بنما KYC, KYB & AML compliance checklist
قائمة عملية وموثقة بالمصادر لتنفيذ متطلبات KYC وKYB وAML في بنما.
- تاريخ آخر مراجعة
- تاريخ آخر مراجعة:
- الإصدار
- الإصدار 1.0
إجابة مباشرة
ما الذي تغطيه قائمة الامتثال الخاصة بـ بنما؟
تحوّل قائمة بنما قواعد KYC وKYB وAML الأساسية إلى 11 مجالات رقابية و33 فحوص تنفيذ، وتشمل الجهات المختصة وواجبات الإبلاغ والأدلة الواجب الاحتفاظ بها.
حقائق تنظيمية أساسية
- National FIU
- Unidad de Analisis Financiero (UAF)
- Core AML framework
- Law 23 of 27 April 2015, as amended, plus sector rules
- Banking rule in force
- SBP Agreement 1-2026, operative from July 2026; it repealed Agreement 10-2015
- Suspicious reports
- Directly and immediately to UAF, including attempted operations; no monetary threshold
- Cash and quasi-cash reports
- B/.10,000 or more, including specified daily or weekly aggregation cases under Law 23 article 53
- AML record retention
- At least 5 years, with the trigger and sector rule documented
- Beneficial-owner thresholds
- Control is not only percentage-based; Decree 2 of 2023 uses 10% or more for financial obliged entities and 25% or more for non-financial obliged entities in the RUBF identification criteria
- Privacy authority
- Autoridad Nacional de Transparencia y Acceso a la Informacion (ANTAI)
- Payments and e-money
- SBP AML registration may apply, but it is expressly limited to AML/CFT/CPF supervision and does not replace other operating permissions
- Virtual assets
- No general standalone VASP licensing framework was identified; perform product-by-product AML, payments, securities and other perimeter analysis
- FATF status
- GAFILAT member; removed from FATF increased monitoring in October 2023 and not named on the public lists reviewed 1 August 2026
تفاصيل التنفيذ
متطلبات وإجراءات الامتثال في بنما
افتح كل مجال لمراجعة المتطلب وإجراء التنفيذ المقترح والأدلة الواجب الاحتفاظ بها والمصدر الأساسي.
01Scope, authorities and licensingResolve the exact legal entity, product and supervisory perimeter before selecting controls; Panama uses different supervisors and sector rules.3 عناصر+
Financial and non-financial activities listed by Law 23 are subject to AML/CFT/CPF supervision by the authority allocated to that sector.
- إجراء التنفيذ
- Map every service, customer type and delivery channel to Law 23 articles 22-24 and the current sector rule; obtain a written perimeter decision before launch.
- الأدلة الواجب الاحتفاظ بها
- Legal-entity map, product inventory, statutory classification, supervisor confirmation and board launch approval.
- المصدر الأساسي
- Law 23 of 2015 arts. 19-24
Banks and trust companies must use SBP Agreement 1-2026 rather than the repealed Agreement 10-2015.
- إجراء التنفيذ
- Version-control the July 2026 rule migration and preserve the special adaptation dates for article 14 and article 25 paragraph 1 where relevant.
- الأدلة الواجب الاحتفاظ بها
- Rule inventory, repeal check, gap assessment, remediation plan and implementation sign-off.
- المصدر الأساسي
- SBP Agreement 1-2026 arts. 52-53; SBP Circular 2026-0011
Payments or e-money businesses within Law 23 must obtain SBP registration for AML supervision, without treating that registration as a full operating licence.
- إجراء التنفيذ
- Submit the model to SBP, confirm the current register and separately identify every corporate, consumer, payment-network, remittance or other permission needed.
- الأدلة الواجب الاحتفاظ بها
- Perimeter opinion, SBP correspondence and registration, other licences and launch conditions.
- المصدر الأساسي
- Law 23 art. 22(1)(g); SBP payments and e-money register
02Governance and risk assessmentGovernance must reflect the entity's own risks and the requirements of its competent supervisor.3 عناصر+
Obliged entities must maintain risk-based policies, controls and monitoring proportionate to customer, product, channel and geographic exposure.
