Operating a crypto exchange without adequate legal authority in Panama – or anywhere that touches Panamanian infrastructure, banking or customers – exposes the business to enforcement action, severed banking relationships and frozen settlement rails at the worst possible moment. Panama sits in a legally significant position: it offers a dollar-based financial system, a territorial tax model and a well-developed free-zone environment, yet its digital-asset regulatory regime is still maturing relative to the major licensed hubs. Understanding exactly what is required, and what the gaps mean operationally, is the threshold question for any inbound operator.
Crypto exchange licensing in Panama turns on a combination of general financial services law, specific virtual asset service provider (VASP) registration requirements introduced under Panama's anti-money-laundering legislation, and – critically – the licensing demands of every other jurisdiction where the business has users, banking or operational presence. Panama alone is rarely a complete answer to the compliance question. A well-structured entry maps the regulatory authorisation layer, the banking layer and the cross-border layer together before committing capital.
This page covers the regulated basis in Panama, the inbound application process, the cross-border reality for exchanges that serve international users, the tax and banking interaction, and the practical decision points that determine whether Panama fits a given operator profile.
What is the legal basis for crypto exchange licensing in Panama?
Panama's primary legal basis for digital-asset regulation is its AML/CFT legislation, which was amended to bring virtual asset service providers within the supervised financial sector. The Superintendency of Banks of Panama (SBP) and the Superintendencia del Mercado de Valores (SMV) both hold supervisory authority depending on the nature of the activity: the SBP oversees financial intermediaries broadly, while the SMV governs securities-like instruments and public offerings. A crypto exchange that handles spot trading of tokens not classified as securities typically falls under the SBP-administered VASP framework; a platform that lists instruments deemed to represent investment contracts or securities would trigger SMV oversight. The line between the two is determined by the substance of the token, not its marketing label – a principle that mirrors the analysis applied under the U.S. SEC/CFTC framework and MiCA in the European Union.
Panama does not yet operate a bespoke licensing regime equivalent to Dubai's VARA activity-based licence structure or Singapore's MAS Payment Services Act tiered framework. The registration obligation is real and enforceable, but the surrounding prudential rulebook – capital adequacy standards, safeguarding requirements, systemic risk buffers – is less prescriptive than in the leading licensed hubs. That creates both a lower initial compliance burden and a genuine gap risk: an operator that structures exclusively to Panama's current minimum may find that correspondent banks, institutional counterparties and users in regulated jurisdictions apply stricter standards anyway.
Under the applicable AML provisions, entities operating as VASPs in Panama must register with the competent authority, implement a risk-based AML/CFT programme, appoint a compliance officer, and comply with the Travel Rule (the obligation to pass originator and beneficiary data with a virtual asset transfer, consistent with FATF Recommendation 15). Failure to register or to maintain adequate controls exposes the entity and its principals to administrative sanctions and, in serious cases, criminal liability.
Importantly, the registration and compliance obligation attaches to activity, not solely to formal establishment. A foreign company operating an exchange that is accessible to Panamanian residents, that uses Panamanian banking infrastructure, or that has management or operational personnel in Panama may be within scope regardless of where it is formally incorporated.
The CTA below is for operators encountering Panama's regulatory perimeter for the first time. The structure above describes the standard path. Your facts – the entity type, the user base geography, the token classification – change the analysis materially.
For a scoped assessment of your Panama entry structure, contact OBOLUS at info@oboluslaw.com or map your options here.
Who actually needs a VASP registration or licence in Panama?
Any business that, as a service to third parties, exchanges virtual assets for fiat or other virtual assets, transfers virtual assets, provides custody or safeguarding of virtual assets, participates in or provides financial services related to a token issuance, or administers virtual assets on behalf of clients, is within the VASP perimeter under Panama's AML legislation. The activity test is functional: it asks what the business does, not what it calls itself.
