Custodial wallet / SaaS in Panama

Custodial license requirements for digital assets.

Segregation of client assets rules for digital assets.

Insurance or bonding requirements for digital asset custodians.

Cold storage mandates for digital asset custodians.

A formal definition of "qualified custodian" for digital assets.

Anti-Money Laundering (AML) and Combating the Financing of Terrorism (CFT) Laws:

Law 23 of 2015 (Ley 23 de 2015): This law adopts measures to prevent money laundering, terrorist financing, and the proliferation of weapons of mass destruction. While it doesn't explicitly mention "digital asset custody," financial institutions and Designated Non-Financial Businesses and Professions (DNFBPs) are subject to its requirements. If a crypto business falls under the scope of a DNFBP (e.g., as a money remitter, trust provider, or even a general financial service provider handling significant value transfers), it would need to comply with KYC (Know Your Customer), transaction monitoring, and suspicious activity reporting requirements.

Unidad de Análisis Financiero (UAF - Financial Analysis Unit): This is Panama's Financial Intelligence Unit (FIU) responsible for receiving, analyzing, and disseminating suspicious transaction reports. Any crypto entity engaging in activities that might be considered financial services or value transfers could fall under UAF scrutiny for AML/CFT purposes.

Bill 697 / Law 173 (Proyecto de Ley No. 697 / Ley 173): This bill aimed to regulate the commercialization, use, and issuance of digital assets and create a framework for their recognition, custody, and tokenization. It specifically included provisions for:

Licensing: Establishing a licensing regime for virtual asset service providers (VASPs), which would likely include custodians.

Operational Requirements: Laying out rules for operational security, consumer protection, and potentially aspects like asset segregation.

AML/CFT Integration: Explicitly integrating digital asset businesses into the existing AML/CFT framework.

Regulatory Oversight: Designating regulatory bodies for different aspects of digital assets.

Status: Partially Vetoed: The bill passed the National Assembly in April 2022. However, President Laurentino Cortizo partially vetoed it in June 2022.

Reasons for Veto: The President cited concerns about the bill's lack of alignment with FATF recommendations regarding AML/CFT, potential risks to the financial system, and the need for more robust regulatory oversight and technical clarity. He argued that it did not sufficiently protect the national financial system and investors from money laundering and other illicit activities.

Current Status: The bill was returned to the National Assembly for reconsideration of the vetoed articles. As of now, it remains in legislative limbo, meaning the comprehensive framework it proposed, including specific custody regulations, is not currently in force.

No Crypto-Specific Licensing Regime: As of late 2023 / early 2024, there is no specific "virtual asset license" in Panama issued by a dedicated crypto regulator.

General Business Registration: Any company wishing to operate in Panama, including those involved in virtual assets, must still:

Be incorporated under Panamanian law (Public Registry).

Obtain a business license ("Aviso de Operación") from the Ministry of Commerce and Industries.

Comply with general tax and labor laws.

Primary Relevance: This is the most likely regulator to assert jurisdiction over virtual asset activities, mainly for AML/CFT compliance. Panama is a member of the Financial Action Task Force (FATF) and is committed to implementing its recommendations, which include regulating VASPs for AML/CFT purposes.

Applicability: Exchanges, custody providers, and payment processors dealing with virtual assets are highly likely to be considered "Designated Non-Financial Businesses and Professions" (DNFBPs) or fall under an extended interpretation of "financial activities" for AML purposes.

Requirement: While not a "license," these entities would need to register with the SSNF for AML/CFT oversight and comply with all associated requirements.

Regulatory Reference: Law 23 of 2015 (Ley 23 de 2015, que adopta medidas para prevenir el blanqueo de capitales, el financiamiento del terrorismo y el financiamiento de la proliferación de armas de destrucción masiva). This law designates certain entities as "obligated subjects" (sujetos obligados) for AML/CFT purposes. While it doesn't explicitly name "VASPs," its broad scope and subsequent interpretations can cover them.

Relevance: If the virtual asset is deemed a "security" under Panamanian law, then the SMV would have jurisdiction. This is a crucial distinction.

Applicability: Projects issuing tokens that represent ownership, a right to profit, or other characteristics of traditional securities would fall under the SMV's purview. Exchanges listing such tokens, or custody providers holding them, would then need to comply with securities regulations.

Requirement: A license as a broker-dealer, investment adviser, or other regulated entity under securities law might be required, depending on the specific service.

Regulatory Reference: Law Decree 1 of 1999 (Decreto Ley 1 de 1999, por el cual se reorganiza el mercado de valores en la República de Panamá).

Relevance: Less likely to directly regulate pure crypto activities unless they involve fiat currency in a way that resembles traditional banking or payment services.

Applicability: If an exchange, custody provider, or payment processor holds significant fiat balances for clients, offers fiat-to-crypto conversion with a "trust" element, or provides services that closely mimic those of licensed financial institutions (e.g., issuing payment instruments that are essentially fiat-backed digital money), the SBP might assert jurisdiction. This is a high bar, as the SBP primarily regulates licensed banks and financial groups.

Requirement: A banking license or a license as a specific type of financial institution would be required, which is highly stringent.

Regulatory Reference: Law Decree 2 of 2008 (Decreto Ley No. 2 de 2008, que regula la actividad bancaria en Panamá).

No specific crypto VASP capital requirements.

General corporate capitalization requirements apply for company formation.

If classified under securities or banking laws, significant capital requirements would apply (e.g., millions for a bank, hundreds of thousands for certain securities brokers).

