Crypto and fintech companies operating through Panama increasingly face a familiar pressure: a banking relationship that worked for years suddenly goes cold. A correspondent bank pulls its line. A local bank sends a 30-day exit notice. Payment rails that settled cross-border transactions for months go dark overnight. The legal question is not abstract — it is whether the business has the documentation, the compliance posture and the structural argument to defend its account or, if the account closes, to open a credible replacement without triggering the same response from the next institution.
De-risking (the withdrawal of banking services from categories of clients a financial institution judges too costly to supervise) has accelerated across Latin America and the offshore world. Panama sits at the intersection of that pressure and a maturing domestic regime for virtual asset service providers (VASPs) – entities that exchange, transfer, administer or custody digital assets. Panamanian law has moved to bring VASPs within its anti-money laundering (AML) and countering the financing of terrorism (CFT) regime, and Superintendencia de Bancos de Panamá (SBP) expectations around correspondent banking compliance are tightening. A business that cannot demonstrate regulatory standing under that regime has limited leverage when a bank exercises its contractual right to exit the relationship.
This page maps the account-defence process, the structural remedies available to a digital-asset business in Panama, and the cross-border considerations that determine whether the solution is local, regional or a re-domicile.
Why do banks exit crypto clients in Panama?
Banks in Panama exit crypto clients for one primary reason: correspondent-banking pressure. A Panamanian commercial bank settles USD through a US correspondent. That correspondent applies its own risk appetite to the Panamanian bank's client base. When the correspondent flags crypto-exposure as disproportionate — often under a broad de-risking policy rather than a specific compliance finding — the local bank has two choices: restructure its client book or lose its USD clearing line. The commercial answer is almost always to notify the crypto client.
Below that headline driver sit several compounding factors. First, Panama's AML/CFT framework, administered by the Unidad de Análisis Financiero (UAF) and supervised by the SBP, has been subject to international scrutiny. Where a jurisdiction faces enhanced monitoring from the Financial Action Task Force (FATF) — the intergovernmental body that sets global AML/CFT standards — correspondent banks raise their own thresholds for any client with a Panama nexus. FATF's Recommendation 15 explicitly brings virtual assets and VASPs within the AML/CFT perimeter, and Panama's implementation of that recommendation directly affects how local banks treat VASP clients.
Second, many crypto businesses operating in Panama have historically relied on informal structures: a Panamanian sociedad anónima (bearer-share company, now largely reformed) with no direct regulatory registration, banking on the basis of general corporate documentation. As SBP's know-your-customer requirements have become more granular — particularly around beneficial ownership, source of funds and the nature of blockchain-based transactions — those informal structures fail the enhanced due-diligence review. The bank closes the account not because the business is illegitimate but because the business cannot satisfy the bank's compliance questions.
Third, the Travel Rule — the FATF requirement to pass originator and beneficiary data alongside a virtual-asset transfer — creates documentation gaps. A VASP that cannot demonstrate Travel Rule compliance, even if its domestic obligations are not yet formally crystallised, loses credibility in a correspondent-bank review.
In our cross-border practice, we see a consistent pattern: the account-closure notice arrives before the business has mapped whether it is even subject to formal VASP registration in Panama, and well before it has assembled the compliance file that would satisfy an enhanced due-diligence request.
What is the legal basis for VASP activity in Panama?
Panama's regulatory regime for virtual assets is anchored in legislation that brought VASPs within the country's formal AML/CFT supervisory architecture. The applicable Panamanian law — enacted to align with FATF standards — requires businesses that provide virtual-asset services commercially to register with the relevant supervisory authority and to maintain an AML/CFT compliance program that meets prescribed standards. This is the document a bank's compliance officer needs to see. Without it, even a well-run business looks uncontrolled.
The supervisory authority for VASPs in Panama is separate from the SBP banking regulator, which means a VASP registration does not automatically resolve a banking relationship — but it is the threshold condition for building the compliance narrative that makes the banking conversation possible. A business that presents its VASP registration, its AML/CFT policy, its beneficial-ownership register and its Travel Rule procedure is in a structurally different position from one presenting general corporate documents.