- إجراء التنفيذ
- Approve an enterprise risk assessment and translate its results into customer-risk tiers, acceptance rules, scenarios and review frequencies.
- الأدلة الواجب الاحتفاظ بها
- Risk methodology, data inputs, board approval, control mapping, model validation and change log.
- المصدر الأساسي
- Law 23 arts. 25-26 and 40; SBP Agreement 1-2026 arts. 9-12
The compliance function must have authority, independence, resources and direct escalation under the applicable sector rules.
- إجراء التنفيذ
- Appoint qualified accountable officers, document deputies and conflicts, and provide unrestricted access to relevant records and senior governance.
- الأدلة الواجب الاحتفاظ بها
- Appointment, role profile, reporting line, committee minutes, budget, training and escalation records.
- المصدر الأساسي
- Law 23 arts. 41-43; SBP Agreement 1-2026 arts. 37-46
Policies and systems must be independently tested and corrected when deficiencies are found.
- إجراء التنفيذ
- Run risk-based compliance testing and audit, assign owners and deadlines, and verify closure rather than accepting management assertion alone.
- الأدلة الواجب الاحتفاظ بها
- Test plan, samples, findings, corrective actions, evidence of closure and board reporting.
- المصدر الأساسي
- Law 23 arts. 20 and 40-43; applicable supervisor rules
03Natural-person KYC and representativesIdentity controls must establish who the person is, who they represent and whether the activity matches the stated profile.3 عناصر+
Obliged entities must identify and reasonably verify natural-person customers using reliable information and documents.
- إجراء التنفيذ
- Capture official identity, address, occupation, purpose, expected activity and source information; authenticate evidence and resolve discrepancies before activation.
- الأدلة الواجب الاحتفاظ بها
- Identity images, authenticity results, address and occupation evidence, timestamps, reviewer and exceptions.
- المصدر الأساسي
- Law 23 art. 27; SBP Agreement 1-2026 arts. 9-10 and 18
Representatives, signatories and attorneys-in-fact must be identified and their authority validated.
- إجراء التنفيذ
- Verify the individual, inspect the current power or mandate, confirm scope and expiry, and link all represented parties to the customer record.
- الأدلة الواجب الاحتفاظ بها
- Representative KYC, power, registry or notarial check, authority analysis and expiry control.
- المصدر الأساسي
- Law 23 arts. 27-28; applicable sector identification rules
If required identity or beneficial-owner information cannot be obtained, the relationship must not begin or continue and suspicion must be assessed.
- إجراء التنفيذ
- Block onboarding or activity, preserve the failed-control record, escalate promptly and decide whether an attempted-operation ROS is required without tipping off.
- الأدلة الواجب الاحتفاظ بها
- System block, missing-information log, escalation, ROS decision and communication record.
- المصدر الأساسي
- Law 23 arts. 28(7), 36 and 54; SBP Agreement 1-2026 arts. 17 and 19
04KYB, registries and beneficial ownershipCorporate existence, authority, ownership and control are separate checks; registry evidence does not replace a complete beneficial-owner analysis.3 عناصر+
Legal-person CDD must identify the entity, its purpose, controllers, representatives and natural-person beneficial owners.
- إجراء التنفيذ
- Obtain constitutional and current registry evidence, trace direct and indirect ownership, assess control by other means and identify the natural person behind the relationship.
- الأدلة الواجب الاحتفاظ بها
- Registry certificate, constitutional documents, ownership chart, control memo, declarations and independent corroboration.
- المصدر الأساسي
- Law 23 art. 28; SBP Agreement 1-2026 arts. 6 and 19
RUBF identification criteria use 10% or more for financial obliged entities and 25% or more for non-financial obliged entities, but control and influence tests also apply.
- إجراء التنفيذ
- Calculate direct and indirect holdings, voting rights and other control; do not stop at a percentage where another natural person exercises ultimate control.
