EMI licence for crypto firms in Panama: Legal Requirements for Businesses

Panama has drawn sustained interest from digital-asset operators seeking a Latin American gateway with dollar-denominated banking, favourable corporate law and a regulatory posture that, until recently, was light by international standards. That calculus is shifting. Panama's legislature has moved to formalise the legal basis for virtual asset service providers (VASPs) and electronic money institutions (EMIs) – entities authorised to issue or administer digital means of payment – bringing the country into closer alignment with FATF expectations. For a crypto firm considering Panama as an operating base, the question is not simply whether a licence is available but whether the authorisation path fits the firm's product, user geography and banking plan.

Panama does not yet operate a bespoke VASP licensing regime of the depth seen in Dubai under VARA or in Singapore under the Monetary Authority of Singapore's Payment Services Act, but regulated pathways exist for payment and electronic money activity – and the consequences of getting the structure wrong are real. Operating an EMI or VASP service without the correct authorisation exposes a business to enforcement action, frozen correspondent banking rails and the loss of the payment accounts that make the business viable.

This page sets out the regulated basis for EMI and crypto-related authorisation in Panama, the application process for inbound operators, the cross-border interaction with tax and banking, and the key decision points your legal team needs to work through before committing to the jurisdiction.

What is the regulated basis for EMI and crypto activity in Panama?

Panama's framework for electronic money and payment activity derives from legislation governing payment systems and financial service providers, supervised by the Superintendency of Banks of Panama (SBP) for banking-adjacent activities and, for certain non-bank payment and remittance operators, by the Ministry of Commerce and Industry (MICI). The FATF Travel Rule obligation – requiring originator and beneficiary data to move with a virtual asset transfer – applies to VASPs operating in or through Panama, consistent with FATF Recommendation 15 on virtual assets.

Panama enacted legislation that formally recognises virtual assets as digital representations of value and establishes a registration obligation for entities engaged in VASP activities. Operators must register with the relevant supervisory body before offering exchange, transfer, custody or related services to clients. The regime is still maturing. Secondary regulation implementing the full licence-category architecture was in development at the time of this writing, meaning that specific capital thresholds, supervisory fee schedules and activity-scope rules should be confirmed against the current regulatory text before any application is submitted.

For EMI-specific activity – issuing digital equivalents of stored value, managing payment accounts or executing payment transactions on behalf of users – the applicable framework draws on banking and non-bank financial institution legislation. An entity that issues a token pegged to the US dollar and allows third-party payment execution may well engage both the VASP registration requirement and the EMI authorisation track simultaneously. In our practice, conflating these two paths is among the most common structural errors we see at the pre-application stage.

Who needs an EMI or VASP licence in Panama?

Any business that exchanges virtual assets for fiat or other virtual assets, transfers virtual assets on behalf of third parties, provides custody or wallet services, or facilitates the issuance or sale of virtual assets in or from Panama will generally fall within the scope of the registration and authorisation requirement. The nationality of the operator's beneficial owners is not the determining factor; the trigger is where the activity is conducted and, in some cases, where the clients are located.

A business incorporated in Panama but directing its services exclusively at users outside Panama needs to assess whether the "business in Panama" test is met. That analysis turns on where decisions are made, where infrastructure is held, where staff operate and whether Panamanian residents access the service. Regulators worldwide are increasingly comfortable piercing the "offshore structure" argument where the operational centre of gravity sits onshore. Operators we advise in this position are consistently surprised by how little operational substance an offshore incorporation alone provides.

The following operator profiles are most commonly in scope:

• Crypto exchanges accepting Panamanian residents or routing settlement through Panamanian accounts.
• Stablecoin issuers using Panamanian entities for reserve management or token issuance.
• Payment fintechs offering digital-dollar wallets or remittance rails to Central and South American corridors.
• Custody providers that hold keys or assets on behalf of institutional clients domiciled in Panama.
• OTC desks and brokers structuring large-block trades through Panamanian legal entities.

What does the EMI and VASP application process involve?

The application process for an EMI or VASP registration in Panama proceeds in distinct phases, beginning with a pre-application assessment of whether the proposed activity maps to the existing authorisation categories and which supervisory body holds jurisdiction. The structure of that assessment matters: errors at this stage generate delays that can run to several months while clarifications are sought.

Phase one is the corporate and compliance readiness review. The applicant entity must be duly incorporated in Panama (or demonstrate a qualifying presence), with a registered agent, a physical office or registered address, and a compliant corporate structure free of opaque beneficial-ownership arrangements. FATF's Recommendation on beneficial ownership transparency is embedded in the SBP's customer-acceptance expectations, and the supervisory body will expect clear UBO documentation from the outset.

Phase two is the regulatory filing. The core submission typically includes:

• Certified constitutional documents, shareholder register and UBO declarations.
• An AML/CFT programme that meets the FATF standard, including a Travel Rule compliance policy adapted to the jurisdictions in which the applicant's counterparties operate.
• A business plan describing the proposed services, target markets, projected transaction volumes and the technology stack.
• Evidence of management fitness – director and senior officer backgrounds, regulatory history and clean criminal records.
• Evidence of financial capacity, including the source of initial capitalisation. Specific minimum capital figures are set by the regulatory text applicable at the time of application; our practice confirms these figures against the current official schedule before any filing.
• An IT and cybersecurity assessment demonstrating that client assets and data are held securely.
• Where applicable, a custody segregation policy.

