Custodial vs Non‑custodial Crypto in Panama 2026: When Your Product Triggers a VASP Licence Under Draft Law No.314 & SBP Rule 1‑2026

Last reviewed: July 26, 2026

Panama’s regulatory posture toward virtual assets is shifting from permissive ambiguity to structured licensing. Draft Law No. 314, the Ley Marco Integral de Tecnologías Financieras, introduced in the Asamblea Nacional in early 2026, proposes a comprehensive registration and licensing regime for Virtual Asset Service Providers (VASPs), while SBP Rule 1‑2026 from the Superintendencia de Bancos de Panamá sets out the banking‑supervision expectations that will govern how custodial crypto businesses open and maintain bank accounts.

For founders, general counsels and compliance officers building crypto products in or from Panama, the central question around VASP custody Panama obligations is now unavoidable: does your specific product architecture, who holds private keys, who signs transactions, who controls fiat rails, place you inside or outside the new licensing perimeter? This guide maps concrete product behaviours to their likely regulatory outcomes, provides a bank‑readiness checklist, and offers an implementation timeline so that product teams can act before the legislative window closes.

If you are evaluating your custody model right now, three immediate actions apply:

• Pause new bank‑onboarding submissions until you have mapped your product flows against the draft licensing categories.
• Run the product‑to‑licence mapping set out in this article to determine whether your architecture is custodial, non‑custodial or hybrid.
• Prepare a bank‑readiness documentation pack, regardless of your licensing conclusion, because Panamanian banks and their correspondent partners are already tightening due diligence on crypto‑adjacent clients.

Background: Panama Fintech Law, Draft Law No.314 & SBP Rule 1‑2026

Legislative Status and Timeline

Panama has not historically maintained a bespoke regulatory framework for virtual assets. Cryptocurrency use has been broadly lawful, there is no prohibition on holding, transferring or accepting digital assets, but the absence of a dedicated licensing regime has left product teams operating in a regulatory grey zone that creates friction with banks and correspondent institutions. Draft Law No.314, formally titled the Ley Marco Integral de Tecnologías Financieras, was introduced in the Asamblea Nacional in 2026 and proposes to close that gap by establishing defined licence categories for VASPs, payment service providers (PSPs) and other fintech operators.

As of this article’s review date, Draft Law No.314 remains under legislative consideration. It has not yet been enacted or published in the Gaceta Oficial. Industry observers expect the bill to advance through committee review during the second half of 2026, with enactment possible by late 2026 or early 2027. Product teams should treat the draft as a strong signal of regulatory direction rather than a finalised obligation, but they should prepare as though licensing is imminent, because the banking sector is already adjusting its risk appetite accordingly.

Who the SBP Regulates, Scope and Supervisory Interplay

The Superintendencia de Bancos de Panamá (SBP) supervises all licensed banks and trust companies in Panama. SBP Rule 1‑2026 addresses the banking relationship layer: it sets out what documentation, AML controls and ongoing monitoring banks must demand from clients engaged in virtual‑asset activities, particularly those performing custodial functions. The rule does not itself create a VASP licence, but it effectively determines whether a crypto business can obtain or retain a Panamanian bank account.

Other regulators play adjacent roles. The Unidad de Análisis Financiero (UAF) is Panama’s AML/CFT intelligence unit, responsible for suspicious‑transaction reporting obligations that will apply to licensed VASPs. The Superintendencia del Mercado de Valores (SMV) may assert jurisdiction where token issuance overlaps with securities regulation. Draft Law No.314 contemplates coordination between these bodies, but the SBP’s gatekeeper role over bank access makes it the regulator with the most immediate, practical impact on crypto businesses seeking to operate in Panama.

Legal Definitions and Licence Classes: What Counts as VASP Custody in Panama

Key Statutory Definitions

Draft Law No.314 aligns Panama’s definitional framework with the FATF’s internationally recognised categories. Under the FATF’s Guidance for a Risk‑Based Approach to Virtual Assets and VASPs, a VASP is any natural or legal person that conducts, as a business, one or more of the following activities for or on behalf of another person: exchange between virtual assets and fiat currencies; exchange between one or more forms of virtual assets; transfer of virtual assets; and safekeeping or administration of virtual assets or instruments enabling control over virtual assets. The draft law incorporates these categories and adds payment‑service activities involving virtual assets.