- الأدلة الواجب الاحتفاظ بها
- Cap table, indirect calculations, voting agreements, board rights, control analysis and approval.
- المصدر الأساسي
- Executive Decree 13 of 2022 art. 10, as amended by Executive Decree 2 of 2023
Resident agents must maintain and update beneficial-owner information in the private RUBF under Law 129.
- إجراء التنفيذ
- Obtain the required data from the legal person, file through the SSNF system, track changes and reconcile the RUBF record with the AML customer file.
- الأدلة الواجب الاحتفاظ بها
- Resident-agent request, RUBF certificate, change notices, update receipt and reconciliation log.
- المصدر الأساسي
- Law 129 of 2020 arts. 10-13, as amended by Law 254 of 2021
05PEPs, EDD and remote onboardingHigher-risk relationships require documented approval, deeper source analysis and intensified monitoring.3 عناصر+
Systems must identify domestic, foreign and international-organisation PEPs, relevant family members and close associates.
- إجراء التنفيذ
- Screen customers, representatives and beneficial owners at onboarding and continuously; document role, relationship and the period for which enhanced treatment remains appropriate.
- الأدلة الواجب الاحتفاظ بها
- Screening results, role research, relationship map, disposition and review date.
- المصدر الأساسي
- Law 23 arts. 4 and 34; SBP Agreement 1-2026 arts. 26-27
PEP and other high-risk relationships require enhanced due diligence proportionate to risk.
- إجراء التنفيذ
- Obtain senior approval, establish source of wealth and source of funds, understand expected activity and apply intensified monitoring and refresh.
- الأدلة الواجب الاحتفاظ بها
- Approval, wealth and funds evidence, adverse-information review, monitoring plan and periodic review.
- المصدر الأساسي
- Law 23 arts. 34 and 39; SBP Agreement 1-2026 arts. 20-21 and 26-27
Remote onboarding remains subject to the same accountable identity and risk outcomes as in-person onboarding.
- إجراء التنفيذ
- Validate the permitted remote method, test impersonation and presentation attacks, bind device and session evidence, and maintain an accessible fallback.
- الأدلة الواجب الاحتفاظ بها
- Legal mapping, vendor assessment, biometric or liveness tests where used, device logs, exceptions and quality testing.
- المصدر الأساسي
- Law 23 arts. 25-28; SBP Agreement 1-2026 arts. 9-21
06Monitoring, suspicious reporting and confidentialitySuspicion is reportable immediately and independently of the cash-reporting threshold.3 عناصر+
Completed and attempted suspicious operations must be reported directly and immediately to UAF.
- إجراء التنفيذ
- Escalate on detection, document the grounds and knowledge time, submit through the current UAF channel and preserve the acknowledgement and any supplement.
- الأدلة الواجب الاحتفاظ بها
- Alert, investigation, decision timeline, ROS, UAF receipt, supplement and access log.
- المصدر الأساسي
- Law 23 art. 54; SBP Agreement 1-2026 arts. 33-36
The entity must monitor activity against the customer profile and investigate unusual patterns.
- إجراء التنفيذ
- Deploy risk-based scenarios for cash, rapid movement, structuring, counterparties, geography, devices and attempted activity; tune and quality-test results.
- الأدلة الواجب الاحتفاظ بها
- Scenario inventory, thresholds, alerts, case files, tuning, validation and management information.
- المصدر الأساسي
- Law 23 arts. 36 and 40; SBP Agreement 1-2026 arts. 23-25 and 32-35
Reporting and related requests are confidential and must not be disclosed to the customer or unauthorised persons.
- إجراء التنفيذ
- Restrict case access, use approved communications, separate customer servicing from ROS decisions and train staff against tipping off.
- الأدلة الواجب الاحتفاظ بها
- Access controls, confidentiality acknowledgements, training, communications and incident log.
- المصدر الأساسي
- Law 23 arts. 55 and 56
07Cash, wires, payments and agentsThreshold reports, wire data and payment-business registration are distinct controls.3 عناصر+
Specified cash and quasi-cash transactions of B/.10,000 or more, including defined daily or weekly aggregates, must be reported under article 53.
