Key Takeaways
- AML and KYC obligations in Panama are set out under Law 23 of 2015 and supporting regulations, defining which financial and non-financial parties are obligated entities.
- Customer due diligence and KYC identification apply to clients, with enhanced due diligence required for politically exposed persons and high-risk relationships.
- Registered agents carry specific KYC duties, and obligated entities must maintain records, conduct ongoing monitoring, and report suspicious transactions within set timelines.
- Failing to meet AML requirements can lead to penalties and other consequences, making ongoing compliance a continuing responsibility for foreign-owned companies.
AML and KYC Obligations in Panama: An Overview
AML/KYC in Panama is a binding obligation, not a formality. The framework rests on Law 23 of 27 April 2015, which sets out the measures that obligated parties must apply to prevent money laundering, terrorist financing, and the financing of weapons of mass destruction. A foreign owner of a Panamanian company does not file these obligations personally in most cases; the duties fall on the entity's resident agent, its bank, and any regulated professional involved in its affairs, all of whom collect and verify information about you and the company's beneficial owners.
This article explains how the regime works in practice: which parties carry the duties, who supervises them, what due diligence and reporting they must perform, how long records are held, and what happens when obligations are missed. The full text of the governing statute is available from the Ministry of Economy. It is most relevant to non-resident shareholders, directors, and their advisers who need to understand why their service providers ask for identity documents and source-of-funds evidence, and what is expected of the company in return.
The Legal Framework: Law 23 of 2015 and Supporting Regulations
Law 23 of 2015 is the backbone. It is supplemented by Decree 363 of 13 August 2015, the implementing regulation that translates the statute into concrete due diligence steps: customer identification, gathering information on the origin of funds, risk analysis, record preservation, suspicious-transaction reporting, and cooperation with authorities. Both instruments have been amended since enactment.
Several later laws extended the perimeter. Law 70 of 2019 strengthened the rules against terrorist and proliferation financing in line with international standards. Law 129 of 17 March 2020 created the private beneficial ownership registry, the RUBF, regulated by Executive Decree No. 13 of 25 March 2022.
The Pandora Papers prompted Law 254 of November 2021, which built on the existing framework and tightened requirements on accounting records, resident agent duties, and compliance deadlines. For non-financial obligated parties, Law 21 of 10 May 2017 set the administrative sanctions regime, granting supervisors power to fine, close establishments, suspend licenses, and publish sanctions.
The Financial Action Task Force grey-listed Panama in June 2019 over deficiencies in beneficial-ownership transparency and AML enforcement. After completing its action plan, confirmed by an onsite visit in September 2023, the country exited the grey list at the FATF October 2023 Plenary.
Two further laws shape the picture for company owners. Law 52 of 2016 requires offshore entities to keep accounting records for at least five years, and Law 47 of 2013 (amended by Law 18 of 2015) governs the custody of bearer share certificates through an authorized custodian.
Panama Company Incorporation in Panama
Set up your company in Panama with Expanship handling registration end to end.
Who Is an Obligated Entity: Financial and Non-Financial Reporting Parties
The duties of Law 23 attach to defined categories of obligated subjects, not to the general public. These split into two broad groups, with a third covering virtual assets.
Financial Reporting Entities cover the regulated money sector:
- Banks offering loans, deposits, and payment services
- Securities brokers and fund managers
- Credit cooperatives and money remitters
- Issuers and reinsurers
Non-Financial Reporting Entities, often called DNFBPs, reach the professions and businesses most exposed to layering:
- Casinos and gaming venues
- Real estate professionals handling large-sum transactions
- Lawyers and notaries who manage client funds or form companies
- Accountants and corporate service providers
- Dealers in precious metals and gems
Virtual asset service providers fall within scope as well: they must comply with AML rules, register, and report suspicious activity. Resident agents are explicitly obligated subjects under both Law 23 and Law 129, a point that matters directly to every foreign-owned company, since the agent carries your entity's compliance burden.
Each obligated party must appoint a person or unit to act as liaison between the Financial Analysis Unit and its supervisor. Until that appointment is formalised, the legal representative performs the liaison role.
Supervisory Authorities and the Financial Analysis Unit
The Unidad de Análisis Financiero, the UAF, is the country's financial intelligence unit and the central hub for AML enforcement. It receives, analyses, and disseminates information on suspected money laundering and terrorist financing, and serves as the recipient of suspicious-transaction reports.
Supervision is divided by sector. The Superintendencia de Bancos de Panamá examines banks and financial institutions for compliance with AML/CTF rules, including KYC policies. The Ministry of Economy's AML/CTF unit oversees the non-financial sector, including all free zones.
For company owners, the most relevant supervisor is the Superintendencia de Sujetos No Financieros, the SSNF, which administers the beneficial ownership register. Your company must give its resident agent the information needed to identify its beneficial owners, and the agent records that detail in the registry the SSNF manages.
A wider set of competent authorities supports enforcement, including the Public Prosecutor's Office, the Ministry of Economy and Finance, and the tax authority (DGI). An interoperability agreement signed on 21 November 2022 connects the databases held by the SSNF, the public registry, the UAF, the DGI, and other agencies to validate beneficial-ownership data.