For the purposes of VASP custody Panama analysis, the critical definitional element is “safekeeping or administration of virtual assets or instruments enabling control over virtual assets.” In product terms, this means: if your platform holds, controls, or has the technical ability to exercise private keys, or if you maintain contractual authority to restore, freeze or redirect user assets, you are performing custody. The definition is functional, not label‑based. Calling your service “non‑custodial” in marketing materials does not determine your regulatory status; the actual architecture does.

Licence Classes Under Draft Law No.314

The draft framework contemplates multiple licence classes, each with distinct capital, AML and reporting floors:

• Exchange licence. Covers platforms facilitating virtual‑asset‑to‑fiat or virtual‑asset‑to‑virtual‑asset conversions, typically with an order book or matching engine.
• Custodian licence. Applies to entities that safekeep or administer virtual assets on behalf of clients, including hot and cold wallet management, institutional custody and staking‑as‑a‑service where the operator controls signing keys.
• Payment Service Provider (PSP) licence. Targets fiat‑backed token issuers and businesses operating virtual‑asset payment rails, including on‑ramp and off‑ramp services.
• Transfer service licence. Covers entities that facilitate on‑chain transfers of virtual assets for or on behalf of clients.

Each class carries minimum capital requirements (the exact thresholds are expected to be set by implementing regulation), mandatory AML programme obligations aligned with UAF guidelines, and periodic reporting duties to the relevant supervisory body. Industry observers expect that a single entity operating across multiple categories, for example, an exchange that also provides custody, would need to satisfy the requirements for each applicable class.

Product Mapping: When Specific Product Behaviours Trigger VASP Licensing in Panama

This section is the operational core of the VASP custody Panama analysis. The licensing trigger under Draft Law No.314 is functional: it depends on what your product does in practice, not how you describe it. The decision tree below and the scenario walkthroughs that follow are designed to help product leads and compliance officers classify their architecture with precision.

Decision Tree: Three Questions That Determine Your Licensing Position

1. Who controls private keys? If your platform generates, stores, or has signing access to private keys associated with user assets, you are performing custody. This includes holding encrypted key shards where your system can reconstitute signing authority without user action.
2. Who authorises outgoing transactions? If outgoing on‑chain transfers require your platform’s co‑signature, approval workflow or operational intervention, you exercise transactional control, a custody indicator even if you do not hold raw private keys.
3. Can you freeze, redirect or restore user access unilaterally? If your platform retains the technical or contractual ability to freeze withdrawals, redirect assets or restore user access without the user’s independent cryptographic action, regulators and banks will treat you as custodial.

If the answer to any of these three questions is “yes,” the likely regulatory outcome is that your product triggers a custodial VASP licence requirement under Draft Law No.314 and attracts heightened bank due diligence under SBP Rule 1‑2026.

Scenario Walkthroughs: Product Architecture to Licensing Outcome

Scenario 1, Hosted exchange with custodial wallets. The exchange generates and stores user private keys on its infrastructure. Users trade on the platform and request withdrawals, but every outgoing transaction requires the exchange’s on‑chain signature. This is the clearest custody case. It triggers the custodian licence (and likely the exchange licence), full AML/KYC programme obligations, capital requirements, and proof‑of‑reserves expectations from banks.

Scenario 2, Non‑custodial wallet provider. The provider supplies a user‑interface application. Users generate and hold their own private keys on their own devices. The provider never has access to signing keys and cannot execute, block or redirect transactions. Under Draft Law No.314’s functional definition, this architecture generally falls outside the custody perimeter. However, if the provider also facilitates in‑app swaps, fiat on‑ramps or transfer relay services, those ancillary features may independently trigger exchange or transfer‑service licensing. Non‑custodial status does not create a blanket exemption from all VASP obligations.

Scenario 3, Hosted wallet with optional custodial backup. The provider stores an encrypted backup of the user’s recovery phrase on its servers. The user retains the primary signing key. The critical question is whether the provider can decrypt and use the backup to sign transactions or restore access without independent user action. If yes, the provider functionally controls the asset, custody is triggered. If the encryption architecture makes provider‑side decryption technically impossible without user‑side authentication, the product may remain non‑custodial, but the burden of proving this to regulators and banks is on the provider.

Scenario 4, Fiat‑backed token issuer with permissioned custody. An entity issues tokens redeemable 1:1 for fiat currency and holds the underlying fiat reserves. The issuer controls both the token‑minting mechanism and the redemption flow. This triggers both the custodian and PSP licence categories, plus bank‑level scrutiny on reserve segregation, audit and insurance.

