The evolution of the fintech market in Panama has been constant and disruptive of traditional models of financing. The market continues to be interested in the country's strategic position, stability, and diversity. Regrettably, the natural evolution of the local market has not been accompanied by the necessary legal framework in many cases. Nonetheless, different business models are pursued through approaches. Regardless of the current grey area regulatory situation, with the local regulatory bodies and compliance with the applicable laws or even compliance with what is understood to be applicable regulation in the near future.

In the next year, we hope to see regulatory bodies' interest in regulation and the continued growth of international and local players, especially from the perspective of developing or including artificial intelligence in their business models. In that regard, it is worth mentioning that there have already been attempts to regulate, develop, and promote the use of artificial intelligence at the Legislative Branch level.

Even though the fintech landscape is constantly evolving, Panama’s new and legacy players have currently concentrated on a few specific business models, as follows.

Payment Service Providers (PSPs)

These companies offer digital payment processing services, such as peer-to-peer, merchant services, or cross-border transactions. Generally, these companies offer technological integrations or standalone platforms that ultimately facilitate payments in a prompt and secure manner.

Cryptocurrency Exchanges

Legacy players typically do not engage in this business model because there is currently a lack of formal regulation. In contrast, new entrants are entering this space and providing these services. Some of these new players offer a wide range of services similar to those of established cryptocurrency exchanges (including custody of fiat and/or cryptocurrency, trading, and leverage), while others focus solely on the exchange of fiat and/or cryptocurrency.

Digital Wallets

Due to the lack of regulation regarding digital wallets, legacy players have been able to use their banking licences to provide digital wallets within their respective ecosystems. New players have mostly avoided this business model due to the potential liabilities derived from infringing the current deposit-taking regulations.

Digital Lending Platforms

Several fintech startups are focused on digital lending models, using data to assess creditworthiness for (mostly) personal loans. These platforms offer digital approval processes, with quick disbursements and smaller loans, filling the gap left by traditional lending institutions, which often have strict requirements.

Panama has a unified regulatory regime, meaning there is no distinction between state and federal regulation. Industry participants can be subject to one or more of the following three verticals that compose the regulatory regime.

Banking

The main legal source for this vertical is Executive Decree 52 of 2008 (the Single Text of the Banking Law (the “Banking Law”)), and the sector is supervised and regulated by the Superintendency of Banks (the “SBP”). The SBP oversees banks, trust companies, and exchange houses; thus, any business model that carries out activities within the referred scope will be subject to either registration or licensing requirements from the SBP.

Securities

The main legal source for this vertical is Decree Law 1 of 1999 on the Securities Market in the Republic of Panama and the Superintendence of the Securities Market (the “Securities Law”). The sector is supervised and regulated by the Superintendency of the Securities Market (the “SMV”), which oversees brokerage houses, investment advisers, stock exchanges, fund administrators, clearing houses, and credit rating agencies, among others. Thus, any business model that carries out activities within the referred scope will be subject to licensing requirements from the SMV. Additionally, the SMV supervises issuers and the registration of public offerings of securities.

Financial Companies

This vertical, which encompasses lending companies, pawn shops, money remittance houses, and movable goods leasing companies, has various legal sources. It is supervised and regulated by the Directorate of Financial Companies attached to the Ministry of Commerce and Industry (“MICI”). Lending companies are entities that engage in lending activities without deposit-taking activities.

As stated above, depending on the scope of the business model, a company may be subject to one or more of the regulations detailed above.

Companies normally charge their customers directly, having clearly communicated pricing and payment terms. However, depending on the specific business model and the regulatory vertical in which the company operates, there may be additional standards or specific information that must be included in the disclosures. For example:

• whenever a brokerage house has a conflict of interest, a separate and independent disclosure must be made to the customer; and
• lending companies must include specific information (interest, term, number of payments, etc) in their contracts.

