Cross-chain bridges – the protocols that lock assets on one blockchain and mint equivalent tokens on another – sit in one of the most legally ambiguous positions in digital-asset infrastructure. A business operating or integrating a bridge in Panama faces a layered set of questions: Is the bridge a regulated financial service? Who is liable when the smart contract fails or is exploited? How does Panama's current legal environment interact with the MiCA-influenced standards that counterparties and banking partners increasingly demand? This guide answers those questions step by step, with the cross-border dimension built into each stage.
Why Panama Matters for Bridge Operators
Panama currently has no dedicated digital-asset licensing statute that squarely addresses cross-chain bridge operations, making it an environment of legal gaps rather than clear permissions. That absence cuts two ways. It means a bridge operator structured through a Panamanian entity is not required to hold a local virtual-asset service provider authorization to run the protocol. It also means the operator cannot rely on a local regulatory safe harbor if a bridge transaction is characterized, by a foreign regulator, as a securities transfer, a payment transmission or an unlicensed exchange function.
Panama passed Law 129 of 2022 addressing virtual assets, establishing a registration and supervision regime administered through the Superintendence of Non-Financial Subjects (SSNF). The law captures businesses providing virtual asset services – including exchange, transfer and custody – that operate from Panama. A cross-chain bridge that accepts user funds, locks them on a source chain and issues wrapped tokens on a destination chain arguably performs an exchange and a transfer function simultaneously. Whether a particular bridge falls within the Law 129 scope depends on its architecture, its governance model and whether the operator can genuinely be described as providing a service to identified users.
In our cross-border practice, we have seen operators assume that a smart-contract-mediated bridge with no central counterparty escapes VASP classification entirely. That assumption is increasingly unsustainable. Regulators in the leading hubs – VARA, ESMA under MiCA, and the FCA under the Money Laundering Regulations – are progressively applying substance-over-form analysis. If a Panamanian entity controls upgrade keys, fee parameters or the oracle that triggers unlocking, it is exercising custodial and decision-making functions that regulators treat as a service, not a protocol.
The practical risk for a bridge operator starting in Panama is not primarily a Panamanian enforcement action. It is the downstream consequence: banking closure, foreign regulatory referral and, in the event of an exploit, personal liability exposure in the jurisdiction where affected users sit.
For a first assessment of where your bridge architecture lands under Law 129 and the cross-border exposure it creates, contact OBOLUS at info@oboluslaw.com. The process above describes the standard analysis path. Your facts – the entity, the smart-contract architecture, the user base geography and the banking relationships – change the analysis materially.
Step 1 – Classify the Bridge and Its Tokens
Token classification is the threshold legal question, and a utility label on a whitepaper does not settle it. Panama's Law 129 distinguishes between virtual assets used as a medium of exchange and those conferring rights in an underlying enterprise or revenue stream. But the more consequential classification question comes from the jurisdictions where bridge users actually sit.
A wrapped token issued by the bridge – for example, a representation of ETH locked on Ethereum, minted as wETH on a destination chain – may be analyzed differently depending on whether the bridge contract retains discretion over redemption. If the issuing entity can delay, condition or deny redemption, the token may resemble an asset-referenced token (an instrument backed by a basket of assets, subject to the ART provisions under MiCA if the issuer is EU-facing) or even a security.
The classification analysis runs through four practical filters. First: what rights does the token confer – pure exchange value, governance, yield, or a claim on the bridge's locked collateral? Second: who controls the peg mechanism and can alter it unilaterally? Third: in which jurisdictions are holders located, and does distribution to those users trigger a local registration or prospectus obligation? Fourth: does the bridge charge a fee that creates a revenue stream from which token holders benefit?
We assess classification against the substance of rights, not the marketing label. A token called a "bridge receipt" that accumulates a share of protocol fees is, in economic substance, an investment product. No whitepaper designation changes that analysis under the investment-substance tests applied by the SEC, ESMA or the SFC in Hong Kong.
Step 2 – Map the Panamanian Regulatory Perimeter
Under Law 129 of 2022, any entity domiciled in or operating from Panama that provides virtual asset services to the public is required to register with the SSNF and comply with its AML/CFT obligations. The registration framework is relatively new and the SSNF's interpretive guidance on complex DeFi structures remains limited. That creates ambiguity rather than freedom.
