How to Apply for Panama's Fintech Regulatory Sandbox (finhub), Step‑by‑step (2026)

Understanding how to apply for the fintech sandbox in Panama is now a practical necessity for any founder, general counsel or compliance officer planning to test a financial‑technology product under regulatory supervision. Panama’s Financial Innovation Hub (FinHub), launched in May 2025 by the country’s Consejo de Coordinación Financiera (CCF), provides confidential, non‑binding counselling that channels innovators toward the correct national supervisor and, where appropriate, into a supervised pilot. Two major 2026 developments, SBP Rule 1‑2026 (Acuerdo 01‑2026, issued January 16, 2026), which tightened AML/CFT controls and set new compliance deadlines, and Anteproyecto Ley No. 314 (presented January 13, 2026), which proposes a formal sandbox regime and differentiated fintech licences, have materially changed what applicants must prepare before submitting.

This guide walks through each stage of the regulatory sandbox application process, from eligibility through pilot exit, with the documents, timeline, costs and AML evidence that a 2026 submission demands.

Overview of the FinHub Process and Who It Applies To

FinHub is not itself a licence‑issuing body. It is a multi‑regulator gateway operated under the CCF, whose members include the Superintendencia de Bancos de Panamá (SBP), the Superintendencia del Mercado de Valores (SMV), and the Superintendencia de Seguros y Reaseguros de Panamá (SSRP). Its purpose is to receive fintech proposals, assess which supervisory authority has jurisdiction, and provide non‑binding orientation, including whether a supervised sandbox pilot is appropriate. The Inter‑American Development Bank (IDB), through its FintechLAC programme, provided technical support for the Hub’s design.

Applicants who benefit most from the FinHub process are startups and scale‑ups with a defined fintech business model, a pilotable technology, and clear consumer‑protection measures. Companies already holding a full licence from the SBP or SMV generally do not need to enter through FinHub unless they are launching a materially different product line. The counselling is free of charge, and any guidance issued is expressly non‑binding.

Eligibility and Prerequisites for the Regulatory Sandbox in Panama

Before submitting, applicants should confirm they meet the following eligibility criteria:

• Novel or underserved fintech use case. The product or service should address a gap in existing financial services, payments, lending, insurance‑tech, securities distribution, open banking or similar.
• Pilotable technology. The applicant must be able to define a bounded test: limited user numbers, capped transaction values and a fixed pilot duration.
• Consumer‑protection plan. A documented plan showing how end‑user funds, data and rights are safeguarded during the pilot.
• AML/CFT readiness. A written AML program, customer risk‑scoring methodology and transaction‑monitoring logic. Under SBP Rule 1‑2026, the bar for AML evidence has risen, banks that process pilot transactions will demand enhanced due diligence (EDD) documentation before opening accounts.
• Corporate existence. While foreign‑incorporated entities can apply, the likely practical effect is that regulators will expect a local representative or branch office for any pilot that serves Panamanian consumers or touches local banking rails. A Panamanian company (S.A. or S.R.L.) is the most straightforward corporate vehicle.
• Key governance roles filled. At minimum, a designated compliance/AML officer and an identifiable technical lead (CTO or equivalent).

Who Cannot Use FinHub

The sandbox application route is not available for every fintech proposition. Activities that already require a full prudential licence, such as deposit‑taking, operating systemically important payment infrastructure, or full custody of client assets without separate supervisory approval, should apply directly to the relevant authority rather than through the FinHub counselling process. Applicants uncertain about classification should use the initial FinHub consultation to clarify.

How to Apply for the FinTech Sandbox in Panama, Step‑by‑Step Procedure

The sandbox application process runs through seven stages, from internal preparation to pilot exit. The table below summarises each step, the responsible party and realistic time expectations, followed by detailed guidance on each stage.

Step 1, Complete Pre‑Application Readiness (1–14 Days)

Before touching the FinHub portal, assemble the internal package that will underpin both the regulator submission and the bank onboarding pack. Key deliverables at this stage include a pilot plan with defined KPIs, an AML risk assessment aligned with SBP Rule 1‑2026, a data‑protection and cybersecurity summary (mapped to Panama’s Law 81 on personal data), a bank‑pack draft (see the documents table below), and a concise pitch deck with demo screenshots or video. Engage external counsel at this point to review AML program adequacy and corporate‑structure options. The quality of the pre‑application package directly determines how quickly subsequent steps proceed.