In general, local law requires companies to provide full disclosure to their clients regarding the compensation models of their business. Furthermore, whenever a specific service is devoid of a legal framework in Panama, it is advisable that end customers be informed that all transactions carried out are at their own risk and are not regulated by the SMV or SBP for local purposes. 

Currently, the regulations applicable to fintech industry participants do not differ from those applicable to legacy players. This is due to Panama’s regulatory framework’s lack of formal recognition of newer business models and more innovative enterprises. In other words, the regulatory landscape has not caught up with the emergence of fintech. Local laws and regulations have been made and implemented around traditional financial institutions, and these regulations do not yet include more flexible parameters or simplified licensing requirements for fintech companies.

There is currently no regulatory sandbox available for fintech companies. Regulators are aware of the lack of specific regulations relating to certain fintech companies, and depending on the business model, they try to accommodate fintech companies within the existing legal framework. However, they are ultimately limited by the lack of regulations, and in many cases, they simply state that the fintech company is not subject to their supervision.

The regulatory scope of each of the three main financial sector regulators is based on the activities conducted by a company, as outlined in section 2.2 Regulatory Regime. For instance, if a company is involved in public lending and issuing securities, it will need to interact with both the MICI and the SMV. Therefore, it is essential for companies to clearly define the specific services they will offer and to obtain the necessary registrations and licenses.

In Panama, regulatory authorities do not formally issue “no-action”  letters, as is commonly understood in jurisdictions like the United States. However, entities can request an opinion to seek regulatory guidance or clarification before undertaking activities.

The Superintendencies (SBP and SMV) issue opinions ex officio or upon request, expressing the respective Superintendency's administrative position regarding the law's application. The opinions issued by the Superintendencies are limited to expressing the administrative position regarding the application of a specific provision of the applicable laws and regulations but may not contravene resolutions approved by the Board of Directors of the respective Superintendency or the Judiciary on the same subject. The opinions in the case of the SMV, and according to its regulation, are binding. However, in the case of the SBP, it is not expressly regulated, therefore:

• the SBP can specify that they are of general application and binding for the specific consultations presented; and
• the SBP can specify that they are non-binding without specifying a particular case.

Depending on the nature of the regulated function, it may or may not be allowed to be outsourced. Whenever local regulations allow for outsourcing, they generally state the requirements that the vendor must meet or state whether said outsourcing is subject to notification or prior approval from the regulator. The vendor is generally responsible to the party contracting the outsourcing, but engaging in outsourcing does not exclude the contracting party from its obligations and responsibilities to the regulator. The outsourcing of regulated functions should be assessed individually for each case. For instance, SBP Agreement 9 of 2005 defines “outsourcing” as the practice in which licensed banks engage third parties – either individuals or legal entities, including companies within the bank’s economic group – to perform activities, functions, or processes that fall within the scope of their legal operations. Banks must seek prior authorisation from the SBP for all outsourcing agreements not exempt under SBP Agreement 9 of 2005.

Panama has issued several laws and regulations relating to anti-money laundering (AML) matters. In this sense, financially obliged subjects are responsible for monitoring and examining the activities carried out on their platforms or servers. However, this responsibility stems from being a regulated financial subject and not from being categorised as a “gatekeeper”. At present, there is no formal categorisation of a company as a “gatekeeper”.       

The three main verticals and their respective regulators share similar enforcement actions. The applicable regulator has the faculty to impose penalties based on the evaluation criteria determined by the corresponding legal source. Generally, the legal source determines which actions and/or omissions are defined as very serious infractions or lesser infractions. Depending on the extent of the infraction, sanctions can include monetary fines, loss of licences or registration to carry out the activities, suspension of activities, removal of personnel from the position of administration or control, or other measures as mandated by the applicable law.

As mentioned before, there are no distinctions between legacy players and fintech companies. In general terms, however, there are a few applicable non-financial service regulations.

