Panama AML compliance: fines to $5M and your name public

Panama cleared its name. Now it checks yours.

For years, the problem was Panama. The FATF grey-listed it, the European Union put it on its anti-money laundering (AML) high-risk list, and foreign banks treated every Panamanian counterparty with extra suspicion.

That chapter is closed. The FATF removed Panama from the grey list on October 27, 2023, and the European Commission removed it from the EU list of high-risk third countries in July 2025.

But delisting does not lower the bar. It moves it. The next evaluation will not ask whether Panama has good laws. It will ask whether the companies operating there actually comply. If your group runs a free zone distributor, a real estate project or a construction company in Panama, that test is about you.

Off the lists, onto the radar

According to Panama’s Financial Analysis Unit (UAF), GAFILAT’s fifth round of mutual evaluations is scheduled for 2027. This round measures effectiveness: inspections carried out, sanctions imposed, cases built.

For a supervisor, the fastest way to show effectiveness is to inspect and sanction. The sectors with the most room to show results are the non-financial ones, where many foreign-owned businesses sit.

One distinction matters for European counterparties. Panama is off the EU’s AML high-risk list, but remains on the EU’s list of non-cooperative jurisdictions for tax purposes as of the February 2026 update. They are different lists with different consequences. We break both down in Panama and money laundering lists.

Who Panama’s law covers

Panama’s AML framework is Law 23 of 2015, which uses the term blanqueo de capitales for money laundering. Since the 2021 reform (Law 254), the list of non-financial obligated entities is set out in Article 40 of Law 124 of 2020. They are supervised by the Superintendency of Non-Financial Obligated Entities (SSNF).

The list includes, among others:

Companies in free zones: Colón Free Zone, Panamá Pacífico, Barú Free Zone and the rest.
Real estate developers, agents and brokers, when they take part in purchases and sales for clients.
Construction companies, general and specialized contractors.
New and used car dealers.
Casinos, pawnshops, cash-in-transit services and dealers in precious metals or stones.
Lawyers and certified public accountants when acting for clients in real estate deals, managing funds, creating or selling companies, or serving as resident agent.

If your Panamanian entity operates in one of these sectors, it is an obligated entity in its own right. Ownership abroad does not change that.

Your group policy is not enough

This is where foreign groups get caught. A strong global AML program, written in English and approved at head office, does not automatically meet Panama’s requirements. Four gaps come up again and again.

1. The risk assessment must be local. Article 26 requires the obligated entity to identify, assess, document and keep current its own risks by client, country, product and channel. A group-wide matrix that never mentions Panamanian clients, free zone re-exports or cash payments is not that assessment.

2. Outsourcing does not transfer responsibility. Panama allows reliance on registered compliance firms, but the obligated entity remains responsible for the measures that third party applies (Art. 35). The same logic applies to a regional shared-service center: the work can sit elsewhere, the liability stays in Panama.

3. Someone local answers by default. Until you formally designate a compliance liaison before the UAF and the SSNF, that role falls on your legal representative (Art. 12). In many foreign-owned companies, that person is a local director who never expected to carry it.

4. Sanctions reach individuals. Article 61 extends sanctions to whoever permits or authorizes the breach. Directors who approve operations without the required controls are not shielded by the fact that the policy came from abroad.

There is also a newer layer. In March 2026, the SSNF issued Resolution S-008-2026, tightening how obligated entities identify and manage politically exposed persons (PEPs). Groups working with ports, logistics, public contracts or government-linked buyers should check their PEP procedures against it.

If your group also operates in Mexico, the same pattern applies there: a global program does not satisfy local evidence rules. We explain it in Mexico’s AML evidence requirements.

What Panama expects on paper

Beyond the local risk assessment, a non-financial obligated entity must be able to show:

Customer due diligence with official sources and, for legal entities, identification of directors, officers, attorneys-in-fact and the ultimate beneficial owner (Arts. 26-A, 27 and 28). If the client will not cooperate, the operation should not go ahead (Art. 36). See Beneficial ownership in Panama.
Ongoing monitoring and list checks proportionate to size and complexity, including technology for transaction monitoring and checks against local and international lists (Arts. 39 to 41).
Records kept for at least five years after the relationship ends, and high-risk client files updated at least once a year (Arts. 29 and 42).
Continuous training for staff who deal with clients or handle money (Art. 47).

Every one of these has an expiry date: a risk assessment that needs review, a high-risk file that needs its annual refresh, a training certificate that ages out. The program does not usually fail on day one. It fails quietly, a year later.