The regime distinguishes between exchanges (spot, order-book or OTC), custodians, transfer agents and advisory businesses. The registration obligation and the compliance requirements attached to each category vary. A business that operates across multiple categories — for example, an exchange that also holds client assets — carries compliance obligations that multiply accordingly.
One structural reality frequently surprises inbound operators: Panama's VASP regime governs activity conducted from Panama, but Panamanian law has limited direct reach over a Panama-incorporated holding company whose operational activity and client base sit elsewhere. The legal question is therefore not only "are we registered in Panama?" but "does our operational substance sit in a jurisdiction where our regulatory posture is defensible to both the local regulator and the correspondent bank?" These are distinct analyses, and conflating them is one of the most common structural errors we correct.
For a CTA: The process above describes the standard path. Your facts — the entity structure, the user base geography, the banking layer — change the analysis significantly.
To map the licence, banking and compliance stack for your Panama structure, write to us at info@oboluslaw.com or map your options on our contact page.
Account closure defence: what can actually be done?
Defending an account, or reconstructing banking access after closure, requires a structured response across three simultaneous tracks: legal, compliance and commercial.
On the legal track, the first step is reviewing the contract. Panamanian banking agreements typically permit account closure on short notice without cause. That contractual right is broad. However, where closure causes immediate and material commercial harm — for example, where client funds are held and the business cannot settle outstanding obligations — the question of whether the bank's contractual discretion was exercised in a manner consistent with its own regulatory duties, or in a manner that could amount to an improper exercise of that power, deserves analysis. This is rarely a viable standalone litigation path, but it is a relevant factor in negotiating an extension of the notice period to allow for an orderly transition.
On the compliance track, the business must rapidly assemble or repair the documentation the bank's compliance team has identified as deficient. In practice, that means: a current VASP registration certificate or evidence of active registration proceedings; an up-to-date AML/CFT policy aligned to the supervisory standards of the applicable regime; a beneficial-ownership certificate reflecting current structure; source-of-funds documentation for the business itself; and a Travel Rule procedure with evidence of implementation. Where a compliance audit has been requested, the business should commission one from counsel rather than allow the bank to define the scope unilaterally.
On the commercial track, the business must simultaneously initiate onboarding with an alternative institution. That institution could be a different Panamanian bank with a higher risk appetite for regulated VASPs, a regional bank in a neighbouring jurisdiction, or an electronic money institution (EMI) — a non-bank payment institution authorised to hold client funds and execute transactions — operating in a jurisdiction with a more structured VASP-banking relationship. The EMI route has become an important component of the fiat-rail architecture for Latin American crypto businesses precisely because EMIs are purpose-built for high-transaction-volume digital-economy clients and are not subject to the same correspondent-bank pressure that drives traditional bank de-risking.
In a recent matter, a payments business operating through a Panamanian entity had its primary USD account closed with 30 days' notice following a correspondent-bank review. The business had no formal VASP documentation and no compliance policy on file. We structured an emergency compliance package — registration documentation, AML/CFT policy, beneficial-ownership materials and a Travel Rule framework — and used that package simultaneously in negotiations with the closing bank to extend the notice period and in onboarding discussions with two regional EMIs. One EMI had the account operational within the notice window. The business maintained continuity. The lesson: the compliance file is both the defence and the alternative-access key.
How does EMI onboarding provide a structural fiat-rail alternative?
An EMI onboarding process for a VASP in the Panama context is not simply swapping one account for another. It is a structural decision about where the payment layer of the business sits and under what regulatory umbrella. The choice of EMI jurisdiction — whether EU-regulated under PSD2 and the evolving MiCA (Markets in Crypto-Assets Regulation) perimeter, UK-regulated under the FCA (Financial Conduct Authority), or licensed in a smaller but well-supervised offshore jurisdiction — determines which currency corridors are available, what the compliance cost of maintaining the relationship will be, and what the counterparty risk looks like.
