Operating an exchange, custody service or payment platform in Panama without the correct authorisation is not a calculated risk – it is the fastest route to frozen correspondent banking, regulatory notice and a permanent bar from the jurisdiction's financial system. For digital-asset businesses reviewing entry options in Latin America, Panama occupies a distinctive position: a dollarised economy with deep free-zone infrastructure, mature banking relationships for international commerce, and a VASP (virtual asset service provider) licensing regime introduced by Law 129 of 2022 that places specific obligations on operators before they touch a Panamanian client or process a transaction through a local entity.
This page maps the regulatory basis, the application process, the banking and tax interactions an inbound operator must plan for, and the cross-border decisions that determine whether Panama belongs at the centre or the edge of your structure. As the regime continues to mature, the gap between operators who have planned the full licence-banking-tax stack and those who have not is widening.
What is the legal basis for VASP licensing in Panama?
Panama's Law 129 of 2022 is the foundational instrument for VASP licensing in Panama, establishing mandatory registration and operational requirements for entities providing virtual-asset services as a business within or from Panamanian territory. The Superintendency of Banks of Panama (SBP) supervises most financial-sector activity; implementation guidance under Law 129 has been developed jointly with the Ministry of Commerce and Industry (MICI). The regime draws directly on the FATF Recommendations, including the FATF's Recommendation 15 on virtual assets and the Travel Rule obligation.
The law defines covered activities broadly. Exchange services, custody of virtual assets, transfer services, financial services related to initial offerings of virtual assets, and participation in or provision of services related to virtual-asset platforms all fall within the regulated perimeter. An operator does not need a physical Panamanian office to trigger the registration requirement if the service is directed at Panamanian residents – a point that catches inbound digital businesses by surprise.
The regime is not a passporting structure. A MiCA CASP authorisation from an EU member state, an FCA registration in the United Kingdom, or a MAS Payment Services Act licence from Singapore does not substitute for Panamanian registration. Each licence stands alone. For a business building a multi-jurisdiction structure, that means the Panama registration sits alongside, not instead of, licences in the other markets the business serves.
The SBP's approach to supervision reflects the international AML/CFT standard. Regulated VASPs must implement customer due diligence, ongoing monitoring, suspicious transaction reporting to the UAF (Panama's financial intelligence unit), and Travel Rule-compliant transaction data-sharing. The Travel Rule (the obligation to pass originator and beneficiary information with a virtual-asset transfer) applies above the prescribed threshold; operators must have compliant technology in place before going live, not as a post-licence retrofit.
Contextual note for inbound operators: Panama's registration is a business licence, not an activity-specific authorisation of the kind seen in Dubai under the VARA regime or in the EU under MiCA's CASP framework. The implication is that an operator running exchange, custody and staking services under one Panamanian entity may do so under a single registration, whereas other leading hubs require separate activity endorsements. That structural simplicity is an advantage – provided the underlying compliance infrastructure is built to the full scope of what the registration covers.
To map whether your specific activities trigger the Panamanian registration requirement, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base, the banking – change the analysis.
Who is required to register as a VASP in Panama?
Any business providing virtual-asset services on a commercial basis that has a Panamanian nexus – through incorporation, a local branch, directing services at Panamanian residents, or processing transactions through Panama's financial system – requires registration under Law 129 of 2022. The analysis turns on substance, not label.
A non-exhaustive list of operator profiles that consistently trigger the requirement:
- Centralised exchanges offering fiat-to-crypto or crypto-to-crypto conversion to Panamanian users
- Custodians holding virtual assets on behalf of Panamanian clients or entities
- Payment processors routing value through virtual-asset rails for Panamanian businesses
- Businesses issuing tokens and offering them to Panamanian residents, where the issuance constitutes a covered financial service
- OTC desks and brokers executing trades for or with Panamanian counterparties on a commercial basis
A pure technology provider – building non-custodial infrastructure, software or APIs without taking custody of assets or executing transfers – occupies a different position, though the line between technology provision and service provision is genuinely contested in practice and should be assessed against the specific facts before the business model is committed to paper.