A bridge operating through a Panamanian foundation or corporation should conduct a formal perimeter analysis. The key questions are: Does the entity hold custody of user assets at any point in the bridge cycle? Does it exercise discretion over transaction execution? Does it earn fees that constitute regulated activity income under Law 129? If the answer to any of these is yes – or genuinely uncertain – the prudent position is to seek a legal opinion on registration status before onboarding users.
Panama's AML/CFT obligations align with FATF Recommendation 15, which extends the Travel Rule to virtual asset service providers. A bridge operator registered under Law 129 must, in principle, apply the Travel Rule (the obligation to pass originator and beneficiary data with a virtual asset transfer) to transfers above the applicable threshold. In practice, enforcement of the Travel Rule against decentralized bridge architectures remains an evolving area. However, correspondent banks and institutional counterparties increasingly require Travel Rule compliance as a condition of account maintenance, regardless of technical feasibility.
Step 3 – Identify Smart-Contract Liability Exposure
When a cross-chain bridge smart contract fails – through a bug, an oracle manipulation or a re-entrancy exploit – the legal question of who bears liability to harmed users is not resolved by the fact that the contract executed automatically. Several liability theories apply, and the operative one depends on the forum where affected users pursue claims.
Under Panamanian civil law, the entity that deployed and operates the bridge may be exposed to claims in tort (extracontractual liability) if the deployment was negligent – for example, if the contract was not audited to a standard commensurate with the value it held. In practice, large bridge exploits measured in the eight figures have drawn class proceedings in US federal courts, DIFC Courts, and courts in England and Wales, where the plaintiffs target the controlling entity or the individuals who hold upgrade keys, rather than the protocol itself.
In our practice, we advise bridge operators to treat the following as concrete liability reduction steps. Obtain a reputable smart-contract audit and retain a copy as evidence of due diligence. Do not retain unilateral upgrade authority in a single key or a small multisig – this is the single most common structural mistake we see. Establish clear terms of service that describe the protocol's mechanics, the absence of a guarantee, and the governing law of any dispute. If the bridge is governed by a DAO structure (a decentralized autonomous organization), ensure the DAO's legal wrapper – whether a Cayman Foundation Company, a Marshall Islands LLC or an equivalent – is capable of holding obligations and being sued, so that individual contributors are not personally exposed.
The cross-border dimension is acute here. A Panamanian entity controlling a bridge that suffered a significant exploit will face disclosure requests and freezing applications in the jurisdictions where recoverable assets sit. England and Wales, Singapore and the DIFC Courts have each recognized cryptocurrency as property capable of being the subject of a worldwide freezing order and a Norwich Pharmacal disclosure order. A well-structured operating entity with documented governance reduces – though does not eliminate – the personal exposure of the individuals behind it.
Step 4 – Structure the Cross-Border Entity and Banking Stack
A cross-chain bridge operating from Panama with users across the US, the EU and Asia cannot be structured as though Panama is the only relevant jurisdiction. The entity map must account for where the protocol is accessed, where revenue is booked, where the treasury sits, and where the team is located.
A typical structure for a bridge operator with a Panamanian foundation at its center might involve a Payman (Panama) foundation holding intellectual property, a BVI or Cayman operating subsidiary interacting with institutional counterparties, and a separate compliance entity in an MiCA-friendly jurisdiction – such as Lithuania, where the Bank of Lithuania supervises the MiCA transition, or Malta, where the MFSA administers the VFA framework now migrating to CASP authorisation – if the operator intends to serve EU users actively. The BVI VASP Act 2022 provides a registration track that some bridge operators use for the subsidiary that holds exchange or transfer functions.
Banking is the most persistent operational constraint. Correspondent banks apply risk-based de-risking policies that treat unregistered DeFi infrastructure as high risk. A bridge with no AML program, no Travel Rule posture and no legal-opinion memo on its regulatory status will struggle to maintain fiat on/off ramps. Operators we advise routinely go through a banking-readiness review – documentation of AML controls, a legal-perimeter opinion, a summary of the smart-contract audit findings – before approaching banking providers.
The tax dimension requires separate analysis. Panama operates a territorial tax regime, meaning that income sourced outside Panama is generally not subject to Panamanian income tax. However, the entity's substance requirements, the residency of key decision-makers and the booking location of revenues all affect whether the territorial benefit is genuinely available. Where team members are resident in high-tax jurisdictions, their personal income tax position requires separate advice in those jurisdictions, coordinated with allied counsel in the relevant jurisdiction.
