Panama PA

The ship registry of Panama, the largest in the world, sits directly at the friction point between Russian shadow-fleet reflagging and Western de-flagging pressure, and the evidence base this cycle assesses that positioning as structurally mixed rather than simply permissive or simply compliant. Vessels exiting scrutinised or already-sanctioned flags, including Malta, the Marshall Islands and the Cook Islands, are reflagged into the Panama registry, exploiting weak registry-level enforcement of international maritime rules, even as the Panama Maritime Authority simultaneously runs an active de-flagging campaign against vessels that have already been individually designated. The architecture-over-incident reading of this pattern matters more than any single vessel-level enforcement action: the commercial incentive of the registry to retain tonnage revenue works structurally against proactive vetting of incoming vessels ahead of designation, meaning enforcement arrives only after the fact rather than as a preventive filter.

The scale of the reactive response is nonetheless material. The Panama Maritime Authority has flagged approximately 128 sanctioned vessels for registration cancellation, with more than 70 already removed by March 2025, a de-flagging campaign triggered sequentially by OFSI action in December 2024, a January 2025 OFAC designation of 155 shadow-fleet tankers, the most extensive single US action against the Russian shadow fleet to date, and ongoing EU Council vessel listings. This sequencing is itself a structural finding rather than an incidental detail: OFAC, OFSI and the EU Council maintain separately timed and only partially overlapping vessel-designation lists, with the EU list approaching nearly 600 vessels by late 2025, forcing the Panama registry to react to each regime independently rather than to a single harmonised list. This produces a compliance-timing gap that is a direct instance of a standing sanctions-regime-divergence pattern: the dollarised economy of Panama and its deep correspondent-banking ties to the United States amplify secondary-sanctions exposure relative to peer flag states, even as formal treaty obligations to any single sanctioning authority remain limited.

Enablement as signal applies with particular force here. The absence of a preventive vetting requirement at the point of reflagging, rather than any single enforcement gap, is the analytically significant condition. Panama is not the only jurisdiction implicated in this scheme architecture; Vietnam, Hong Kong and Seychelles also feature among enabling jurisdictions in the same reflagging pattern, underscoring that the role of Panama, while central given registry scale, is one node within a wider multi-jurisdictional evasion network rather than a unique point of failure. The severity of this scheme has been preliminarily assessed as high, reflecting both the scale of tonnage involved and the structural rather than episodic nature of the vulnerability, and its current status is assessed as evolving rather than resolved or closed, reflecting the rolling nature of designation-triggered de-flagging described above.

The three-pillar balance principle bears directly on this domain: the evidence this cycle is entirely AML and sanctions-evasion in character, with no CTF or CPF-specific finding surfaced for the maritime sector of Panama this cycle. That absence is noted rather than assumed to indicate resolution. For obliged entities in trade finance and correspondent banking relationships touching Panama-flagged tonnage, the relevant red-flag indicator identified this cycle is a vessel reflagged from a sanctioned or heavily scrutinised registry to Panama shortly before or after individual sanctions designation, an indicator drawn from trade documentation rather than beneficial-ownership records. This reinforces the trade-finance and correspondent-banking customer-typology exposure already associated with the flag-state role of Panama, independent of the beneficial-ownership or virtual-asset posture addressed elsewhere in this brief. The same asynchronous listing architecture is also of direct relevance to macro-sanctions tracking: a jurisdiction whose flag-state exposure is driven by regime divergence rather than domestic policy choice illustrates how the sanctions architecture itself, and not any single enforcement action, is the appropriate unit of analysis.

This cycle also establishes the first FIM baseline observation of the role of Panama within the standing Russian Sanctions-Evasion Architecture tracker, alongside Russia, the United States, the United Kingdom and the European Union as primary jurisdictions. The trajectory recorded for that tracker is stable, reflecting a registry response that has kept pace with, but not got ahead of, the designations driving it.

Outlook

The rolling nature of this exposure means the de-flagging campaign of the Panama Maritime Authority should be read as a continuing, event-driven process rather than a closed episode: new OFAC, OFSI and EU Council designations will continue to trigger sequential registry action for as long as the underlying vessel-designation lists remain unharmonised. No horizon item identified this cycle specifically addresses a prospective change to the vetting standards of the Panama registry itself, meaning the reactive posture identified here is likely to persist absent a distinct policy intervention. The broader sanctions-regime-divergence pattern, asynchronous OFAC, OFSI and EU Council listing practice, remains a structural condition affecting the flag-state exposure of Panama rather than a Panama-specific policy choice, and any future convergence of those three regimes would be among the most consequential developments this tracker could register, though none is currently signalled.