The offshore-holding-company assumption is a common point of failure. A BVI or Cayman parent company whose Panama subsidiary or branch provides the actual service does not escape registration. The regulated person is the entity providing the service, not the entity at the top of the corporate chain. In our practice, we have seen operators launch in Panama relying on a parent-level registration in another jurisdiction – a structure that does not satisfy Panamanian law and surfaces precisely when the banking relationship is reviewed.
What does the VASP registration process in Panama involve?
The registration process under Law 129 of 2022 is document-intensive and materially similar in structure to the processes used by leading hubs globally, with the SBP and MICI each playing a role in the review. A well-prepared application proceeds in the following sequence, though the exact steps and their sequencing should be confirmed against current implementing regulations before submission.
The first stage is entity establishment. The applicant must be a Panamanian-incorporated entity or an authorised foreign entity operating through a registered branch. Panama offers several corporate forms; the most commonly used for financial-services purposes is the sociedad anónima (a private corporation). Registered-agent and resident-agent requirements apply.
The second stage is preparation of the compliance and governance package. The SBP expects to see an AML/CFT program that is complete at the time of application – not a draft to be finalised post-licence. That program must address customer due diligence procedures, Travel Rule data-sharing arrangements and the technology solution chosen for them, suspicious transaction reporting channels to the UAF, sanctions-screening processes, and internal audit arrangements. A compliance officer must be designated; the officer's qualifications and the completeness of the program are reviewed before the application advances.
The third stage is the fit-and-proper review of beneficial owners, directors and senior management. Panama applies a thorough beneficial-ownership analysis. Operators with complex multi-layer holding structures should expect extended review at this stage. Background checks, criminal-record certificates across all relevant jurisdictions, and source-of-funds documentation for capital are standard.
Timeline for registration is not fixed by statute at a single publicly stated period; it varies based on the complexity of the entity structure, the quality of the initial submission and the volume of concurrent applications before the relevant authorities. In our cross-border practice, operators who submit a complete and well-organised package consistently move through the process faster than those who submit incrementally or with gaps that generate regulatory information requests. Allowing for a period measured in weeks to several months is the prudent planning assumption, not a short turnaround.
A micro-matter illustrates the difference preparation makes. In a recent matter, a payments company had incorporated a Panamanian entity and opened a local bank account before engaging legal counsel on the registration requirement. The compliance program it had drafted did not include Travel Rule provisions and did not designate a compliant technology solution. We restructured the compliance framework, updated the officer's mandate, and completed the regulatory submission with a full beneficial-ownership package. The application proceeded without a request for additional information at the first review stage.
How does Panama's banking environment affect crypto businesses?
Banking access is the single largest operational risk for a VASP in Panama, and it is the issue that most reliably separates businesses that planned the structure carefully from those that did not. Panama's bank secrecy tradition and its status as a major international banking centre create real advantages for legitimate financial commerce. They also create a compliance culture among Panamanian correspondent banks that is among the most conservative in Latin America.
Panamanian commercial banks maintain their own de-risking policies for virtual-asset businesses. Registration under Law 129 of 2022 is a necessary condition for banking access – but it is not a sufficient one. Banks conduct their own due-diligence review of VASP applicants, and they assess the nature of the business, the volume and type of transactions expected, the jurisdiction of the counterparties, and the depth of the AML/CFT program. An operator with a clean registration but a thin compliance file will not find the banking relationship straightforward.
The dollarisation of Panama's economy is structurally important for cross-border operators. All transactions in Panama clear in US dollars, which means a VASP operating in Panama has direct access to dollar-denominated commercial banking without the currency-conversion layer that applies in other Latin American jurisdictions. For a business whose primary treasury currency is USD – the majority of exchange and stablecoin-focused operators – that is a meaningful structural advantage.
Correspondent banking risk is real. Several Panamanian banks lost US correspondent relationships in prior years following FATF grey-listing, and while Panama's FATF status has improved, the memory of that period shapes how Panamanian banks approach high-risk sectors including virtual assets. Operators should expect to provide granular transaction-volume projections, counterparty profiles and source-of-funds documentation at the account-opening stage, and should plan for a bank onboarding process that may take longer than the licence registration itself.
