Agreement No. 8 (2026) — Establishing Guidelines on Control Measures Necessary for the Verification of Electronic Fund Transfers Within National Territory

Republic of Panama
Superintendency of Banks of Panama
AGREEMENT No. 8-2026
(September 22, 2026)
"Establishing Guidelines on Control Measures Necessary for the Verification of Electronic Fund Transfers Within National Territory"

THE BOARD OF DIRECTORS,

in the exercise of its legal powers, and

CONSIDERING:

That following the issuance of Decree Law No. 2 of February 22, 2008, the Executive Branch prepared a systematic ordering in the form of a single text of Decree Law No. 9 of February 26, 1998, and all its modifications, which was approved through Executive Decree No. 52 of April 30, 2008, hereinafter the Banking Law;

That in accordance with numerals 1 and 3 of Article 5 of the Banking Law, it is the objective of the Superintendency of Banks to ensure the solidity and efficiency of the banking system; as well as to promote public confidence in the banking system;

That in accordance with numeral 5 of Article 11 of the Banking Law, it is a technical attribute of the Board of Directors to establish, within the administrative scope, the interpretation and scope of legal or regulatory provisions in banking matters;

That in accordance with numeral 19 of Article 16 of the Banking Law, the Superintendent of Banks has the attribute to ensure that banks provide their clients with information that ensures the greatest transparency of banking operations;

That Article 112 of the Banking Law establishes that banks and other supervised entities by the Superintendency of Banks shall have the obligation to establish policies, procedures, and internal control structures to prevent their services from being used improperly for the crime of money laundering, Terrorism Financing, and other related or similar crimes;

That through Agreement No. 1-2011 of January 4, 2011, and its modifications, guidelines are issued for the transparency of information through the use of banking products and services;

That Article 2 of Agreement No. 1-2011 establishes that banks must promote information transparency as a mechanism so that users of banking services and the general public know at all times and can make informed decisions regarding banking operations and services;

That Agreement No. 6-2011 of December 6, 2011, and its modifications, establishes guidelines on electronic banking and the management of related risks;

That Article 2 numeral 1 of Agreement No. 6-2011 defines electronic banking as the provision of banking services through electronic means or channels that involve services offered by internet banking, mobile banking, among other electronic means or channels;

That Article 11 numeral 3 and Article 15 of Agreement No. 6-2011 establish that banks in their integral management of risks associated with electronic banking must establish technical measures and procedures that ensure applicable privacy for clients and the security of their operations; as well as establishing minimum security controls that must be applied at the level of internet banking, mobile banking, and other electronic channels;

That Agreement No. 1-2026 establishes guidelines for the prevention of the improper use of banking and fiduciary services;

That Article 2 of Agreement No. 1-2026 establishes that banks must take the necessary measures to prevent their operations and/or transactions from being carried out with funds or on funds originating from activities related to crimes of money laundering, terrorism financing, or financing of the proliferation of weapons of mass destruction;

That in accordance with Article 22 of Agreement No. 1-2026, banks must ensure the proper application of due diligence procedures when electronic transfers are made, for which they must collect information on the name of the originator, name of the beneficiary, account number for each or a single reference number of the transaction, and the amount of the transfer; as well as having effective security procedures and measures to prevent their clients from improperly using electronic transfers;

That Agreement No. 2-2017 of April 18, 2017, updates provisions on fund transfers, establishing minimum parameters regarding fund transfers, national and international, in order to avoid the improper use of banking services through such operations;

That numerals 1 and 8 of Article 3 of Agreement No. 2-2017 define a fund transfer as that transaction ordered by a person, whether natural or legal, called the orderor, through which the bank, through electronic means, makes a determined amount of money available to another person, called the beneficiary. On the other hand, it defines national transfer as those transactions in which the banks of the orderor and the beneficiary are located within national territory;

That Article 4 of Agreement No. 2-2017 establishes that every orderor bank that carries out a national or international transfer must ensure that it maintains the required information on the orderor and beneficiary and that the same can be verified with the transfer or message related to it throughout the entire payment chain, among which includes the name or corporate name of the orderor, in identical form to that registered in the account and the number of their bank account or unique reference number of the transaction; as well as the name of the beneficiary and account number, among others;

That Article 13 of Agreement No. 2-2017 establishes that the bank to prevent the improper use of fund transfers through electronic banking channels must ensure the existence and functioning of effective security procedures and measures for the identification and tracking of suspicious transactions;

That Agreement No. 11-2018 of September 11, 2018, dictates new provisions on operational risk;

That Article 3 of Agreement No. 11-2018 defines operational risk as the possibility of incurring losses due to deficiencies, failures, or inadequacies of human resources, processes, technology, infrastructure, management information, models used, or by the occurrence of external events. This definition includes the legal risk associated with such factors; but excludes losses from lost profits, reputational risk, and strategic risk;

That given the possibility of sending an electronic fund transfer to an undesired beneficiary or one that does not correspond, as a result of errors or fraud, it is necessary to implement solid detection and prevention measures that allow increasing customer confidence in the service of sending and receiving transfers, and guaranteeing its use;

That the treatment of the names and identifiers of the beneficiary of the electronic fund transfer would comprise a proportional and necessary measure to avoid fraudulent operations and detect errors, which would offer the orderor customer of the transfer greater protection for the transactions they carry out through electronic channels by being able to verify the necessary information of the beneficiary before authorizing the transfer, since the orderor might not be able to recover the funds once credited to the beneficiary's account;

That in a working session of this Superintendency, the need and convenience of establishing guidelines that allow adequate and effective control of electronic fund transfers has been manifested, in order to reduce the risk of possible scams and errors in transfers.

