Panama KYC & AML compliance checklist
A practical, source-linked checklist for implementing KYC, KYB and AML requirements in Panama.
Direct answer
What does the Panama compliance checklist cover?
The Panama checklist translates primary KYC, KYB and AML rules into 11 control areas and 33 implementation checks. It identifies the relevant authorities, customer and beneficial-owner controls, reporting duties, recordkeeping expectations and evidence teams should retain.
Key regulatory facts
- National FIU
- Unidad de Analisis Financiero (UAF)
- Core AML framework
- Law 23 of 27 April 2015, as amended, plus sector rules
- Banking rule in force
- SBP Agreement 1-2026, operative from July 2026; it repealed Agreement 10-2015
- Suspicious reports
- Directly and immediately to UAF, including attempted operations; no monetary threshold
- Cash and quasi-cash reports
- B/.10,000 or more, including specified daily or weekly aggregation cases under Law 23 article 53
- AML record retention
- At least 5 years, with the trigger and sector rule documented
- Beneficial-owner thresholds
- Control is not only percentage-based; Decree 2 of 2023 uses 10% or more for financial obliged entities and 25% or more for non-financial obliged entities in the RUBF identification criteria
- Privacy authority
- Autoridad Nacional de Transparencia y Acceso a la Informacion (ANTAI)
- Payments and e-money
- SBP AML registration may apply, but it is expressly limited to AML/CFT/CPF supervision and does not replace other operating permissions
- Virtual assets
- No general standalone VASP licensing framework was identified; perform product-by-product AML, payments, securities and other perimeter analysis
- FATF status
- GAFILAT member; removed from FATF increased monitoring in October 2023 and not named on the public lists reviewed 1 August 2026
Implementation detail
Panama compliance requirements and actions
Open each control area to review the requirement, recommended implementation action, evidence to retain and the primary-source citation used by the research team.
01Scope, authorities and licensingResolve the exact legal entity, product and supervisory perimeter before selecting controls; Panama uses different supervisors and sector rules.3 items+
Financial and non-financial activities listed by Law 23 are subject to AML/CFT/CPF supervision by the authority allocated to that sector.
- Implementation action
- Map every service, customer type and delivery channel to Law 23 articles 22-24 and the current sector rule; obtain a written perimeter decision before launch.
- Evidence to retain
- Legal-entity map, product inventory, statutory classification, supervisor confirmation and board launch approval.
- Primary citation
- Law 23 of 2015 arts. 19-24
Banks and trust companies must use SBP Agreement 1-2026 rather than the repealed Agreement 10-2015.
- Implementation action
- Version-control the July 2026 rule migration and preserve the special adaptation dates for article 14 and article 25 paragraph 1 where relevant.
- Evidence to retain
- Rule inventory, repeal check, gap assessment, remediation plan and implementation sign-off.
- Primary citation
- SBP Agreement 1-2026 arts. 52-53; SBP Circular 2026-0011
Payments or e-money businesses within Law 23 must obtain SBP registration for AML supervision, without treating that registration as a full operating licence.
- Implementation action
- Submit the model to SBP, confirm the current register and separately identify every corporate, consumer, payment-network, remittance or other permission needed.
- Evidence to retain
- Perimeter opinion, SBP correspondence and registration, other licences and launch conditions.
- Primary citation
- Law 23 art. 22(1)(g); SBP payments and e-money register
02Governance and risk assessmentGovernance must reflect the entity's own risks and the requirements of its competent supervisor.3 items+
Obliged entities must maintain risk-based policies, controls and monitoring proportionate to customer, product, channel and geographic exposure.
- Implementation action
- Approve an enterprise risk assessment and translate its results into customer-risk tiers, acceptance rules, scenarios and review frequencies.
- Evidence to retain
- Risk methodology, data inputs, board approval, control mapping, model validation and change log.
- Primary citation
- Law 23 arts. 25-26 and 40; SBP Agreement 1-2026 arts. 9-12
The compliance function must have authority, independence, resources and direct escalation under the applicable sector rules.
- Implementation action
- Appoint qualified accountable officers, document deputies and conflicts, and provide unrestricted access to relevant records and senior governance.
- Evidence to retain
- Appointment, role profile, reporting line, committee minutes, budget, training and escalation records.