The cross-border dimension extends to the relationship between the Panamanian VASP and its entities in other jurisdictions. A Panama-licensed entity that routes transactions to or from entities in the EU, Singapore or the United Kingdom will be subject to the outbound reporting and Travel Rule requirements of both Panama and those jurisdictions. The compliance architecture must address all legs of the chain. A MiCA-licensed counterparty in the EU, for instance, will require Travel Rule-compliant data from the Panamanian originating VASP before it will process a transfer – making Travel Rule implementation in Panama not just a domestic regulatory obligation but a commercial prerequisite for European counterparty relationships.
What are the tax and economic substance considerations for a licensed VASP in Panama?
Panama's territorial tax system is the most cited reason for choosing the jurisdiction as a digital-asset base. Under the territorial principle, income derived from sources outside Panama is not subject to Panamanian income tax. A VASP that is incorporated in Panama and conducts business activity for international clients may, depending on the structure and facts, pay no Panamanian corporate income tax on the international revenue stream.
That general principle is accurate as far as it goes. The complications arise in the application. First, a VASP registered in Panama and actively supervised by Panamanian authorities must demonstrate that it has genuine substance in the jurisdiction – management decisions made in Panama, compliance operations run in Panama, key personnel physically present. Substance is not a formality under current international standards; it is assessed by the SBP as part of supervision and by trading partners and banks as part of their due-diligence review of the entity.
Second, the territorial rule applies to Panamanian-source income. Revenue from Panamanian clients, or from transactions that are executed through Panamanian infrastructure in a legally meaningful sense, may attract Panamanian tax. The analysis is fact-specific and should be mapped before the business model is committed to a structure that assumes full territorial exemption.
Third, the jurisdictions where the VASP's clients and counterparties are located impose their own tax reporting obligations. A Panama VASP serving EU clients is within scope of the reporting obligations that MiCA-supervised entities in the EU impose on their counterparties. US persons dealing with a Panamanian VASP will trigger FBAR and FATCA reporting chains. The Panama structure does not isolate the operator from those extraterritorial obligations – it just changes the primary registration point.
Economic substance for a licensed VASP is a related but distinct question. The OECD's base erosion standards and Panama's own commitment to the Common Reporting Standard (CRS) mean that the post-registration substance requirement is treated seriously by sophisticated counterparties even where Panamanian law does not itself impose a standalone substance test. We map the substance requirements alongside the licence at the outset, because retrofitting substance into an existing structure is consistently more expensive than building it in.
How does Panama compare to other licensing jurisdictions for crypto businesses?
Panama is best understood as a Latin American operational base with territorial tax advantages, rather than a globally recognised brand-name crypto hub of the kind that Dubai, Singapore or Lithuania represent. That distinction matters for the decision matrix.
An operator whose primary market is Latin America, whose treasury currency is USD, and whose banking counterparties operate in the Western Hemisphere will find Panama structurally well-suited. The dollarised economy, the Panama Canal-era banking infrastructure, the territorial tax system and the geographic position in the same time zone as the majority of North and South American markets align with that operator profile.
An operator seeking a globally recognised licence that signals regulatory credibility to institutional counterparties in Europe or Asia will find that a Panamanian registration does not carry the same weight as a MiCA CASP authorisation, a MAS Payment Services Act licence, or a VARA licence in Dubai. Those regimes have passporting arrangements, established supervisory track records and institutional counterparty recognition that Panama's newer regime has not yet accumulated. The business using Panama as its primary licence for European institutional business should expect that counterparties will ask for additional comfort – and should plan accordingly.
The comparison is not binary. A common structure in our practice is a Panama entity serving Latin American retail and commercial clients, paired with an EU-registered entity under MiCA for European business, and a Singapore or Hong Kong entity for Asia-Pacific institutional relationships. Panama occupies a defined role in that stack; it is not asked to do work it was not designed to do.
Three operator profiles and their fit with a Panamanian VASP registration:
- LatAm-focused exchange or payment company: strong fit – territorial tax advantage, dollarised banking, responsive to the local client base, registration requirement satisfied domestically.
- Global institutional exchange seeking EU passporting: weak fit as a sole licence – Panama registration does not passport; a MiCA CASP or equivalent is required for EU access.