The Electronic Commerce Law

In Panama, electronic commerce is regulated by Law 51 of 22 July 2008, as amended to date (the “Electronic Commerce Law”), which applies to businesses that work through the internet and are offered in Panama. The Electronic Commerce Law relates mainly to electronic contracts and the conditions relating to the validity and effectiveness of said contracts and establishes the obligations and responsibilities of providers of commercial services through the internet, including those who act as intermediaries in the transmission of content by social media networks and the exchange of commercial information and documentation electronically, including offers, promotions and contests.

The Data Protection Regulation

Law 81 of 2019, regulated by Executive Decree 285 of 2021 (the “Data Protection Regulation”), regulates the protection of personal data of natural persons and its handling, storage, and treatment. The Data Protection Regulation applies to data processing that originates or is stored in Panama and data processing carried out within the framework of a commercial activity on the internet, or any other means of electronic or digital communication in accordance with the Electronic Commerce Law to guarantee data protection in activities aimed at the Panamanian market.

Whenever a person or entity obtains its users’ personal data, it must implement a privacy policy that respects the “ARCO rights” enshrined in the Data Protection Regulation. Such a person or entity must also obtain the necessary consent from its users for the collection, use, and processing of their personal data, in addition to complying with the requirements in case of transfer of said personal data to third parties (local or cross-border).

Law 45

Law 45 of 2007 (“Law 45”), which dictates regulations on consumer protection and defence of competition, is also applicable to financial service providers. In general, Law 45 implements standards for providing information clearly, truthfully and without inducing confusion. For example, credit products must expressly and visibly indicate the total amount of the debt, the effective interest rate applied and its calculation method, the commissions, and the natural or legal person providing the credit.

Assuming that industry participants have some kind of registration or licensing, they will generally be required to obtain audited financial statements from auditing firms and present them to the regulators, along with other information.       

Industry participants generally do not offer unregulated products and services in conjunction with regulated ones. However, different legal entities within the same economic group can offer regulated and unregulated products separately, and regulators have not opposed this practice. In any case, this must be evaluated on a case-by-case basis to determine the regulator’s possible interpretation.       

Anti-money laundering (“AML”) rules impact fintech companies because the regulation does not distinguish between established legacy players and fintech companies. Thus, the obligations and responsibilities will be the same across the board except for specific vertical regulations.       

Law 23 of 2015 (“Law 23”) adopts measures to prevent money laundering, the financing of terrorism and the financing of the proliferation of weapons of mass destruction and dictates other provisions which are further regulated by Executive Decree 363 of 2015 (“Regulation of Law 23”). Article 22 of Law 23 lists the financially obliged subjects, which the SBP supervises in matters of compliance with Law 23, the Regulation of Law 23, and other corresponding agreements related to the prevention of money laundering, financing of terrorism and financing of the proliferation of weapons of mass destruction (the “Compliance Laws”). The Compliance Laws establish a series of measures that financial obliged subjects must implement to prevent the improper use of their services.

It is worth noting that it is possible for an entity to be subject to the Compliance Laws but not subject to licensing requirements. For example, entities dedicated to payment processing services and issuers of electronic money are financially obliged subjects and must register with the SBP in order to comply with the Compliance Laws, but they are not required to obtain a licence for their activities. Thus, a fintech company may not be required to have a licence from any of the regulators, but it could be subject to registration requirements with the SBP only for the purposes of the Compliance Laws.

Law 23 establishes a regime of administrative sanctions for those who violate its provisions. The supervisory bodies will apply sanctions considering the seriousness of the offence, its recurrence, and the damage caused. Sanctions may include fines of between USD5,000 and USD5 million, which may be imposed on individuals and entities that fail to comply. In addition, progressive sanctions are provided for continuous violations, and corporate responsibility is established, attributing the acts of employees to the obliged entity.       

Panama’s Compliance Laws are generally aligned with the standards  of the Financial Action Task Force (FATF). Since the enactment of Law 23 in 2015, Panama has been actively taking significant steps to comply with FATF recommendations. However, its progress and effectiveness have been subject to periodic scrutiny by the FATF.       