An EU-authorised EMI carries passporting rights across the EU and EEA, which is relevant for a Panama-domiciled business with European clients or investors. An FCA-registered EMI provides access to GBP clearing and SEPA-adjacent infrastructure. MiCA, which creates an EU-wide authorisation regime for crypto-asset service providers, is reshaping how EU EMIs approach their VASP clients — EMIs serving crypto businesses increasingly expect those businesses to demonstrate their own regulatory standing, not merely VASP registration but a credible compliance program.
The onboarding timeline for an EMI varies. It is typically measured in weeks rather than days for a business that arrives with complete documentation. Businesses that arrive with gaps — no AML policy, no Travel Rule procedure, unclear beneficial ownership — can expect the process to extend materially. The EMI's own regulatory obligations require it to conduct enhanced due diligence on VASP clients, and the quality of the file submitted directly determines the speed and outcome of that review.
For a business sitting between the Panama entity layer and a European or UK EMI relationship, the legal question turns on documentation, structure and the regulatory narrative that connects them. We regularly advise on how to construct that narrative — not as a compliance exercise but as a business-continuity strategy that survives the next correspondent-bank review cycle.
How does the cross-border tax and banking structure interact with de-risking?
A Panama-domiciled business with foreign clients, foreign payment flows and a foreign EMI relationship operates across at least three regulatory environments simultaneously: Panama for entity law and domestic AML/CFT obligations; the EMI's home jurisdiction for payment-services regulation; and the jurisdictions where clients are located for whatever local financial-services or consumer-protection rules may apply. Each layer imposes its own compliance expectations. A gap in any one of them surfaces in the others.
The tax dimension compounds this. Panama operates a territorial tax system — income derived from sources outside Panama is generally not subject to Panamanian income tax. That feature has made Panama attractive as a holding or operating location for businesses whose revenue base is international. However, the territorial principle does not insulate the business from tax obligations in jurisdictions where it has economic substance, employees or users. A crypto exchange that books revenue through a Panamanian entity but employs staff in a higher-tax jurisdiction, or that serves users whose government imposes withholding obligations on digital-asset income, carries potential tax exposure in those jurisdictions that a Panamanian structure does not extinguish.
Banks and EMIs performing enhanced due diligence ask where the business actually operates, not where it is incorporated. A business with minimal Panamanian substance but a global user base — serviced through a Panama entity purely for tax efficiency — presents exactly the risk profile that triggers the compliance questions that lead to de-risking. The structural answer is not to eliminate the Panama layer but to ensure the substance, the compliance infrastructure and the tax position are coherent and documentable.
A common assumption in the market is that a single offshore licence — or even a registration in a well-regarded jurisdiction — is sufficient to access banking and EMI services globally. It is not. EMIs and correspondent banks assess the full regulatory posture of the business: the jurisdictions where it operates, the jurisdictions where its clients are located, the compliance controls in place for each client category and the evidential trail showing those controls work. A business that has addressed only the entity layer, without addressing the operational, compliance and payment layers, will face the same de-risking pressure regardless of where it is incorporated.
Which business profiles need account closure defence counsel in Panama?
Account defence and EMI onboarding counsel in Panama is relevant for a specific set of business profiles.
The first is a crypto exchange or OTC desk incorporated in Panama or holding Panamanian accounts as its primary banking layer. These businesses face the most direct de-risking exposure as SBP tightens its correspondent-banking supervisory expectations and as FATF-aligned AML/CFT obligations become more concrete. The defensive strategy is proactive: build the compliance file before the bank raises the question, not in response to a 30-day notice.
The second is a payments business or fintech that uses a Panamanian entity as part of a Latin American market-entry structure. These businesses are frequently caught between local commercial-bank limits and the absence of a regional EMI with the technical and compliance capacity to serve cross-border digital-payment flows. Counsel helps map which EMI jurisdictions are accessible from the Panama entity structure and what documentation is required to complete onboarding.
The third is an early-stage founder who has been using a personal or corporate Panamanian account to manage business treasury — a pattern that becomes untenable as transaction volumes grow and banks begin flagging the account for enhanced review. The structural remedy here typically involves formalising the entity layer, completing VASP registration if applicable and presenting a credible compliance file to either the existing bank or an EMI.