Scenario 5, Staking‑as‑a‑service with operator key control. The operator receives user tokens, delegates or bonds them on‑chain, and controls the validator keys. Users cannot unstake or withdraw without the operator’s intervention. This is custody. The operator holds assets on behalf of users and exercises control over their disposition. VASP licensing, AML obligations and capital requirements are all expected to apply. Banks evaluating these operators will require evidence of key‑management controls, segregation and insurance.

Scenario 6, Smart‑contract multi‑sig custody (DAO or multi‑party). A smart contract governs asset custody with a threshold signing scheme (e.g., 3‑of‑5 multi‑sig). If the provider controls enough keys to meet the signing threshold unilaterally, it is custodial. If users collectively retain threshold control and the provider holds only a minority of keys insufficient to sign alone, the arrangement is likely non‑custodial, but banks will scrutinise governance documents, key‑holder identities and on‑chain evidence of control distribution.

Scenario 7, Custodial hot wallet with bank fiat rails. A platform holds user crypto in hot wallets and offers fiat on‑ramp/off‑ramp via a Panamanian bank account. This is the highest‑scrutiny configuration. It triggers the custodian licence, likely the exchange or PSP licence, and the full weight of SBP Rule 1‑2026 bank‑documentation requirements. Correspondent banks will evaluate the platform’s AML programme, sanctions screening, transaction monitoring and proof‑of‑reserves before approving the relationship.

Comparison Table: Custodial vs Non‑custodial vs Hybrid, Licensing Triggers and Bank Impact

Practical takeaway: If your product gives you, the operator, the technical ability to move, freeze or restore user assets without independent user cryptographic action, assume that VASP licensing in Panama will be required and build your compliance programme accordingly.

Bank Access for VASPs in Panama: What Banks Expect for Custodial Onboarding

Obtaining and retaining a Panamanian bank account is the single most operationally consequential step for any VASP. SBP Rule 1‑2026 formalises the due‑diligence expectations that banks must apply to virtual‑asset clients, and banks are implementing these requirements now, even while Draft Law No.314 remains in legislative process. Failure to present a complete documentation pack will result in account rejection or, for existing clients, account closure during periodic review.

Documentation Pack for Banks

The following ten‑item bank‑readiness checklist reflects the documentation that Panamanian banks and their compliance teams are requesting from VASP applicants under SBP Rule 1‑2026 guidance:

1. Corporate KYB package, certificate of incorporation, articles, register of directors and shareholders, UBO declarations.
2. Licence or licence‑application evidence, proof of VASP licence (once available) or evidence of application / regulatory correspondence.
3. Ownership and control chart, full beneficial‑ownership chain to natural persons, with supporting ID and source‑of‑wealth documentation.
4. Business model narrative, plain‑language description of services, custody model, fund flows and target markets.
5. AML/CFT programme, written policies and procedures covering customer due diligence, enhanced due diligence, sanctions screening, suspicious‑transaction reporting to the UAF and training schedules.
6. Transaction‑monitoring system documentation, description of automated and manual monitoring rules, alert thresholds and escalation workflows.
7. Proof‑of‑reserves attestation, for custodial VASPs, auditable evidence (on‑chain cryptographic proof plus independent attestation) that client assets are fully backed and segregated.
8. Custody technology and key‑management documentation, description of MPC, multi‑sig, HSM or cold‑storage architecture, key‑rotation schedules and access controls.
9. Insurance and bonding, evidence of professional indemnity, crime or custody insurance covering loss of client assets.
10. SOC 2 Type II or equivalent attestation, independent audit report on security, availability and confidentiality controls.

Transaction Monitoring and AML Programme Expectations

Banks expect custodial VASPs to operate a risk‑based AML programme aligned with the UAF’s guidance and FATF standards. This includes real‑time or near‑real‑time transaction monitoring with blockchain‑analytics tooling capable of flagging sanctioned addresses, high‑risk jurisdictions and mixing or tumbling patterns. Suspicious‑transaction reports must be filed with the UAF within the timelines prescribed by Panamanian AML law.

Correspondent Bank Considerations

Panamanian banks maintain correspondent relationships with international financial institutions that impose their own risk‑appetite constraints. Correspondent banks will evaluate the VASP’s travel‑rule compliance (the ability to transmit originator and beneficiary information with virtual‑asset transfers), sanctions‑screening capability and PII‑sharing protocols. Early indications suggest that VASPs unable to demonstrate travel‑rule readiness face the highest risk of correspondent‑bank‑driven account restrictions, even if the local Panamanian bank is initially willing to onboard the client.