Phase three is the supervisory review and query process. Regulators routinely issue a written queries round. Response quality at this stage is determinative. A substantive, precise response compresses the overall timeline; an incomplete or overly general one triggers a second round and can extend the process by weeks or longer.

The total duration from filing to authorisation varies by the complexity of the applicant's structure and the workload of the relevant supervisory body. In our experience advising on comparable registration paths in the region, a well-prepared application with no material complications typically resolves in a matter of weeks to several months – but this is not a guaranteed timeline and the current regulatory development in Panama means applicants should build contingency into their project plans.

The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. For a scoped assessment of your Panama EMI or VASP position, contact OBOLUS at Map your options.

How does the cross-border banking interaction work for Panama-licensed crypto firms?

Panama's dollarised economy and its position as a regional financial centre make it genuinely attractive for crypto firms that need to move money across Latin American corridors. The challenge is that Panamanian correspondent banks apply de-risking standards that have tightened considerably in recent years, in line with global correspondent banking retrenchment. A VASP or EMI licence does not automatically open a bank account.

Crypto firms operating from Panama routinely find that local commercial banks require regulatory authorisation as a minimum threshold – not a guarantee – before opening an account. Banks then layer on their own internal VASP risk frameworks, which typically demand evidence of a strong AML programme, transaction monitoring capability, clear product scope and a client base that does not create OFAC or sanctions exposure. Operators that arrive at the banking conversation without those materials will not open accounts.

The cross-border dimension is more complex. A Panama-licensed firm serving clients in Brazil, Colombia or Mexico faces the regulatory requirements of each of those jurisdictions in addition to Panama's own regime. Providing payment or virtual-asset services into a jurisdiction without authorisation there – on the assumption that a Panamanian licence provides cover – is a structural misconception that regularly results in enforcement action or the loss of correspondent banking. Regulators in Brazil (under the Banco Central) and Colombia (under the SFC) have active VASP supervisory programmes of their own.

Tax efficiency is often cited as a reason to domicile in Panama. Panama operates a territorial tax system: income generated outside Panama is generally not subject to Panamanian income tax. For a crypto firm whose clients and revenue are predominantly outside Panama, this can be structurally efficient. The analysis must, however, account for the tax treatment in the jurisdictions where those clients and revenues arise, for the transfer-pricing implications of intra-group payments, and for any controlled-foreign-company rules that apply in the beneficial owners' home jurisdictions. Tax analysis must accompany the licence analysis, not follow it.

A practical illustration

In a recent matter, a Central American payments fintech approached us after its Panamanian bank account was closed without notice. The firm had been operating a digital-dollar remittance service under the assumption that its incorporation in Panama satisfied all local requirements. It had not obtained VASP registration, and its AML programme had not been updated to reflect the Travel Rule obligations that applied to its cross-border transfers. We mapped the gap between the firm's operational footprint and its regulatory status, prepared a remediation plan that included an expedited VASP registration filing and a revised AML/CFT framework, and engaged with the firm's replacement banking provider on its behalf. The account was restored and the registration process was initiated – but the episode had cost the firm several weeks of operational disruption and significant management time that would not have been necessary with the right structure in place from the start.

Which operator profile should consider Panama, and which should not?

Panama fits some operator profiles well and is a poor fit for others. Working through the decision honestly before committing avoids the cost of a structural rebuild later.

Profile A – Latin American corridor payment operator. A firm whose core product is fiat-to-crypto or crypto-to-fiat conversion serving Central and South American users, with a need for USD banking and regional physical presence, is a natural candidate for the Panama route. The territorial tax system, dollarised environment and regulatory development trajectory each support this profile. The key risk is that additional VASP authorisations will be required in each jurisdiction where clients reside – Panama alone is not a regional passport.

Profile B – EU-facing exchange or custodian. A firm that intends to serve European clients at scale should place its primary licence in the EU under MiCA (the Markets in Crypto-Assets Regulation), which provides a genuine EU-wide passport through a CASP (Crypto-Asset Service Provider) authorisation from any member state competent authority. A Panama entity may complement the structure but should not be the primary regulatory home for EU user relationships. A secondary entity in a high-regulatory-credibility jurisdiction is operationally useful; it does not substitute for the primary licence in the market where the clients are.

Profile C – Institutional OTC desk or fund manager. A firm engaged in large-block virtual-asset trading for institutional counterparties with no retail-facing product faces a lower regulatory trigger in many respects – the retail-protection provisions that drive much of the EMI/VASP licensing architecture are less directly applicable. Panama can be a viable structure for this profile, but banking and counterparty due-diligence requirements from institutional clients will demand regulatory clarity regardless. An unregistered structure will be screened out by sophisticated counterparties.