AGREES:

ARTICLE 1. OBJECT AND SCOPE. This Agreement aims to establish the control measures that banking entities, both in their capacity as orderor bank and as beneficiary bank, must apply in electronic fund transfer operations, which allow mitigating errors and risks associated with said operation.

The guidelines established in this Agreement will be applicable to electronic fund transfers, when both the orderor bank and the beneficiary bank are located within national territory, whether in operations carried out between clients of the same bank or between clients of different banks in the market.

ARTICLE 2. SCOPE OF APPLICATION. The provisions of this Agreement will apply to Official Banks and General License Banks that provide the service of electronic fund transfer through electronic channels such as online banking, mobile banking, and payments or mobile wallets.

ARTICLE 3. VERIFICATION OF TRANSFER DATA. Banking entities must ensure that they maintain the information on the orderor and beneficiary required by applicable banking regulations for electronic fund transfers.

Likewise, they must implement due diligence processes and validation mechanisms that allow verifying that every electronic fund transfer order between banks in the market (sent and received) is executed in compliance with said regulatory requirements.

During the course of the transfer, banking entities must verify that the data of the orderor and the beneficiary, as well as the bank account numbers or the alias defined by the bank (the cell phone number, email address, user number, or others) recorded in the electronic fund transfer order, correspond to the information registered in the orderor bank and the beneficiary bank, respectively.

The consultation and presentation of the beneficiary's name must be allowed only within a duly authenticated banking session and as part of an active transfer to be initiated by the orderor.

ARTICLE 4. VERIFICATION AND PREVALIDATION OF BENEFICIARY DATA. Banking entities must have systems in their electronic channels that show the orderor customer, free of charge, that the beneficiary's account is enabled to receive funds. Likewise, said systems must show in a visible and understandable manner that the beneficiary's name corresponds to the account holder or the alias defined by the bank (the cell phone number, email address, user number, or others) in which the funds will be credited.

The verification of the account and confirmation of the beneficiary's data must be carried out immediately within the transactional flow after the orderor provides the relevant information about the beneficiary (account number or the alias defined by the bank such as the cell phone number, email address, user number, or others) and before authorizing the sending of the transfer.

Once the validated information is displayed, it will be up to the orderor customer to decide whether or not to execute the electronic fund transfer.

Likewise, banks must keep records and traceable and integral evidence that allows auditing the queries made, the responses received, the warnings shown to the customer, and the final authorization of the electronic fund transfer. Both entities must maintain security controls to guarantee the integrity, confidentiality, and availability of data in case of audit.

ARTICLE 5. MINIMUM TRANSFER DATA. Before the orderor authorizes the electronic fund transfer, the orderor bank must show the following minimum data for verification:

1. Name of the bank and account number where the funds will be credited, only for those cases where the orderor requests account-to-account transfer or the alias defined by the bank (the cell phone number, email address, user number, or others), for those cases where the orderor requests the transfer using this data;
2. Account holder in which the funds will be credited;
3. Amount of the transfer.

The information indicated above must be presented in a clear, visible, and understandable manner in the electronic channels enabled for the operation. Exclusively the personal data revealed by virtue of this Agreement may be used for the verification, execution, control, and audit of electronic fund transfers, their use for different or incompatible purposes being prohibited.

ARTICLE 6. CONTROL MEASURES FOR TRANSFERS. For adequate management of risks associated with electronic fund transfers and the prevention of the improper use of banking services offered through said channels, banking entities must have control systems that allow detecting any transfer order that does not meet the requirements indicated in this regulation.

When, in an electronic fund transfer order, the data of the beneficiary's name and the bank account numbers or the alias defined by the bank (the cell phone number, email address, user number, or others) provided by the orderor customer do not match the registered information of the beneficiary, the orderor bank must warn in a clear, prior, and visible manner to the orderor customer that the authorization of the transfer could result in the sending of funds to an account whose holder does not correspond to the indicated beneficiary. In these cases, the final decision to authorize or not the electronic fund transfer will correspond to the orderor customer, once the respective warning has been received, without prejudice to the responsibilities that may correspond to the banking entity for failures in its controls, processes, systems, or warning mechanisms.

The orderor bank must process electronic fund transfers in compliance with the guidelines established in this Agreement and other banking regulations.

ARTICLE 7. This Agreement will enter into force within a period of nine (9) months, counted from its promulgation.

Given in the City of Panama, on the twenty-second (22) day of the month of September of two thousand twenty-six (2026).

NOTIFY, PUBLISH, AND COMPLY.

THE PRESIDENT, THE SECRETARY,
Felipe Echandi Lacayo David Alberto Davarro