A token issuer expanding into Latin America discovers that Panama's legal system offers a sophisticated civil-law base and a common-law influenced commercial court, yet provides no dedicated digital-asset securities statute. The central legal question for any security token offering (an STO – a tokenized instrument that confers economic rights typical of a security) structured from or through Panama is therefore not whether the jurisdiction is crypto-friendly in a general sense, but whether the specific rights encoded in the token trigger Panama's securities laws, the tax and corporate regimes that surround the offering, and the downstream obligations that arise in every jurisdiction where the token is sold. Mis-classifying a token can convert what was designed as a product launch into an unregistered securities offering – a regulatory failure with consequences that reach the founders personally. This page maps the legal analysis, the process, the cross-border interaction, and the decision point for a business considering an STO from Panama.
What is a security token offering in Panama, and how is the legal basis determined?
A security token offering in Panama is a public or private sale of digital tokens whose legal substance – not their label – confers rights equivalent to equity, debt, profit participation or investment in a managed enterprise. Panama's principal securities regime, administered by the Comisión Nacional de Valores (CNV – the National Securities Commission), applies to instruments that meet the functional definition of a "valor" (security) under the applicable securities legislation. The CNV has not issued a dedicated crypto-asset regulation, but its classification methodology tracks substance over form: a token that grants dividend rights, a revenue share, a debt obligation or a claim on the proceeds of a managed pool of assets will be treated as a security regardless of whether the whitepaper calls it a utility token.
The analytical starting point is therefore a token-classification opinion. That opinion asks three questions simultaneously: first, what rights does the holder receive under the smart contract and the governing documentation; second, do those rights create a passive-investment expectation in a promoter's efforts (the classic Howey-adjacent test that the CNV applies by reference to comparative jurisprudence); and third, in what other jurisdictions will the token be offered, sold or traded, because each of those jurisdictions applies its own classification logic. Panama's rules govern the issuer's domestic position; they do not displace the securities laws of the US, the EU, the UK or any other market where purchasers are located.
In our cross-border practice, the single most common structural error is completing the Panama corporate and tax work without commissioning a multi-jurisdictional classification matrix first. The entity is incorporated, the whitepaper is drafted, and then the offering is paused at the banking stage because the bank's compliance team concludes the instrument is a security in the bank's home jurisdiction. Sequence matters: classification drives structure, not the other way around.
The CNV has broad authority to require registration of any public offering of securities in Panama, including tokenized ones. A private placement to sophisticated or institutional investors may avoid the full public-offering registration pathway – but the criteria for "private" are strict, and the issuer must document the basis for the exemption before the offering opens, not after.
To map the classification and choose the correct offering track before you commit to a structure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard analytical path. Your facts – the rights encoded in the token, your investor base, your banking counterparty – change the analysis materially.
How does the Panama corporate framework support an STO structure?
Panama's corporate environment is one of the most internationally used in the Americas for holding and issuing vehicles, and that depth of infrastructure is a genuine advantage for STO structuring. A Sociedad Anónima (S.A. – Panama's bearer-share-reformed joint-stock company) or a Fundación de Interés Privado (Private Interest Foundation) can serve as the issuer entity, with the choice turning on governance preferences, succession planning, and the nature of the token's rights structure.
For a standard STO, the issuer S.A. holds the tokenized instrument on its balance sheet, the smart contract mints tokens that represent the economic rights specified in the subscription agreement, and the white paper constitutes the primary disclosure document. Panama's corporate law is flexible on capital structure: the S.A. can issue multiple classes of shares or other instruments, and there is no mandatory minimum paid-in capital at formation – though a capitalised entity provides a stronger picture to banking counterparties and the CNV.
One structural consideration specific to Panama is the interaction between the corporate formalities and the token's on-chain mechanics. If the token represents equity in the S.A. itself, the register of shareholders must reflect on-chain ownership changes in order to maintain legal coherence. That register-to-chain reconciliation protocol is a technical-legal deliverable that is frequently overlooked until it causes a problem at a transfer event. We build that reconciliation mechanism into the offering documents at the outset.
Panama also operates a territorial tax system: income generated outside Panama is not subject to Panamanian income tax at the corporate level. For an STO whose investors and commercial activity are largely offshore, this can be a material consideration – but the territorial character does not eliminate withholding-tax obligations on distributions to foreign holders, VAT-equivalent analysis on token sales, or the tax obligations that arise in investors' home jurisdictions. Each of those layers is analyzed separately.
How do you classify a token correctly under Panamanian and international standards?
Correct token classification requires a rights-based analysis that looks through the marketing label and examines what the holder actually receives. A utility token (a token granting access to a specific product or service that the issuer is building or operating) sits outside the securities perimeter if the holder's return is the service itself rather than a share of the issuer's profits or assets. A security token sits inside it if any of the following are present: a right to dividends or profit distributions; a right to vote on management decisions in a way that resembles equity governance; a contractual obligation of repayment (debt); or a reasonable expectation of return derived from the efforts of a promoter or management team.
