Financial Integrity Monitor

Panama PA

Domains (D1–D6)

Sources

Role actions

Jurisdiction profile

CleanTier BRisk: StableMixed

Panama exited the FATF grey list in October 2023 and the EU high-risk third-country list in June 2025.

AML law criminalises laundering broadly and created a non-public UBO registry (Law 129/2020) under Superintendencia/UAF supervision, but domestic ML prosecution remains weak, professional-enabler oversight (CSPs, lawyers) is uneven, and no comprehensive VASP/crypto law is in force.

Key deficiencies

Non-public beneficial ownership registry limits third-party/journalistic verification of nominee-shareholder structures
Weak domestic prosecutorial capacity for complex professional-enabler money-laundering cases, exemplified by the 2024 mass acquittal in the Panama Papers trial
No comprehensive virtual-asset service provider (VASP) AML/CFT statute in force after the 2022 crypto bill was vetoed for insufficient controls
Ship registry (Panama flag) remains a preferred reflagging destination for vessels exiting sanctioned or scrutinised flags despite an active de-flagging campaign
Colon Free Zone transaction data remains incompletely integrated with customs systems, sustaining trade-based money-laundering exposure

Recent developments (18m)

EU Commission delisted Panama from the AML high-risk third-country list, effective June 2025
Panama's courts acquitted all 28 defendants in the Panama Papers money-laundering trial (July 2024), and Panama's new president publicly dismissed the ICIJ investigation as a 'hoax'
Panama Maritime Authority accelerated de-registration of sanctioned shadow-fleet tankers (approx. 128 vessels flagged for cancellation by March 2025, at least 70 already removed)
A former senior Mossack Fonseca executive, Christoph Zollinger, was set for trial in Germany (March 2026) on tax-evasion/criminal-organisation charges tied to Panama-based offshore structures
UNODC, with Canadian government support, ran a January 2026 high-level training for Panamanian regulators (Ministry of Economy and Finance, UAF, Attorney General's Office) on virtual-asset AML/CFT supervision

Weekly brief

Lead signal

Lead Signal

Read full brief

Lead Signal

This cycle's lead signal for Pennsylvania is EagleBank's resolution of a decade-long Bank Secrecy Act and anti-money-laundering program failure through a Department of Justice non-prosecution agreement. EagleBank, operating as Eagle Bancorp, Inc., admitted it willfully failed to establish an AML/CFT program between 2010 and 2021, a period during which a father-son customer pair ran a check-kiting scheme for ten years. The resolution carries a fine of $9,057,821.62 plus forfeiture of $736,515, for a total exceeding $9.7 million. This is a confirmed, Tier 1, high-confidence finding, and it is read here architecturally rather than as an isolated incident: a decade-long absence of a functioning compliance program at a regulated bank, resolved through settlement rather than prosecution, is itself the structural signal, independent of the specific customer scheme it happened to surface. The three-pillar balance principle cautions against reading this only as an AML matter: a program failure of this duration at an institution of this scale carries latent counter-terrorist-financing and counter-proliferation-financing exposure that a settlement resolving only the pleaded AML facts does not fully surface, and that gap in visibility is itself part of the lead signal this cycle.

Other Developments

Pennsylvania closes its virtual-currency licensing gap. Act 7 of 2025 (SB 202) extends Money Transmitter Act licensure to virtual-currency transmission conducted for a fee, effective August 26, 2025, and the state simultaneously rescinded its prior non-binding Virtual Currency Statement of Policy at 10 Pa. Code Section 19.1a as redundant. Both developments are confirmed, high-confidence, Tier 1 findings, and together they represent a structural closure of what had previously been a licensing gap for fee-based virtual-currency transmission in the state.

Deibler Brothers Novelty Company felony forfeiture. The Pennsylvania Office of Attorney General secured a felony conviction against Deibler Brothers Novelty Company for corrupt organizations tied to hundreds of illegal video gambling machines installed across the state, with a $3,000,000 forfeiture ordered. This is an assessed-confidence finding sourced to a single Tier 1 source without independent corroboration this cycle.