- Primary citation
- Law 23 arts. 41-43; SBP Agreement 1-2026 arts. 37-46
Policies and systems must be independently tested and corrected when deficiencies are found.
- Implementation action
- Run risk-based compliance testing and audit, assign owners and deadlines, and verify closure rather than accepting management assertion alone.
- Evidence to retain
- Test plan, samples, findings, corrective actions, evidence of closure and board reporting.
- Primary citation
- Law 23 arts. 20 and 40-43; applicable supervisor rules
03Natural-person KYC and representativesIdentity controls must establish who the person is, who they represent and whether the activity matches the stated profile.3 items+
Obliged entities must identify and reasonably verify natural-person customers using reliable information and documents.
- Implementation action
- Capture official identity, address, occupation, purpose, expected activity and source information; authenticate evidence and resolve discrepancies before activation.
- Evidence to retain
- Identity images, authenticity results, address and occupation evidence, timestamps, reviewer and exceptions.
- Primary citation
- Law 23 art. 27; SBP Agreement 1-2026 arts. 9-10 and 18
Representatives, signatories and attorneys-in-fact must be identified and their authority validated.
- Implementation action
- Verify the individual, inspect the current power or mandate, confirm scope and expiry, and link all represented parties to the customer record.
- Evidence to retain
- Representative KYC, power, registry or notarial check, authority analysis and expiry control.
- Primary citation
- Law 23 arts. 27-28; applicable sector identification rules
If required identity or beneficial-owner information cannot be obtained, the relationship must not begin or continue and suspicion must be assessed.
- Implementation action
- Block onboarding or activity, preserve the failed-control record, escalate promptly and decide whether an attempted-operation ROS is required without tipping off.
- Evidence to retain
- System block, missing-information log, escalation, ROS decision and communication record.
- Primary citation
- Law 23 arts. 28(7), 36 and 54; SBP Agreement 1-2026 arts. 17 and 19
04KYB, registries and beneficial ownershipCorporate existence, authority, ownership and control are separate checks; registry evidence does not replace a complete beneficial-owner analysis.3 items+
Legal-person CDD must identify the entity, its purpose, controllers, representatives and natural-person beneficial owners.
- Implementation action
- Obtain constitutional and current registry evidence, trace direct and indirect ownership, assess control by other means and identify the natural person behind the relationship.
- Evidence to retain
- Registry certificate, constitutional documents, ownership chart, control memo, declarations and independent corroboration.
- Primary citation
- Law 23 art. 28; SBP Agreement 1-2026 arts. 6 and 19
RUBF identification criteria use 10% or more for financial obliged entities and 25% or more for non-financial obliged entities, but control and influence tests also apply.
- Implementation action
- Calculate direct and indirect holdings, voting rights and other control; do not stop at a percentage where another natural person exercises ultimate control.
- Evidence to retain
- Cap table, indirect calculations, voting agreements, board rights, control analysis and approval.
- Primary citation
- Executive Decree 13 of 2022 art. 10, as amended by Executive Decree 2 of 2023
Resident agents must maintain and update beneficial-owner information in the private RUBF under Law 129.
- Implementation action
- Obtain the required data from the legal person, file through the SSNF system, track changes and reconcile the RUBF record with the AML customer file.
- Evidence to retain
- Resident-agent request, RUBF certificate, change notices, update receipt and reconciliation log.
- Primary citation
- Law 129 of 2020 arts. 10-13, as amended by Law 254 of 2021
05PEPs, EDD and remote onboardingHigher-risk relationships require documented approval, deeper source analysis and intensified monitoring.3 items+
Systems must identify domestic, foreign and international-organisation PEPs, relevant family members and close associates.
- Implementation action
- Screen customers, representatives and beneficial owners at onboarding and continuously; document role, relationship and the period for which enhanced treatment remains appropriate.
- Evidence to retain
- Screening results, role research, relationship map, disposition and review date.
- Primary citation
- Law 23 arts. 4 and 34; SBP Agreement 1-2026 arts. 26-27
PEP and other high-risk relationships require enhanced due diligence proportionate to risk.
- Implementation action
- Obtain senior approval, establish source of wealth and source of funds, understand expected activity and apply intensified monitoring and refresh.
- Evidence to retain
- Approval, wealth and funds evidence, adverse-information review, monitoring plan and periodic review.
