## 1panea2024003

## Source details

**Canonical URL:** [1panea2024003](https://www.imf.org/-/media/files/publications/cr/2024/english/1panea2024003.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2024/english/1panea2024003.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2024/english/1panea2024003.pdf.json)

---

### Introduction and assessment scope
- Assessment conducted in Panama City, Panama, from January 17 – February 6, 2023, as part of the Financial Sector Assessment Program (FSAP) by the IMF and the World Bank.
- Compliance measured against Basel Committee on Banking Supervision (BCBS) standards issued in 2012.
- Assessment based on legal and documentary evidence, review of supervisory work, and implementation; only "essential" criteria (ECs) are described and graded.

### Institutional and market structure — mandate, organization, and market size
- SBP mandate and powers:
  - SBP has exclusive authority to “regulate and supervise the banks, the banking business and other entities and activities assigned” (Article 4, Banking Law).
  - Corrective Action provisions and liquidation powers set out in Banking Law, Chapter 1, Title 111; Chapters 15-18, Articles 124-183.
  - SBP is the de facto resolution authority for banks in Panama.
- Organizational roles:
  - Macroprudential supervision: highest level within SBP with input from Division of Financial Studies and Division of Risk Management; Division of Regulation drafts rules.
  - Microprudential supervision: Division of Supervision with support from Specialized Divisions of Risk Management and Prevention and Control of Illicit Operations.
  - Risk-based supervisory methodology documented in “Manual Unico Supervision Basada en Riesgos” (MUSBER), adopted in 2012.
- Market metrics and structure:
  - Financial sector contribution: around 6.5 percent to GDP, on average, each year.
  - Total assets of the banking system: USD137.3 billion (191 percent of GDP) as of end-June 2022.
  - Bank counts and licenses:
    - 56 banks total; 42 general license banks; 14 international license banks.
    - Elsewhere in source: 57 banks regulated and supervised by the SBP; SBP supervises 2 State Banks, 40 General License banks and 15 International License banks; in addition, 2 banks under voluntary liquidation and 4 banks under compulsory liquidation.
  - Ownership and systemic importance:
    - Largest five general license banks account for half of all general license bank assets.
    - Ten Domestically Systemically Important Banks (D-SIBs).
    - Ownership: two state-owned, 13 Panamanian, and 27 foreign-owned banks.
  - Offshore banking:
    - International license banks hold 16 percent of banking sector assets and 14 percent of deposits.
  - Funding composition (general license banks):
    - 70 percent deposits; 16 percent securities issuance; 10 percent shareholder capital; 3 percent other liabilities.
    - Share of local deposits increased from 60 percent in 2013 to 72 percent.

### Key supervisory strengths
- Regulatory and supervisory implementation:
  - SBP implemented Basel III and IFRS; all banks apply IFRS.
  - Comprehensive regulations on corporate governance, risk management, credit risk, operational risk and liquidity risk.
  - Structured risk-based supervision (GREN-P / SER) supported by IT system (ITBANK) and early warning system (SIAT).
  - SBP collects and analyzes a wide range of prudential reports on solo and consolidated basis; publishes granular performance data including individual bank data.
- Supervisory cooperation and AML/CFT:
  - SBP routinely liaises with Financial Analysis Unit (UAF); MoUs with 29 overseas regulators; participation in CCSBSO and supervisory colleges.
  - SBP has specialist AML/CFT supervisory resources; AML/CFT prioritized following FATF grey listing.