- إجراء التنفيذ
- Implement transaction and aggregation logic for each listed category, use the current reporting format and keep the threshold report separate from the ROS decision.
- الأدلة الواجب الاحتفاظ بها
- Aggregation rules, daily and weekly tests, report, receipt, exception log and reconciliation.
- المصدر الأساسي
- Law 23 art. 53; applicable UAF and supervisor reporting instructions
Bank transfers must carry and preserve required originator and beneficiary information and deficient transfers require controls.
- إجراء التنفيذ
- Validate mandatory fields before execution, monitor missing or inconsistent data, apply hold/reject/escalate rules and screen all relevant parties.
- الأدلة الواجب الاحتفاظ بها
- Payment message, field validation, screening, exception decision and audit trail.
- المصدر الأساسي
- Law 23 art. 46; SBP Agreement 2-2017, as amended
Use of agents, processors or vendors does not remove the obliged entity's responsibility.
- إجراء التنفيذ
- Contract for control standards, evidence access, audit rights, incident notice and termination; test agent and vendor performance continuously.
- الأدلة الواجب الاحتفاظ بها
- Due diligence, contract, control map, sample testing, incidents and exit plan.
- المصدر الأساسي
- Law 23 arts. 35 and 37; applicable sector rules
08Targeted financial sanctionsUN designations require immediate operational capability, not only periodic customer screening.3 عناصر+
Obliged entities must implement preventive freezing of funds or assets connected to applicable UN Security Council designations without delay.
- إجراء التنفيذ
- Screen customers, beneficial owners, counterparties and assets on list updates and before relevant transactions; freeze without prior notice where required and follow the UAF route.
- الأدلة الواجب الاحتفاظ بها
- List source, screening timestamp, match analysis, freeze record, UAF communication and legal escalation.
- المصدر الأساسي
- Law 23 arts. 49-52; Executive Decree 587 of 2015; UAF freezing process
Potential matches must be resolved accurately without releasing assets prematurely or freezing unrelated persons indefinitely.
- إجراء التنفيذ
- Use documented identifiers, escalation and false-positive procedures; follow competent-authority instructions for confirmation, access and release.
- الأدلة الواجب الاحتفاظ بها
- Match packet, identifiers, counsel review, authority correspondence and release approval.
- المصدر الأساسي
- Executive Decree 587 of 2015 and UAF procedures
Sanctions screening must cover control, ownership and persons acting on behalf of designated parties.
- إجراء التنفيذ
- Extend screening beyond customer names to natural-person owners, controllers, representatives, payment parties and relevant assets.
- الأدلة الواجب الاحتفاظ بها
- Ownership screening, relationship mapping, payment screening and periodic rescreen logs.
- المصدر الأساسي
- Law 23 arts. 49-52; applicable UN Security Council resolutions
09Records and regulator accessRecords must reconstruct the customer decision and transaction, remain secure and be retrievable for authorities.3 عناصر+
CDD, beneficial-owner and transaction records must be retained for at least five years under Law 23 and applicable sector rules.
- إجراء التنفيذ
- Define the correct trigger for each record class, suspend deletion for investigations or authority requests and document any longer sector period.
- الأدلة الواجب الاحتفاظ بها
- Retention schedule, legal mapping, deletion controls, holds and tested retrieval.
- المصدر الأساسي
- Law 23 art. 29; SBP Agreement 1-2026 art. 29
Records must be sufficient to reconstruct transactions and demonstrate the basis for risk and reporting decisions.
- إجراء التنفيذ
- Preserve source documents, versions, approvals, screening, monitoring, communications and reports in an auditable sequence.
- الأدلة الواجب الاحتفاظ بها
- Complete sample file, immutable audit trail, version history and reconstruction test.
- المصدر الأساسي
- Law 23 arts. 29-30 and 36; applicable supervisor rules
UAF and competent supervisors must receive information through lawful, secure and timely channels.