Step 2, Submit the Sandbox Application to FinHub (Day 0)

Access the FinHub portal at finhub.ccf.gob.pa and complete the intake form. The form requests a description of the proposed innovation, the target market, anticipated risks and the regulatory question the applicant needs answered. Upload the business plan, pilot plan and supporting attachments in PDF or PPT format. Upon submission, FinHub acknowledges receipt and schedules a presentation session. There is no submission fee, the FinHub counselling service is provided free of charge.

Step 3, Deliver Presentation and Respond to Regulator Q&A (Days 7–21)

FinHub coordinates a presentation session (typically by video call) attended by staff from the relevant CCF member regulators. The applicant presents the product, business model, risk controls and pilot design. Regulators will ask questions about AML controls, data flows, third‑party dependencies, consumer complaints handling and operational resilience. Expect follow‑up requests for additional documentation or clarification. Track all queries and responses in writing, this record forms part of the supervisory file and demonstrates cooperative engagement.

Step 4, Receive Counselling Outcome and Next Steps (Days 21–60)

After the presentation, FinHub advises the applicant on which supervisory authority has jurisdiction (SBP for banking‑adjacent services, SMV for securities‑related models, SSRP for insurance‑tech). The outcome may be one of several: referral to the supervising authority for a sandbox pilot, recommendation to apply for a full licence, direction toward an administrative inquiry, or advice that the activity does not fall within regulated perimeters. If a sandbox pilot is recommended, the applicant proceeds to negotiate formal pilot terms with the supervising entity.

Step 5, Secure Pilot Authorisation and Complete Bank Readiness (30–90 Days)

This is often the most time‑consuming stage. The supervising authority sets the pilot’s scope, user caps, transaction limits, reporting cadence and monitoring obligations. Simultaneously, the applicant must finalise banking arrangements. Under post‑Rule 1‑2026 expectations, banks require a comprehensive bank‑pack demonstrating AML program robustness, expected transaction flows, counterparty contracts and proof of compliance‑officer oversight. An MOU between the applicant and the bank partner typically formalises account access for the pilot. AML controls should be live‑tested in a staging environment before launch.

Step 6, Run the Live Pilot and Report (3–12 Months)

During the pilot testing phase, the applicant operates the product under the conditions set by the supervisor. Reporting obligations normally include periodic transaction logs, incident reports, consumer‑complaint summaries and AML‑alert statistics. Remediation triggers, pre‑agreed thresholds that, if breached, require immediate corrective action, should be documented in the pilot agreement. Consumer‑protection incidents must be escalated to the supervisor promptly. The pilot duration varies; industry observers expect most pilots in Panama to run between six and twelve months.

Step 7, Exit the Pilot, Scale to Licence or Terminate (30–90 Days)

At pilot conclusion, the applicant and supervisor jointly decide the next step. Options include migration to a full licence (applying the evidence and track record generated during the pilot), extension of the pilot with revised parameters, or orderly wind‑down if the product is not viable. The transition plan should address customer migration, data retention, outstanding obligations to bank partners and final reporting to the supervisor. Early indications suggest that Anteproyecto Ley No. 314, if enacted, will create simplified fintech licence categories that would streamline this post‑pilot migration path.

Required Documents and Information for a FinHub Sandbox Application

The table below lists every document an applicant should prepare. While FinHub’s published intake form asks principally for a business plan, the full package listed here reflects what regulators and banks will need across steps 1 through 5 of the process. Preparing these upfront avoids delays.

A critical note on bank readiness: under SBP Rule 1‑2026, Panamanian banks are subject to strengthened CDD, transaction‑monitoring and EDD requirements for higher‑risk services. Any sandbox applicant whose pilot involves fiat payment rails should include a dedicated AML evidence pack, covering risk assessment, monitoring technology, and escalation procedures, in both the FinHub submission and the bank‑pack. Insufficient AML documentation remains one of the most common reasons banks decline to open accounts for fintech pilots.

Timeline and Key Deadlines for the Regulatory Sandbox in Panama

The table below provides a realistic calendar view from submission through pilot completion.

