Panama KYC, KYB & AML compliance checklist
Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Panama.
- Dernière revue
- Dernière revue:
- Version
- Version 1.0
Réponse directe
Que couvre la checklist de conformité pour Panama ?
La checklist pour Panama traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 33 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.
Faits réglementaires clés
- National FIU
- Unidad de Analisis Financiero (UAF)
- Core AML framework
- Law 23 of 27 April 2015, as amended, plus sector rules
- Banking rule in force
- SBP Agreement 1-2026, operative from July 2026; it repealed Agreement 10-2015
- Suspicious reports
- Directly and immediately to UAF, including attempted operations; no monetary threshold
- Cash and quasi-cash reports
- B/.10,000 or more, including specified daily or weekly aggregation cases under Law 23 article 53
- AML record retention
- At least 5 years, with the trigger and sector rule documented
- Beneficial-owner thresholds
- Control is not only percentage-based; Decree 2 of 2023 uses 10% or more for financial obliged entities and 25% or more for non-financial obliged entities in the RUBF identification criteria
- Privacy authority
- Autoridad Nacional de Transparencia y Acceso a la Informacion (ANTAI)
- Payments and e-money
- SBP AML registration may apply, but it is expressly limited to AML/CFT/CPF supervision and does not replace other operating permissions
- Virtual assets
- No general standalone VASP licensing framework was identified; perform product-by-product AML, payments, securities and other perimeter analysis
- FATF status
- GAFILAT member; removed from FATF increased monitoring in October 2023 and not named on the public lists reviewed 1 August 2026
Détail d’implémentation
Exigences et actions de conformité pour Panama
Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.
01Scope, authorities and licensingResolve the exact legal entity, product and supervisory perimeter before selecting controls; Panama uses different supervisors and sector rules.3 éléments+
Financial and non-financial activities listed by Law 23 are subject to AML/CFT/CPF supervision by the authority allocated to that sector.
- Action d’implémentation
- Map every service, customer type and delivery channel to Law 23 articles 22-24 and the current sector rule; obtain a written perimeter decision before launch.
- Preuves à conserver
- Legal-entity map, product inventory, statutory classification, supervisor confirmation and board launch approval.
- Source primaire
- Law 23 of 2015 arts. 19-24
Banks and trust companies must use SBP Agreement 1-2026 rather than the repealed Agreement 10-2015.
- Action d’implémentation
- Version-control the July 2026 rule migration and preserve the special adaptation dates for article 14 and article 25 paragraph 1 where relevant.
- Preuves à conserver
- Rule inventory, repeal check, gap assessment, remediation plan and implementation sign-off.
- Source primaire
- SBP Agreement 1-2026 arts. 52-53; SBP Circular 2026-0011
Payments or e-money businesses within Law 23 must obtain SBP registration for AML supervision, without treating that registration as a full operating licence.
- Action d’implémentation
- Submit the model to SBP, confirm the current register and separately identify every corporate, consumer, payment-network, remittance or other permission needed.
- Preuves à conserver
- Perimeter opinion, SBP correspondence and registration, other licences and launch conditions.
- Source primaire
- Law 23 art. 22(1)(g); SBP payments and e-money register
02Governance and risk assessmentGovernance must reflect the entity's own risks and the requirements of its competent supervisor.3 éléments+
Obliged entities must maintain risk-based policies, controls and monitoring proportionate to customer, product, channel and geographic exposure.
- Action d’implémentation
- Approve an enterprise risk assessment and translate its results into customer-risk tiers, acceptance rules, scenarios and review frequencies.
- Preuves à conserver
- Risk methodology, data inputs, board approval, control mapping, model validation and change log.
- Source primaire
- Law 23 arts. 25-26 and 40; SBP Agreement 1-2026 arts. 9-12
The compliance function must have authority, independence, resources and direct escalation under the applicable sector rules.
- Action d’implémentation
- Appoint qualified accountable officers, document deputies and conflicts, and provide unrestricted access to relevant records and senior governance.
- Preuves à conserver
- Appointment, role profile, reporting line, committee minutes, budget, training and escalation records.
- Source primaire
- Law 23 arts. 41-43; SBP Agreement 1-2026 arts. 37-46
Policies and systems must be independently tested and corrected when deficiencies are found.
