Bill 666.

Summary.

The bill provides for consumer payments to be credited within the time limits established by applicable law or contract. A financial institution responsible for late posting must correct it and refund charges directly caused by the delay. Where insurance is required to obtain a financial product, the institution must explain its coverage, cost, term, the insured person's rights, and the conditions for replacing the policy. Consumers would also be entitled to clear information about required guarantees, their legal effects, the consequences of enforcement, and their release once the principal obligation ends.

The bill defines a direct payroll deduction or wage withholding as money an employer retains from wages, with the worker's express authorization or under a legal provision, and sends to a creditor institution. Employers must remit the money within five (5) business days after paying wages and may use it only for its designated purpose. If the employer withholds but fails to remit it on time, the consumer would not be in default for that reason. The institution must recognize the proven withholding date as the payment date. While responsibility is determined, it may not report the consumer as delinquent, impose default interest or penalties, accelerate the debt, or restrict other products solely because of the employer's failure. It must notify the consumer that payment was not received and allow proof of withholding. The principal debt remains; the institution must pursue the responsible employer, while the consumer retains available legal remedies.

For digital financial services, the bill requires security, confidentiality, availability, information integrity, authenticity, traceability, and operational continuity. Institutions must prevent unauthorized access, fraud, and cyberattacks, use authentication suited to transaction risk, and explain digital risks. They must accept reports of unrecognized transactions twenty-four (24) hours a day, promptly investigate, keep the consumer informed, and preserve records and technical evidence. When a consumer timely disputes an electronic transaction, the institution must establish that the prescribed authentication was used and that it reasonably met its security duties, subject to assessment by the competent authority. The bill also requires incident procedures, continuity plans, controls to protect funds, redress where warranted, digital security education, and preservation of evidence. The banking supervisor may set cybersecurity standards and promote institutional coordination.

For deposits and contractual relationships, unilateral termination must rest on a legal or contractual ground and an objective, documented decision. A consumer's public connection to proceedings alone would be insufficient to end the relationship. Institutions retain powers based on official orders, Law 23 of 2015, documented risks, contractual breach, fraud, unlawful use, or false information. Where special legislation permits, they must explain the decision and how the consumer may withdraw funds or seek review. Restrictions on funds are confined to authorized grounds; institutions must make deposited funds available under the contract and permit complaints without retaliation.

The Superintendency of Banks of Panama (Superintendencia de Bancos de Panamá) would promote financial education with the Ministry of Education (Ministerio de Educación) and other participants. Institutions must maintain education programs and provide suitable service to vulnerable consumers. They must offer free in-person, telephone, and electronic channels, track complaints, give reasoned responses, and maintain current complaint records. The governing board would establish the Office of the Financial Consumer Ombudsperson (Oficina del Defensor del Consumidor Financiero) within the Superintendency of Banks (Superintendencia de Bancos) to advise consumers, promote voluntary mediation, follow complaints, and make recommendations. The bill also provides for public statistics and coordination with the Consumer Protection and Competition Defense Authority (Autoridad de Protección al Consumidor y Defensa de la Competencia), the Ministry of Commerce and Industry (Ministerio de Comercio e Industrias), the Securities Market Superintendency (Superintendencia del Mercado de Valores), and the Insurance and Reinsurance Superintendency of Panama (Superintendencia de Seguros y Reaseguros de Panamá).

Supervisory responsibilities remain allocated under existing law. Financial institutions must establish compliance programs and conduct internal audits; competent authorities may order corrective measures and apply the sanction procedures of the Banking Law (Ley Bancaria), Law 42 of 2001, and other special laws. Improper charges established through an administrative proceeding or final court decision must be refunded. The bill also provides for cooperation among authorities and publication of good practices. The Executive Branch (Órgano Ejecutivo) and the banking supervisor must issue regulations within twelve (12) months, while institutions have twelve (12) months from commencement to adapt. Some obligations may be implemented progressively, and specified protections extend to existing contracts without retroactively changing essential economic terms. A public evaluation is required every two (2) years. The bill repeals conflicting provisions and would take effect twelve (12) months after publication in the Official Gazette (Gaceta Oficial), subject to its immediate-application exceptions. In the Republic of Panama (República de Panamá), banks, finance companies, digital service providers, employers, insurers, and consumers may be affected; the National Assembly (Asamblea Nacional) may receive the evaluation report.