Panama Ongoing Compliance in Panama
Keep your Panama entity compliant with filings, returns, and statutory obligations.
Customer Due Diligence and KYC Identification Requirements
Customer due diligence is mandatory for every obligated entity. When your company opens a bank account, engages a law firm, or buys property, the counterparty must verify identity and understand the relationship before proceeding.
The core CDD elements under Law 23 and Decree 363 are threefold:
- Identity verification using a passport, national ID, or driver's license
- Understanding the relationship by gathering information on the client's activities, transactions, and goals
- Identifying control of any legal entity, meaning its beneficial owners
The beneficial owner is defined, following the harmonisation in Law 254, as the natural person who ultimately owns, controls, or exercises significant influence over a client or relationship, or on whose behalf a transaction is conducted. For a foreign-owned company, this means the individual behind the structure, not an intermediate holding entity, must be identified.
Banks apply a risk-based approach aligned with FATF recommendations, calibrating scrutiny to the risk a client presents. Two defined concepts drive monitoring: an unusual operation departs from the customer's declared profile and must be justified, while a suspicious operation cannot be reconciled with that profile or may connect to financial crime.
| Report type | Threshold | Recipient |
|---|---|---|
| Cash transaction report | US $10,000 or more (single or successive) | UAF |
| Suspicious transaction report | No monetary threshold | UAF |
Enhanced Due Diligence, Politically Exposed Persons, and High-Risk Clients
Where risk rises, so does the depth of inquiry. Enhanced due diligence goes beyond standard checks into a closer examination of a client's profile, background, activities, and source of funds.
Several categories trigger this heightened scrutiny:
- Politically exposed persons, defined as national or foreign individuals holding high-ranking public functions, together with their relatives, because of elevated corruption risk
- Clients from high-risk jurisdictions with weak AML controls
- Shell companies and trusts that require extra work to confirm transparency
The mandatory identification of PEPs and of the ultimate beneficiary was a notable addition when Law 23 entered force. If you or a related person hold a senior public role, expect deeper questions and longer onboarding when your company seeks banking or professional services.
Screening is part of EDD. Obligated parties check clients against United Nations, OFAC, European Union, and GAFILAT-relevant sanctions lists, alongside national lists. The compliance officer who leads this work liaises with the UAF, and entities must protect the confidentiality of staff performing compliance duties.
Panama Panama Incorporation Pricing
See transparent pricing to incorporate and maintain a company in Panama.
Ongoing Monitoring and Periodic Review of Client Information
Due diligence is a continuing duty, not a single event at onboarding. Obligated parties must monitor transactions throughout the relationship and report anything suggestive of illicit activity.
For company structures, the most concrete ongoing duty falls on the resident agent: beneficial-ownership changes must be registered in the RUBF within 15 business days of the event. This is why your agent will ask to be told promptly when shareholders, directors, or controllers change.
Risk profiles are expected to be refreshed as circumstances shift, with high-risk clients reviewed more often under the risk-based model. No fixed statutory review cycle (such as an annual or triennial file refresh) is published in retrievable sources, so periodicity follows supervisory guidance and the risk a client presents.
The IMF's 2024 financial sector assessment flagged a historic weakness: gaps in the obligations placed on resident agents had limited assurance that shareholder and beneficial-ownership information stayed accurate and current. The later layers of law, particularly the RUBF and Law 254, were designed to close that gap.
AML Record-Keeping and Retention Requirements
The headline figure is five years. Records related to due diligence must be kept by the resident agent and the obligated entity for at least five years after the business relationship ends.
Two distinct record sets sit in different places:
- Beneficial-ownership data is uploaded by the resident agent to the RUBF, administered by the SSNF
- CDD and due diligence files remain with the resident agent and the obligated entity for the retention period
A separate accounting-record obligation runs alongside the AML rules. Under Law 52 of 2016, confirmed by Law 254, legal entities (including corporations and private interest foundations) must keep accounting records and supporting documentation for at least five years; that subject has its own detailed requirements beyond AML.
The RUBF is private, not public. It is accessible to competent authorities, and Law 23 provides mechanisms for exchanging information with foreign authorities to address cross-border crime.
Suspicious Transaction Reporting and Reporting Timelines
Reporting suspicion is a core duty. Banks, law firms, real estate agencies, and other service providers must report any activity that suggests money laundering or other illicit conduct.
A suspicious transaction report goes to the UAF within 15 working days of detecting the suspicious activity. No monetary threshold applies: if conduct is suspicious, it is reported regardless of value. The separate cash transaction report covers movements of US $10,000 or more.
Tipping off is a distinct offence. Disclosing to a client, or to any unauthorised third party, that a report has been filed carries its own criminal liability, and obligated parties must protect the confidentiality of staff who file. The receiving authority is the UAF; the named electronic submission portal is not specified in retrievable public sources.
For a foreign owner, the practical effect is that a bank or professional may decline or pause a transaction without explanation. They are legally barred from telling you a report has been made.