Local regulation does not explicitly permit reverse solicitation, albeit it does often apply to operations carried out in or from Panama. Under that premise, when a Panamanian customer independently approaches a foreign provider to access a regulated product or service, the provision of said foreign product or service would not be caught by local regulation. It is very important that the foreign provider does not carry out any prior marketing, solicitation, or advertisement directed at the Panamanian market.

As mentioned previously, Panama does not have a special regulatory framework for companies in the fintech industry, including robo-advisers. Therefore, there are no regulations or requirements for robo-advisers besides the applicable AML legislation (Law 23) and the Data Protection Regulation. SMV regulates “investment advisers,” defined as individuals or entities that, for compensation, provide advice to others on the pricing of securities or the suitability of investing, buying, or selling those securities. This includes preparing and publishing studies or reports related to securities, as well as advising on forex. These regulations apply to both individuals and companies, along with their employees, that offer investment advisory services to clients. However, there is currently no clear guidance on whether these regulations also extend to robo-advisers.

Legacy players in Panama have not developed or are only beginning to develop robo-adviser services for their clients. However, it is only a matter of time before all legacy players will offer these services to their clients since there is a trend in Panama for legacy players to create and implement fintech products and services based on modernisation and the current changing dynamic of services offered to a new wave of clients that want to leverage technology for their financial services.

Panama has no special regulations regarding the best execution of customer trades. However, some securities laws applicable to brokers establish that the individuals who carry out broker services have an obligation to perform their duties with the diligence and care that a person uses in their business. Brokers must carry out their duties with strict adherence to ethical principles, good conduct, and transparency.

There are no significant differences in the business or regulation of loans to individuals, small businesses, and other entities. The regulation of loan activities is based on the use of the funds rather than the recipients of the loans. Entities that extend loans fall into two categories: licensed banks or financial companies (empresas financieras). Licensed banks are regulated by Executive Decree 52 of 2008 – the Single Text of the Banking Law (as amended, the “Banking Law”), while financial companies are governed by Law 42 of 2001 (as amended, the “Financial Companies’ Law”). An entity is regulated under the Banking Law if it raises funds from the general public (through deposits or other means) and uses those funds to extend loans to third parties. Conversely, an entity is regulated under the Financial Companies’ Law if it uses its own funds to extend loans to third parties.

Both licensed banks and financial companies evaluate a potential client’s creditworthiness through the Asociación Panameña de Crédito (APC), a tool used to assess an individual’s credit rating and accurately determine the associated loan risk. Additionally, licensed banks are legally mandated to establish credit and risk committees. These committees are responsible for assessing and approving (or rejecting) loans based on the borrower’s profile and the transaction’s credit risk.

In Panama, companies can raise funds from various sources, including loans or equity investments from peers or private equity firms, loans from banks and financial companies, and private or public securities offerings. Lending between peers or by private equity firms does not require licenses or permits, provided these activities do not fall under the definition of “banking business” as defined and regulated by the Banking Law and are not conducted in the ordinary course of business by the lending party. If lending to third parties becomes habitual and part of the ordinary course of business, the entity would be classified as a financial company under the Financial Companies’ Law and require a license from the Ministry of Commerce and Industry.

Equity fundraising may be regulated depending on the target audience. In Panama, public securities offerings are governed by the Securities Law and Agreement No. 2-2010 (as amended) issued by the SMV.

Under the Securities Law, public offerings of securities must be registered with the Superintendence when the offer or sale is made by an issuer, an affiliate of the issuer, or an offeror of the issuer or its affiliate in the Republic of Panama. An offer or sale of securities is considered to have been made in Panama if it is directed to individuals domiciled in Panama, regardless of whether the offer or sale originated from within Panama or abroad. All securities subject to a public offering, except those exempt from registration with the SMV, require authorisation from the SMV.

A registration application and a prospectus regarding the offering must be submitted for approval to the SMV.

