Crypto License in Panama

As a rule, strict AML/KYC requirements are imposed in Panama, especially in the context of banks’ expectations and FATF international standards for companies with certain types of activities. First and foremost, these are:

• crypto exchanges and exchangers (crypto-fiat and crypto-crypto);
• custodial wallets and services that store private keys;
• crypto processing and payment gateways;
• OTC platforms and large transaction processing services;
• token launch platforms, if operations are performed by the project operator;
• ecosystems where token movement is controlled by the platform;
• services that perform actions with assets on behalf of the user;
• custodial staking, where assets are managed by a company;
• gaming and digital systems with internal values that are processed through the project’s infrastructure.

The following are not subject to regulation:

• software developers without access to client assets;
• companies providing consulting and technical support without conducting transactions;
• mining projects;
• non-custodial staking, where users have full control over their assets.

Panama does not issue separate “exchange / wallet / ICO licences” as standalone permits. Instead, projects choose an operating model and build an AML/CTF and governance setup that satisfies counterparties (banks/EMIs) and applies relevant general laws.

Model: Crypto exchange (crypto-fiat / crypto-crypto)

What matters in practice:

• AML/CTF programme (KYC/KYT, sanctions screening, STR workflows);
• custody and settlement controls (who holds keys, how withdrawals are approved);
• security controls and incident response;
• clear Terms of Service, Risk Disclosure, and complaints handling.

Model: Custodial wallet / custody services

What matters in practice:

• segregation logic and access controls;
• recovery procedures and audit trails;
• enhanced due diligence for high-risk users and large flows.

Model: Payments / processing / OTC

What matters in practice:

• source of funds/source of wealth checks for higher-risk flows;
• transaction monitoring rules and escalation;
• alignment with bank/EMI onboarding requirements.

Model: Token issuance (utility / platform tokens)

What matters in practice:

• token description, allocation, and disclosure pack;
• AML controls for primary distribution;
• legal classification review where tokens may resemble securities features (case-by-case).

A company that plans to work with digital assets in Panama must comply with a number of corporate and operational conditions. Below are the requirements confirmed by current legislation and the current practices of banks, providers, and corporate services.

• Establishment of a legal entity in the form of an S.A. The Sociedad Anónima corporation is used as the basic structure for crypto services because it is suitable for international operations and flexible distribution of roles.

• Three directors. Panamanian law requires a minimum of three directors: President, Secretary, and Treasurer. Directors may be non-residents.

• Appointment of a Registered Agent. Each company must have a local agent who maintains corporate records and interacts with registration authorities.

• Registration with the Public Registry and obtaining a RUC. After submitting the incorporation documents, the company becomes a legal entity and receives a RUC tax identification number, which is required for contracts and financial transactions.

• Obtaining a Licencia Comercial. To conduct commercial activities, an Aviso de Operación / Licencia Comercial is issued through MICI — this is a basic permit confirming the company’s right to operate in Panama.

• Publication of mandatory information on the website. The company must post its commercial name, legal address, contact details, domain name, Terms of Use, and Privacy Policy on its corporate website.

• Preparation of a three-year business plan. A three-year plan is drawn up describing the services, business model, company structure, financial forecasts, and risk management approaches. The document is used by banks and fintech providers during onboarding.

• Collection of corporate and personal data. Notarized passports of directors and shareholders, proof of address, resumes, criminal record certificates, and ownership structure are prepared.

• Proof of financial stability. The law does not set a minimum capital requirement, but banks and providers require confirmation of available funds, usually between USD 10,000 and USD 50,000.

• AML/CTF compliance of the company. The organization implements internal AML/KYC procedures, Customer Due Diligence mechanisms, suspicious transaction monitoring, and UBO identification policies in accordance with UAF and SSNF requirements.

• Description of technological infrastructure. Companies may request a technical description of IT architecture, security measures, and internal control systems, especially when opening corporate accounts and connecting fintech platforms.

At this stage, a package of corporate and compliance documents is formed, which allows you to confirm the legality of your activities and compliance with financial monitoring requirements.

The following are usually required:

• Passports or IDs of directors and shareholders. Notarized copies for the corporate registry and AML procedures.
• Proof of address. Utility bill or bank statement issued within the last 90 days.
• Due diligence form. Contains information about the company, controlling persons, and source of funds.
• Business plan. A clear description of the business model, market, monetization, and financial projections.
• Description of crypto activities.  List of services (exchange, wallets, processing, tokenization, etc.) with an explanation of how the company will comply with AML controls and internal procedures.

Panama remains a jurisdiction where digital asset activities are regulated through corporate law and strict AML/CFT requirements. There is no separate cryptocurrency law yet, and companies operate within the framework of existing regulations, including Law No. 129.
In 2025–2026, discussions on the future regulatory model for VASPs continue, but the specific bill, previously referred to as Bill 247/697, is not under active consideration in its previous form, as it was partially rejected and returned for revision by the president. The authorities are working on an updated initiative, but there are no final texts yet.

Key supervisory authorities

UAF (Unidad de Análisis Financiero)

The main financial monitoring authority that receives STR reports and monitors AML/CFT compliance.

SSNF (Superintendencia de Sujetos No Financieros)

The main supervisory authority for non-financial entities, including companies providing services related to digital assets. It monitors the implementation and enforcement of AML procedures, internal risk assessment, KYC, and COMPLIANCE.

SBP (Superintendencia de Bancos de Panamá)

Becomes involved if the model includes elements of financial intermediation or working with client assets.

SMV (Superintendencia del Mercado de Valores)

Regulates projects in which tokens may have characteristics of securities.

MICI (Ministry of Commerce and Industry)

Responsible for corporate registration and issuing the Aviso de Operación.

It can be concluded that Panama remains a jurisdiction where digital asset activities are possible without a separate crypto license.

Companies launch services through standard corporate structures and mandatory AML/KYC procedures, which makes market entry easier compared to strict licensing regimes.

This approach reduces legal barriers and allows for a faster start to operations, while maintaining the financial oversight requirements that apply to all virtual asset service providers.

Bill 247 (draft) is a proposed framework to clarify crypto-asset activity and compliance expend alone “VASP license” regime in force as of 2026. In practice, Panama remains a low-friction jurisdiction where the key constraint is AML/CTF readiness (UAF guidance and supervised-entity expectations). Panama has also taken steps toward international tax transparency under the OECD Crypto-Asset Reporting Framework (CARF), including signing the CARF-MCAA (02-12-2025). The operational trend for 2026 is not “new licensing”, but tighter onboarding standards from banks/EMIs and higher evidence requirements on source of funds, KYT, and sanctions controls.

In 2026, Panama will continue to adhere to the territorial principle and does not plan to introduce special taxes on digital asset transactions. The focus will remain on strengthening AML controls rather than changing rates. Possible adjustments may affect reporting and requirements.