KYC Panama: AML Guide for Fintechs and Obligated Subjects

Panama's anti-money-laundering framework rests on Ley 23 de 2015, which established the core obligations for entities exposed to money laundering, terrorism financing, and proliferation financing risks. For fintechs and any team building financial products in the jurisdiction, understanding how these rules translate into day-to-day identity checks is the difference between a defensible program and a regulatory finding.

What Ley 23 de 2015 Requires of Sujetos Obligados

Ley 23 de 2015 defines two broad classes of sujetos obligados: financial obligated subjects (banks, trust companies, payment institutions, remittance firms) and non-financial obligated subjects (real estate brokers, lawyers, casinos, and others). The statute is complemented by Decreto Ejecutivo 363 de 2015, which details how prevention measures must be applied.

Every obligated subject must, at minimum:

• Identify and verify customers before or during the establishment of a business relationship.
• Identify the beneficial owner behind legal persons and structures.
• Maintain a risk-based approach with documented policies and a designated compliance officer.
• File suspicious transaction reports and retain records for the periods set by law.

The Role of the Superintendencia de Bancos de Panamá

The Superintendencia de Bancos de Panamá (SBP) supervises banks and other financial obligated subjects for AML compliance. Non-financial obligated subjects fall under the Intendencia de Supervisión y Regulación de Sujetos No Financieros. Sitting above both, the Unidad de Análisis Financiero (UAF) receives and analyzes suspicious activity reports and cash and quasi-cash transaction reports.

Fintechs should map early which supervisor governs their license type. A payment or e-money entity operating under an SBP-issued authorization is held to the same customer due diligence standards as a traditional bank, even when the entire relationship happens through a mobile app or messaging channel.

Customer Due Diligence Under AML Panama Rules

Debida diligencia del cliente is the operational heart of any AML Panama program. In practice, obligated subjects apply three tiers:

• Standard due diligence: collect and verify identity data, purpose of the relationship, and expected activity.
• Simplified due diligence: permitted for lower-risk products, subject to documented justification.
• Enhanced due diligence: mandatory for politically exposed persons, higher-risk geographies, and complex ownership structures.

Verification typically requires a valid identity document, confirmation of the data against reliable sources, and screening against sanctions and PEP lists. For legal persons, the chain of ownership must be traced to natural persons holding a defined threshold of control.

Because KYC Panama obligations are risk-based, the volume of data you collect should match the risk of the relationship. Gathering more than you can justify creates retention exposure without improving your risk assessment. Chat-based verification flows let teams request only the fields a given risk tier requires, and configurable retention windows help align record-keeping with the periods the law actually mandates rather than storing everything indefinitely.

Practical Steps for Fintech Panama Compliance

Building a defensible fintech Panama compliance posture involves both design and documentation. A workable checklist:

• Confirm your obligated-subject classification and the responsible supervisor.
• Draft a risk matrix covering products, channels, customers, and jurisdictions.
• Appoint a compliance officer and document escalation and reporting procedures.
• Define onboarding flows that capture identity data proportionate to risk.
• Implement ongoing monitoring and periodic review of existing customers.
• Establish retention and deletion schedules that reflect statutory timeframes.

For remote-first products, verifying customers through Telegram or WhatsApp can shorten onboarding while keeping an auditable record of each step, provided the underlying process still meets the identification and verification standards set out in law.

Staying Aligned as the Framework Evolves

Panama has periodically tightened its AML regime in response to international assessments, including amendments touching beneficial ownership transparency and non-financial sectors. Obligated subjects should track updates published by the SBP and the UAF, and revisit their policies when new regulations or guidance are issued.

This article is general information, not legal advice. Confirm current obligations with qualified Panamanian counsel and the relevant supervisor before finalizing your program. Treated as a living process rather than a one-time project, a well-scoped KYC and AML framework protects both your customers and your license to operate.