The fourth is a foreign-incorporated business — EU, UK or US — that operates a Panamanian subsidiary or holds accounts in Panama as part of a broader corporate structure. These businesses face a compounded review: the Panama bank applies SBP standards; the parent jurisdiction's regulator applies its own; and any EMI serving the structure applies the standards of its own licence. We map the licence stack across operating, custody and payment layers before a business commits to a structure, because retrofitting compliance is always more expensive than building it in at the design stage.
If a prior application stalled or an account was closed, a second review can surface the structural reason and the route back. Reach our banking and payments desk at info@oboluslaw.com or map your options.
Self-assessment: is your Panama banking posture defensible?
A banking posture in Panama is defensible when the business can answer yes to each of the following questions. This is not a legal opinion — it is a practical filter for identifying where the gaps are before a bank's compliance officer identifies them first.
Is the business registered with the relevant Panamanian supervisory authority as a VASP, where that obligation applies? Does the business have a current, written AML/CFT policy that reflects the applicable Panamanian regime and FATF Recommendation 15? Is the beneficial-ownership register current, accurate and accessible to the bank on request? Can the business provide source-of-funds documentation for its corporate treasury — not just for its clients, but for its own operating account? Does the business have a documented Travel Rule procedure showing how it passes originator and beneficiary data with virtual-asset transfers, and evidence that the procedure is implemented rather than merely written? Is the corporate structure documented — entity chart, ownership tiers, registered office, substance indicators — in a form that satisfies enhanced due diligence at both the local bank and any EMI level?
A "no" answer to any of these questions is a gap that will surface. The question is whether it surfaces in counsel's office, where it can be remedied, or in the bank's compliance review, where it triggers an exit.
Related at OBOLUS
Related at OBOLUS
- Banking, Payments & EMI Onboarding for digital-asset businesses – our full practice for fiat-rail structuring, EMI onboarding and payment-licence strategy across jurisdictions.
- De-risking and account closure defence for early-stage founders – practical account-defence strategy for founders facing their first bank exit notice.
- Travel Rule compliance program in Brazil – how the Travel Rule obligation operates for VASPs in Brazil and the cross-border interaction with Latin American fiat rails.
FAQ
Why do banks close crypto company accounts?
Banks exit crypto clients primarily because of correspondent-bank pressure rather than specific compliance findings about the client. A US correspondent bank applying its own risk appetite to a Panamanian bank's client book may flag crypto exposure as disproportionate, leaving the local bank to choose between its correspondent relationship and its crypto clients. Weak documentation — no VASP registration, no AML policy, no Travel Rule procedure — converts a policy-level concern into a specific compliance failure that accelerates the decision.
How can a VASP onboard with an EMI?
An EMI (electronic money institution) will conduct enhanced due diligence on any VASP it onboards, because its own regulatory licence requires it to treat VASPs as higher-risk clients. A successful onboarding requires, at minimum: VASP registration documentation from the applicable regime, a current AML/CFT policy, a beneficial-ownership certificate, source-of-funds evidence for corporate treasury, and a Travel Rule procedure. EMIs authorised in EU, UK or other structured jurisdictions may also require evidence that the VASP's home jurisdiction maintains a credible supervisory regime.
What does client-money safeguarding require?
Client-money safeguarding requires that funds held on behalf of clients are segregated from the business's own operating funds and held in a manner that protects them in the event of insolvency. In the EMI context, this typically means holding client funds in a designated safeguarding account at a credit institution or investing them in specified low-risk liquid assets. For VASPs, the applicable safeguarding standard depends on whether the business is regulated as a payment institution, an EMI, or solely under a VASP regime — the standards are not identical, and the gap between them is a frequent compliance oversight.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise crypto exchanges, custodians, token issuers and funds on licensing across more than 70 jurisdictions, on disputes and on-chain asset recovery across more than 25 forums, and on the tax, banking and compliance structures that connect them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before clients commit to a structure — because the cost of retrofitting compliance after a bank exit is always higher than addressing it at design. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Victor Olsen, Regulatory & Compliance Analyst — specialising in VASP registration, AML/CFT compliance architecture and de-risking defence across Latin American and offshore jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.