### Major gaps, risks and supervisory deficiencies
- Objectives and potential conflict:
  - Banking Law sets four objectives; potential conflict between safeguarding soundness and fostering development of Panama as an international financial sector.
  - Assessment: Recommendation that SBP’s primary objective should be to safeguard the soundness of the financial system, with remaining objectives subordinate.
- Independence and resourcing:
  - Legal independence prescribed (Article 4) but constrained by successive Budget Laws since 2019 requiring pre-approval for recruitment and personnel decisions; prior to 2019 SBP only had to notify MEF.
  - Vacancies at SBP: 96 vacancies at an all-time high; 18 percent of positions assigned (230) to technical areas remain vacant; turnover for on-site supervision staff 5.03 percent.
  - Assessment of Principle 2: Materially non-compliant.
- Notifications, ownership transfers, and acquisitions:
  - Pre-approval required for transfers of ownership of 25 percent or more of capital; no legal requirement to notify SBP of acquisitions/investments below 25 percent of capital.
  - SBP has no explicit power to reverse a share transaction or remove voting rights if significant ownership is acquired without prior approval or based on misleading information.
  - Assessment of Principle 6 and Principle 7: Materially non-compliant.
- Forward-looking supervision, stress testing and ICAAP/ILAAP:
  - Supervisory framework effective at identifying risks at assessment time but insufficiently forward-looking.
  - Banks required to undertake periodic stress testing of capital adequacy but not systematically integrated into supervision.
  - SBP drafted ICAAP framework; no timetable for implementation. No regulatory requirement for comprehensive stress testing across all risks linking capital and liquidity.
  - Recommendation: Implement ICAAP and ILAAP; systematically integrate bank stress testing and regular engagement with Boards and heads of key control functions.
- Prudential reporting and data gaps:
  - SBP does not collect data on:
    - consolidated liquidity positions of banking groups;
    - wider concentration risks (geographic, sectoral, currency);
    - interest rate risk in the banking book (IRRBB).
  - No regulation requiring prudential reports to be signed-off by senior management certifying accuracy.
  - Verification of data accuracy relies on on-site examinations that are periodic and not systematic.
- Liquidity regulation and consolidated LCR:
  - Liquidity rules generally comprehensive (Legal Liquidity Index and LCR); Legal Liquidity Index: 57.8 percent of short-term deposits as of end-April 2022 (regulatory minimum: 30 percent).
  - LCR is calculated and reported on a Level 1 basis only; not L2 or group-wide; material subsidiaries are omitted from LCR calculation.
  - Result: No consolidated view of group-wide liquidity; offshore operations rely on host supervisors for liquidity limits; domestic non-bank subsidiaries’ liquidity needs not captured.
  - Assessment of Principle 24: Materially non-compliant.
- Interest Rate Risk in the Banking Book (IRRBB):
  - Regulatory framework not updated to BCBS (2016); guidance in draft form.
  - SBP does not receive routine IRRBB reporting; relies on on-site examinations; draft Agreement contemplates annual stress tests but not yet enforced.
  - Assessment of Principle 23: Materially non-compliant.
- Capital framework and buffers:
  - Capital definitions align with Basel III; minimum capital adequacy ratio 8 percent; primary capital (equity) no less than 4 percent of total RWA.
  - CET1 and Tier definitions align; leverage ratio set at 3 percent measured against common tier 1 capital.
  - No formal buffer framework implemented (capital conservation buffer, countercyclical buffer); D-SIB systemic risk buffer not implemented.
  - Average capital adequacy ratio of the sector approximately 15 percent; internationally active banks do not meet full Basel III thresholds including buffers.
  - Assessment of Principle 16: Materially non-compliant.
- Resolution framework and financial safety net:
  - No formal resolution regime though SBP effectively undertakes resolution-like actions; draft resolution legislation submitted and under deliberation.
  - Panama lacks key safety-net pillars: no deposit insurance framework; no lender-of-last resort (LOLR) or emergency liquidity assistance (ELA); two large state-owned banks benefit from comprehensive legislated state guarantees (MEF contingent exposure).
- Corporate governance, internal audit and external audit engagement:
  - Comprehensive corporate governance regulation (Regulation 5-2011) and supervision; requirements for Board composition, committees, fit-and-proper are in place.
  - SBP lacks formal power to set scope of external audits and does not routinely meet external auditors; no power to require auditors to report directly to SBP.
  - Recommendation: more frequent, structured engagement with Heads of Internal Audit, Board Audit Committees and external auditors.
- AML/CFT supervisory notification gap:
  - No explicit requirement that banks immediately notify SBP if aware of suspicious activity that may impact safety and soundness (STR reporting flows to UAF, SBP liaises with UAF). Panama remains on FATF-ICRG grey list.
- Concentration risk and stress testing:
  - Prudential limits: single counterparty or group exposures restricted to 25 percent of total capital; material exposure defined as 10 percent of capital.
  - Framework focused on credit-related concentration; need to expand monitoring to asset classes, products, collateral, currencies; no formal requirement for stress testing concentration risks.