In practice, many tokens issued by early-stage projects are hybrids. They offer access rights (utility) but are sold at a price that implies an appreciation expectation driven by the issuer's future development (investment). That hybrid character typically pulls the token into the securities analysis, because the dominant economic purpose is investment, not consumption. The CNV, like regulators in the EU under MiCA and in the US under SEC guidance, gives decisive weight to the economic substance at the time of sale, not to the state of the product at issuance.
The international dimension is unavoidable. A token classified as a utility instrument under Panama's domestic analysis may still be a security under US federal law (applicable to any US-person purchaser), a transferable security under the MiCA framework (triggering EU prospectus or MiCA whitepaper obligations for EU-resident purchasers), or a regulated investment product under the FCA's financial-promotion rules for UK purchasers. The offering structure must, at a minimum, include verified geographic restrictions and a documented basis for those restrictions in the subscription agreement and the smart-contract access controls.
What is the STO process and indicative timeline when structured from Panama?
The process for a Panama-domiciled STO moves through five sequential phases, and the timeline is determined primarily by the complexity of the classification analysis and the level of investor verification required – not by the speed of corporate formation, which is a matter of days.
The first phase is scoping: classification opinion, investor-base analysis, and jurisdiction mapping. This phase establishes whether the offering is a public securities offering requiring CNV registration, a private placement structured under an available exemption, or a hybrid that requires parallel regulatory analysis in the target investor markets. Depending on the complexity of the token's rights structure and the number of target jurisdictions, this phase typically runs over several weeks.
The second phase is structural design: entity selection and incorporation (S.A. or other vehicle), capital structure documentation, and the smart-contract governance protocol (including the register-to-chain reconciliation mechanism described above). This phase runs in parallel with the third phase – document drafting – which produces the subscription agreement, the whitepaper or offering memorandum, the terms and conditions governing the token, and any investor-representation letters needed to support a private-placement exemption.
The fourth phase is regulatory filing or exemption documentation. If the offering is a public offering in Panama, CNV pre-registration review adds time that varies with the regulator's workload and the complexity of the instrument. Private placements proceed on a shorter track, but the exemption documentation must be complete and filed in the correct sequence. The fifth phase is the offering itself: KYC/AML onboarding of investors, smart-contract deployment, subscription closing, and post-closing compliance reporting.
A well-prepared private placement structured entirely from Panama, with no requirement for CNV full registration, can move from scoping to closing in a matter of months. A public-offering track adds regulatory review time. Operators we advise routinely underestimate the time required at the classification and document-drafting phases – the corporate formation is the fastest element, not the slowest.
If a prior STO structure stalled at the banking stage or received a regulatory query, a second-read analysis can surface the structural cause and the path forward – contact us to schedule a scoped review. A prior application that stalled often reflects a classification or documentation issue that is correctable.
How does the cross-border tax and banking layer interact with a Panama STO?
Panama's territorial tax system is one of the most discussed features of the jurisdiction for international issuers, but it operates within a set of constraints that the territorial label alone does not capture. The key interaction points for an STO are corporate income tax on Panama-source income, withholding tax on distributions to foreign investors, transfer-tax analysis on secondary-market token transfers, and the substance-over-form scrutiny that banking counterparties and correspondent banks apply to Panama-domiciled entities.
On the tax side: token sale proceeds that are sourced offshore – that is, from investors who are not Panamanian residents and whose investment activity occurs outside Panama – are generally outside the Panamanian corporate income tax base under the territorial principle. That does not mean the proceeds are untaxed globally: investors in the EU, the US, Singapore, the UK and most other significant markets will have their own characterization rules for token acquisition, gain and income, and those rules are entirely independent of Panama's domestic analysis. The offering structure must account for investor-side tax disclosures, particularly for US-person investors who are subject to FATCA reporting obligations that flow back to the Panamanian issuer's banking counterparty.
On the banking side, the practical reality is that Panama-domiciled entities associated with digital-asset offerings face elevated correspondent-bank due-diligence requirements. Panama remains on certain enhanced-monitoring lists maintained by international bodies, and banks in the US, EU and UK that might otherwise service a Panama S.A. will apply heightened scrutiny to the source of funds, the nature of the digital-asset activity, and the AML/KYC controls in place. We have seen well-structured offerings delayed at the banking stage not because of a legal defect in the offering itself, but because the issuer had not prepared a banking-compliance package – a structured summary of the AML/KYC protocol, the investor verification process, the forensic monitoring approach, and the governance documentation – that meets the correspondent bank's standard.