Exemptions under the Securities Laws include:

• (i) sales or offers of securities to persons domiciled outside the Republic of Panama;
• (ii) sales or offers of securities made by an issuer, an affiliate of the issuer, or an offeror of the issuer or its affiliate to no more than 25 persons, resulting in the sale of said securities to no more than ten persons within one year; and
• (iii) sales or offers of securities made by an issuer, an affiliate of the issuer, or an offeror of the issuer or its affiliate to institutional investors (as defined by Agreement 1-2001 issued by the SMV, as amended).

It is important to note that while the exemption in (iii) does not require registration, certain formalities must be observed in accordance with Agreement 1-2001 issued by the SMV, such as notifying (as opposed to registering) the SMV of the offering.

Loan syndication frequently occurs in Panama; however, there are no specific laws or regulations regarding it.

In general terms, payment processors use existing payment rails and create or implement new ones to the extent they relate to new technologies such as blockchain.

Cross-border payments and remittances are regulated from the perspective of tax implications, regulated banks and AML/CFT standards.

The Securities Law mandates that trading platforms for securities and other financial instruments must be regulated by the SMV and require a license issued by this entity. The law defines “securities” as “[a]ny bond, negotiable commercial instrument, or other debt security, stock (including treasury stock), recognised stock right in a custody account, share, participation unit, participation certificate, securitisation certificate, trustee certificate, deposit certificate, mortgage certificate, option, and any other security, instrument, or right commonly recognised as a security or determined by the [SMV] to constitute a security.” Conversely, “financial instruments” are defined as “[a]ny contract that gives rise to the creation of a financial asset for one entity and the creation of a financial liability or equity instrument for another entity.” This includes all financial assets and liabilities, whether securitised or not, as well as their derivatives, with underlying assets such as currencies and precious metals. The Securities Law classifies securities trading platforms as “self-regulated entities.” These platforms must establish internal rules and regulations based on the following principles:

• protecting the interests of investors;
• promoting cooperation and coordination among individuals responsible for processing information about securities, as well as for trading, safeguarding, clearing, and settling securities;
• ensuring fair and representative participation of members in governing bodies;
• ensuring that fees and expenses paid by members are reasonable and equitably shared;
• reporting any violations of the Securities Law by members, directors, officials, or employees to the SMV;
• monitoring members, directors, officials, and employees to ensure compliance with internal rules, and establishing corresponding disciplinary procedures and sanctions;
• ensuring the confidentiality of transactions; and
• preventing deceptive and manipulative practices or any actions that may affect market transparency, promoting fair practices in securities trading and fostering the development of an efficient market.

Commodities Trading Platforms

Panama also permits commodities trading platforms under Law 23 of 1997 (as amended) and Executive Decree 11 of 1998 (as amended). The National Commission of Commodities Exchange regulates these platforms and requires a licence to operate. Brokers also need a special license to trade commodities within these platforms. Panama has one commodity trading platform, the Bolsa Nacional de Productos, S.A. (“BAISA”). Products that can be traded on commodities exchanges include any goods, services, and products, whether domestic or foreign, and contracts or commercial documents that represent, establish, or grant rights over these goods, services, or products.

Securities and financial instruments are regulated by the Securities Law and the Superintendency of the Securities Market (SMV). In contrast, commodities are regulated by Law 23 of 1997 (as amended from time to time) and Executive Decree 11 of 1998 (as amended from time to time). Currently, Panama does not regulate security tokens and cryptocurrencies.

No specific laws or regulations govern the issuance or transaction of virtual assets in Panama. An attempt was made to legislate this matter through Bill 697 of 2022, which ultimately did not become law.

Nevertheless, the emergence of cryptocurrency exchanges has forced the regulators to issue statements and, in certain cases, analyse whether they have jurisdiction over cryptocurrencies. For example, the Superintendency of the Securities Market (SMV) has issued public statements indicating that cryptocurrencies are not considered “securities” and, therefore, are not regulated by the SMV. The SMV has also warned the public about the risks associated with cryptocurrencies, noting that, in their view, cryptocurrencies:

• lack a legal framework and are not subject to supervision or regulation by any financial regulatory authority in the Republic of Panama;
• have no inherent value, being intangible, and their circulation occurs via the internet;
• do not have the approval or regulation of a central authority;
• are vulnerable to money laundering;
• are highly volatile and speculative assets; and
• involve a high risk of fraud.

