Panama: technology regulation at a glance

Framework: No dedicated crypto law in force; Law 23 of 2015 (AML/CFT) via UAF applies to virtual-asset businesses; Bill 247 (March 2025) pending in National Assembly subcommittee

Crypto is legal to hold and use in Panama but no sector-specific legislation is currently in force. The 2022 National Assembly crypto bill (Bill 697) was struck down in its entirety as unconstitutional by the Supreme Court in July 2023 following a presidential referral. A successor bill, Bill 247, introduced on 20 March 2025 and referred to a National Assembly subcommittee on 30 September 2025, proposes VASP licensing, stablecoin recognition, and a special tax regime but remained unenacted as of May 2026.

Framework: No comprehensive AI law in force. Proyecto de Ley 588 (adaptive AI governance) passed first legislative debate (primer debate) in the National Assembly in April 2026 and is pending further debates and promulgation. Sectoral data protection covered by Law 81 of 2019. National AI Strategy under development by SENACYT and AIG.

Panama has no enacted comprehensive AI statute as of May 2026. Multiple draft bills are progressing through the National Assembly, most notably Proyecto de Ley 588, which passed its first debate in April 2026 and proposes adaptive AI governance framing Panama as an innovation hub. Concurrently, SENACYT is developing a National Artificial Intelligence Strategy in partnership with Georgia Tech, structured around four axes: Smart Use, Smart Development, Smart Training, and Smart Partnerships.

Framework: Law No. 81 of 26 March 2019 on Personal Data Protection (Ley 81 de Protección de Datos Personales), implemented by Executive Decree No. 285 of 28 May 2021; supervised by the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) through its Directorate of Personal Data Protection

Panama enacted a comprehensive, GDPR-inspired personal data protection law, Law No. 81 of 2019, which entered into force on 29 March 2021 alongside its implementing regulation, Executive Decree 285 of 2021. The law establishes broad data-subject rights, controller obligations, cross-border transfer rules, and assigns enforcement authority to ANTAI. As of 2025-2026, ANTAI has formally transitioned from an educational outreach phase toward active compliance auditing and sanctions enforcement.

Framework: SBP Acuerdo 001-2018 (e-money/payment instrument issuers); Law 48 of 2003 (money remittance, MICI); Law 23 of 2015 (AML supervision of payment entities); SBP Agreement 1-2026 (AML/digital ID); Draft Law No. 314 pending, Superintendencia de Bancos de Panamá (SBP)

Panama operates a fragmented but functional licensing regime for digital payments: the SBP supervises e-money and payment instrument issuers under Acuerdo 001-2018, while money-remittance businesses are licensed by MICI under Law 48 of 2003 and all payment entities face AML obligations under Law 23 of 2015. A comprehensive Fintech Framework Law (Draft Law No. 314), introduced to the Asamblea Nacional on 13 January 2026, would consolidate licensing for PSPs, EMIs, and VASPs under the SBP, but remains unenacted as of May 2026. Open banking and BNPL-specific rules do not yet exist.

Framework: Executive Decree No. 198 of May 7, 2021 (Servicio Nacional de Migración, SNM); supplemented by the Friendly Nations Visa and Qualified Investor Visa residency programs

Panama established a dedicated Short-Stay Visa for Remote Workers (commonly called the Digital Nomad Visa) via Executive Decree 198 of 2021, administered by the SNM. The visa permits up to 18 months of legal residence for foreign remote workers earning at least USD 36,000/year from non-Panamanian sources. For longer-term residency, Panama's Friendly Nations Visa and investment-based programs offer separate, permanent-residency pathways.

Framework: Partial framework: Law No. 81/2019 (Personal Data Protection), October 2024 Cybercrime Amendments (Budapest Convention alignment), Law No. 51/2008 (Electronic Commerce), enforced by ANTAI and the Public Ministry; no comprehensive online-safety or platform-liability law

Panama regulates the online environment through a patchwork of sectoral laws rather than a single comprehensive online-safety statute. Its personal data protection law (2019) and a significant October 2024 cybercrime reform, which fully aligns domestic legislation with the Budapest Convention, are the principal instruments. No DSA- or OSA-style content-moderation or platform-liability regime exists, and the internet remains relatively open with Freedom House classifying Panama as 'Free'.

Framework: Law 478 of 2025 (cybercrime amendments to Penal Code), Law 81 of 2019 (data protection / breach notification), National Cybersecurity Strategy 2021-2024, AIG / CSIRT-Panama

Panama's cybersecurity regime is sectoral rather than comprehensive: criminal liability for cyber-offences is governed by the Penal Code as most recently amended by Law 478 of August 2025, while breach-notification duties derive from the 2019 Personal Data Protection Law (Law 81). The National Authority for Government Innovation (AIG) operates CSIRT-Panama for incident response and coordinated the 2021-2024 National Cybersecurity Strategy; no single omnibus statute equivalent to NIS2 is in force.

Framework: Law 32 of February 26, 1927 (General Corporation Law, Sociedad Anónima); Panama Commercial Code (S.R.L.); supervised by the Registro Público de Panamá and the Ministerio de Comercio e Industrias (MICI)

Panama allows 100% foreign ownership and imposes no residency or physical-presence requirement to incorporate a company. A Sociedad Anónima (S.A.) under Law 32 of 1927 can be registered remotely in 3-10 business days via a licensed Panamanian resident agent, with no mandatory paid-in capital. Sector-specific foreign-ownership restrictions apply only to retail trade, maritime activities, and broadcast media.