Panama sits outside the direct perimeter of the EU AML Package: as a non-EU third country, it carries no AMLR direct-applicability obligation and no 6AMLD transposition requirement of its own. Its only formal interface with that EU architecture is the AML high-risk third-country delegated regulation, from which it was removed effective June 2025, a delisting that arrived some twenty months after the exit of Panama itself from the FATF Increased Monitoring list in October 2023. The developments that are directly relevant to the beneficial-ownership perimeter of Panama this cycle are therefore domestic and regional rather than EU-driven, and they present a materially more mixed picture than either list exit suggests in isolation.

The Law 129/2020 beneficial-ownership registry of Panama remains held privately by the Superintendencia de Bancos and the Unidad de Analisis Financiero, and is not publicly searchable. Companies maintain a share register recording the owners of nominal shares, but are not required to disclose ownership information directly to government in a form accessible to third parties, a structural finding that continues to limit verification by banks, journalists and foreign law enforcement of nominee-shareholder and private-foundation structures. That registry architecture is the same one that underpinned the Mossack Fonseca shell-company network, and it persists as standing infrastructure independent of the closure of that particular firm. Compounding the transparency gap is a weak record of domestic prosecutorial follow-through: all 28 defendants in the Panama Papers money-laundering trial, including Mossack Fonseca co-founder Jurgen Mossack, were acquitted in July 2024, with the court citing insufficient and inadmissible electronic evidence, and the Panamanian president subsequently characterised the underlying ICIJ investigation publicly as a hoax. Read together, these two findings indicate that even where beneficial-ownership chains are eventually traced by investigative journalism or foreign law enforcement, the domestic mechanisms needed to convert that tracing into accountability outcomes have, in this instance, not held.

Globally, the EU AML Package sets the structural direction for beneficial-ownership regulation even where it does not directly bind Panama. That package now comprises three distinct instruments: the AML Regulation, directly applicable across the European Economic Area; the sixth AML Directive, transposed on a per-Member-State basis; and the AMLA Regulation, which establishes the Anti-Money Laundering Authority and is progressively shifting supervision of higher-risk cross-border obliged entities from purely national authorities toward a hybrid EU-level regime. For Panama, this architecture functions as external backdrop rather than binding law: its only point of contact remains the high-risk third-country delegated regulation, and the delisting of Panama from that list in June 2025 removed the mandatory enhanced-due-diligence trigger that EU obliged entities had previously been required to apply when dealing with Panama-linked counterparties, without altering any domestic transparency obligation inside Panama itself.

For obliged entities applying FATF Recommendations 24 and 25 to Panama-linked beneficial-ownership verification, the practical control implication is that customer due diligence at onboarding cannot rely on the domestic registry as an independent verification source, since the registry itself is not publicly accessible; the relevant customer typologies most exposed are high-net-worth individuals, fund structures and corporate vehicles making use of nominee-shareholder or private-foundation arrangements. This is a covered rather than an open obligation gap in the formal FATF Recommendation sense, since the underlying share-register requirement exists in Panamanian law, but the practical verification gap for third parties remains open regardless of the formal coverage status. It is also notable that this cycle records no primary Panamanian Companies Registry or Superintendencia verification of the nominee-shareholder mechanics described by secondary reporting; this is recorded as a research coverage gap rather than a finding, and it means the beneficial-ownership assessment for Panama this cycle rests on FATF, ICIJ and Global Witness secondary and institutional sourcing rather than direct primary-registry retrieval.

Outlook

The next enhanced follow-up report from GAFILAT, expected in the fourth quarter of 2026, will re-rate technical compliance on outstanding Recommendations including beneficial-ownership access, providing the next formal signal on whether registry accessibility is improving. The Zollinger trial in Cologne, expected to conclude around March 2026, will separately test whether a foreign jurisdiction can secure the accountability outcome that domestic Panamanian courts did not in the 2024 acquittal. Absent either a change to the public-accessibility status of the Law 129/2020 registry or a demonstrated increase in domestic prosecutorial success, the enforcement-reality gap identified this cycle is expected to persist as the dominant analytical characteristic of the beneficial-ownership posture of Panama.