### Supervisory tools, on-/off-site practices and escalation
- Early remediation and enforcement:
  - SBP operates SIAT (Sistema de Alerta Temprana) to track capital, liquidity, credit, asset quality and other indicators with bank-specific triggers.
  - SBP powers include demanding increased capital, improving liquidity, ordering divestments, restructuring operations, appointing advisors, reorganizers or administrators, seizure of administrative control, and compulsory liquidation.
  - Evidence of practical use: removing Board/senior management, forcing mergers, assuming control, revoking licenses, forced liquidations in 2017 and 2019.
- On- and off-site supervision:
  - MUSBER defines planning, GREN-P rating (Governance, Risks, Economic/financial evaluation, Regulatory compliance, Prevention), SER residual risk methodology; rating 1-5, annual rating cycle between August and December.
  - On-site inspections conducted annually for D-SIBs and higher risk banks; other banks no less than once every two years.
  - Supervisory teams and staffing examples:
    - Financial Conglomerate Department: supervises 26 banking groups; 63 staff, 9 off-site analysts.
    - Bank Department: supervises 39 banks and 60 Trusts; 69 staff, 10 off-site analysts.
    - Risk Department: 23 staff, 6 vacancies.
    - Prevention Department: 86 staff, 13 vacancies.
    - Regulatory Department: 6 staff, 4 vacancies.
    - Financial Stability Department: 18 staff, 1 vacancy.
  - IT and validation: ITBANK and automated reporting; validations exist but on-site verification remains main accuracy check.
- Reporting, sanctions and penalties:
  - Article 86 and Resolution 2-2022 set reporting powers and schedules; required reports include AT21, BAN21, ADECAP, BAN16, AT7, LS03, BAN12-14, BAN03, AT03, BAN10, BAN17-18.
  - Penalties for late reporting: up to B/.500,000.00 calculated per business day with graduated bands (exact fines per day prescribed in law).
  - External experts: Article 66 allows outsourcing inspections to external auditors or specialists; SBP has not used this power to date.

### Detailed prudential and technical items (selected)
- Liquidity metrics and calibration:
  - Legal Liquidity Index: 57.8 percent of short-term deposits as of end-April 2022 (regulatory minimum: 30 percent).
  - LCR: calculated on Level 1 basis only; LCR survival horizon 30 days; LLI survival horizon 186 days.
  - HQLA inclusion: deposits with Banco Nacional de Panamá included as Level 1 asset (exception to BCBS).
  - NSFR: not implemented.
- Dynamic provisioning:
  - Components:
    - Component #1: risk-weighted assets for loans classified under normal category × Alpha coefficient 1.5 percent.
    - Component #2: quarterly positive variation in risk-weighted assets for loans in normal category × Beta coefficient 5 percent (if variation negative, amount is zero).
    - Component #3: variation in balance of specific reserves during the quarter.
    - Dynamic reserve = Components #1 + #2 − #3 (mathematical sign considered).
  - Bounds:
    - Cannot be greater than 2.5 percent of risk-weighted assets of loans in normal category.
    - Cannot be less than 1.25 percent of risk-weighted assets of loans in normal category.
  - Purpose: countercyclical buffer; not counted toward 8 percent minimum capital; applicable to all banks with loan portfolios.
- Capital requirements and composition:
  - Minimum capital adequacy index: at no time less than 8 percent of RWA; primary capital (equity) not less than 4 percent.
  - Article 11 of regulations: CET1 cannot be less than 4.5 percent of RWA; Tier 1 cannot be less than 6 percent of RWA.
  - Leverage ratio: 3 percent measured against common tier 1 capital to total exposure.
  - Sector average capital adequacy ratio: approximately 15 percent.
- Credit and asset quality:
  - NPL ratios: around 2.5 percent since moratorium ended in June 2021.
  - Loans subject to moratorium peaked at around 50 percent of loans outstanding during pandemic; declined to around 5 percent of total loans in August 2022.
  - Household lending represents about 60 percent of private sector lending; state banks account for 46 percent of total mortgage stock and offer subsidized rates.
- Market risk and trading:
  - Trading activity composition: fixed income instruments 73 percent; equity instruments 16 percent; trading derivatives 10 percent.
  - Market risk capital for system: approximately 1.7 percent RWAs; traded market risk de minimis.
- Operational and IT risk:
  - Decision No. 11-2018 for operational risk; basic indicator approach for operational risk capital.
  - Supervisory focus on IT governance, cybersecurity, outsourcing; Agreement 3-2012 and Decision No. 9-2005 govern outsourcing and IT risk.
- Reporting and disclosure timelines:
  - Banks with general or international license must submit audited financial statements within three months following fiscal year close.
  - Publish audited financial statements within 30 days after submission to SBP and display them for 90 days in public location.
  - Consolidated financial statements publication: within seven (7) business days of submission to SBP.
  - Annual report by bank holding group’s board: within one hundred and twenty (120) calendar days after fiscal year closure.
  - Audit firm rotation: five-year firm rotation; partners and managers rotated on a three-year period.
  - Record retention for CDD: at least five-year retention period.