- Action d’implémentation
- Run risk-based compliance testing and audit, assign owners and deadlines, and verify closure rather than accepting management assertion alone.
- Preuves à conserver
- Test plan, samples, findings, corrective actions, evidence of closure and board reporting.
- Source primaire
- Law 23 arts. 20 and 40-43; applicable supervisor rules
03Natural-person KYC and representativesIdentity controls must establish who the person is, who they represent and whether the activity matches the stated profile.3 éléments+
Obliged entities must identify and reasonably verify natural-person customers using reliable information and documents.
- Action d’implémentation
- Capture official identity, address, occupation, purpose, expected activity and source information; authenticate evidence and resolve discrepancies before activation.
- Preuves à conserver
- Identity images, authenticity results, address and occupation evidence, timestamps, reviewer and exceptions.
- Source primaire
- Law 23 art. 27; SBP Agreement 1-2026 arts. 9-10 and 18
Representatives, signatories and attorneys-in-fact must be identified and their authority validated.
- Action d’implémentation
- Verify the individual, inspect the current power or mandate, confirm scope and expiry, and link all represented parties to the customer record.
- Preuves à conserver
- Representative KYC, power, registry or notarial check, authority analysis and expiry control.
- Source primaire
- Law 23 arts. 27-28; applicable sector identification rules
If required identity or beneficial-owner information cannot be obtained, the relationship must not begin or continue and suspicion must be assessed.
- Action d’implémentation
- Block onboarding or activity, preserve the failed-control record, escalate promptly and decide whether an attempted-operation ROS is required without tipping off.
- Preuves à conserver
- System block, missing-information log, escalation, ROS decision and communication record.
- Source primaire
- Law 23 arts. 28(7), 36 and 54; SBP Agreement 1-2026 arts. 17 and 19
04KYB, registries and beneficial ownershipCorporate existence, authority, ownership and control are separate checks; registry evidence does not replace a complete beneficial-owner analysis.3 éléments+
Legal-person CDD must identify the entity, its purpose, controllers, representatives and natural-person beneficial owners.
- Action d’implémentation
- Obtain constitutional and current registry evidence, trace direct and indirect ownership, assess control by other means and identify the natural person behind the relationship.
- Preuves à conserver
- Registry certificate, constitutional documents, ownership chart, control memo, declarations and independent corroboration.
- Source primaire
- Law 23 art. 28; SBP Agreement 1-2026 arts. 6 and 19
RUBF identification criteria use 10% or more for financial obliged entities and 25% or more for non-financial obliged entities, but control and influence tests also apply.
- Action d’implémentation
- Calculate direct and indirect holdings, voting rights and other control; do not stop at a percentage where another natural person exercises ultimate control.
- Preuves à conserver
- Cap table, indirect calculations, voting agreements, board rights, control analysis and approval.
- Source primaire
- Executive Decree 13 of 2022 art. 10, as amended by Executive Decree 2 of 2023
Resident agents must maintain and update beneficial-owner information in the private RUBF under Law 129.
- Action d’implémentation
- Obtain the required data from the legal person, file through the SSNF system, track changes and reconcile the RUBF record with the AML customer file.
- Preuves à conserver
- Resident-agent request, RUBF certificate, change notices, update receipt and reconciliation log.
- Source primaire
- Law 129 of 2020 arts. 10-13, as amended by Law 254 of 2021
05PEPs, EDD and remote onboardingHigher-risk relationships require documented approval, deeper source analysis and intensified monitoring.3 éléments+
Systems must identify domestic, foreign and international-organisation PEPs, relevant family members and close associates.
- Action d’implémentation
- Screen customers, representatives and beneficial owners at onboarding and continuously; document role, relationship and the period for which enhanced treatment remains appropriate.
- Preuves à conserver
- Screening results, role research, relationship map, disposition and review date.
- Source primaire
- Law 23 arts. 4 and 34; SBP Agreement 1-2026 arts. 26-27
PEP and other high-risk relationships require enhanced due diligence proportionate to risk.
- Action d’implémentation
- Obtain senior approval, establish source of wealth and source of funds, understand expected activity and apply intensified monitoring and refresh.
- Preuves à conserver
- Approval, wealth and funds evidence, adverse-information review, monitoring plan and periodic review.
- Source primaire
- Law 23 arts. 34 and 39; SBP Agreement 1-2026 arts. 20-21 and 26-27
Remote onboarding remains subject to the same accountable identity and risk outcomes as in-person onboarding.