Applying the four-dimension enabler-jurisdiction framework, that is legal framework, enforcement record, capacity versus choice, and systemic significance, to Panama this cycle produces a mixed rather than uniformly negative assessment. On the enforcement-record dimension, Panama remains in the enhanced follow-up process of GAFILAT notwithstanding its exits from the FATF Increased Monitoring list and the EU high-risk third-country list; the first enhanced follow-up report from GAFILAT re-rated Panama on multiple FATF Recommendations in June 2025 while retaining the enhanced follow-up designation, indicating that regional peer-review scrutiny has continued even as the two headline list exits were being processed elsewhere.

On the legal-framework and capacity dimensions, the clearest structural vulnerability this cycle is the Colon Free Zone. Incomplete integration between free-zone administration and Panamanian customs systems sustains a trade-based money-laundering exposure in which cash-intensive wholesale re-export businesses, some of which routinely accept large volumes of cash for wholesale quantities of merchandise, mix with narcotics-linked peso-exchange laundering mechanisms. This is assessed as a structural vulnerability independent of any single enforcement action, consistent with the architecture-over-incident principle applied throughout this brief; it reflects an administrative capacity gap in shipment-level transaction tracing rather than a deliberate policy choice to tolerate laundering, though the practical effect on illicit-finance exposure is the same regardless of intent.

The professional-facilitator dimension of this cycle is illustrated most sharply by a case moving outside Panama entirely. Christoph Zollinger, a former senior Mossack Fonseca executive, is set for trial in Cologne, Germany in March 2026 on tax-evasion and criminal-organisation charges tied to approximately 50 Panama-linked offshore companies. This is a direct test of cross-border enforcement reach precisely because domestic Panamanian prosecution of comparable facilitator-level conduct failed in 2024, when all 28 defendants in the Panama Papers trial were acquitted on evidentiary grounds. The systemic-significance dimension is underscored by the scale of the underlying facilitator network Mossack Fonseca once represented, and by the persistence of the nominee-shareholder and private-foundation architecture that such facilitators relied on, which remains structurally available regardless of the closure of any single firm.

Read across these four dimensions, Panama presents as an enabler jurisdiction whose deficiencies are substantially capacity-driven, incomplete customs-zone integration, backlogged prosecutorial capacity, rather than a deliberate policy choice to remain permissive, while nonetheless producing enabler-jurisdiction outcomes, persistent registry opacity, weak domestic prosecutorial follow-through, that are functionally indistinguishable from those of a more deliberately permissive jurisdiction. This domain also intersects directly with the terrorism-finance channel identified elsewhere in this brief: the same free-trade-zone architecture that sustains narcotics-linked trade-based laundering in the Colon Free Zone is structurally similar to, though evidentially distinct from, the commercial and trading fronts through which Hizballah generates revenue within the free-trade-zone economy of Panama, illustrating how a single administrative capacity gap can be exploited by multiple, unrelated illicit-finance actors simultaneously. Key enforcement actors relevant to this domain include the Panama Maritime Authority, the National Customs Authority, the Unidad de Analisis Financiero, GAFILAT and, for the Zollinger matter specifically, German prosecutorial authorities in Cologne; the involvement of a non-Panamanian enforcement actor in the most consequential pending professional-facilitator case of this cycle is itself an analytically significant fact about the current limits of domestic enforcement capacity. The severity of the Colon Free Zone trade-based laundering scheme has been preliminarily assessed as elevated, with a current status of active rather than evolving or resolved, reflecting its continuous rather than episodic operation.

Outlook

The next enhanced follow-up report from GAFILAT, due in the fourth quarter of 2026, will provide the next formal re-rating on outstanding Recommendations including DNFBP supervision and beneficial-ownership access, both directly relevant to the professional-facilitator dimension of this assessment. The outcome of the Zollinger trial, expected around March 2026, will be the most consequential single data point for this domain in the near term, testing directly whether cross-border enforcement can succeed where domestic prosecution did not. The next FATF and GAFILAT mutual evaluation of Panama under the fifth-round effectiveness-based methodology, not expected before 2028, will eventually test whether the enabler-jurisdiction deficiencies identified here have been resolved in substance rather than in technical compliance rating alone.