Skill-games licensing and tax framework remains unresolved. The Pennsylvania General Assembly did not address skill-games licensing or taxation in the signed FY2026-27 budget, leaving the framework at consultation stage ahead of the October 13, 2026 enforcement-stay deadline. This is an assessed-confidence, cross-pillar finding, and it sustains the cash-intensive unlicensed-gambling exposure identified in the enabler-jurisdiction domain this cycle.

Cross-Monitor Connections

The Deibler Brothers matter and the unresolved skill-games legislative question sit at the intersection of this monitor's enabler-jurisdiction domain and parallel gambling-regulatory tracking maintained elsewhere in the fleet: the same underlying device population and the same October 13, 2026 deadline that drive the gambling-regulatory read are also the facts that sustain this cycle's domestic money-laundering-vector assessment. Similarly, Pennsylvania's virtual-currency licensing closure under Act 7 is a payments-adjacent development with direct relevance to any parallel payments-regulation tracking of the same statute; the licensing perimeter it establishes is the shared factual basis for both readings, even though this monitor's contribution is limited to the AML/enabler-exposure lens rather than a payments-market-structure assessment.

Outlook

Two dates anchor the outlook for Pennsylvania. The nearer-term structural question, Act 7's licensing perimeter, is now settled in text; the open question is whether the Department of Banking and Securities begins bringing enforcement or licensing actions under it, which would convert this cycle's structural finding into an operational track record. The more consequential date is October 13, 2026, when the Pennsylvania Supreme Court's stay on its skill-games ruling expires; whether the General Assembly enacts a licensing and taxation framework before that date will determine whether the domestic unlicensed-gambling enabler exposure identified this cycle persists, narrows, or is formally brought inside a regulatory and AML perimeter.

weekly_brief_draft · JID PA

Domain intelligence (D1–D6)

D1 Sanctions

Not covered

Sanctions is not yet covered for this jurisdiction in this report.

D2 Beneficial Ownership

Not covered

Beneficial Ownership is not yet covered for this jurisdiction in this report.

D3 Enabler Jurisdictions and Professional Facilitators

Enabler Jurisdictions and Professional Facilitators

Two developments this cycle test the enabler-jurisdiction lens for Pennsylvania and, more broadly, for the federal district-level enforcement architecture that resolves bank-secrecy failures through negotiated settlement rather than prosecution. EagleBank, operating as Eagle Bancorp, Inc., admitted that it willfully failed to establish an anti-money-laundering and countering-the-financing-of-terrorism program for more than a decade, from 2010 through 2021. During that period the institution permitted a father-son customer pair to run a check-kiting scheme that persisted for ten years. The architecture-over-incident reading of this case is not the specific kiting scheme itself, which is a single-customer episode, but the decade-long absence of a functioning AML/CFT program at an institution of EagleBank's scale, a structural governance failure under 31 U.S.C. Section 5318(h) that a functioning compliance program did not simply miss but that, on the government's own framing, was permitted to persist. That governance-failure framing is the higher-order signal; the specific kiting scheme is the episodic illustration of what the absent architecture allowed to happen undetected.

The resolution itself is instructive for the enabler-jurisdiction question. Rather than pursue criminal prosecution, the Department of Justice resolved the matter through a non-prosecution agreement carrying a fine of $9,057,821.62 plus forfeiture of $736,515, for a total resolution exceeding $9.7 million. This is a confirmed, high-confidence, Tier 1 finding sourced directly to the DOJ's own release. Read architecturally, the non-prosecution disposition, rather than an indictment, is itself part of the enabler picture: it is a recurring pattern in United States BSA enforcement that even admitted, decade-long, willful program failures at regulated banks are resolved through monetary settlement, preserving the institution's charter and market position. The three-pillar balance principle cautions against reading this only through the AML lens: a program failure of this duration, at an institution handling comparably significant retail volumes, carries latent CTF and CPF exposure that the settlement architecture does not surface, since non-prosecution agreements typically resolve on the AML facts pleaded rather than a full accounting of what the absent program failed to catch across all three pillars.