- Action d’implémentation
- Validate the permitted remote method, test impersonation and presentation attacks, bind device and session evidence, and maintain an accessible fallback.
- Preuves à conserver
- Legal mapping, vendor assessment, biometric or liveness tests where used, device logs, exceptions and quality testing.
- Source primaire
- Law 23 arts. 25-28; SBP Agreement 1-2026 arts. 9-21
06Monitoring, suspicious reporting and confidentialitySuspicion is reportable immediately and independently of the cash-reporting threshold.3 éléments+
Completed and attempted suspicious operations must be reported directly and immediately to UAF.
- Action d’implémentation
- Escalate on detection, document the grounds and knowledge time, submit through the current UAF channel and preserve the acknowledgement and any supplement.
- Preuves à conserver
- Alert, investigation, decision timeline, ROS, UAF receipt, supplement and access log.
- Source primaire
- Law 23 art. 54; SBP Agreement 1-2026 arts. 33-36
The entity must monitor activity against the customer profile and investigate unusual patterns.
- Action d’implémentation
- Deploy risk-based scenarios for cash, rapid movement, structuring, counterparties, geography, devices and attempted activity; tune and quality-test results.
- Preuves à conserver
- Scenario inventory, thresholds, alerts, case files, tuning, validation and management information.
- Source primaire
- Law 23 arts. 36 and 40; SBP Agreement 1-2026 arts. 23-25 and 32-35
Reporting and related requests are confidential and must not be disclosed to the customer or unauthorised persons.
- Action d’implémentation
- Restrict case access, use approved communications, separate customer servicing from ROS decisions and train staff against tipping off.
- Preuves à conserver
- Access controls, confidentiality acknowledgements, training, communications and incident log.
- Source primaire
- Law 23 arts. 55 and 56
07Cash, wires, payments and agentsThreshold reports, wire data and payment-business registration are distinct controls.3 éléments+
Specified cash and quasi-cash transactions of B/.10,000 or more, including defined daily or weekly aggregates, must be reported under article 53.
- Action d’implémentation
- Implement transaction and aggregation logic for each listed category, use the current reporting format and keep the threshold report separate from the ROS decision.
- Preuves à conserver
- Aggregation rules, daily and weekly tests, report, receipt, exception log and reconciliation.
- Source primaire
- Law 23 art. 53; applicable UAF and supervisor reporting instructions
Bank transfers must carry and preserve required originator and beneficiary information and deficient transfers require controls.
- Action d’implémentation
- Validate mandatory fields before execution, monitor missing or inconsistent data, apply hold/reject/escalate rules and screen all relevant parties.
- Preuves à conserver
- Payment message, field validation, screening, exception decision and audit trail.
- Source primaire
- Law 23 art. 46; SBP Agreement 2-2017, as amended
Use of agents, processors or vendors does not remove the obliged entity's responsibility.
- Action d’implémentation
- Contract for control standards, evidence access, audit rights, incident notice and termination; test agent and vendor performance continuously.
- Preuves à conserver
- Due diligence, contract, control map, sample testing, incidents and exit plan.
- Source primaire
- Law 23 arts. 35 and 37; applicable sector rules
08Targeted financial sanctionsUN designations require immediate operational capability, not only periodic customer screening.3 éléments+
Obliged entities must implement preventive freezing of funds or assets connected to applicable UN Security Council designations without delay.
- Action d’implémentation
- Screen customers, beneficial owners, counterparties and assets on list updates and before relevant transactions; freeze without prior notice where required and follow the UAF route.
- Preuves à conserver
- List source, screening timestamp, match analysis, freeze record, UAF communication and legal escalation.
- Source primaire
- Law 23 arts. 49-52; Executive Decree 587 of 2015; UAF freezing process
Potential matches must be resolved accurately without releasing assets prematurely or freezing unrelated persons indefinitely.
- Action d’implémentation
- Use documented identifiers, escalation and false-positive procedures; follow competent-authority instructions for confirmation, access and release.
- Preuves à conserver
- Match packet, identifiers, counsel review, authority correspondence and release approval.
- Source primaire
- Executive Decree 587 of 2015 and UAF procedures
Sanctions screening must cover control, ownership and persons acting on behalf of designated parties.