### Grading highlights (as assessed in source)
- Principle 1 (Responsibilities, Objectives, Powers, Independence): Materially non-compliant.
- Principle 2 (Independence, resources, legal protection): Materially non-compliant.
- Principle 3 (Cooperation and collaboration): Compliant.
- Principle 4 (Permissible activities): Compliant.
- Principle 5 (Licensing): Compliant.
- Principle 6 (Transfer of significant ownership): Materially non-compliant.
- Principle 7 (Major acquisitions): Materially non-compliant.
- Principle 8 (Supervisory approach): Largely Compliant.
- Principle 9 (Supervisory techniques and tools): Largely Compliant.
- Principle 10 (Supervisory reporting): Largely Compliant.
- Principle 11 (Corrective and sanctioning powers): Largely Compliant.
- Principle 12 (Consolidated supervision): Compliant.
- Principle 13 (Home-host relationships): Largely Compliant.
- Principle 14 (Corporate governance): Largely Compliant.
- Principle 15 (Risk management process): Materially non-compliant.
- Principle 16 (Capital adequacy): Materially non-compliant.
- Principle 17 (Credit risk): Compliant.
- Principle 18 (Problem assets, provisions): Compliant.
- Principle 19 (Concentration risk and large exposure): Largely Compliant.
- Principle 22 (Market risk): Compliant.
- Principle 23 (IRRBB): Materially non-compliant.
- Principle 24 (Liquidity risk): Materially non-compliant.
- Principle 25 (Operational risk): Compliant.
- Principle 26 (Internal control and audit): Compliant.
- Principle 27 (Financial reporting and external audit): Largely Compliant.
- Principle 28 (Disclosure and transparency): Largely Compliant.
- Principle 29 (Abuse of financial services / AML‑CFT): Largely Compliant.

### Priority recommendations (selected and preserved wording)
- Amend the Banking Law to make explicit that the SBP’s primary objective is to promote safety and soundness, with remaining objectives subordinate.
- Amend the current Budget Law to restore SBP’s independence on budgetary issues and ensure future Budget Laws maintain this autonomy.
- Introduce a regulation/threshold requiring immediate notification to the SBP of acquisitions or investments below the 25 percent pre-approval level; consider a notification threshold below 25 percent.
- Introduce explicit legal/regulatory power for SBP to modify, reverse or otherwise address a change of control that has taken place without necessary approval.
- Implement a timetable and roll-out for ICAAP and ILAAP; systematically integrate bank stress testing into the supervisory framework.
- Require reporting on consolidated liquidity positions, wider concentration risks (geographic, sectoral, currency), and IRRBB; require senior management certification of prudential reports.
- Expand LCR calculation to capture group-wide and Level 2 considerations and include material subsidiaries; address liquidity oversight for offshore operations and domestic non-bank subsidiaries.
- Establish formal requirements and supervisory processes for stress testing concentration risks.
- Implement a prudential valuation framework consistent with BCBS guidance.
- Finalize and formalize IRRBB guidance aligned with BCBS (2016).
- Consider introducing a formal resolution framework and deposit insurance/LOLR arrangements to strengthen the financial safety net.
- Increase structured and periodic engagement with Heads of Internal Audit, Board Audit Committees and external auditors; consider powers to define external audit scope and require auditor reporting to SBP.

### Key numeric and timing facts (verbatim)
- Assessment conducted: January 17 – February 6, 2023.
- Total assets of the banking system: USD137.3 billion (191 percent of GDP) as of end-June 2022.
- Banking counts encountered in source: 56 banks total; 42 general license banks; 14 international license banks; elsewhere cited as 57 banks regulated and supervised by the SBP; SBP supervises 2 State Banks, 40 General License banks and 15 International License banks; 2 banks under voluntary liquidation and 4 banks under compulsory liquidation.
- Legal Liquidity Index: 57.8 percent of short-term deposits as of end-April 2022 (regulatory minimum: 30 percent).
- Capital ratios: 15.8 percent at end-2022; minimum requirement 8 percent; primary capital minimum 4 percent of RWA; CET1 minimum in regulations 4.5 percent; Tier 1 minimum 6 percent.
- Dynamic provisioning parameters: Alpha 1.5 percent; Beta 5 percent; floor 1.25 percent; cap 2.5 percent of risk-weighted assets for loans in normal category.
- LCR horizon: 30 days; LLI horizon: 186 days.
- Banks required to submit audited financial statements within three months following fiscal year close.
- Publish audited financial statements within 30 days after submission to SBP; display for 90 days.
- Consolidated financial statements published within seven (7) business days of submission to SBP.
- Annual report submission by bank holding group’s board: within one hundred and twenty (120) calendar days after fiscal year closure.
- Rotation: audit firm rotation five-year basis; partners and managers rotated on a three-year period.
- Record retention period for CDD records: at least five-year retention period.
- Penalties for AML/CFT noncompliance: from five thousand balboas (B/.5,000.00) to one million balboas (B/.1,000,000.00).
- On-site inspection frequency: D-SIBs annually; other banks not less than once every two years.
- Vacancy statistic: 96 vacancies at SBP; 18 percent of positions assigned (230) to technical areas remain vacant.
- NPL ratios: around 2.5 percent since June 2021.
- Loans modified at pandemic peak: around 50 percent of loans outstanding; declined to around 5 percent of total loans in August 2022.
- Trading book composition (June 2022): Fixed income 73 percent; Equity 16 percent; Trading derivatives 10 percent.
- Market risk capital for the system: approximately 1.7 percent RWAs.

