#
Panama's operational-resilience framework for regulated financial entities rests on a set of pre-DORA SBP agreements covering outsourcing, electronic banking, and IT risk management, with cloud-service use outside Panama requiring prior SBP/SMV approval or notification; there is no consolidated cyber-resilience statute equivalent to DORA.
Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →
Absent a central bank, Banco Nacional de Panamá's clearinghouse functions as the country's most important settlement system for retail payments. The World Bank's Financial Sector Assessment finds that settlement-risk management here lacks sophistication, with participants able to run largely uncollateralized net debit positions — a structural feature carried through directly into this monitor's W12 correspondent-banking and settlement analysis.
Outlook
Absent a DORA-equivalent statute, Panama's operational-resilience posture will likely continue to develop incrementally through SBP/SMV rule updates rather than a single consolidating law; monitor for any successor instrument that might formally supersede the 2005-2018 Acuerdo series.
no periodic updates on record for this sub-brief
Sources and findings (4 unique sources · R-3/R-4)
- [W3-E1] T2 Derived: Confirmed in_force Collapsed 2× useshttps://aws.amazon.com/financial-services/security-compliance/compliance-center/pa/ re-verified
SBP's outsourcing regulation (Acuerdo 009-2005), electronic banking risk guidelines (Acuerdo 006-2011), and IT risk management guidelines (Acuerdo 003-2012, and 005-2018 issued jointly with the SMV) cover due diligence, risk management, business continuity, and monitoring/oversight of third parties.
- [W3-E3] T3 Derived: Probable in_forcehttps://emailmarketingpanama.com/en/email-banking-financial-services.html re-verified
Bank email and IT infrastructure in Panama is examined by the SBP under Acuerdo 11-2018 on operational risk, alongside comparators such as FFIEC in the US and DORA in the EU, reflecting the absence of an equivalent single consolidated Panamanian cyber-resilience statute.
SBP requires financial institutions to implement documented information security programs covering access controls, incident response, business continuity, and cybersecurity risk management, alongside SMV information-security requirements for securities market participants and Law 81 on personal data protection breach notification via ANTAI.
- [W3-E5] T1 Derived: Confirmed in_forcehttps://documents1.worldbank.org/curated/en/099613104102429031/pdf/SECBOS1af572a90621b72716e27781ecaec.pdf re-verified
Because Panama has no central bank, Banco Nacional de Panamá (BNP) plays the role of main settlement bank and operator of the country's most important settlement system (the BNP clearinghouse), with the FSAP noting management of settlement risk lacks sophistication and participants can run largely uncollateralized net debit positions.