Applying the source, channel, deployment trace required under the conflict-finance filter to this cycle evidence for Panama identifies a single but well-corroborated terrorism-finance channel rather than an extractive-industry integrity finding. Hizballah operates commercial and trading fronts within the free-trade-zone economy of Panama, generating revenue for the organisation through mixed licit and illicit trade, alongside its established presence in the tri-border area spanning Argentina, Brazil and Paraguay. The source in this trace is mixed licit and illicit trade activity; the channel is the free-trade-zone commercial infrastructure of Panama, the same infrastructure implicated in the Colon Free Zone trade-based laundering exposure discussed under enabler jurisdictions; and the deployment is organisational revenue for Hizballah, an entity designated as a terrorist organisation by multiple sanctioning authorities including the United States.

This finding is drawn from a tier-1 FinCEN alert and is assessed at high confidence; it is not a new development this cycle but rather a standing feature of the free-trade-zone economy of Panama that this baseline formally establishes as a tracked conflict and terrorism-finance channel for the first time. The structural significance of this finding lies less in any single transaction and more in the observation that the same cash-intensive, weakly-traced free-zone architecture exploited by narcotics-linked trade-based laundering schemes is simultaneously available to, and reportedly used by, a designated terrorist organisation for revenue generation. This is a direct illustration of the three-pillar balance principle in practice: a CTF finding of this kind carries equal analytical weight to an AML finding of similar structural character, even though CTF findings of this type generate comparatively less enforcement volume and therefore less contemporaneous news coverage than sanctions-evasion or beneficial-ownership stories.

No extractive-industry integrity finding specific to Panama was identified in the evidence reviewed this cycle; Panama functions in this domain as a transit and revenue-generation environment for the Hizballah channel rather than as a source or destination for conflict-linked commodity flows. This absence is recorded rather than assumed to indicate that no such exposure exists, consistent with the honesty-over-coverage principle applied throughout this brief. The customer typologies most relevant to this finding are trade finance and corporate customers operating through Panama free-trade-zone structures, and the observability of the associated red-flag indicator, a commercial trading front with revenue flows split between licit merchandise trade and unverified downstream beneficiaries, is through trade documentation rather than through account-level transaction monitoring alone.

Outlook

No specific regulatory horizon item addressing this channel directly was identified this cycle, and the current expectation is that the Hizballah free-trade-zone revenue channel will persist as a standing tracked item rather than resolve through any near-term Panama-specific policy change. Any future designation action by OFAC or the US Department of State targeting Panama-based Hizballah-linked commercial fronts specifically would represent the most significant possible development against this baseline, and any GAFILAT or FATF technical-compliance re-rating that addresses CTF-specific measures, as distinct from the AML-focused re-ratings recorded elsewhere in this brief, would also be a material development to track.

The digital-asset regulatory environment directly relevant to Panama this cycle is defined by absence rather than by presence: Panama has no comprehensive virtual-asset service provider or crypto AML statute in force, following a 2022 presidential veto of a licensing bill on the grounds of inadequate AML controls. This leaves a live FATF Recommendation 15 supervisory-perimeter gap open for any virtual-asset activity conducted by or accessed through Panama-based operators, a gap that has now persisted for more than four years since the veto. Against that backdrop, the most concrete development this cycle is not legislative but institutional: UNODC, with backing from the Canadian government, delivered high-level AML and CFT training in January 2026 to the Ministry of Economy and Finance, the Unidad de Analisis Financiero and the Attorney General Office of Panama on virtual-asset supervision. This training signals capacity-building momentum within the regulatory apparatus of Panama, but it has not, as of this cycle, produced enacted legislation, and the underlying source for this training is tier-flagged at T3 in the cumulative source register despite the broader jurisdiction record generally reflecting stronger sourcing; the more conservative tier has been honoured per source-quality carry-through discipline.

Globally, frameworks such as the EU markets-in-crypto-assets regulation and the FATF virtual-asset standards set the structural direction for digital-asset regulation generally, and Panama sits outside both of those direct perimeters: the EU framework applies within the European Economic Area rather than to Panama, and the FATF virtual-asset standards function as an international benchmark against which the absence of Panamanian implementing legislation is measured rather than a directly binding instrument. This global backdrop is relevant to Panama primarily as the reference point against which the current legislative gap is assessed as a gap at all, rather than as a direct source of obligation.