Separately, Pennsylvania's domestic enabler exposure surfaced through the criminal-justice channel rather than the bank-supervisory channel. The Pennsylvania Office of Attorney General secured a felony conviction against Deibler Brothers Novelty Company, which pleaded guilty to corrupt organizations, a first-degree felony, for installing hundreds of illegal video gambling machines across the state; the company was ordered to forfeit $3,000,000 in cash and assets. This is an assessed-confidence finding, sourced to a single Tier 1 primary source without independent second-source corroboration this cycle, a gap the underlying research explicitly flagged. Structurally, this is the kind of domestic unlicensed-cash-business laundering vector that a functioning enabler-jurisdiction lens should weight independently of its comparatively modest dollar value relative to the EagleBank settlement: cash-intensive, unlicensed gambling infrastructure is a facilitator pattern in its own right, and its persistence alongside Pennsylvania's unresolved skill-games legislative question compounds the exposure. The General Assembly's failure to resolve a licensing and tax framework for skill-games in the signed FY2026-27 budget, ahead of the October 13, 2026 enforcement-stay deadline, leaves an estimated device population operating without AML, KYC, or revenue-reporting controls for as long as that legislative gap persists, an enablement-as-signal condition in which the absence of a regulatory perimeter is itself the analytically significant fact, independent of any single enforcement action.

Outlook

The near-term outlook for this domain turns on two separate tracks. On the bank-supervisory track, the EagleBank resolution closes that specific matter, but the non-prosecution-agreement-as-disposition pattern it exemplifies is a standing feature of the US enforcement architecture worth continued monitoring rather than a one-off data point. On the domestic-facilitator track, the binding date to watch is October 13, 2026, when the Pennsylvania Supreme Court's stay on its skill-games ruling expires; whether the General Assembly enacts a licensing and taxation framework before that date will determine whether the unlicensed-device enabler exposure identified this cycle persists, narrows, or is formally brought inside a regulatory perimeter. Absent legislative action, the enabler-jurisdiction reading for Pennsylvania's domestic unlicensed-gambling sector should be expected to remain unchanged into the next cycle.

D4 Conflict Finance

Not covered

Conflict Finance is not yet covered for this jurisdiction in this report.

D5 Crypto / Digital Assets / Financial Innovation

Crypto / Digital Assets / Financial Innovation

Pennsylvania's Act 7 of 2025 (SB 202) is this cycle's structural crypto/digital-asset development for the jurisdiction: it extends Money Transmitter Act licensure to virtual-currency transmission conducted for a fee, closing a gap that had previously allowed virtual-currency transmission services to operate outside the licensing perimeter that governs fiat money transmission. The change took effect August 26, 2025, and this is a confirmed, high-confidence, Tier 1 finding corroborated by both the Department of Banking and Securities' own announcement and the Pennsylvania Bulletin. Architecturally, this is exactly the kind of enabler-condition closure that the jurisdiction-risk framework should weight heavily: a state that previously permitted fee-based virtual-currency transmission without licensure created a structural gap in AML supervision coverage for that activity class, regardless of whether any specific illicit-finance incident had yet exploited it. Act 7 removes that structural gap prospectively.

Reinforcing the structural reading, Pennsylvania rescinded 10 Pa. Code Section 19.1a, its Virtual Currency Statement of Policy, in its entirety, effective the same date, on the basis that the guidance had become redundant once Act 7's statutory coverage took effect. This lifecycle transition, from a non-binding statement of policy to a licensing statute, is itself a durability upgrade: questions about virtual-currency transmission enforcement in Pennsylvania now rest on primary legislation carrying licensure consequences, not on an interpretive circular that carried no independent enforcement teeth. This is a confirmed, high-confidence, Tier 1 finding.