Exchanges with a centralised order book and fiat on/off ramps are the clearest case. Custody businesses, OTC desks, token issuers conducting a public distribution, and payment processors routing value through virtual assets are all within scope. A pure peer-to-peer protocol with no intermediary operator typically falls outside the perimeter – though the moment a business layer sits above the protocol to manage matching, liquidity or user accounts, the analysis changes.
For inbound operators, the geographic nexus test matters enormously. In our cross-border practice, we regularly advise businesses whose primary market is outside Panama but whose holding structure, banking or payment rails touch the country. Those businesses often underestimate the local VASP obligation. The relevant question is not only whether the entity is registered in Panama, but whether the Panamanian SBP would regard the activity as being carried on within its jurisdiction. Managing that analysis proactively – rather than discovering it during a bank's KYC review – is a recurring feature of the matters we handle.
What does the Panama VASP registration process involve?
The VASP registration process in Panama involves submitting a formal application to the SBP, producing corporate documentation, demonstrating adequate AML/CFT infrastructure, and passing fit-and-proper vetting of beneficial owners and senior officers. The process is administrative in structure but substantive in what it requires of the applicant.
The core documentation package typically includes: constitutional documents and ownership structure charts (tracing to ultimate beneficial owners); AML/CFT programme documentation (policies, procedures, risk assessment, controls); a compliance officer profile with supporting qualifications; a business plan with a description of the services to be offered and the technology platform; a technology security overview addressing how digital assets are held and transmitted; and evidence of source of funds for capitalisation. The SBP may request additional materials, and the review dialogue can extend the process depending on the complexity of the applicant's structure.
Panama does not currently publish a fixed statutory timeline for VASP registration decisions in the same way that MiCA prescribes defined review windows for CASP authorisation in the EU. In practice, timelines vary by applicant readiness and the SBP's current caseload; operators should plan conservatively rather than assume a rapid turnaround. A well-prepared file – one where the AML programme is genuinely operational rather than a template exercise – tends to move faster and attract fewer information requests.
After registration, ongoing obligations include periodic reporting to the SBP, maintenance of the AML programme, Travel Rule compliance on transfers, transaction monitoring, suspicious activity reporting, and cooperation with supervisory examination. These are not one-time costs: they are recurrent operational requirements that must be resourced and managed.
A common mistake at this stage is treating the AML programme as a paper exercise. Panamanian supervisors, like most in the FATF-aligned network, are increasingly focused on the quality of implementation rather than the existence of a document. An exchange whose transaction monitoring generates no alerts, or whose Travel Rule transfers consistently lack counterpart data, will face supervisory scrutiny regardless of whether the programme document exists.
How does Panama licensing interact with other jurisdictions?
Panama registration does not passport into any other jurisdiction. This is the single most important structural fact for an operator building a business intended to serve users across multiple markets. Unlike a MiCA CASP authorisation in an EU member state – which permits passporting across the entire EU and EEA – a Panamanian VASP registration is a domestic instrument only. It satisfies the Panamanian compliance obligation; it says nothing about the legality of serving customers in the EU, the UK, Singapore, the UAE or the United States.
Operators we advise routinely arrive at this point having assumed that an offshore registration was sufficient to serve clients globally. It is not. Each jurisdiction where users are located, where fiat is settled, where marketing is directed or where a regulated activity is deemed to occur applies its own licensing test. Serving EU retail users without CASP authorisation, or serving UK customers without FCA registration, is an enforcement risk entirely separate from the Panama question.
The cross-border analysis maps three layers simultaneously: the entity layer (where is the legal person licensed?), the activity layer (what activities trigger a licence obligation in each user jurisdiction?), and the technology layer (where do servers, wallets and key management sit, and does that create a regulated presence?). Panama frequently works as the entity layer – particularly for holding and contracting – but requires companion licensing in operating markets and careful attention to the activity triggers in each.