- Token issuer conducting an international offering: partial fit – Panama may serve as a holding or IP structure, but the offering itself will require analysis of the securities and public-offering laws in each target jurisdiction.
If a prior application in another jurisdiction stalled or a banking relationship closed, a structural review can identify the reason and the route forward. Write to info@oboluslaw.com to discuss the options.
What mistakes do VASP applicants most commonly make in Panama?
The most costly mistake is treating the registration as an administrative checkbox rather than the first step in building a supervised financial-services business. Operators who draft a thin compliance program, designate a nominal compliance officer and then submit an application expecting a short review cycle consistently generate regulatory requests for additional information that add months to the process and signal to the SBP that the business is not ready to operate.
A second common mistake is the assumption that a Panamanian registration resolves the cross-border licensing question. It does not. A Panama-licensed VASP directing services at clients in the EU is not exempt from MiCA obligations. A Panama-licensed VASP whose US-person clients trigger FinCEN reporting requirements does not eliminate those requirements by placing the entity in Panama. The Panama licence addresses the Panamanian regulatory obligation only.
A third mistake – closely related to the myth this page addresses directly – is the assumption that a single offshore registration covers global operations. A common assumption among early-stage operators is that licensing in one jurisdiction, wherever that jurisdiction may be, creates a blanket authorisation to serve clients worldwide. That assumption has never been accurate. It is actively dangerous in the current environment, where regulators in the EU under MiCA, in the United Kingdom under FCA rules, in Singapore under the Payment Services Act and in Hong Kong under the SFC's VATP regime are actively enforcing against unlicensed foreign VASPs directing services at their residents.
A fourth mistake is deferring the banking analysis until after the licence is obtained. The banks most relevant to a Panamanian VASP review the compliance program before they will open an account. An operator who obtains the registration and then approaches banks will discover that the questions the banks ask are substantially identical to the questions the regulator asked – and that any gaps in the compliance program that slipped through the registration review will surface in the banking process.
Related at OBOLUS
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the full scope of OBOLUS's licensing practice across 70+ jurisdictions
- Economic Substance for Licensed VASPs – substance requirements for regulated entities across leading hub jurisdictions
- AML and Travel Rule Regime in Lithuania – the EU's Travel Rule implementation and its practical effect on cross-border transfers
FAQ
How long does a crypto licence take to obtain?
In Panama, registration timelines under Law 129 of 2022 vary by the complexity of the entity structure and the completeness of the initial submission. A well-prepared application from a straightforward single-entity structure typically advances materially faster than one requiring multiple rounds of regulatory correspondence. Across other flagship jurisdictions – MAS in Singapore, SFC in Hong Kong, VARA in Dubai – timelines similarly range from a matter of weeks for simpler registrations to several months for full licence authorisations requiring capital and governance review. Build the conservative end of the range into your go-live plan.
Which jurisdiction is best for licensing my crypto business?
There is no universally correct answer. The optimal registration jurisdiction depends on the primary client market, the treasury currency, the banking relationships required, the nature of the services, and the institutional credibility the operator needs with counterparties. Panama suits a Latin American focus with USD banking requirements. The EU under MiCA suits operators needing passported access to European retail and institutional clients. Singapore and Hong Kong suit Asia-Pacific institutional business. Most sophisticated operators hold licences in more than one jurisdiction, each calibrated to a specific market.
Do I need a separate custody licence?
In Panama, the Law 129 of 2022 registration covers custody as a defined virtual-asset service alongside exchange, transfer and related activities; a separate standalone custody authorisation is not required under the current framework. In other flagship jurisdictions the answer differs: VARA in Dubai, the MAS Payment Services Act in Singapore, and MiCA in the EU each address custody as a distinct regulated activity with its own requirements. An operator running custody services across multiple jurisdictions must map the custody-specific requirements in each one, not assume that a single registration covers the full activity set everywhere.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit, because the cost of a structural mistake surfaces at the worst possible moment – when banking is under review or a regulatory notice arrives. Digital assets are the entirety of our practice, and we act only for businesses. To discuss your situation, contact info@oboluslaw.com or message us via t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialist in inbound digital-asset registration strategy for operators entering Latin American and multi-hub licence structures.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.