A key judgment carried by this baseline is that the absence of a VASP or crypto AML statute in Panama five years after the 2022 veto represents a persistent legal gap rather than a capacity deficit alone, given that continued international capacity-building support has not been matched by corresponding legislative action; this judgment is assessed at possible rather than assessed or high confidence, reflecting the inherent difficulty of distinguishing genuine capacity constraints from deliberate legislative inaction from outside sources alone. The customer typology most directly exposed by this gap is virtual-asset service provider counterparties dealing with Panama-linked crypto-asset operators, for whom the absence of a domestic supervisory perimeter means that counterparty due diligence cannot rely on any Panama-specific licensing or registration requirement. The research coverage this cycle did not extend to a primary retrieval of any Panamanian legislative record beyond secondary UNODC reporting on the training itself, and this is recorded as a gap rather than as an indication that no legislative activity is underway. It is also worth noting for cross-domain reference that the absence of a VASP AML statute compounds, rather than operates independently from, the beneficial-ownership opacity documented elsewhere in this brief: a virtual-asset operator structured through a Panamanian corporate vehicle with nominee shareholders would currently face neither a domestic VASP licensing requirement nor a publicly verifiable beneficial-ownership record, a compounding gap that obliged entities transacting with Panama-linked crypto counterparties should weigh cumulatively rather than assess each gap in isolation. This compounding condition is assessed at possible confidence given the absence of any documented instance this cycle in which it has been jointly exploited, though the structural conditions for such exploitation are independently well evidenced. The severity of this regulatory gap, considered independently of any specific scheme, is not assigned a preliminary rating in this brief, since no active scheme inventory entry specific to Panama-based virtual-asset laundering was identified this cycle; this itself is recorded as a gap rather than as reassurance of low risk.

Outlook

A prospective successor to the vetoed 2022 VASP legislation is recorded on the regulatory horizon with an expected date of 2027 and a multi-year uncertainty band, reflecting that no bill is currently tabled and that enactment remains a plausible but genuinely uncertain legislative outcome. Enactment of such legislation would bring Panama-based or Panama-accessed virtual-asset activity within the FATF Recommendation 15 supervisory perimeter for the first time since the 2022 veto, and would be the single most consequential development this domain could register in coming cycles. Absent that legislative step, the January 2026 UNODC and Canadian-backed training is best read as capacity-building in advance of a possible future legislative window rather than as a substitute for one.

No material development in RegTech, perpetual-KYC, or AI and machine-learning transaction-monitoring capability specific to Panama was identified in the evidence reviewed this cycle. This domain is subject to a standing exemption from the substantive-finding floor applied elsewhere in this brief, reflecting that compliance-technology developments are tracked opportunistically as they arise rather than assumed to occur on a fixed cycle, and this row is carried forward quiet on that basis rather than omitted.

Honesty over coverage governs the treatment of this domain: rather than construct an inferential compliance-technology narrative from adjacent findings, such as the absence of a virtual-asset supervisory perimeter documented under the digital-assets domain, or the non-public status of the beneficial-ownership registry documented under the corporate-transparency domain, this brief records plainly that no direct evidence of RegTech, perpetual-KYC, or active-defence technology adoption by Panamanian supervisory authorities or obliged entities was retrieved this cycle. It is nonetheless worth noting, as a structural observation rather than a finding, that the practical effect of both the non-public registry status and the absent VASP licensing regime is to limit the data infrastructure against which any future compliance-technology deployment, whether by Panamanian authorities or by foreign obliged entities transacting with Panama-linked counterparties, would need to operate; a public, machine-readable beneficial-ownership registry interface, for example, is a common precondition for the perpetual-KYC tooling increasingly adopted elsewhere, and its absence in Panama is a relevant precondition gap for this domain even though it is recorded under corporate transparency rather than as a compliance-technology finding in its own right.

Outlook

No regulatory horizon item specific to compliance technology in Panama was identified this cycle. Future cycles should watch for any technology component within a successor VASP licensing bill, given that modern virtual-asset licensing regimes elsewhere frequently include supervisory technology or reporting-API requirements, and for any technology-enabled component of the beneficial-ownership registry reforms that might eventually accompany a future GAFILAT re-rating.