The Role and KYC Duties of the Registered Agent
Every Panamanian company must appoint a resident agent, and that agent must be a local attorney or law firm. This is the single most important AML relationship for a non-resident owner, because the agent is personally liable for the company's compliance with beneficial-ownership and AML obligations.
The agent's duties are concrete:
- Obtain and keep current the due diligence documentation of the legal entity
- Register beneficial ownership in the RUBF within 15 business days of incorporation
- Update the RUBF within 15 business days of any change to that information
- Safeguard due diligence records for at least five years after the relationship ends
The information flow runs from you to the agent to the registry. Your company supplies the data needed to identify beneficial owners; the agent records it in the register the SSNF manages. Where a corporation has issued bearer shares, an authorized custodian holds the certificates and the associated ownership information under the immobilisation regime.
Because the resident agent bears personal liability and controls your RUBF filings, the quality and responsiveness of that appointment directly affects whether your company stays compliant.
Penalties and Consequences for AML Non-Compliance
Failures carry administrative, financial, and criminal consequences. For non-financial obligated parties, Law 21 of 2017 lets supervisors impose fines, close establishments, suspend licenses, and publish sanctions.
The penalties most likely to reach a foreign-owned company concern registry and record obligations:
| Failure | Consequence |
|---|---|
| Beneficial-ownership not registered in RUBF | Fine up to US $5,000 per entity, plus daily fines until corrected |
| Share and minute registers not maintained (Law 22 of 2015) | Daily fine; Public Registry annotation blocking dissolution until fixed |
| Broader non-compliance | Suspension of the company's tax ID; legal action against administrators |
Exact fine schedules under Law 23 and Decree 363 for specific CDD or STR failures are not published in retrievable primary sources; the regime confirms that fines exist and escalate, but precise statutory bands require verification against the official Gaceta Oficial. Serious violations can lead to criminal charges against individuals and entities.
Beyond individual penalties lies the systemic cost. The grey-listing between June 2019 and October 2023 raised friction and scrutiny for every Panamanian entity seeking foreign banking, a reminder that national AML performance affects each company's access to the financial system.
Conclusion
For a non-resident owner, the practical weight of AML/KYC in Panama sits with your resident agent and your bank, not on a form you file yourself. What you control is the quality of information you give them and the speed with which you report changes, because their personal liability and your company's good standing both depend on it.
The next step worth weighing is the strength of your resident agent relationship: a slow or careless agent is the most common reason a Panamanian company falls behind on RUBF updates and due diligence records.
How Expanship Can Help Your Business in Panama
Expanship supports foreign owners across the full AML/KYC cycle in Panama, from preparing beneficial-ownership and source-of-funds documentation to coordinating with your resident agent on RUBF filings and keeping due diligence records current. The same team handles the wider compliance needs of a foreign-owned entity, so your obligations are managed in one coordinated workstream rather than scattered across providers.
- Company formation and structuring for non-residents
- Resident agent and registered office appointment
- Ongoing compliance and filing management
- Accounting and bookkeeping in line with record-retention rules
- Beneficial-ownership registration and economic-substance support
- Introductions to banking partners
To discuss your company's requirements, contact Expanship Panama.
Frequently Asked Questions
In most cases, no. The reporting and due diligence duties fall on obligated parties such as your resident agent, bank, and any regulated professional, while your responsibility is to provide accurate identity and beneficial-ownership information and report changes promptly. The resident agent registers your beneficial owners in the RUBF, not you directly.
The resident agent must register beneficial ownership in the RUBF within 15 business days of incorporation and update it within 15 business days of any subsequent change. This is why you should notify your agent immediately when shareholders, directors, or controllers change.
The minimum retention period is five years. Due diligence records are held by the resident agent and the obligated entity for at least five years after the business relationship ends, and offshore entities must keep accounting records for at least five years under Law 52 of 2016.
Any activity that cannot be reconciled with a client's financial profile, or that may connect to money laundering or terrorist financing, must be reported to the Financial Analysis Unit, the UAF, within 15 working days. There is no monetary threshold for a suspicious transaction report; cash movements of US $10,000 or more are reported separately.
Bearer shares are not banned but are subject to a custody regime under Law 47 of 2013 as amended. The certificates must be held by an authorized custodian, typically a bank or trustee, who also keeps the related beneficial-ownership information.
Failure to register can bring a fine of up to US $5,000 per unregistered entity, with additional daily fines until the omission is corrected. The registry is private and accessible only to competent authorities, so registration does not make your ownership public, but non-registration exposes the company and its agent to escalating penalties.
Legal Disclaimer
The information provided in this article is for general informational purposes only and does not constitute legal, tax, or professional advice. While we strive to ensure the accuracy and timeliness of the content, laws and regulations are subject to change, and the application of laws can vary widely based on specific facts and circumstances.
Readers should not act upon this information without seeking professional counsel tailored to their individual situation. Expanship and its authors disclaim any liability for actions taken or not taken based on the content of this article.
For specific advice regarding your business setup, compliance requirements, or any legal matters, please consult with qualified legal and tax professionals in the relevant jurisdiction.