The jurisdiction-risk-tracker record for Pennsylvania characterizes this closure as decreasing enabler-jurisdiction exposure specifically in the crypto and digital-asset domain, even as the domestic enabler exposure discussed elsewhere this cycle, the unresolved skill-games licensing gap and the EagleBank AML program failure, moves in the opposite direction. This is not a contradiction; it illustrates the enforcement-versus-enablement duality that a jurisdiction can exhibit simultaneously across different typology domains within the same reporting cycle, and it is why domain-level readings, rather than a single composite jurisdiction score, are the analytically correct unit for this monitor. The jurisdiction_risk_tracker record for Pennsylvania this cycle also classifies the state's overall enforcement-versus-enablement posture as mixed and its structural-versus-episodic posture as mixed, combining a structural improvement in the crypto/digital-asset domain with episodic enforcement activity in the enabler-and-facilitator domain. For an operator or counterparty assessing Pennsylvania's overall financial-integrity posture, the correct read is domain-specific rather than a single directional score: the licensing perimeter for virtual-currency transmission is tightening in the state's favor, independent of what happens with the EagleBank matter or the unresolved skill-games question.

Outlook

Watch for enforcement activity testing the new licensing perimeter in the coming cycles: Act 7's practical significance will be measured less by the statutory text itself, which is now settled, than by whether the Department of Banking and Securities brings enforcement or licensing actions against virtual-currency transmitters that were previously operating unlicensed in the state. No such enforcement action has yet been reported this cycle. The next materiality test for this domain is whether Pennsylvania's Department of Banking and Securities issues its first licensing decisions or enforcement actions under the new virtual-currency transmission perimeter, which would convert this cycle's structural finding into an operational track record.

D6 Compliance Technology & Active Defence

Not covered

Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.

D7 AML/CTF Regime

Not covered

AML/CTF Regime is not yet covered for this jurisdiction in this report.

Regulatory horizon

No dated horizon items this cycle. 4 items tracked without a confirmed date.

4 pending date · baseline financial-integrity-2026-07-05

Role action cards

MLROHigh

EagleBank admitted a decade-long AML program failure and Pennsylvania closed its virtual-currency licensing gap this cycle.

EagleBank's resolution illustrates that even functioning-institution-scale AML programs can be found to have been absent for years without triggering criminal prosecution, while Act 7 now brings virtual-currency transmitters into Pennsylvania's licensing and AML-obligation perimeter, changing which counterparties in that sector are supervised entities.

5 evidence refs

ComplianceHigh

Pennsylvania closed a structural virtual-currency licensing gap via Act 7 and rescinded superseded guidance.

Act 7 replaces a non-binding statement of policy with a licensing statute carrying enforcement consequences, meaning compliance functions with Pennsylvania virtual-currency-transmission exposure should reassess licensing status against the new statutory perimeter rather than the withdrawn guidance.

2 evidence refs

LegalHigh

EagleBank resolved a decade-long AML program failure via non-prosecution agreement rather than prosecution.

The non-prosecution disposition, carrying a fine and forfeiture exceeding $9.7 million, is a data point on enforcement trajectory for admitted willful program failures, relevant to liability-exposure assessments for institutions with comparable control gaps.

3 evidence refs

BoardHigh

A regulated bank's decade-long AML program failure was resolved through a multimillion-dollar non-prosecution agreement this cycle.

The scale and duration of EagleBank's admitted failure, resolved rather than prosecuted, together with the Deibler Brothers felony forfeiture, represent material financial-crime and reputational risk data points for institutions operating in or through Pennsylvania.

3 evidence refs

CTOHigh

Pennsylvania now requires Money Transmitter Act licensure for fee-based virtual-currency transmission.

Digital-asset infrastructure serving Pennsylvania customers for a fee now sits within the same licensing and technical-compliance perimeter as fiat money transmission, and the state's prior interpretive guidance on virtual currency has been withdrawn as redundant.