- Primary citation
- Law 23 arts. 34 and 39; SBP Agreement 1-2026 arts. 20-21 and 26-27
Remote onboarding remains subject to the same accountable identity and risk outcomes as in-person onboarding.
- Implementation action
- Validate the permitted remote method, test impersonation and presentation attacks, bind device and session evidence, and maintain an accessible fallback.
- Evidence to retain
- Legal mapping, vendor assessment, biometric or liveness tests where used, device logs, exceptions and quality testing.
- Primary citation
- Law 23 arts. 25-28; SBP Agreement 1-2026 arts. 9-21
06Monitoring, suspicious reporting and confidentialitySuspicion is reportable immediately and independently of the cash-reporting threshold.3 items+
Completed and attempted suspicious operations must be reported directly and immediately to UAF.
- Implementation action
- Escalate on detection, document the grounds and knowledge time, submit through the current UAF channel and preserve the acknowledgement and any supplement.
- Evidence to retain
- Alert, investigation, decision timeline, ROS, UAF receipt, supplement and access log.
- Primary citation
- Law 23 art. 54; SBP Agreement 1-2026 arts. 33-36
The entity must monitor activity against the customer profile and investigate unusual patterns.
- Implementation action
- Deploy risk-based scenarios for cash, rapid movement, structuring, counterparties, geography, devices and attempted activity; tune and quality-test results.
- Evidence to retain
- Scenario inventory, thresholds, alerts, case files, tuning, validation and management information.
- Primary citation
- Law 23 arts. 36 and 40; SBP Agreement 1-2026 arts. 23-25 and 32-35
Reporting and related requests are confidential and must not be disclosed to the customer or unauthorised persons.
- Implementation action
- Restrict case access, use approved communications, separate customer servicing from ROS decisions and train staff against tipping off.
- Evidence to retain
- Access controls, confidentiality acknowledgements, training, communications and incident log.
- Primary citation
- Law 23 arts. 55 and 56
07Cash, wires, payments and agentsThreshold reports, wire data and payment-business registration are distinct controls.3 items+
Specified cash and quasi-cash transactions of B/.10,000 or more, including defined daily or weekly aggregates, must be reported under article 53.
- Implementation action
- Implement transaction and aggregation logic for each listed category, use the current reporting format and keep the threshold report separate from the ROS decision.
- Evidence to retain
- Aggregation rules, daily and weekly tests, report, receipt, exception log and reconciliation.
- Primary citation
- Law 23 art. 53; applicable UAF and supervisor reporting instructions
Bank transfers must carry and preserve required originator and beneficiary information and deficient transfers require controls.
- Implementation action
- Validate mandatory fields before execution, monitor missing or inconsistent data, apply hold/reject/escalate rules and screen all relevant parties.
- Evidence to retain
- Payment message, field validation, screening, exception decision and audit trail.
- Primary citation
- Law 23 art. 46; SBP Agreement 2-2017, as amended
Use of agents, processors or vendors does not remove the obliged entity's responsibility.
- Implementation action
- Contract for control standards, evidence access, audit rights, incident notice and termination; test agent and vendor performance continuously.
- Evidence to retain
- Due diligence, contract, control map, sample testing, incidents and exit plan.
- Primary citation
- Law 23 arts. 35 and 37; applicable sector rules
08Targeted financial sanctionsUN designations require immediate operational capability, not only periodic customer screening.3 items+
Obliged entities must implement preventive freezing of funds or assets connected to applicable UN Security Council designations without delay.
- Implementation action
- Screen customers, beneficial owners, counterparties and assets on list updates and before relevant transactions; freeze without prior notice where required and follow the UAF route.
- Evidence to retain
- List source, screening timestamp, match analysis, freeze record, UAF communication and legal escalation.
- Primary citation
- Law 23 arts. 49-52; Executive Decree 587 of 2015; UAF freezing process
Potential matches must be resolved accurately without releasing assets prematurely or freezing unrelated persons indefinitely.
- Implementation action
- Use documented identifiers, escalation and false-positive procedures; follow competent-authority instructions for confirmation, access and release.
- Evidence to retain
- Match packet, identifiers, counsel review, authority correspondence and release approval.
- Primary citation
- Executive Decree 587 of 2015 and UAF procedures
Sanctions screening must cover control, ownership and persons acting on behalf of designated parties.