Where DÝNAMI fits. DÝNAMI by Cumbre Asesores tracks the expiry dates in your compliance file and alerts you before they lapse: the risk assessment due for review, the high-risk client file due for its annual update, the expired ID, the missing training record. Your Panama program stays current between inspections, not just on the day it was written.

The B/.10,000 cash line

Article 53 requires certain cash and quasi-cash transactions of B/.10,000 or more to be reported to the UAF. The balboa trades at par with the US dollar, so think of it as US$10,000. For non-financial entities, the common trigger is cash payments or collections from the same client, or a third party on their behalf, that reach that amount in one transaction or added up over a week.

For free zone distributors and car dealers, this is the daily risk. Payments split to stay below the line are invisible unless you add them up by client and by week.

Suspicion: report it now

When an operation cannot be justified against the client’s profile, or may be linked to money laundering, a suspicious transaction report goes to the UAF immediately after detection (Art. 54). There is no minimum amount, and attemptedoperations count too.

Good-faith reporting carries no criminal or civil liability for the company or its staff, and tipping off the client is prohibited (Art. 56). That second rule matters for groups where the sales team and the client relationship sit abroad.

Fines that go public

Consequence	Legal basis
Fine of B/.5,000 to B/.5,000,000 for breaches with no specific sanction	Art. 60
Graded by severity, repeat offenses, damage and size of the obligated entity	Art. 60
Progressive fines while the breach continues	Art. 62
Sanctions for anyone who permits or authorizes the breach	Art. 61
Suspension of the company’s corporate rights if its resident agent fails	Art. 61
Request to cancel or suspend the license for serious repeated violations	Art. 59
Publication of the sanctioned party’s name, the sanction and the amount on the supervisor’s website	Art. 20, num. 5

For a foreign group, the last row is the expensive one. A fine is paid once. A name on a public sanctions page is found by every bank, auditor and buyer that runs due diligence on your group.

There is a mitigating route. The supervisor may accept the obligated entity’s acknowledgment of the breach and reduce the sanction (Art. 66). Fixing the gap before an inspection finds it is always cheaper.

Before the SSNF knocks

Can your Panama entity answer each of these with documents, not intentions?

Is the entity registered with the SSNF?
Is there a written risk assessment specific to Panama, reviewed this year?
Has a compliance liaison been formally designated before the UAF and the SSNF?
Does every corporate client file identify the ultimate beneficial owner?
Are PEP checks aligned with the March 2026 SSNF rules?
Are cash payments added up by client and by week?
Is there proof that local staff were trained this year?
If a third party or regional team runs due diligence, can you show what they did?

If any answer is “no” or “head office handles that,” the gap sits in Panama. Book a review with Cumbre Asesores and close it before the 2027 evaluation does it for you.

Operating in Mexico too?

Many groups run Panama and Mexico from the same regional structure. Mexico applies its own AML law, the LFPIORPI, with separate thresholds, filings and a mandatory local compliance representative. Compliance in one country does not cover the other. See who answers for AML compliance in Mexico.

Frequently asked questions

Does Panama AML compliance apply to foreign-owned companies?
Yes. Obligations fall on the Panamanian entity based on its activity, not on who owns it. A free zone company, real estate firm or construction company is an obligated entity even if its parent is abroad.

Who supervises non-financial companies in Panama?
The Superintendency of Non-Financial Obligated Entities (SSNF). Suspicious transaction and cash reports go to the Financial Analysis Unit (UAF).

Can our group’s global AML policy satisfy Panamanian law?
Only if it is adapted locally. Law 23 of 2015 requires a documented risk assessment of the Panamanian entity’s own risks, and the entity remains responsible even when due diligence is outsourced.

How much are AML fines in Panama?
Where no specific sanction applies, fines range from B/.5,000 to B/.5,000,000 (the balboa is at par with the US dollar), graded by severity and company size, and can increase while the breach continues.

Are sanctions made public?
Yes. The supervisor publishes the sanctioned party’s name, the type of sanction and, if monetary, the amount on its website.

Is Panama still on any EU list?
It was removed from the EU’s AML high-risk list in July 2025, but remains on the EU’s list of non-cooperative jurisdictions for tax purposes as of the February 2026 update.

This article is for information only and reflects Panama’s Law 23 of 2015 as amended, including Law 254 of 2021, and Law 124 of 2020. It is not legal or compliance advice for a specific case. How the law applies depends on each entity’s activity and circumstances.