Implementation Checklist: Minimum Technical Crypto Custody Requirements

Minimum Custody Controls

Custodial VASPs seeking to satisfy both Draft Law No.314 licensing standards and SBP Rule 1‑2026 bank expectations should implement, at minimum, the following technical controls:

• Multi‑party computation (MPC) or multi‑sig key management. No single individual or system component should be able to unilaterally sign a transaction. Distribute signing authority across geographically separated infrastructure.
• Hardware security modules (HSMs). Store key material in tamper‑resistant, FIPS 140‑2 Level 3 (or higher) certified hardware.
• Cold storage for the majority of client assets. Maintain at least 80–95 percent of client virtual assets in air‑gapped, offline storage with documented access procedures.
• Documented key‑rotation schedule. Rotate signing keys and administrative credentials on a defined cadence, with audit‑trail logging of every rotation event.
• Segregation of client and proprietary assets. Client virtual assets must be held in separate on‑chain addresses from the operator’s own holdings, with verifiable on‑chain segregation.

Audit, Proof‑of‑Reserves, Insurance and Incident Response

• Proof‑of‑reserves (PoR). Implement Merkle‑tree or similar cryptographic proof that client balances are fully backed by on‑chain reserves. Commission independent attestation at least quarterly.
• Annual security audit. Engage an independent third party to audit custody infrastructure, penetration‑test key‑management systems and review access controls.
• Custody insurance. Obtain coverage for theft, loss of keys, internal fraud and operational failure affecting client assets.
• Incident‑response plan. Maintain a documented, tested plan for key compromise, unauthorised access or asset loss, including regulator and client notification timelines.

These controls form the baseline that banks and regulators will expect. Product teams should treat them as mandatory infrastructure, not aspirational targets.

Timeline, Risk and Next Steps for Product Teams

The likely practical effect of Draft Law No.314 and SBP Rule 1‑2026 is that product teams have a finite window, measured in months, not years, to prepare. The following phased plan provides a structured approach:

1. Phase 1, Map (Weeks 1–3). Run every product flow through the three‑question decision tree in this article. Document who controls keys, who signs, and who can freeze or restore. Classify each flow as custodial, non‑custodial or hybrid.
2. Phase 2, Decide (Weeks 3–5). Based on the mapping, decide whether to restructure product architecture to avoid custody triggers, or to accept custodial classification and build toward licensing.
3. Phase 3, Build (Weeks 5–12). Implement minimum custody controls, draft AML programme documentation, commission SOC 2 audit, and prepare the full bank‑readiness documentation pack.
4. Phase 4, Bank outreach (Weeks 10–16). Begin or resume bank onboarding with the complete pack. Engage correspondent‑bank compliance teams proactively on travel‑rule and sanctions‑screening readiness.
5. Phase 5, Licence application (upon enactment). When Draft Law No.314 is enacted and implementing regulations are published, submit the VASP licence application with all supporting documentation already prepared.

Risk note: Waiting for final enactment before starting preparation is the highest‑risk strategy. Banks are tightening onboarding criteria now, and competitors who present complete documentation packs first will secure banking relationships that become increasingly scarce as the regulatory perimeter formalises.

Conclusion: VASP Custody Panama, Recommended Actions

The regulatory trajectory in Panama is clear: Draft Law No.314 and SBP Rule 1‑2026 are converting a permissive, undefined environment into a structured licensing regime where custody is the central dividing line. Whether your product triggers a VASP licence depends on a functional analysis of who controls keys, who signs transactions, and who can freeze or restore access, not on how you label your service.

Three recommended actions for founders and compliance teams navigating VASP custody Panama requirements:

1. Map your product flows now. Use the decision tree and scenario walkthroughs in this article to classify every product feature. If any flow gives your platform unilateral control over user assets, treat the entire product as custodial for regulatory and bank‑readiness purposes.
2. Build your bank‑readiness pack immediately. The ten‑item documentation checklist above reflects what Panamanian banks are requesting today. Do not wait for enactment, the SBP’s supervisory expectations are already shaping bank behaviour.
3. Assume licensing is coming and prepare accordingly. If your product is custodial, begin building AML programme documentation, commissioning audits, and implementing technical custody controls. Engaging experienced legal counsel in Panama at this stage, rather than after enactment, will materially reduce licensing timeline and bank‑onboarding friction.

Sources

1. Asamblea Nacional de Panamá
2. Superintendencia de Bancos de Panamá (SBP)
3. Gaceta Oficial de la República de Panamá
4. Unidad de Análisis Financiero (UAF) Panamá
5. FATF, Guidance for a Risk‑Based Approach to Virtual Assets and VASPs (2019)
6. Superintendencia del Mercado de Valores de Panamá (SMV)