If a prior banking relationship was closed or a structure built around Panama has hit a compliance wall, a second read can surface the structural reason and the route forward. Write to OBOLUS at info@oboluslaw.com or message us at t.me/oboluslaw.
Step 5 – Build the AML and Sanctions Posture
A cross-chain bridge is a vector for sanctions evasion and for the layering stage of money laundering. That is not an academic observation – several high-profile bridge exploits and misuse cases have resulted in OFAC designations targeting the bridge's smart-contract addresses directly. An operator that does not build a sanctions screening and AML monitoring posture into its technical architecture is exposed to secondary sanctions risk in the United States and to AML enforcement under Law 129 in Panama.
The practical components of an adequate posture at the bridge layer include: wallet screening against OFAC's Specially Designated Nationals list and equivalent lists maintained by the EU and HM Treasury; monitoring of transaction patterns for clustering, rapid cycling or high-velocity movement that is inconsistent with stated purpose; a documented risk-based framework for blocking or delaying transactions; and a clear escalation protocol for suspicious-activity reporting under the SSNF's requirements.
Decentralization does not exempt a bridge from these obligations. If a single entity – even one structured as a DAO contributor – can insert transactions into the bridge's permissioned relayer set, that entity is exercising a gatekeeping function that regulators treat as a VASP activity. Operators we advise regularly commission a technical architecture review specifically to determine which components of the bridge carry VASP-equivalent functions, so that AML controls can be embedded at the right layer.
On-chain forensic tooling is now a standard component of institutional-grade bridge infrastructure. The ability to screen incoming bridge transactions in real time, trace prior transaction history, and generate a compliance report per transaction is expected by institutional liquidity providers, regulated DEX aggregators and the banking partners that support fiat conversion. This is not a future-state requirement – it is current market practice among the leading bridge operators.
Micro-Matter – Bridge Exploit and Cross-Border Recovery
In a recent matter, a payments technology company had built a cross-chain bridge using a Panamanian foundation as the controlling entity. Following an oracle-manipulation exploit, a seven-figure balance was drained across three chains to a cluster of wallets on a destination chain. We coordinated on-chain tracing with forensic specialists, identified the destination exchange and, working with allied counsel in a leading common-law forum, applied for a disclosure order against the exchange and a worldwide freezing order against the identified wallets. The exchange complied with the disclosure order within days. The assets were frozen pending the substantive claim. The cross-border process – from exploit identification to court-ordered freeze – was completed within a matter of weeks. The decisive factor was the speed of the tracing report and the quality of the Panamanian entity's corporate documentation, which allowed allied counsel to establish standing rapidly.
Decision Matrix – Which Bridge Profile Needs What
The legal steps a bridge operator must take vary materially by the operator's profile. The following matrix maps the most common profiles to the principal instruments and risks.
A protocol-only operator – one that deploys immutable smart contracts with no fee capture, no upgrade keys and no user interface – carries the lightest regulatory footprint in Panama. The primary risk is smart-contract liability if the contracts are defective. The instrument priority is a thorough audit, documented terms of use, and a clear legal opinion establishing that the protocol does not constitute a VASP-equivalent service under Law 129. Timeline to legal readiness: typically a matter of weeks from engagement, if the architecture documentation is available.
A fee-capturing bridge operator – one that retains protocol fees in a treasury, distributes them to token holders or uses them to fund team compensation – sits firmly within the Law 129 registration analysis. The instruments required are Law 129 registration (or a reasoned legal opinion as to why registration is not required), an AML program, a Travel Rule posture, and, if EU users are served, an assessment against MiCA's ART and CASP provisions. Timeline to full compliance readiness varies by jurisdiction – registration processes differ from weeks to months across the relevant hubs.
A DAO-governed bridge – one in which protocol parameter changes are decided by token-holder vote – requires an entity-level legal wrapper capable of holding obligations and managing liability. Without a wrapper, individual contributors who exercise governance rights risk personal liability in the event of a harmful outcome. A Cayman Foundation Company or a Marshall Islands DAO LLC, held above a Panamanian operating entity, is a structure we see used in practice. The key risk is that governance participation by individuals in high-regulation jurisdictions – particularly the US – imports those regulators' jurisdiction into the DAO's activities.