- إجراء التنفيذ
- Maintain current credentials, authority-verification procedures, response owners and an indexed production log.
- الأدلة الواجب الاحتفاظ بها
- Request, authority check, production index, secure delivery receipt and legal hold.
- المصدر الأساسي
- Law 23 arts. 11-12, 20 and 59
10Privacy, biometrics and transfersAML processing has a legal purpose, but data minimisation, transparency, security and transfer controls still apply.3 عناصر+
Personal-data processing must comply with Law 81 principles and provide required information about purpose, use, recipients and rights unless a lawful exception applies.
- إجراء التنفيذ
- Map each KYC field and disclosure to a legal basis, issue a clear notice, minimise optional data and prevent the notice from revealing confidential ROS activity.
- الأدلة الواجب الاحتفاظ بها
- Data inventory, legal-basis record, notice version, consent where used and rights log.
- المصدر الأساسي
- Law 81 of 2019 arts. 2-9; Executive Decree 285 of 2021
Sensitive and biometric data require heightened necessity, security and access controls.
- إجراء التنفيذ
- Document why biometrics are necessary, test accuracy and bias, encrypt templates, restrict access and provide a workable alternative where legally required.
- الأدلة الواجب الاحتفاظ بها
- Necessity assessment, consent or exception, security design, vendor tests, access log and deletion rule.
- المصدر الأساسي
- Law 81 of 2019 arts. 4-9 and 19-24; Executive Decree 285 of 2021
Processors and cross-border transfers must preserve Law 81 protections and mandatory AML access.
- إجراء التنفيذ
- Map locations and subprocessors, contract for confidentiality, security, incident handling, deletion and regulator access, and assess each transfer mechanism.
- الأدلة الواجب الاحتفاظ بها
- Data-flow map, transfer assessment, contracts, subprocessor register and incident plan.
- المصدر الأساسي
- Law 81 of 2019 arts. 15-18 and 24; Executive Decree 285 of 2021
11Fintech, virtual assets and practical evidence packsInnovative products require a documented perimeter decision and the same reconstructable compliance evidence as traditional channels.3 عناصر+
A technology label does not determine whether banking, payments, remittance, securities or AML rules apply.
- إجراء التنفيذ
- Analyse custody, settlement, stored value, redemption, returns, transfer, customer-fund control and marketing before launch; seek each relevant authority's confirmation.
- الأدلة الواجب الاحتفاظ بها
- Product flow, funds-flow diagram, legal opinions, regulator correspondence, conditions and approval.
- المصدر الأساسي
- Law 23 arts. 22-24; Banking Law; Securities Law; SBP innovative-products guidance
Panama did not have a general standalone VASP licensing framework identified as at the review date.
- إجراء التنفيذ
- Do not describe absence of a standalone VASP law as exemption: assess AML obliged-entity status, securities, payments, remittance, consumer, tax and sanctions rules for the exact model.
- الأدلة الواجب الاحتفاظ بها
- Dated perimeter memo, legal sources, authority checks, risk assessment and monitoring plan.
- المصدر الأساسي
- Law 23; SBP and SSNF current registers and guidance, reviewed 1 August 2026
Every implemented control should have a compact, reviewable evidence pack.
- إجراء التنفيذ
- Assign an owner, applicability decision, procedure, system control, test, exception process and remediation date to every checklist row.
- الأدلة الواجب الاحتفاظ بها
- Control matrix, RACI, evidence links, test results, gaps, remediation and final approval.
- المصدر الأساسي
- Recommended implementation control supporting Law 23 and sector-rule compliance
سجل المصادر الأساسية
16 مصدرًا مستخدمًا في هذه القائمة
استخدم هذه الروابط للتحقق من التشريعات وإرشادات الجهات الرقابية وإجراءات الإبلاغ والبيانات الدولية.