For FATF purposes, Panama has historically faced scrutiny over its AML/CFT posture. It was placed on the FATF grey list in 2019 and subsequently removed in 2023, following demonstrated improvements in its AML regime. That history remains relevant for correspondent banking relationships: some banks apply enhanced due diligence to Panamanian-connected entities as a matter of internal policy regardless of the current FATF status. An operator planning to use Panamanian banking for settlement or custody should factor that into the feasibility assessment, and should have a clear narrative about its own AML controls ready for the banking dialogue.
What is the tax and banking position for a Panama-based crypto exchange?
Panama operates a territorial tax system: income earned from sources outside Panama is not subject to Panamanian income tax. For a crypto exchange whose customers and counterparties are located outside Panama, this can produce a structurally favourable tax position – trading revenue derived from offshore activity is generally outside the Panamanian tax base on that principle.
However, territorial tax is not a blanket exemption. Activities carried out within Panama – services to domestic customers, local marketing, Panamanian management functions – attract Panamanian tax. Where the line falls depends on the specific facts of the business model, and tax authorities have become more sophisticated in examining substance over the past several years. Operators who rely on Panama for tax purposes need to be able to demonstrate genuine operational substance in the country, not merely a registered address.
The VAT treatment of crypto transactions in Panama remains an area where clarity is still developing. The interaction between ITBMS (Panama's VAT equivalent) and digital-asset services is not fully settled by published guidance, and operators should obtain specific advice rather than assuming a tax-free position.
On banking, Panama hosts a well-developed international financial centre with significant correspondent banking capacity. Panamanian banks have, however, been cautious about onboarding crypto businesses, reflecting both FATF-related compliance pressures and the internal risk appetite policies of their own correspondent banks. A Panamanian bank's willingness to maintain a crypto exchange account depends heavily on the exchange's AML programme quality, its user geography, its transaction volumes and whether the bank's own correspondents will support the relationship. We have seen well-structured, licensed exchanges face protracted banking onboarding processes in Panama even where all regulatory conditions are met. Operators should plan for this and explore multi-banking strategies across jurisdictions.
What does Panama VASP registration look like in practice?
In a recent cross-border matter, a payments technology company incorporated outside Latin America had been operating a virtual asset transfer service that incidentally processed transactions for Panamanian business customers. When the company sought to open a Panamanian correspondent banking relationship, the bank identified the VASP activity and requested evidence of SBP registration. The company had not registered, having assumed that its offshore incorporation satisfied the compliance requirement. We undertook a rapid gap analysis, mapped the applicable VASP obligation, structured a registration-ready AML programme from the ground up, and coordinated the application submission with local allied counsel. Registration was completed within a period of months, the banking relationship proceeded, and the operator avoided an enforcement referral that the bank had flagged as a potential outcome had the application been delayed further.
Which operator profiles fit a Panama licensing structure?
Not every operator should center its structure on Panama. The decision turns on the operator's user geography, institutional relationships and long-term compliance ambitions.
Profile A – Latin American-focused exchange. An exchange whose primary user base is in Latin America, whose settlement currency is USD and whose counterparties are regional banks and payment processors is a natural fit for a Panama structure. The territorial tax model is advantageous, the dollar system removes FX friction, and the VASP registration satisfies the local compliance requirement. The key residual risk is correspondent banking willingness, and the operator should budget for an extended banking onboarding dialogue.
Profile B – Global exchange seeking an efficient holding structure. An exchange with a genuinely global user base needs licensed presence in the jurisdictions where it operates, not only a Panama holding entity. Panama can serve as the holding and contracting layer, particularly where assets and intellectual property are held at the group level. The trading and custody activity needs to sit in jurisdictions whose licences are recognised by the exchange's institutional counterparties: typically an EU CASP, a MAS Payment Services licence, an SFC VATP authorisation in Hong Kong, or a VARA licence in Dubai. The Panama entity in this model reduces group tax drag on offshore profits; it does not replace operational licensing.