For issuers whose ultimate investor base is significantly EU-resident, the MiCA regime adds another layer. MiCA applies to crypto-asset services provided to EU residents regardless of where the issuer is domiciled. If the token meets the definition of a crypto-asset under MiCA (which encompasses most non-security tokens and specifically asset-referenced tokens and e-money tokens), the issuer is required to publish a compliant whitepaper – a defined disclosure document – before marketing to EU purchasers, even from Panama. A Panama-domiciled issuer marketing to EU investors without a MiCA-compliant whitepaper is in breach of EU law, not just as a matter of best practice but as an enforceable obligation the ESMA and national competent authorities can act on.
What AML, KYC and Travel Rule obligations apply to a Panama STO?
Panama has implemented a FATF-aligned AML/CFT framework, and virtual asset service providers operating in Panama are subject to its provisions. For an STO issuer, the relevant obligations arise at two levels: the issuer's own investor-onboarding process and, if the tokens are subsequently traded on a secondary-market platform, the VASP-level obligations that apply to that platform.
At the issuance stage, the issuer must apply customer due diligence (CDD) to each investor at subscription: identity verification, source-of-funds documentation, sanctions screening and, where investor profiles require it, enhanced due diligence. These obligations are not optional even for a private placement. Panama's AML supervisors have broadened their focus on digital-asset activities, and an issuer that cannot produce investor-verification records is exposed both to regulatory sanction and to banking-relationship risk.
The Travel Rule (the obligation, derived from FATF Recommendation 15, to pass originator and beneficiary identification data alongside a virtual-asset transfer above the applicable threshold) applies in principle to transfers of the STO tokens wherever those transfers occur on a regulated platform. The threshold varies by jurisdiction – each jurisdiction that has implemented the Travel Rule sets its own de-minimis amount – and the issuer's legal responsibility is to ensure that the smart-contract and token-transfer documentation architecture is compatible with Travel Rule data collection, even if the issuer itself is not the VASP processing the transfer.
We assess this interaction at the structural phase, not after deployment. A token whose transfer mechanism is incompatible with Travel Rule data attachment can require a protocol-level revision that is significantly more costly post-launch than at the design stage.
Which offering profile suits Panama, and how should the decision be framed?
Not every STO is well-suited to Panama, and the decision whether to use Panama as the issuer jurisdiction – rather than a jurisdiction with an explicit digital-asset securities regime, such as the ADGM in Abu Dhabi or a MiCA-authorised EU entity – turns on a set of identifiable variables.
Profile A is the issuer whose token rights analysis concludes the instrument is a security, whose target investor base is institutional or sophisticated (non-retail), whose investors are primarily in the Americas and Asia-Pacific rather than the EU, and whose corporate flexibility and tax-efficiency objectives are well-served by a territorial-tax jurisdiction. For this profile, a Panama private placement structure – supported by a robust classification opinion, a full AML/KYC investor-onboarding process, and a banking-compliance package – can be a proportionate and efficient solution. The timeline is measured in months, not quarters, and the absence of a dedicated digital-asset securities licensing regime means the regulatory pathway is primarily transactional rather than supervisory.
Profile B is the issuer whose token is on the borderline of the utility/security classification – where a reasonable argument exists that MiCA's crypto-asset whitepaper obligation applies for the EU investor segment. For this profile, a Panama entity can still serve as the offshore issuer, but a parallel MiCA-compliant whitepaper and a CASP-authorised EU distribution partner may be required, adding structural and compliance cost. The decision matrix for Profile B is whether to restrict EU investors entirely (contractually and at the smart-contract access-control level) or to accept the MiCA obligation and build for it from the start.
Profile C is the issuer seeking a retail offering to a broad global investor base, including EU and UK retail investors. For this profile, Panama alone is not sufficient: EU retail access requires either MiCA CASP authorisation for the distribution channel or a national prospectus-equivalent, and UK retail access requires FCA financial-promotion compliance. Panama can still play a role as the holding or treasury entity, but the offering-facing entity must sit in a regulated jurisdiction for each relevant market.
In our cross-border practice, we have seen issuers default to Panama on cost grounds and then incur substantially higher costs re-structuring the offering when the investor-base and distribution-channel analysis is done properly. The cheaper entry point is the correct jurisdictional analysis at the outset, not the Panama incorporation cost.
A recent structuring engagement: cross-border STO from a Americas-domiciled issuer
In a recent matter, a fintech operator based in the Americas sought to issue tokens representing a revenue-share interest in a payments platform. The initial whitepaper described the tokens as utility instruments granting "access to platform features." Our classification analysis concluded the tokens were securities under the applicable legal tests in three of the five target investor jurisdictions, because the economic substance – a percentage of monthly net revenue distributed quarterly to holders – was unambiguously a profit-participation right, not a service-access right. We restructured the offering as a private placement to institutional investors only, implemented a jurisdiction-by-jurisdiction investor restriction protocol, and prepared a banking-compliance package that addressed the correspondent bank's enhanced due-diligence requirements. The offering closed within the planned window, and the issuer's banking relationship was maintained without interruption.