An institutional bridge integrator – a bank, payment institution or licensed exchange that integrates a third-party bridge into its product stack – faces a different question: the bridge becomes part of its regulated service, and failures in the bridge's AML controls or smart-contract security become the integrator's regulatory problem. Operators we advise in this profile require a vendor-due-diligence package from the bridge operator before integration, covering security audit findings, regulatory perimeter analysis and sanctions screening capability.
Common Mistakes at Each Step
At the classification step, the most frequent mistake is treating the token's stated purpose as its legal character. A bridge token that accumulates protocol fees is an investment product regardless of its label. Operators discover this when a foreign securities regulator issues a notice of investigation rather than when the whitepaper is drafted.
At the structural step, the most damaging mistake is retaining concentrated upgrade authority. A multisig controlled by three co-founders in the same jurisdiction, with no time-lock, creates a single point of legal and technical failure. If the bridge is exploited and the co-founders are identifiable, they become the target of the recovery claim. Distributing upgrade authority across a large, geographically diverse multisig with an appropriate time-lock reduces – though never eliminates – this exposure.
At the banking step, the most common mistake is approaching banking providers before the legal and compliance documentation is in place. A bridge operator that cannot produce a regulatory perimeter opinion, an AML program summary and a clean smart-contract audit will be declined by institutional-grade banking providers, and those declinations become part of the operator's risk history.
At the cross-border step, the structural mistake we see most often is building the Panama entity in isolation, without considering the tax residency of key personnel, the location of banking relationships, and the regulatory exposure created by actively marketing to users in regulated jurisdictions. Panama's territorial tax advantage does not survive a determination that the principal place of management is in a high-tax jurisdiction.
A common assumption among bridge operators is that smart-contract automation removes human legal responsibility. It does not. The individuals who deploy a contract, hold upgrade keys, set fee parameters, or operate a front-end interface are exercising agency. Every major enforcement action against DeFi infrastructure has targeted those individuals, not the contract address. The automation of execution does not automate the legal analysis.
Related at OBOLUS
- DeFi, Tokenization and Smart-Contract Law – the full practice overview for digital-asset builders and operators
- Staking Service Legal Framework in the Bahamas – how a comparable offshore hub structures yield-generating digital-asset services
- Sanctions Screening for Crypto Under Heightened Scrutiny – building a defensible OFAC and multi-list screening posture for DeFi infrastructure
FAQ
Can a DeFi protocol be regulated?
Yes – in most leading jurisdictions, a DeFi protocol is subject to regulation if a human actor exercises control over it. Control includes deploying the contract, holding upgrade or pause keys, operating a front-end interface, or capturing fees. The degree of decentralization affects the analysis, but protocols with identifiable governing entities are treated as VASP-equivalent services under MiCA, VARA, the MAS Payment Services Act and Law 129 in Panama. The threshold question is always who exercises discretion, not whether the code runs automatically.
What legal wrapper suits a DAO?
The most commonly used wrappers in our practice are the Cayman Foundation Company and the Marshall Islands DAO LLC. Both allow the DAO to hold assets, enter contracts and be sued without exposing individual token holders or contributors to personal liability. The choice between them turns on the DAO's governance structure, the jurisdictions where contributors are located, and the nature of the activities the wrapper must hold. A Panama foundation can serve as a complementary holding layer but should not be used as the sole wrapper for a DAO with significant user-facing activity.
Who is liable when a smart contract fails?
Liability for a failed smart contract falls, in practice, on the persons or entities who deployed it, governed it, or marketed it to users. In proceedings before courts in England and Wales, Singapore and the DIFC Courts, claimants have successfully targeted controlling entities and key-holders rather than the contract address. A documented audit, distributed governance, clear terms of service and a legal-perimeter opinion each reduce – but do not eliminate – liability. The specific allocation depends on the forum, the cause of failure and the contractual relationship between the operator and affected users.
OBOLUS is an independent digital-asset law boutique acting exclusively for businesses. We advise exchanges, custodians, token issuers, DeFi operators and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and AML compliance that surround them. Digital assets are the whole of our practice. We assess token classification against the substance of rights, not the marketing label, and our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Roman Levitt, Technology & DeFi Counsel – specialising in smart-contract liability, cross-chain protocol structuring and DeFi regulatory perimeter analysis across common-law and civil-law jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.