Panama AML Compliance: Crypto, Ships and the 2027 Test

Panama AML Compliance: What Its Compliance Officers Told Us at ASOCUPA XI

On October 22 and 23, the DÝNAMI by Cumbre Asesores team attended ASOCUPA’s 11th International Compliance Congress in Panama City. Two members of our team took notes, one on the people in the room and one on the risks they kept bringing up. This article puts both together.

If your company has clients, counterparties or legal entities in Panama, these notes describe the people who will review them. They also show where the next round of scrutiny is likely to focus.

Packed rooms, sharp questions

Attendance was higher than expected, and the rooms stayed full on both days. More importantly, people came to learn. Sessions were followed closely, and the questions from the floor were specific and practical.

Networking mattered, as it does at any congress. Even so, our team’s impression was clear: most attendees came to update their knowledge and strengthen their programs. We also noticed a strong presence of women in the profession, both on stage and in the audience.

The tone was open. Conversations at our stand started easily, often with a joke, and moved quickly to real operational problems. For a foreign firm that wants to build relationships in Panama, that openness is an advantage.

The 2027 evaluation

One concern came up more than any other: the country’s next mutual evaluation.

Panama was removed from the FATF grey list on October 27, 2023. However, the work is not finished. According to the calendar reported in 2026, GAFILAT will begin its evaluation of Panama in August 2027, and the report is expected to be discussed and approved in December 2028. The process includes a two-week on-site visit and a three-year follow-up period.

From rules on paper to proof

What worries compliance officers is not whether Panama has the right laws. It is the focus of this round: effectiveness.

Technical compliance asks whether laws and regulations exist and are well designed. Effectiveness asks whether they actually work. Are suspicious transactions detected? Is the beneficial owner known? Are controls applied every time, and can you prove it?

As a result, a policy manual is no longer enough. Evaluators will look for evidence. That pressure will reach every company that does business with Panamanian obligated entities, including foreign ones.

Risk without borders

The second set of notes focused on how Panamanian compliance officers read risk. Their view is global by necessity.

A Panamanian law firm, trust company or real estate developer may serve a European investor, a company with Asian shareholders and a South American family business in the same week. Therefore, the local compliance officer rarely thinks in national terms. Risk comes from wherever the client, the money or the structure comes from.

For international compliance teams, this is good news. You will usually find a counterpart who understands cross-border exposure. However, you should also expect detailed questions about your own ownership chain and the origin of funds.

A supervisor that opens doors

Another point our team noticed was the relationship with the regulator. The Superintendency of Non-Financial Obligated Entities (SSNF), created by Law 124 of 2020, is perceived by obligated entities as accessible and supportive.

That perception has a basis. In August 2025, the SSNF published a consultation guide for non-financial obligated entities, and its superintendent has publicly described an open-door approach.

To avoid confusion, keep the roles straight. The SSNF supervises non-financial obligated entities. The Financial Analysis Unit (UAF) is Panama’s financial intelligence unit. They are different bodies with different functions.

The risks now on the agenda

Several emerging risk topics ran through the congress. We summarize why each matters for an AML program. We do not attribute specific data to any speaker.

Crypto and tokenized assets

Virtual assets and their service providers have been part of the FATF standards since 2019. Meanwhile, the region keeps moving. El Salvador passed a Digital Assets Issuance Law in January 2023 and created a dedicated regulator, the CNAD. Tokenized real estate, corporate debt and commodities now exist there.

For a compliance team, the challenge is traceability. When an asset changes hands as a token, you still need to know who is behind each side of the transaction.

Ships and maritime exposure

Panama has one of the world’s largest ship registries. Consequently, vessel ownership, flag changes and opaque shipping structures are a constant source of sanctions and money laundering risk. We covered this in detail in our article on sanctions lists and asset freezes in Panama.

Rare earths, critical minerals

Rare earths and critical minerals are scarce, valuable and subject to export controls. That combination attracts opaque intermediaries and transactions that are hard to justify. These are classic warning signs for money laundering and sanctions evasion.

What this means for your program

Put both sets of notes together and one message stands out. Panama’s compliance community is skilled, globally minded and preparing for an evaluation that rewards proof, not intentions.

If you operate with Panamanian counterparties, three things will matter:

1. Continuous reviews. A client checked once at onboarding is not a client under control. Reviews must be repeated when lists, ownership or risk factors change.
2. Current files. Expired documents and outdated beneficial ownership data are the first gaps an evaluator or correspondent bank will find.
3. A record of every action. Each list check, each alert and each decision should leave a dated trace that someone else can audit.

The third point is where most programs fail. The work gets done, but nothing shows it was done. DÝNAMI by Cumbre Asesores keeps that record automatically. Every review, alert and resolution is logged with date and responsible user, so your team can show an evaluator, a regulator or a banking partner what was checked, when and why. If you want to see how that audit trail would look for your counterparties in Panama, talk to our team.

For a related angle, read our article on why a global AML program does not automatically satisfy Mexico’s evidence requirements.

Frequently asked questions

When will GAFILAT evaluate Panama?
According to the calendar reported in 2026, the evaluation begins in August 2027, and the report is expected to be approved in December 2028.

Is Panama still on the FATF grey list?
No. Panama was removed from the FATF grey list on October 27, 2023. It still appears on the European Union’s list of non-cooperative jurisdictions for tax purposes.

What is the difference between technical compliance and effectiveness?
Technical compliance reviews whether laws and rules exist and are well designed. Effectiveness reviews whether they work in practice and whether there is evidence of it.

Who supervises non-financial obligated entities in Panama?
The Superintendency of Non-Financial Obligated Entities (SSNF). The Financial Analysis Unit (UAF) is the country’s financial intelligence unit.

Why do tokenized assets matter for AML compliance?
Because the asset can move quickly between parties. A compliance program still needs to identify who stands behind each side and where the funds come from.

This article is for informational purposes only and does not constitute legal advice. To assess your company’s specific obligations, consult a specialist.