Two regulatory deadlines introduced by SBP Rule 1‑2026 (Acuerdo 01‑2026) are particularly relevant for sandbox participants relying on bank partnerships. Banks must comply with Article 14 of the Rule by June 30, 2027, and with paragraph 1 of Article 25 by January 31, 2027. Applicants should expect their bank partners to demand compliance evidence or mitigation plans keyed to these deadlines during the pilot authorisation stage. Building this timeline into your internal project plan avoids last‑minute disruptions.

Costs, Fees and Tax Considerations

Submitting to FinHub is free. However, total cost to reach a live pilot is non‑trivial once legal, compliance and operational expenses are factored in.

Running a pilot in Panama may also trigger VAT or other tax obligations depending on whether the applicant charges local customers during testing. A brief tax review with local counsel before launch is recommended.

What Changes in 2026, SBP Rule 1‑2026 and Anteproyecto Ley 314

Two regulatory developments directly affect anyone preparing a sandbox application in 2026:

SBP Rule 1‑2026 (Acuerdo 01‑2026), issued on January 16, 2026, updates the AML/CFT framework overseen by the Superintendencia de Bancos de Panamá. The Rule introduces strengthened customer due diligence, enhanced transaction monitoring and explicit compliance deadlines, notably Article 14 (compliance by June 30, 2027) and Article 25, paragraph 1 (compliance by January 31, 2027). For sandbox applicants, the practical impact is that banks will now require more granular AML evidence before opening or maintaining accounts for fintech pilots. Any sandbox application that touches fiat rails should include a full AML risk assessment, monitoring architecture and SAR escalation procedure in the submission package.

Anteproyecto Ley No. 314 (Ley Marco Integral Fintech), presented on January 13, 2026, proposes an integrated fintech law that would formalise the sandbox regime and create differentiated licensing categories for fintech operators. If enacted, industry observers expect the law to establish clearer migration pathways from sandbox pilot to simplified fintech licence, reducing the time and cost of post‑pilot scale‑up.

Immediate action items for applicants:

• Review and upgrade AML programs to reflect SBP Rule 1‑2026 thresholds before submitting to FinHub.
• Design pilot exit plans that anticipate a future licensing pathway under Ley 314.
• Confirm bank‑partner readiness against the January and June 2027 compliance deadlines.

Common Pitfalls and How to Avoid Them

• Weak AML evidence. Submit a fully documented AML risk assessment, not just a policy statement, with monitoring logic and SAR flow diagrams.
• Missing data‑flow diagrams. Regulators need to see exactly where data is stored and which third parties have access; include a technical architecture diagram in every submission.
• Insufficient bank‑pack. Prepare the bank onboarding pack in parallel with the FinHub submission to avoid a 60–90 day delay at step 5.
• Vague KPIs. Define measurable success metrics (e.g., transaction volumes, error rates, complaint ratios) rather than aspirational statements.
• No incident response plan. Regulators will ask how you handle a data breach or fraud event during the pilot, have a written plan ready.
• Unclear exit strategy. Document what happens to customer data and funds if the pilot is terminated early.
• Failing to label test transactions. Test transactions must be clearly distinguishable from production traffic; banks and supervisors require this for reconciliation and reporting.
• Poor customer‑protection procedures. Pilots involving real consumers must include a complaints mechanism, refund policy and transparent disclosure that the product is operating under sandbox conditions.

Conclusion

Knowing how to apply for the fintech sandbox in Panama, and preparing a submission that satisfies both regulators and bank partners, is the difference between a pilot that launches in months and one that stalls indefinitely. The FinHub process is accessible and free, but the evidentiary bar, particularly around AML requirements under SBP Rule 1‑2026, is substantially higher in 2026 than it was at launch. Applicants who invest in thorough pre‑application preparation, assemble a comprehensive bank‑pack and build their pilot plan around measurable KPIs will be best positioned to move from regulatory sandbox to market.

Sources

1. FinHub, Official Finhub Panamá (CCF)
2. Superintendencia de Bancos de Panamá, FinHub Launch Announcement
3. SBP, Acuerdo 01‑2026 (Rule 1‑2026) AML/CFT Update
4. Inter‑American Development Bank (IDB), Panama FinHub Launch
5. LexLatin, Anteproyecto Ley N° 314 Analysis
6. Global Law Experts, Panama Fintech Law 2026 Analysis