3 evidence refs

RiskHigh

Pennsylvania's risk profile is mixed this cycle: crypto-licensing exposure is decreasing while domestic enabler exposure is worsening.

The Act 7 licensing closure reduces structural crypto-sector risk, while the EagleBank AML failure and the unresolved skill-games legislative gap sustain elevated domestic enabler-jurisdiction exposure, illustrating that jurisdiction-level risk direction should be read by domain rather than as a single composite score.

4 evidence refs

OperationsAssessed

New Pennsylvania licensing obligations now apply to virtual-currency transmitters operating for a fee.

Operational workflows for onboarding and monitoring virtual-currency-transmission counterparties in Pennsylvania should be updated to reflect the Money Transmitter Act licensing perimeter established by Act 7 and the withdrawal of the prior statement-of-policy guidance.

2 evidence refs

AuditHigh

EagleBank's admitted decade-long AML program failure raises questions about control-testing adequacy at comparable institutions.

The government's characterization of a functioning escalation process being overridden for a decade is a control-testing red flag pattern worth incorporating into audit-scope considerations for institutions with long client-relationship tenures and limited independent escalation review.

2 evidence refs

Decision lens

MLRO

EagleBank admitted a decade-long AML program failure and Pennsylvania closed its virtual-currency licensing gap this cycle.

Compliance

Pennsylvania closed a structural virtual-currency licensing gap via Act 7 and rescinded superseded guidance.

Legal

EagleBank resolved a decade-long AML program failure via non-prosecution agreement rather than prosecution.

Board

A regulated bank's decade-long AML program failure was resolved through a multimillion-dollar non-prosecution agreement this cycle.

CTO

Pennsylvania now requires Money Transmitter Act licensure for fee-based virtual-currency transmission.

Risk

Pennsylvania's risk profile is mixed this cycle: crypto-licensing exposure is decreasing while domestic enabler exposure is worsening.

Operations

New Pennsylvania licensing obligations now apply to virtual-currency transmitters operating for a fee.

Audit

EagleBank's admitted decade-long AML program failure raises questions about control-testing adequacy at comparable institutions.

Shared evidence: 6 refs

Scenario sketches

AMLA Direct-Supervision Transition and Cross-Border Obliged-Entity Evasion

Illustrative orientation only: as the EU AML Package matures, the shift from purely national AML supervision toward AMLA direct and indirect supervision of cross-border obliged entities, under the AMLA Regulation (Reg (EU) 2024/1620), alongside the directly-applicable AMLR (Reg (EU) 2024/1624) and per-state 6AMLD transposition, could reshape the supervisory and evasion landscape by concentrating scrutiny on cross-border groups while leaving purely domestic obliged entities under continued national-level supervision. This is an architecture-over-incident illustration of a structural transition, not an observed development in Pennsylvania or the United States this cycle.

Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.

Standing trackers (T1–T6)

Tracker	Status	Note
T1 · Russian Sanctions-Evasion Architecture	no_change	No PA-specific Russian sanctions-evasion material surfaced this cycle.
T2 · EU AML Package / AMLA	no_change	Not applicable to this PA-scoped cycle; no PA nexus to AMLR/6AMLD/AMLA identified.
T3 · FATF Grey List	no_change	No PA-specific FATF plenary or mutual-evaluation material surfaced this cycle.
T4 · Beneficial-Ownership Register Status	no_change	No PA-specific beneficial-ownership registry development surfaced this cycle.
T5 · Crypto & Digital-Asset Integrity	material_change	Act 7 of 2025 brings virtual-currency transmission within PA's Money Transmitter Act licensing perimeter, closing a prior VC-licensing gap.
T6 · Sanctions Regime Divergence	no_change	No PA-specific EU/US/UK autonomous-listing divergence signal surfaced this cycle.