Furthermore, the SMV has stated that it does not have the legal authority to regulate or supervise crypto-exchange platforms. It has advised that to secure their investments, rights, and obligations, entities creating and operating these platforms should limit their liability by prioritising transparency and informing investors or “users” that cryptocurrencies are not regulated.

There are no regulatory listing standards.

For registered securities and financial instruments, industry practices indicate that public offerings totalling less than USD 12 million are uncommon. Specifically, for bonds, Rule 2-2010 issued by the SMV mandates that the duration of revolving bond programs must not exceed ten years. This does not imply that the maturity of bonds issued under a revolving program cannot extend beyond ten years from the issuance date; rather, the availability of the program, under which the issuer can issue bonds, cannot last more than ten years.

Regarding securities trades on an organised exchange, Rule 5-2003 issued by the SMV, which regulates order handling, mandates that brokerage firms require their clients to issue orders that are clear and precise in scope and meaning, ensuring both the issuer and recipient fully understand their effects. Orders placed over the phone may be recorded with prior client authorisation. Entities receiving orders must execute them or take necessary measures to deliver them to the responsible entity on the same day of receipt or, if not possible, on the next business day. The receiving entity must include the order in its register in strict chronological order, assigning each a consecutive number and identifying the broker who received the order.

These rules apply exclusively to entities handling orders for securities and financial instruments traded on organised exchanges in Panama or globally.

Peer-to-peer trading platforms of registered securities are currently not permitted in Panama, as the Securities Law requires that all trades of registered securities must be carried out through a stock exchange and the investors’ brokers and their brokerage accounts.

Panama does not regulate trading in securities that are not subject to registration and other assets (such as cryptocurrencies).

For peer-to-peer trading to prosper in Panama, the Securities Law would need to be amended to specifically exclude these innovative platforms from the definition of stock exchanges and establish clear rules on the type of transactions that peer-to-peer trading platforms can handle. However, fraud, money laundering, and cybersecurity threats are big concerns for Panama’s regulators, so changes are unlikely to happen very quickly.

Payment for order flow is not regulated in Panama.

Under the Securities Law, markets should be designed to prevent deceptive and manipulative practices or any other actions that affect market transparency, to promote fair practices in securities trading, and to encourage the development of an efficient market.

High-frequency and algorithmic trading are not regulated in Panama.

Market makers are regulated by Agreement 2-2011 of the SMV, which regulates securities brokers and dictates that stock exchanges must establish the rules governing market makers. The Latin American stock exchange has established a rulebook for market makers, which indicates that market makers are a “fundamental pillar in financial markets, providing the opportunity to expand market reach and even engage in international transactions, leading to the benefit of being more recognised in other countries”. Under said rulebook, any securities broker can apply to be a market maker, which application is subject to the consideration of the board of directors of the stock exchange.

In Panama, the regulations do not distinguish between funds or dealers that engage in these activities.

The Securities Law in Panama does make a distinction between a dealer and a fund. The Securities Law defines a “broker‐dealer firm” as a legal entity engaging in the business of purchasing and selling securities or financial instruments for third parties or on its own account. The operation of a broker-dealer firm is regulated by Title III of the Securities Law and Agreement No 2-2011 of the SMV. On the other hand, the Securities Law defines a “fund” (“investment company” in Panama as used in the Securities Law) as a legal entity, trust or contractual arrangement that, by issuing and selling its own participation quotas, engages in the business of obtaining money from the investing public through one payment or periodical payments for the purpose of investing and trading securities, foreign exchange, metals and supplies, chattel property or any other property determined by the SMV. The operation of a fund is regulated by Title VIII of the Securities Law and Agreement No 5-2004 of the SMV.

