly, in accordance with applicable restrictions and procedures."
Table 3.8 summarises the evaluation of the existence and use of digital files by the VUI.
Evaluation summary
The VUI has features that are consistent with the blocks of the digital procedures pyramid and is on track to become a digital VUI with 100% digital procedures. One of the blocks in which the VUI has made the greatest progress is the digital file, which is also one of the most challenging, since it requires technological capabilities, co-ordination between agencies and strong regulatory support for its implementation.
It is worth noting that including procedures from different governmental levels in a one-stop shop is a challenge that relies on high-level political commitment, investment of human and technological resources, co-ordination, leadership and management capacity. As such, the fact that the VUI has incorporated municipality-level procedures is an achievement worth highlighting.
References
[8] ASAMBLEA LEGISLATIVA DE LA REPÚBLICA DE COSTA RICA (1944), Reforma del artículo 2 de la ley N° 5695, Creación del Registro Nacional, y sus reformas; y modificación de la ley N° 59, Creación y Organización del Instituto Geográfico Nacional, de 4 de julio de 1944, y sus reformas, http://www.pgrweb.go.cr/scij/Busqueda/Normativa/Normas/nrm_texto_completo.aspx?param1=N%20RTC&nValor1=1&nValor2=69510&nValor3=83516&strTipM=TC (accessed on 7 March 2024).
[12] ASAMBLEA LEGISLATIVA DE LA REPÚBLICA DE COSTA RICA (n.d.), Ley de Certificados, Firmas Digitales y Documentos Electrónicos, http://www.pgrweb.go.cr/scij/Busqueda/Normativa/Normas/nrm_texto_completo.aspx?param1=NRTC&nValor1=1&nValor2=55666&nValor3=60993&strTipM=TC (accessed on 8 March 2024).
[6] Ayuntamiento de Puebla (2024), Ventanilla Digital de Inversiones, https://abretuempresa.pueblacapital.gob.mx/ (accessed on 5 February 2024).
[7] CONGRESO CONSTITUCIONAL DE LA REPÚBLICA DE COSTA RICA (1991), Ley de Creación y Organización del Instituto Geográfico Nacional, http://www.pgrweb.go.cr/scij/Busqueda/Normativa/Normas/nrm_texto_completo.aspx?param1=N%20RTC&nValor1=1&nValor2=34222&nValor3=87501¶m2=1&strTipM=TC&lResultado=2&strSi%20m=simp, (accessed on 7 March 2024).
[14] Departamento de Certificadores de Firma Digital, Dirección de Gobernanza Digital and T. Ministerio de Ciencia (2018), DIRECTRICES PARA LAS AUTORIDADES DE REGISTRO Características de cumplimiento de Autoridades de Registro (RA) de la jerarquía nacional de certificadores registrados de Costa Rica, https://www.mifirmadigital.go.cr/wp-content/uploads/2019/02/DCFD-Directrices-para-las-Autoridades-de-Registro.pdf (accessed on 8 March 2024).
[17] Dirección de Certificadores de Firma Digital and Ministerio de Ciencia y Tecnología (2008), Política de sellado de tiempo del Sistema Nacional de Certificación Digital, https://www.mifirmadigital.go.cr/wp-content/uploads/2019/02/DCFD-PoliticadeSelladodetiempo.pdf (accessed on 8 March 2024).
[15] Dirección de Gobernanza Digital, Certificadores de Firma Digital and I. Ministerio de Ciencia (2022), POLÍTICA DE CERTIFICADOS PARA LA JERARQUÍA NACIONAL DE CERTIFICADORES REGISTRADOS, https://www.mifirmadigital.go.cr/wp-content/uploads/2022/08/DCFD-Politica-de-certificados-v2.0.pdf (accessed on 8 March 2024).
[16] Dirección de Gobernanza Digital, Certificadores de Firma Digital and I. Ministerio de Ciencia (n.d.), Política de Formatos Oficiales de los Documentos Electrónicos Firmados Digitalmente, https://www.mifirmadigital.go.cr/wp-content/uploads/2019/02/DCFD-Politica-de-Formato-Oficial-v2.0.pdf (accessed on 8 March 2024).
[5] OECD (2023), Effective Government Information Websites: Toolkit for Implementation, OECD Publishing, Paris, https://doi.org/10.1787/ac325b03-en.
[11] OECD (2023), Recommendation of the Council on the Governance of Digital Identity, https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0491 (accessed on 6 March 2024).
[3] OECD (2015), OECD Regulatory Policy Outlook 2015, OECD Publishing, Paris, https://doi.org/10.1787/9789264238770-en.
[1] OECD (2012), Guia para mejorar la calidad regulatoria de trámites estatales y municipales e impulsar la competitividad de México, OECD Publishing, Paris.
[4] OECD (2012), Recommendation of the Council on Regulatory Policy and Governance, OECD, http://www.oecd.org/regreform (accessed on 9 January 2023).
[9] PRESIDENTA DE LA REPÚBLICA (2013), Crea Sistema Nacional de Información Territorial (SNIT) N° 37773-JP-H-MINAE-MICITT, http://www.pgrweb.go.cr/scij/Busqueda/Normativa/Normas/nrm_texto_completo.aspx?param1=N%20RTC&nValor1=1&nValor2=75234&nValor3=93225&strTipM=TC (accessed on 7 March 2024).
[10] PRESIDENTE DE LA REPÚBLICA and MINISTRA DE JUSTICIA Y PAZ (2019), Creación de la Infraestructura de datos espaciales de Costa Rica, https://www.pgrweb.go.cr/scij/Busqueda/Normativa/Normas/nrm_texto_completo.aspx?param1=%20NRTC&nValor1=1&nValor2=90558&nValor3=0&strTipM=TC (accessed on 7 March 2024).
[13] PRESIDENTE DE LA REPÚBLICA and MINISTRO DE CIENCIA Y TECNOLOGÍA (2006), Reforma Reglamento a la Ley de Certificados, Firmas Digitales y Documentos Electrónicos, Decreto Ejecutivo N° 33018-MICIT, del 20 de marzo de 2006 publicado en el Diario Oficial La Gaceta Nº 77 del 21 de abril de 2006, http://www.pgrweb.go.cr/scij/Busqueda/Normativa/Normas/nrm_texto_completo.aspx?param1=NRTC&nValor1=1&nValor2=64418&nValor3=74724&strTipM=TC (accessed on 8 March 2024).
[2] Ventanilla Única de Inversión (2024), Procesos y trámites, https://vui.cr/tramite/ (accessed on 5 February 2024).
← 1. Includes work with the national governments of Argentina, Mexico and Peru, as well as with regional and local governments in Mexico and Argentina.