Registers

Enforcement actions

Panama Maritime Authority announced the cancellation of registration for vessels sanctioned by the US, its allies, or the UN, following a prior pledge to penalise blacklisted vessels; at least 70 tankers had already been removed by the announcement date. 27 Mar 2025
Panama cancelled registration of six ships sailing under its flag after the UK blacklisted 30 vessels the prior week, carrying out what the Authority termed an 'expedited cancellation.' 2 Dec 2024
Following OFAC's designation of 155 shadow-fleet tankers in January 2025 — the most extensive US action against the fleet to date — Panama's ship registry began de-listing 68 of the sanctioned vessels flying its flag. 23 Jan 2025
Panama's courts concluded the high-profile Panama Papers money-laundering trial, with judge Baloisa Marquínez acquitting all 28 defendants over their alleged role in setting up shell companies used in Brazil- and Germany-linked bribery and corruption scandals, citing insufficient evidence and inadmissible electronic evidence. 5 Jul 2024
GAFILAT issued a first enhanced follow-up report analysing Panama's progress addressing technical compliance deficiencies identified in its 2018 Mutual Evaluation Report, re-rating several FATF Recommendations while keeping Panama in the enhanced follow-up process. 1 Jun 2025

Sanctions changes

OFAC designated 155 shadow-fleet tankers in January 2025, its most extensive single action against Russia's shadow fleet to date, including vessels flagged under Panama's registry, triggering Panama's de-flagging response. 23 Jan 2025
The European Commission updated its delegated regulation listing high-risk third countries under AMLD IV, delisting Panama alongside Barbados, Gibraltar, Jamaica, the Philippines, Senegal, Uganda and the UAE, removing the requirement for EU obliged entities to apply enhanced due diligence specifically keyed to Panama's AML/CFT deficiencies. 10 Jun 2025

Regulatory horizon (register)

Panama's next FATF/GAFILAT Mutual Evaluation under 5th round methodology
Next GAFILAT enhanced follow-up report on Panama AML/CFT reforms
Prospective Panama VASP/crypto AML legislation
Zollinger Mossack Fonseca-linked trial in Cologne, Germany

Active schemes

[HIGH] Panama flag-of-convenience reflagging for shadow-fleet tankers
[HIGH] Nominee-shareholder and private-foundation BO opacity
Colon Free Zone trade-based laundering / peso exchange
Hizballah revenue generation via Panama free-trade zones

Sources

Coverage gaps

The 2024 acquittal of all 28 Panama Papers defendants, inclu…

The 2024 acquittal of all 28 Panama Papers defendants, including Mossack Fonseca's founders, on money-laundering charges — with the presiding court dismissing key electronic evidence on chain-of-custody grounds — demonstrates persistent weakness in Panama's capacity to secure domestic convictions against professional enablers of offshore shell-company networks.

Panama's beneficial-ownership registry (Law 129/2020) is hel…

Panama's beneficial-ownership registry (Law 129/2020) is held privately by supervisory authorities rather than made publicly accessible, restricting the ability of banks, foreign law enforcement, and investigative journalists to independently verify nominee-shareholder and private-foundation ownership structures.

Panama has no comprehensive VASP/crypto AML statute in force…

Panama has no comprehensive VASP/crypto AML statute in force after President Cortizo vetoed the 2022 crypto bill for lacking adequate anti-money-laundering controls; capacity-building continues via UNODC training but no replacement legislation has been enacted.

Despite an active de-flagging campaign against already-sanct…

Despite an active de-flagging campaign against already-sanctioned vessels, Panama's registry continues to receive newly-reflagged shadow-fleet tankers exiting other flags before they are individually designated, reflecting a structural lag between vessel-level sanctions designation and registry-level screening.

Colon Free Zone administration and Panamanian Customs system…

Colon Free Zone administration and Panamanian Customs systems remain incompletely integrated for electronic transaction tracking, sustaining the trade-based money-laundering vulnerability long identified by FATF and FinCEN typology reporting on the zone.

Evidence

Confidence-tiered claims

No structured claims published for this jurisdiction yet.