Both business models require authorisation from the SMV. In the case of a broker-dealer firm, the legal entity requires a licence issued by the SMV. In the case of a fund, the legal entity must be registered with the SMV.

Panama has no regulations for programmers and the programming to develop and create trading algorithms and other electronic trading tools, provided the programmers are not performing trades. 

The underwriting process by industry participants in insutech usually involves the same process as that of traditional insurance companies. There is no specific regulation applicable to insurtech. The Superintendence of Insurance and Reinsurance, or SSR, is the local regulatory body that supervises and regulates the insurance and reinsurance business.

The participants treat each type of insurance in accordance with the applicable current regulations.

There is only one insurance regulator, which is the SSR, and regulation is mainly focused on the following lines of business, each of which requires its own respective licence:

• personal – individual life in all its modalities, collective or group, personal accidents, health, industrial, annuities, income, disability, loss of income, assistance to travellers or any other insurance covering exposure to loss and risks of persons;
• general – fidelity, fire and similar, maritime, land and/or air transport, sea and air hull, automobile, aviation, civil liability, theft, technical branches, property titles, various risks, extensions of manufacturer guarantee, or any other insurance not included in the field of people and/or guarantee/bonds; and
• guarantee and bond – compliance with the contract, with payment and other related guarantees or bonds related to the construction of works or for the supply of materials or equipment or any other bonds/guarantees.

Each of these lines of business has different applicable regulations (eg, for purposes of reserves or obligations of the parties).

Regtech providers are not regulated in Panama. However, financial companies generally use their services in order to comply with AML laws, such as Law 23.

In Panama, there are no regulations governing the terms and conditions of contracts with regtech providers, allowing financial services companies the flexibility to negotiate their contractual obligations with these providers.

Due to a lack of regulation, traditional players have been reluctant to implement blockchain technology in the provision of their financial services.

In recent years, there have been several legislative initiatives, but none have been enacted into law.

The most recent initiative was Bill 697 of 2022, titled “Regulating the Marketing and Use of Virtual Assets, Providers of Virtual Asset Services, and Other Provisions” (“Bill 697-2022”). This bill aimed to:

• provide legal, regulatory, and fiscal certainty for using and holding crypto-assets, virtual asset service providers, commercial actors of virtual assets, and issuers of virtual assets and electronic money in the Republic of Panama, including mitigating the risks of illicit use of such technologies;
• promote financial inclusion, foster a robust ecosystem of innovation in financial services, enhance competition among financial service providers, and ensure financial consumer freedom of choice; and
• facilitate Panama’s involvement in providing state-of-the-art technology services that promote financial inclusion through a virtual assets exchange platform and an official digital wallet, enabling secure transactions for both individuals and legal entities.

The National Assembly approved the original bill, but it was partially vetoed by the President and returned for further debate and adjustment. On 28 October 2022, the National Assembly approved an updated version of Bill 697-2022, incorporating the President’s vetoed articles. However, on 26 January 2023, the President presented an objection of unconstitutionality to the Supreme Court of Justice. On 14 July 2023, the Supreme Court ruled that Bill 697-2022 was unconstitutional, effectively ending the bill.

Blockchain assets are not regulated in Panama. Under Opinion 2-2015 and Opinion 1-2018, the SMV has established that tokens registered in a blockchain are not considered “securities” under its current definition in the Securities Law.

Issuers of blockchain assets not regulated in Panama. The SMV issued Opinion 1-2018, in which it concluded that a platform under which a platform raised capital from the general public and issued a token registered in the platform’s blockchain in exchange for the investment was not an activity that was under the SMV’s jurisdiction because tokens are not considered “securities” under its definition in the Securities Law.

Blockchain asset trading platforms and the secondary market trading of blockchain assets, either through intermediaries or peer-to-peer, are not regulated in Panama.

The provision of staking services relating to cryptocurrencies is not regulated in Panama.

The provision of lending services relating to cryptocurrencies is not regulated in Panama.