Profile D – Global stablecoin issuer. A firm issuing a stablecoin pegged to a fiat currency and distributing it to users across multiple jurisdictions faces the full architecture of both the EMI regime (in Panama and in each user jurisdiction) and the token-specific rules applicable in the EU (under MiCA's ART/EMT categories), Singapore and Hong Kong. Panama alone does not resolve that structure. The firm needs a licence stack, not a single registration.

If a prior application stalled or a banking relationship was closed, a second-read engagement can surface the structural reason and the route forward. Map your options with the OBOLUS licensing desk.

What are the AML and Travel Rule obligations for Panama crypto firms?

Panama's AML/CFT requirements for VASPs and EMIs are grounded in FATF standards, and compliance with FATF Recommendation 15 – including the Travel Rule obligation to pass originator and beneficiary data with each qualifying virtual-asset transfer – is now a core supervisory expectation. The Travel Rule applies to transfers above a threshold set by the applicable regulation; that threshold should be confirmed against the current official text, as it may differ from the FATF-recommended figure.

Practically, Travel Rule compliance requires a technical solution. The firm must be able to identify the originating VASP and the beneficiary VASP for each covered transfer, transmit the required data in a format compatible with the counterparty VASP's system, and retain records for the period prescribed by regulation. Where the counterparty VASP is in a jurisdiction that has not implemented the Travel Rule, the firm must apply a risk-based approach to managing the information gap – typically involving enhanced due diligence on the counterparty and a documented policy for handling non-compliant transfers.

KYC requirements align with the customer due-diligence standard under the FATF Recommendations: identity verification, beneficial ownership identification for legal-entity clients, source-of-funds documentation at or above the applicable threshold, and ongoing transaction monitoring calibrated to the firm's risk appetite. Panama's supervisory body will assess the adequacy of the programme as part of the authorisation process and in any subsequent inspection.

In our cross-border practice, we consistently find that AML programmes drafted for one jurisdiction need material revision before they meet the supervisory expectations of another. A programme built for an EU entity under MiCA's AML/CFT overlay will not translate directly to a Panama VASP submission without adaptation to the local supervisory guidance, the counterparty profile and the specific payment corridors in use.

A common assumption worth examining

A common assumption among operators entering Panama is that a single offshore registration covers their entire global user base. It does not. The territorial principle in licensing means that a VASP authorisation in Panama creates a right to operate in Panama – it does not create a right to serve clients in Brazil, Mexico, the EU or anywhere else without separate analysis of whether those jurisdictions require local authorisation. The practical consequence of the assumption, when it is tested by a regulator or a banking partner, is invariably expensive: enforcement proceedings, banking account closure, or the cost of a structural rebuild under time pressure.

The correct approach is to map the jurisdictions in which the firm's clients are located or will be located, identify which of those impose their own VASP/EMI authorisation requirements, and build a licence stack that covers the material operating perimeter before the first client onboards. That stack may include Panama as the primary entity, allied counsel in the relevant jurisdiction for each market, and a tax and banking architecture that supports the whole structure. It is more work up front. It is considerably less work than unwinding an enforcement action.

Related at OBOLUS

Related at OBOLUS

• Digital-asset licensing and registration practice – end-to-end licensing counsel across 70+ jurisdictions for exchanges, custodians and issuers
• Crypto regulation and licensing in Malta – how Malta's MiCA transition affects existing VFA-licensed operators and new CASP applicants
• KYC and onboarding framework in Gibraltar – the customer due-diligence and onboarding obligations that apply to Gibraltar-licensed crypto firms

FAQ

How long does a crypto licence take to obtain?

Timelines vary significantly by jurisdiction and by the complexity of the applicant's structure. In well-developed regimes – Singapore under the Payment Services Act, or an EU CASP under MiCA – a fully prepared application typically moves through the review process over a period of several months. In a developing regime such as Panama, where secondary regulation is still being implemented, building additional contingency into the project timeline is prudent. The single greatest driver of delay is an incomplete or poorly sequenced application file.

Which jurisdiction is best for licensing my crypto business?

There is no universally correct answer. The right jurisdiction turns on the firm's product, its client geography, its banking requirements and its beneficial-ownership structure. An EU-facing exchange belongs in MiCA. A Latin American remittance operator may find Panama genuinely efficient. A firm with institutional counterparties globally needs a jurisdiction with strong regulatory credibility – ADGM, Singapore, or an EU member state. A single assessment of product, market and structure is the correct starting point, not a list of available jurisdictions ranked by cost.

Do I need a separate custody licence?

In most established regimes, custody of virtual assets is a regulated activity in its own right and requires either a standalone authorisation or a specific activity permission within a broader licence. Under MiCA, custody and administration of crypto-assets for clients is one of the defined CASP activities. Under VARA in Dubai, custody is a separately licensed activity. Panama's framework addresses custody within its VASP registration architecture, but the precise scope of the custody permission and whether it covers all intended custody arrangements should be confirmed against the current regulatory text.

About OBOLUS

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – not after the first enforcement letter arrives. We work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications. To discuss your situation, contact info@oboluslaw.com or reach us via t.me/oboluslaw.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in inbound operator authorisation strategies across Latin American and Asia-Pacific digital-asset regulatory regimes.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.