- Law 23 of 27 April 2015 - UAF consolidated textUnidad de Analisis Financiero · Primary legislation
- Panama AML and transparency laws registerUnidad de Analisis Financiero · Official legislation register
- Law 129 of 2020 - beneficial-owner register consolidated textUnidad de Analisis Financiero · Primary legislation
- Law 254 of 2021 - AML and international tax transparency amendmentsUnidad de Analisis Financiero · Primary legislation
- Executive Decree 13 of 2022 - RUBF regulationGaceta Oficial de Panama · Primary regulation
- Executive Decree 2 of 2023 - amended RUBF identification criteriaSuperintendencia de Sujetos no Financieros · Primary regulation
- SBP Agreement 1-2026 - prevention for banks and trust companiesSuperintendencia de Bancos de Panama · Primary sector regulation
- SBP Agreement 2-2017 consolidated - fund transfersSuperintendencia de Bancos de Panama · Primary sector regulation
- UAF preventive-freezing processUnidad de Analisis Financiero · Official sanctions procedure
- SBP payments and e-money AML registerSuperintendencia de Bancos de Panama · Official current register
- SBP innovative financial-technology guidanceSuperintendencia de Bancos de Panama · Official perimeter guidance
- Law 81 of 2019 - personal data protectionAutoridad Nacional de Transparencia y Acceso a la Informacion · Primary legislation
- Panama data-protection legislation registerAutoridad Nacional de Transparencia y Acceso a la Informacion · Official legislation register
- Panama Emprende operating-notice guidanceMinisterio de Comercio e Industrias · Official business-registration guidance
- FATF Panama country page and October 2023 exit statementFinancial Action Task Force · Official country-status source
- FATF black and grey listsFinancial Action Task Force · Official current-status source
إجابات مباشرة
أسئلة KYC وKYB وAML في بنما
Who receives suspicious-operation reports in Panama?+
The Unidad de Analisis Financiero (UAF). Law 23 requires obliged entities to report directly and immediately, including attempted suspicious operations, through the current official channel.
Is there a monetary threshold for a Panama ROS?+
No. Suspicion, not value, triggers a ROS. The B/.10,000 rules are separate cash and quasi-cash transaction-reporting duties.
What is Panama's B/.10,000 reporting rule?+
Law 23 article 53 lists specified cash and quasi-cash transactions at B/.10,000 or more and defined daily or weekly aggregation cases. Apply the exact category and current reporting instructions.
How is beneficial ownership determined in Panama?+
Trace ownership and control to natural persons. For RUBF identification, Decree 2 of 2023 uses 10% or more for financial obliged entities and 25% or more for non-financial obliged entities, while control and influence tests remain relevant.
How long are Panama AML records retained?+
At least five years under Law 23 and the current banking rule, with the relevant end-of-relationship or transaction trigger and any longer sector requirement documented.
What happens on a UN sanctions match?+
Apply the preventive-freezing process without delay, avoid prior notice, and communicate through the UAF route. Preserve the designation, identifiers, freeze time and authority communications.
Does SBP AML registration fully license a payments company?+
No. The SBP register expressly concerns AML/CFT/CPF supervision. The business must separately confirm every operating, corporate, remittance, consumer and network permission that its model requires.
Does Panama have a general VASP licence?+
No general standalone VASP licensing framework was identified at the 1 August 2026 review date. That is not an exemption: the exact model still requires AML, payments, securities, remittance, sanctions, consumer and tax perimeter analysis.
Is Panama currently on a FATF public list?+
Panama was removed from increased monitoring in October 2023 and was not named on the FATF public call-for-action or increased-monitoring lists reviewed 1 August 2026.
منهجية البحث والمراجعة
تحدد VOVE ID Compliance Research النطاق التنظيمي، وتحول الالتزامات إلى ضوابط تشغيلية، وتربط الادعاءات الجوهرية بالمصادر، وتسجل تاريخ وإصدار كل مراجعة.
General regulatory information, not legal advice, an authorization decision or a substitute for the operative Spanish text, official reporting instructions or regulator confirmation. Reviewed 1 August 2026. Confirm entity, activity, customer, transaction, reporting channel, sanctions route, privacy role and later developments with qualified Panamanian counsel and the competent authority before launch.