The offering of cryptocurrency derivatives is not regulated in Panama.

Decentralised Finance is not regulated in Panama.

Funds that invest in blockchain assets are not regulated in Panama.

Currently, no regulations apply to digital assets, cryptocurrencies, or virtual currencies in Panama. However, both the Superintendence of Banks of Panama (SBP) and the Superintendency of the Securities Market (SMV) have issued public notices and opinions stating that they do not generally monitor cryptocurrencies. Each entity has specifically established the following:

The SMV

In Opinion 07-2018, the SMV indicated that it does not consider cryptocurrencies (specifically, bitcoin) as currencies, noting that “in the Republic of Panama, no inherent value has been given to bitcoin or another type of cryptocurrency.” The SMV also confirmed that the concept of “securities” under the Securities Law does not encompass virtual currencies, so Bitcoin is not considered a security. Additionally, the SMV established that no forex regulation applies to cryptocurrencies, as it only applies to currencies that are an exclusive and incidental activity of broker-dealer houses.

In a statement issued on 25 April 2018, the SMV referred to cryptocurrencies as “digital assets intended for purchases, sales, or other financial transactions, created by companies or individuals and stored electronically in a blockchain, a database that maintains a permanent record of these digital transactions.”

Therefore, the SMV does not consider digital assets, cryptocurrencies, or virtual currencies to be subject to its supervision, and no license is required to operate activities involving the exchange of virtual currencies or cryptocurrencies, including bitcoin and other cryptocurrencies.

The SBP

Unlike the SMV, the opinions of the SBP are not publicly confirmed. However, on 24 April 2018, the SBP issued a public notice warning the general public about the use of “bitcoin or any other instrument of the same category,” indicating that these do not have specific regulations and are not within the competence of the SBP. The notice also established that “as usual, regulated entities must maintain due diligence measures to prevent the improper use of their services and platforms, in accordance with the provisions of the Banking Law, Law 23 of 2015, Agreement 10 of 2015, and other applicable regulations.”

Although cryptocurrencies, digital assets, and virtual currencies are not regulated in Panama, there are platforms where these assets are traded or stored. Operators of these platforms are advised to implement compliance measures, such as due diligence and KYC procedures based on local regulations, to prevent the misuse of their services before allowing any person to use their platforms.

NFTs and NFT platforms  are not regulated in Panama, and we have no knowledge of any opinions issued by any regulator with respect to NFTs.

There is no local specific regulation on open banking. The banking business continues to be regulated and supervised by the SBP.

The Data Protection Regulation regulates the protection of natural persons’ personal data, as well as its handling, storage, and treatment. The Data Protection Regulation applies to the processing of data that originates or is stored in Panama and data processing carried out within the framework of a commercial activity on the internet, or any other means of electronic or digital communication in accordance with the Electronic Commerce Law, to guarantee data protection in activities aimed at the Panamanian market. The Data Protection Regulation includes obligations for banks and technology providers related to data privacy and data security. Furthermore, the SBP issued Regulation 1-2022, which establishes special regulations in relation to personal data handled by banks.

Therefore, the general rule is to obtain the customer/client’s consent and have the appropriate privacy policies and security protocols in place.

Both the Banking Law and the Securities Law contain dispositions that prohibit and sanction fraudulent activity. The legislation does not provide a specific list of the elements of fraud; however, in a general sense, fraud requires a person to have the intent to deceive for personal gain or to cause harm to others by making false statements, material omissions or misrepresentations. Panama’s Criminal Code also contains dispositions relating to fraud and financial crimes.

Regulators supervise their regulated entities to prevent and detect fraudulent or illicit activity. They focus on investment fraud, accounting fraud, payment fraud, and others.

A fintech service provider may be liable for losses sustained by a customer if those losses result from fraudulent activities conducted by the provider. Additionally, depending on the specific terms of the contract between the fintech service provider and the customer, the provider may also be accountable for losses arising from gross negligence. The extent of this liability will depend on the damages that can be substantiated.