- Action d’implémentation
- Extend screening beyond customer names to natural-person owners, controllers, representatives, payment parties and relevant assets.
- Preuves à conserver
- Ownership screening, relationship mapping, payment screening and periodic rescreen logs.
- Source primaire
- Law 23 arts. 49-52; applicable UN Security Council resolutions
09Records and regulator accessRecords must reconstruct the customer decision and transaction, remain secure and be retrievable for authorities.3 éléments+
CDD, beneficial-owner and transaction records must be retained for at least five years under Law 23 and applicable sector rules.
- Action d’implémentation
- Define the correct trigger for each record class, suspend deletion for investigations or authority requests and document any longer sector period.
- Preuves à conserver
- Retention schedule, legal mapping, deletion controls, holds and tested retrieval.
- Source primaire
- Law 23 art. 29; SBP Agreement 1-2026 art. 29
Records must be sufficient to reconstruct transactions and demonstrate the basis for risk and reporting decisions.
- Action d’implémentation
- Preserve source documents, versions, approvals, screening, monitoring, communications and reports in an auditable sequence.
- Preuves à conserver
- Complete sample file, immutable audit trail, version history and reconstruction test.
- Source primaire
- Law 23 arts. 29-30 and 36; applicable supervisor rules
UAF and competent supervisors must receive information through lawful, secure and timely channels.
- Action d’implémentation
- Maintain current credentials, authority-verification procedures, response owners and an indexed production log.
- Preuves à conserver
- Request, authority check, production index, secure delivery receipt and legal hold.
- Source primaire
- Law 23 arts. 11-12, 20 and 59
10Privacy, biometrics and transfersAML processing has a legal purpose, but data minimisation, transparency, security and transfer controls still apply.3 éléments+
Personal-data processing must comply with Law 81 principles and provide required information about purpose, use, recipients and rights unless a lawful exception applies.
- Action d’implémentation
- Map each KYC field and disclosure to a legal basis, issue a clear notice, minimise optional data and prevent the notice from revealing confidential ROS activity.
- Preuves à conserver
- Data inventory, legal-basis record, notice version, consent where used and rights log.
- Source primaire
- Law 81 of 2019 arts. 2-9; Executive Decree 285 of 2021
Sensitive and biometric data require heightened necessity, security and access controls.
- Action d’implémentation
- Document why biometrics are necessary, test accuracy and bias, encrypt templates, restrict access and provide a workable alternative where legally required.
- Preuves à conserver
- Necessity assessment, consent or exception, security design, vendor tests, access log and deletion rule.
- Source primaire
- Law 81 of 2019 arts. 4-9 and 19-24; Executive Decree 285 of 2021
Processors and cross-border transfers must preserve Law 81 protections and mandatory AML access.
- Action d’implémentation
- Map locations and subprocessors, contract for confidentiality, security, incident handling, deletion and regulator access, and assess each transfer mechanism.
- Preuves à conserver
- Data-flow map, transfer assessment, contracts, subprocessor register and incident plan.
- Source primaire
- Law 81 of 2019 arts. 15-18 and 24; Executive Decree 285 of 2021
11Fintech, virtual assets and practical evidence packsInnovative products require a documented perimeter decision and the same reconstructable compliance evidence as traditional channels.3 éléments+
A technology label does not determine whether banking, payments, remittance, securities or AML rules apply.
- Action d’implémentation
- Analyse custody, settlement, stored value, redemption, returns, transfer, customer-fund control and marketing before launch; seek each relevant authority's confirmation.
- Preuves à conserver
- Product flow, funds-flow diagram, legal opinions, regulator correspondence, conditions and approval.
- Source primaire
- Law 23 arts. 22-24; Banking Law; Securities Law; SBP innovative-products guidance
Panama did not have a general standalone VASP licensing framework identified as at the review date.
- Action d’implémentation
- Do not describe absence of a standalone VASP law as exemption: assess AML obliged-entity status, securities, payments, remittance, consumer, tax and sanctions rules for the exact model.
- Preuves à conserver
- Dated perimeter memo, legal sources, authority checks, risk assessment and monitoring plan.
- Source primaire
- Law 23; SBP and SSNF current registers and guidance, reviewed 1 August 2026
Every implemented control should have a compact, reviewable evidence pack.