- Implementation action
- Extend screening beyond customer names to natural-person owners, controllers, representatives, payment parties and relevant assets.
- Evidence to retain
- Ownership screening, relationship mapping, payment screening and periodic rescreen logs.
- Primary citation
- Law 23 arts. 49-52; applicable UN Security Council resolutions
09Records and regulator accessRecords must reconstruct the customer decision and transaction, remain secure and be retrievable for authorities.3 items+
CDD, beneficial-owner and transaction records must be retained for at least five years under Law 23 and applicable sector rules.
- Implementation action
- Define the correct trigger for each record class, suspend deletion for investigations or authority requests and document any longer sector period.
- Evidence to retain
- Retention schedule, legal mapping, deletion controls, holds and tested retrieval.
- Primary citation
- Law 23 art. 29; SBP Agreement 1-2026 art. 29
Records must be sufficient to reconstruct transactions and demonstrate the basis for risk and reporting decisions.
- Implementation action
- Preserve source documents, versions, approvals, screening, monitoring, communications and reports in an auditable sequence.
- Evidence to retain
- Complete sample file, immutable audit trail, version history and reconstruction test.
- Primary citation
- Law 23 arts. 29-30 and 36; applicable supervisor rules
UAF and competent supervisors must receive information through lawful, secure and timely channels.
- Implementation action
- Maintain current credentials, authority-verification procedures, response owners and an indexed production log.
- Evidence to retain
- Request, authority check, production index, secure delivery receipt and legal hold.
- Primary citation
- Law 23 arts. 11-12, 20 and 59
10Privacy, biometrics and transfersAML processing has a legal purpose, but data minimisation, transparency, security and transfer controls still apply.3 items+
Personal-data processing must comply with Law 81 principles and provide required information about purpose, use, recipients and rights unless a lawful exception applies.
- Implementation action
- Map each KYC field and disclosure to a legal basis, issue a clear notice, minimise optional data and prevent the notice from revealing confidential ROS activity.
- Evidence to retain
- Data inventory, legal-basis record, notice version, consent where used and rights log.
- Primary citation
- Law 81 of 2019 arts. 2-9; Executive Decree 285 of 2021
Sensitive and biometric data require heightened necessity, security and access controls.
- Implementation action
- Document why biometrics are necessary, test accuracy and bias, encrypt templates, restrict access and provide a workable alternative where legally required.
- Evidence to retain
- Necessity assessment, consent or exception, security design, vendor tests, access log and deletion rule.
- Primary citation
- Law 81 of 2019 arts. 4-9 and 19-24; Executive Decree 285 of 2021
Processors and cross-border transfers must preserve Law 81 protections and mandatory AML access.
- Implementation action
- Map locations and subprocessors, contract for confidentiality, security, incident handling, deletion and regulator access, and assess each transfer mechanism.
- Evidence to retain
- Data-flow map, transfer assessment, contracts, subprocessor register and incident plan.
- Primary citation
- Law 81 of 2019 arts. 15-18 and 24; Executive Decree 285 of 2021
11Fintech, virtual assets and practical evidence packsInnovative products require a documented perimeter decision and the same reconstructable compliance evidence as traditional channels.3 items+
A technology label does not determine whether banking, payments, remittance, securities or AML rules apply.
- Implementation action
- Analyse custody, settlement, stored value, redemption, returns, transfer, customer-fund control and marketing before launch; seek each relevant authority's confirmation.
- Evidence to retain
- Product flow, funds-flow diagram, legal opinions, regulator correspondence, conditions and approval.
- Primary citation
- Law 23 arts. 22-24; Banking Law; Securities Law; SBP innovative-products guidance
Panama did not have a general standalone VASP licensing framework identified as at the review date.
- Implementation action
- Do not describe absence of a standalone VASP law as exemption: assess AML obliged-entity status, securities, payments, remittance, consumer, tax and sanctions rules for the exact model.
- Evidence to retain
- Dated perimeter memo, legal sources, authority checks, risk assessment and monitoring plan.
- Primary citation
- Law 23; SBP and SSNF current registers and guidance, reviewed 1 August 2026
Every implemented control should have a compact, reviewable evidence pack.
- Implementation action
- Assign an owner, applicability decision, procedure, system control, test, exception process and remediation date to every checklist row.
- Evidence to retain
- Control matrix, RACI, evidence links, test results, gaps, remediation and final approval.
