Bill 326.

Summary.

The bill establishes a registration, licensing, supervision and control regime for virtual asset service providers operating in, from or toward the Republic of Panama (República de Panamá). It covers domestic and foreign individuals and legal entities that habitually provide these services or direct them to users in the country. It defines virtual assets and their providers, transfers, the Travel Rule, stablecoins, decentralized finance, digital wallets and related concepts. Regulation would reflect each activity’s economic function and risk. Its guiding principles include technological neutrality, traceability, user protection, financial inclusion and market integrity, with reference to standards of the Financial Action Task Force (Grupo de Acción Financiera, GAFI) and its Latin American regional body (GAFILAT).

The Superintendency of the Securities Market of Panama (Superintendencia del Mercado de Valores de Panamá) would authorize, regulate and supervise providers. It could conduct inspections, request records, order audits, impose measures and authorize controlled innovation environments. By a reasoned administrative decision, it could temporarily restrict activities posing significant risks. The Executive Branch (Órgano Ejecutivo) would support policymaking alongside the Public Prosecutor’s Office (Ministerio Público) and other authorities. Each provider would have to maintain a documented compliance system covering customer due diligence, beneficial ownership, monitoring, a compliance officer registered with the Financial Analysis Unit (UAF), training, reporting and retention of information for five (5) years. The bill gives users rights to information, custody safeguards, complaints procedures and legal action. It also sets technical requirements for certain platforms concerning solvency, security, asset segregation and risk disclosure.

A license would be mandatory for regulated activities. The public register would show authorized services and compliance history. Applicants would provide information on controlling persons, evidence of fitness and solvency, a prevention manual, technical information and a risk assessment. Each authorization would specify permitted services, including exchange, custody, transfers, offerings and other digital financial services. The securities supervisor would set technical rules, categories, licensing fees and supervisory charges according to the entity’s risk profile.

On taxation, the Directorate General of Revenue (Dirección General de Ingresos) would establish voluntary compliance rules and electronic forms for a simplified tax filing regime covering virtual asset transactions. The bill provides safeguards for the collection and use of tax data, formal requests to providers and application of the Personal Data Protection Law (Ley de Protección de Datos Personales). It also provides for the application, where relevant, of tax information exchange agreements and tax due diligence for foreign clients.

Banks authorized by the Superintendency of Banks of Panama (Superintendencia de Bancos de Panamá) could voluntarily participate in virtual asset operations under Decree Law 9 of 1998 (Decreto Ley 9 de 1998) and Law 23 of 2015 (Ley 23 de 2015). Funds entering the banking system would require documentation of lawful origin, identification of the beneficial owner and a risk assessment; a bank could reject and report transactions that fail those requirements. Participating banks would have to approve a risk model, appoint a specialist compliance officer, retain records for five (5) years and inform clients of risks and operating conditions. The bank supervisor and the Financial Analysis Unit (Unidad de Análisis Financiero) could issue guidance and training programs.

The Ministry of Economy and Finance (Ministerio de Economía y Finanzas) would coordinate implementation with supervisory and tax authorities and make budgetary provision. The Executive Branch would have six (6) months from promulgation to issue implementing regulations; the bill provides for entry into force twelve (12) months after promulgation in the Official Gazette. Its provisions would concern virtual asset providers, technology platforms, banks, their customers and taxpayers.