Profile C – Early-stage operator assessing entry costs. For a business in early development, the VASP registration process in Panama is less demanding in upfront capital terms than many of the flagship licensed hubs. It provides a compliant basis from which to demonstrate regulatory engagement to banks and investors. The operator must be clear, however, that this registration does not authorise cross-border activity, and that scaling into EU, UK, US or Asian markets will require separate authorisation work. Building the compliance infrastructure to Panama standards from the outset – rather than reverse-engineering it later – substantially reduces the cost of subsequent applications in more demanding regimes.
For operators working through a multi-jurisdiction structure, contact OBOLUS at info@oboluslaw.com or map your licence stack here.
A common assumption about Panama licensing that costs operators time and money
A common assumption is that a single offshore registration – whether Panama, BVI or another well-known holding jurisdiction – is sufficient to serve clients across multiple markets without additional licensing. That assumption is incorrect and carries meaningful enforcement risk.
Every jurisdiction where a crypto exchange has users, markets its services, processes fiat, or is deemed to carry on regulated activity applies its own licensing test independently. The EU's MiCA CASP requirement applies to exchanges serving EU users regardless of where the exchange entity is domiciled. The FCA's financial promotion rules apply to marketing directed at UK persons regardless of the issuer's corporate seat. VARA in Dubai and MAS in Singapore apply to activity-based triggers that are similarly agnostic to the operator's offshore structure.
Regulators in the leading hubs are increasingly focused on the substance of cross-border activity, not just formal establishment within their borders. Operators that have built their compliance story around a single offshore registration often discover this reality when they seek to open institutional banking, onboard liquidity providers or respond to a supervisory inquiry in an operating market. The cost of correcting an inadequate structure at that stage – under time pressure, with a banking or enforcement deadline – is substantially higher than building the right stack from the outset.
In our practice, we map the licence, banking and tax stack across all relevant layers before the operator commits capital to a structure. That process surfaces the gaps that a single-jurisdiction analysis misses.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the full practice overview across 70+ jurisdictions, covering the licence stack from entity to activity layer.
- Crypto regulation and licensing in the British Virgin Islands – VASP Act 2022 obligations, BVI FSC registration and the offshore holding structure decision.
- EMI onboarding for VASPs in Nigeria – cross-border licensing for operators bridging African payment infrastructure and digital-asset rails.
FAQ
How long does a crypto licence take to obtain?
Timelines vary by jurisdiction and applicant readiness. In Panama, the SBP does not publish a fixed statutory review window, and the process depends on the quality of the submitted file and the authority's current caseload. In jurisdictions with defined timelines – such as the EU under MiCA, or Singapore under the Payment Services Act – review periods are prescribed by regulation but can extend where the authority raises queries. A well-prepared application consistently moves faster than one submitted without complete AML programme documentation and a clear beneficial ownership structure.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right licensing structure depends on your user geography, the assets you handle, your banking requirements, your institutional counterparty relationships and your longer-term compliance ambitions. Panama suits operators with a Latin American focus or those seeking an efficient holding layer for an offshore group. Operators serving EU users need a MiCA CASP; those targeting the UAE need a VARA or FSRA authorisation; those in Asia need MAS or SFC coverage. In our practice, we map the full stack before recommending a jurisdiction combination.
Do I need a separate custody licence?
In most leading regimes, custody of virtual assets on behalf of third parties is a separately regulated activity. Under MiCA, custody and administration of crypto-assets is a defined CASP service requiring authorisation. VARA in Dubai, MAS in Singapore and the SFC in Hong Kong each treat custody as a distinct regulated function. In Panama, the VASP framework addresses custody within the broader VASP perimeter, but the applicable requirements are less granular than in the major hubs. If your exchange holds customer assets – rather than acting as a pure matching venue – the custody question must be answered for every jurisdiction in which you operate, not only the entity's home jurisdiction.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance obligations that sit around them. Digital assets are the whole of our practice. We map the licence stack across the operating, custody and payment layers before you commit to a structure – that process is the difference between a compliant build and an expensive reconstruction. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when recovery is at stake. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in cross-border VASP authorisation, inbound licensing strategy and multi-jurisdiction compliance stack design for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.