- Action d’implémentation
- Assign an owner, applicability decision, procedure, system control, test, exception process and remediation date to every checklist row.
- Preuves à conserver
- Control matrix, RACI, evidence links, test results, gaps, remediation and final approval.
- Source primaire
- Recommended implementation control supporting Law 23 and sector-rule compliance
Registre des sources primaires
16 sources utilisées pour cette checklist
Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.
- Law 23 of 27 April 2015 - UAF consolidated textUnidad de Analisis Financiero · Primary legislation
- Panama AML and transparency laws registerUnidad de Analisis Financiero · Official legislation register
- Law 129 of 2020 - beneficial-owner register consolidated textUnidad de Analisis Financiero · Primary legislation
- Law 254 of 2021 - AML and international tax transparency amendmentsUnidad de Analisis Financiero · Primary legislation
- Executive Decree 13 of 2022 - RUBF regulationGaceta Oficial de Panama · Primary regulation
- Executive Decree 2 of 2023 - amended RUBF identification criteriaSuperintendencia de Sujetos no Financieros · Primary regulation
- SBP Agreement 1-2026 - prevention for banks and trust companiesSuperintendencia de Bancos de Panama · Primary sector regulation
- SBP Agreement 2-2017 consolidated - fund transfersSuperintendencia de Bancos de Panama · Primary sector regulation
- UAF preventive-freezing processUnidad de Analisis Financiero · Official sanctions procedure
- SBP payments and e-money AML registerSuperintendencia de Bancos de Panama · Official current register
- SBP innovative financial-technology guidanceSuperintendencia de Bancos de Panama · Official perimeter guidance
- Law 81 of 2019 - personal data protectionAutoridad Nacional de Transparencia y Acceso a la Informacion · Primary legislation
- Panama data-protection legislation registerAutoridad Nacional de Transparencia y Acceso a la Informacion · Official legislation register
- Panama Emprende operating-notice guidanceMinisterio de Comercio e Industrias · Official business-registration guidance
- FATF Panama country page and October 2023 exit statementFinancial Action Task Force · Official country-status source
- FATF black and grey listsFinancial Action Task Force · Official current-status source
Réponses directes
Questions KYC, KYB et AML pour Panama
Who receives suspicious-operation reports in Panama?+
The Unidad de Analisis Financiero (UAF). Law 23 requires obliged entities to report directly and immediately, including attempted suspicious operations, through the current official channel.
Is there a monetary threshold for a Panama ROS?+
No. Suspicion, not value, triggers a ROS. The B/.10,000 rules are separate cash and quasi-cash transaction-reporting duties.
What is Panama's B/.10,000 reporting rule?+
Law 23 article 53 lists specified cash and quasi-cash transactions at B/.10,000 or more and defined daily or weekly aggregation cases. Apply the exact category and current reporting instructions.
How is beneficial ownership determined in Panama?+
Trace ownership and control to natural persons. For RUBF identification, Decree 2 of 2023 uses 10% or more for financial obliged entities and 25% or more for non-financial obliged entities, while control and influence tests remain relevant.
How long are Panama AML records retained?+
At least five years under Law 23 and the current banking rule, with the relevant end-of-relationship or transaction trigger and any longer sector requirement documented.
What happens on a UN sanctions match?+
Apply the preventive-freezing process without delay, avoid prior notice, and communicate through the UAF route. Preserve the designation, identifiers, freeze time and authority communications.
Does SBP AML registration fully license a payments company?+
No. The SBP register expressly concerns AML/CFT/CPF supervision. The business must separately confirm every operating, corporate, remittance, consumer and network permission that its model requires.
Does Panama have a general VASP licence?+
No general standalone VASP licensing framework was identified at the 1 August 2026 review date. That is not an exemption: the exact model still requires AML, payments, securities, remittance, sanctions, consumer and tax perimeter analysis.
Is Panama currently on a FATF public list?+
Panama was removed from increased monitoring in October 2023 and was not named on the FATF public call-for-action or increased-monitoring lists reviewed 1 August 2026.
Méthode de recherche et de revue
VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.
General regulatory information, not legal advice, an authorization decision or a substitute for the operative Spanish text, official reporting instructions or regulator confirmation. Reviewed 1 August 2026. Confirm entity, activity, customer, transaction, reporting channel, sanctions route, privacy role and later developments with qualified Panamanian counsel and the competent authority before launch.