Law 23 of April 27, 2015 (Ley 23 de 27 de abril de 2015): This is the foundational AML/CFT law in Panama. It adopted measures to prevent money laundering, financing of terrorism, and financing of the proliferation of weapons of mass destruction. It established the Financial Analysis Unit (UAF) and defined "obligated subjects" (sujetos obligados), which, through subsequent interpretations and amendments, have come to include VASPs. This law sets general obligations for customer due diligence, suspicious transaction reporting, and record-keeping.

Executive Decree 44 of April 15, 2016 (Decreto Ejecutivo N° 44 de 15 de abril de 2016): This decree complements Law 23, providing detailed regulations for its application, including specific procedures for due diligence, risk assessment, and internal controls for obligated subjects.

Law 1 of January 5, 2024 (Ley No. 1 de 5 de enero de 2024): This is the most crucial and recent piece of legislation specifically for virtual assets. It amends Law 23 of 2015 and other related laws to define virtual assets and virtual asset service providers (VASPs), establish a licensing and supervision regime, and explicitly subject VASPs to AML/CFT obligations under the supervision of the Superintendency of Banks of Panama (SBP). This law ensures Panama's compliance with FATF Recommendation 15 on new technologies and VASPs.

Superintendencia de Bancos de Panamá (SBP) - Superintendency of Banks of Panama:

Role: With the enactment of Law 1 of 2024, the SBP is now the primary regulatory and supervisory authority responsible for the licensing, authorization, and oversight of VASPs in Panama. This includes ensuring their compliance with AML/CFT requirements, operational standards, and consumer protection.

Unidad de Análisis Financiero (UAF) - Financial Analysis Unit of Panama:

Role: The UAF is Panama's Financial Intelligence Unit (FIU). It is responsible for receiving, analyzing, and disseminating suspicious transaction reports (STRs) and other relevant financial intelligence to combat money laundering, terrorism financing, and the financing of the proliferation of weapons of mass destruction. VASPs, as obligated subjects, must report suspicious activities directly to the UAF.

Identification and Verification:

For Individuals: Obtaining and verifying the identity of the customer and beneficial owner (if different from the customer) using reliable, independent source documents, data, or information (e.g., government-issued ID, passport, proof of address).

For Legal Entities/Arrangements: Obtaining and verifying the legal name, legal form, proof of existence, powers that regulate and bind the entity, names of relevant persons (directors, partners), and the identity of beneficial owners (those ultimately owning or controlling more than a specified percentage, typically 10% or 25%).

Understanding the Purpose and Nature of the Business Relationship: Gathering information on the customer's financial activities, expected transaction types, and the source of funds/wealth.

Ongoing Monitoring: Continuously monitoring the business relationship and transactions to ensure consistency with the VASP's knowledge of the customer, their business, and risk profile. This includes scrutinizing complex, unusual large transactions, and all unusual patterns of transactions that have no apparent economic or lawful purpose.

Enhanced Due Diligence (EDD): Applying EDD measures for high-risk customers, business relationships, or transactions, which include:

Politically Exposed Persons (PEPs) and their family members and close associates.

Customers from high-risk jurisdictions identified by FATF or local authorities.

Transactions involving new or developing technologies that might favor anonymity.

High-value or complex transactions.

Obtaining additional information on the customer, beneficial owner, source of funds/wealth, and reasons for intended transactions.

Obtaining senior management approval for establishing or continuing high-risk relationships.

Increased frequency of monitoring.

Simplified Due Diligence (SDD): Permitted in clearly defined low-risk scenarios, provided there is sufficient information to justify such an approach.

Obligation to Report: VASPs are legally obligated to report any suspicious transaction or activity to the UAF, regardless of the amount. A transaction is suspicious if the VASP has reasonable grounds to suspect that it may be related to money laundering, terrorism financing, or other illicit activities.

No Tipping-Off: VASPs, their employees, and officers are prohibited from disclosing to the customer or any third party that an STR has been or will be submitted.

Content of Report: STRs must include all relevant information available to the VASP, such as customer identification details, transaction specifics, and the grounds for suspicion.

Duration: Records must typically be kept for at least five (5) years after the business relationship has ended or after the date of the transaction.

Evolving Regulatory Framework: Panama has been discussing comprehensive cryptocurrency regulation, most notably with Bill 697, which was partially vetoed in 2022. This lack of a clear, dedicated crypto legal framework means that enforcement would likely fall under existing general financial laws (e.g., anti-money laundering, fraud), making it harder to categorize specifically as "crypto enforcement."

Focus on AML/CFT: Panama was on the FATF grey list until October 2023, which heavily emphasized improving its Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) regime. While this pressure indirectly affects crypto (as it's a known vector for financial crime), direct, high-profile enforcement actions against crypto entities with specific fines haven't been widely publicized as a result.

Regulator Name: Superintendencia de Bancos de Panamá (SBP) - Banking Superintendent of Panama

SBP Circulars and Statements on Crypto Risks:

The SBP has repeatedly issued statements clarifying that cryptocurrencies are not legal tender in Panama, are not regulated by the SBP, and entities under its supervision (banks) should exercise extreme caution and assess risks related to crypto assets. They have warned against financial institutions engaging in crypto activities without proper risk management and adherence to existing AML/CFT regulations.

Failed Cryptocurrency Law (Bill 697):

In 2022, Panama's National Assembly approved Bill 697, which aimed to regulate crypto assets. However, President Laurentino Cortizo partially vetoed it, citing concerns about its AML/CFT provisions and the need for more robust regulation under the existing framework. This highlights the government's struggle to establish a clear regulatory path, which precedes significant enforcement.