- Primary citation
- Recommended implementation control supporting Law 23 and sector-rule compliance
Primary-source register
16 sources used for this checklist
Use these links to verify the underlying legislation, regulator guidance, reporting procedures and international status statements.
- Law 23 of 27 April 2015 - UAF consolidated textUnidad de Analisis Financiero · Primary legislation
- Panama AML and transparency laws registerUnidad de Analisis Financiero · Official legislation register
- Law 129 of 2020 - beneficial-owner register consolidated textUnidad de Analisis Financiero · Primary legislation
- Law 254 of 2021 - AML and international tax transparency amendmentsUnidad de Analisis Financiero · Primary legislation
- Executive Decree 13 of 2022 - RUBF regulationGaceta Oficial de Panama · Primary regulation
- Executive Decree 2 of 2023 - amended RUBF identification criteriaSuperintendencia de Sujetos no Financieros · Primary regulation
- SBP Agreement 1-2026 - prevention for banks and trust companiesSuperintendencia de Bancos de Panama · Primary sector regulation
- SBP Agreement 2-2017 consolidated - fund transfersSuperintendencia de Bancos de Panama · Primary sector regulation
- UAF preventive-freezing processUnidad de Analisis Financiero · Official sanctions procedure
- SBP payments and e-money AML registerSuperintendencia de Bancos de Panama · Official current register
- SBP innovative financial-technology guidanceSuperintendencia de Bancos de Panama · Official perimeter guidance
- Law 81 of 2019 - personal data protectionAutoridad Nacional de Transparencia y Acceso a la Informacion · Primary legislation
- Panama data-protection legislation registerAutoridad Nacional de Transparencia y Acceso a la Informacion · Official legislation register
- Panama Emprende operating-notice guidanceMinisterio de Comercio e Industrias · Official business-registration guidance
- FATF Panama country page and October 2023 exit statementFinancial Action Task Force · Official country-status source
- FATF black and grey listsFinancial Action Task Force · Official current-status source
Direct answers
Panama KYC, KYB and AML questions
Who receives suspicious-operation reports in Panama?+
The Unidad de Analisis Financiero (UAF). Law 23 requires obliged entities to report directly and immediately, including attempted suspicious operations, through the current official channel.
Is there a monetary threshold for a Panama ROS?+
No. Suspicion, not value, triggers a ROS. The B/.10,000 rules are separate cash and quasi-cash transaction-reporting duties.
What is Panama's B/.10,000 reporting rule?+
Law 23 article 53 lists specified cash and quasi-cash transactions at B/.10,000 or more and defined daily or weekly aggregation cases. Apply the exact category and current reporting instructions.
How is beneficial ownership determined in Panama?+
Trace ownership and control to natural persons. For RUBF identification, Decree 2 of 2023 uses 10% or more for financial obliged entities and 25% or more for non-financial obliged entities, while control and influence tests remain relevant.
How long are Panama AML records retained?+
At least five years under Law 23 and the current banking rule, with the relevant end-of-relationship or transaction trigger and any longer sector requirement documented.
What happens on a UN sanctions match?+
Apply the preventive-freezing process without delay, avoid prior notice, and communicate through the UAF route. Preserve the designation, identifiers, freeze time and authority communications.
Does SBP AML registration fully license a payments company?+
No. The SBP register expressly concerns AML/CFT/CPF supervision. The business must separately confirm every operating, corporate, remittance, consumer and network permission that its model requires.
Does Panama have a general VASP licence?+
No general standalone VASP licensing framework was identified at the 1 August 2026 review date. That is not an exemption: the exact model still requires AML, payments, securities, remittance, sanctions, consumer and tax perimeter analysis.
Is Panama currently on a FATF public list?+
Panama was removed from increased monitoring in October 2023 and was not named on the FATF public call-for-action or increased-monitoring lists reviewed 1 August 2026.
Research and review method
VOVE ID Compliance Research maps the regulatory perimeter, translates obligations into operational controls, links each material claim to a source and records the date and version of every review.
General regulatory information, not legal advice, an authorization decision or a substitute for the operative Spanish text, official reporting instructions or regulator confirmation. Reviewed 1 August 2026. Confirm entity, activity, customer, transaction, reporting channel, sanctions route, privacy role and later developments with qualified Panamanian counsel and the competent authority before launch.