Common assumption: does a utility label on a whitepaper settle the classification?
A common assumption among first-time STO issuers is that labeling a token as a "utility token" in the whitepaper resolves the securities-law question in their favor. It does not. Regulators in every major jurisdiction – the CNV, the SEC, the FCA, and the competent authorities under MiCA – apply a substance-over-label test. The name given to the token in the issuer's marketing documents is a starting point for analysis, not a conclusion. What matters is the actual bundle of rights encoded in the smart contract and the governing documentation: if those rights create a passive-investment expectation dependent on the issuer's management efforts, the token is a security in substance, and the utility label provides no legal protection. It may, in fact, aggravate the regulatory exposure by demonstrating that the issuer was aware of the classification question and chose a label to avoid it.
We assess classification against the substance of the rights, not the marketing framing. That approach protects the issuer from the most serious category of post-launch regulatory risk: a cease-and-desist or enforcement action framed around an unregistered securities offering.
Self-assessment checklist for a Panama STO
Before engaging counsel or beginning document preparation, an issuer can use the following questions to identify the complexity of the engagement and the most critical sequencing decisions.
- Have you documented precisely what rights the token confers – economic, governance and redemption – independent of any marketing description?
- Have you identified every jurisdiction in which you intend to offer, sell or allow secondary-market trading of the token?
- Have you assessed whether any of those jurisdictions requires a regulatory filing, authorisation or exemption documentation before the offering opens?
- Have you identified your banking counterparty and confirmed that counterparty's requirements for onboarding a Panama digital-asset issuer?
- Have you built a KYC/AML investor-onboarding protocol that meets Panama's AML obligations and the requirements of the bank servicing the offering proceeds account?
- Have you mapped the Travel Rule data obligations for the token's secondary-market transfer infrastructure?
- Have you assessed whether MiCA applies to any segment of your target investor base, and if so, whether you are building for compliance or restricting EU investors contractually?
Each "no" or "uncertain" answer in that checklist represents a workstream that must be completed before the offering opens. Operators we advise routinely discover that the checklist surfaces two or three structural gaps that the initial project plan had not identified as legal deliverables.
Related at OBOLUS
- Token Offerings & Securities – practice overview – how OBOLUS approaches STO structuring, classification and cross-border securities compliance
- Token legal classification in Mauritius – comparative classification analysis under the VAITOS framework for issuers weighing African-hub alternatives
- MLRO and compliance officer function in the Czech Republic – AML governance requirements for digital-asset businesses in an EU member-state context
FAQ
Is my token a security?
Whether your token is a security depends on the rights it actually confers, not on the label in your whitepaper. Regulators – including Panama's CNV, the SEC and the competent authorities under MiCA – apply a substance-over-form test. A token that grants profit participation, dividends, repayment obligations or a passive-investment expectation tied to the issuer's efforts will typically be classified as a security in the jurisdictions where it is offered, regardless of its marketing description. A rights-based classification opinion is the required first step before any offering documents are prepared.
Do I need a MiCA whitepaper?
If your token meets the definition of a crypto-asset under MiCA – and your offering reaches EU-resident purchasers – a MiCA-compliant whitepaper is required before marketing begins, even if your issuer entity is domiciled outside the EU, including in Panama. MiCA's reach is determined by where purchasers are located, not where the issuer is incorporated. The whitepaper requirements under MiCA are a defined disclosure standard administered by ESMA and national competent authorities; non-compliance exposes the issuer to enforcement action in each affected member state. EU investor restriction – enforced both contractually and at the smart-contract level – is the alternative to MiCA compliance, but it must be implemented rigorously to be effective.
How should an airdrop be structured legally?
An airdrop – the free distribution of tokens to wallet addresses – is not automatically outside the securities perimeter simply because no payment is received. The analysis turns on whether the recipients are expected to provide value (through promotion, data contribution or community activity), whether the airdropped tokens confer the same rights as sold tokens, and whether the distribution constitutes a public offering in the jurisdictions where recipients are located. A well-structured airdrop documents the absence of an investment contract, applies geographic restrictions to exclude restricted jurisdictions, and is consistent with the issuer's overall classification position. AML considerations also apply: large-scale airdrops to unverified wallet addresses may conflict with the issuer's KYC obligations in its banking and regulatory relationships.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess token classification against the substance of rights, not marketing labels – protecting issuers from the most serious category of post-launch regulatory exposure. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when misappropriation occurs. To discuss your situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in token classification, smart-contract governance and cross-border STO structuring for digital-asset issuers.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.