_Italic: Source: EXECUTIVE SUMMARY — Detailed Assessment Report prepared by Christopher Wilson, IMF and Alan Ball, World Bank._

### EXECUTIVE SUMMARY __________________________________________________________________________ 5

### EXECUTIVE SUMMARY

### INTRODUCTION
- Assessment conducted in Panama City, Panama, from January 17 – February 6, 2023, as part of the Financial Sector Assessment Program (FSAP) by the IMF and the World Bank.
- Compliance measured against Basel Committee on Banking Supervision (BCBS) standards issued in 2012.
- Assessment based on legal and documentary evidence, review of supervisory work, and implementation; only "essential" criteria (ECs) are described and graded.

### INSTITUTIONAL AND MARKET STRUCTURE — OVERVIEW
- SBP mandate and scope:
  - SBP has exclusive authority to “regulate and supervise the banks, the banking business and other entities and activities assigned” (Article 4, Banking Law).
  - Objectives include: “safeguard the soundness and efficiency of the banking system” and to inspect and supervise banks to confirm financial stability and compliance with the Banking Law.
  - Corrective Action provisions and liquidation powers set out in Banking Law, Chapter 1, Title 111; Chapters 15-18, Articles 124-183.
- Macroprudential and microprudential organization:
  - Macroprudential supervision conducted at the highest level within SBP with input from the Division of Financial Studies and the Division of Risk Management; Division of Regulation drafts rules.
  - Microprudential supervision led by the Division of Supervision with support from Specialized Divisions of Risk Management and Prevention and Control of Illicit Operations.
- Supervisory methodology:
  - Risk-based approach adopted in 2012, documented in the supervisory manual “Manual Unico Supervision Basada en Riesgos” (MUSBER), an internal document describing processes, procedures and methodology for supervising banks and banking groups.
- Consolidated supervision powers:
  - SBP authority to “carry out the consolidated supervision of the activities of all non-banking and non-financial entities that are affiliated or related to banking groups” (Banking Law; Article 63).
  - Powers extend to require groups, including holding companies, to take corrective actions to “address material risks to the bank(s) within the group.”

### PRECONDITIONS FOR EFFECTIVE BANKING SUPERVISION (HIGHLIGHTS)
- Progress since 2012:
  - SBP implemented Basel III and IFRS9.
  - Introduced comprehensive regulations on corporate governance and risk management.
  - Adopted structured risk-based supervision supported by a sophisticated IT system.
- Remaining gaps in legal/regulatory framework and supervisory approach noted.

### KEY FINDINGS AND SUPERVISORY GAPS
- Objectives and potential conflicts:
  - Banking Law sets four objectives for SBP; two—safeguarding soundness and fostering development of Panama as an international financial sector—have potential to conflict.
  - Recommendation: SBP’s primary objective should be to safeguard the soundness of the financial system, with the remaining three objectives subordinate to this objective.
- Autonomy and budgetary constraints:
  - Banking Law established SBP as an autonomous agency with administrative, budgetary, and financial independence.
  - Successive Budget Laws since 2019 require SBP to seek pre-approval and obtain budget verification and registration for recruitment and other HR decisions with budgetary impact; prior to 2019 SBP only had to notify the Ministry of Economy and Finance (MEF).
  - Delays in approvals contributed to high level of current vacancies in SBP.
  - Recommendation: Current Budget Law should be amended to restore SBP’s independence on budgetary issues; future Budget Laws should maintain this autonomy.
- Notifications of acquisitions and investments:
  - No legal or regulatory requirement for banks or banking groups to notify SBP of acquisitions or investments below 25 percent of their capital.
  - Banks prohibited from acquiring or owning stock/participations in non-banking ventures whose aggregate value exceeds 25 percent of their capital, but acquisitions/investments up to this limit need not be reported.
  - Impact: Lack of notification hinders SBP’s ability to assess risks from non-banking activities.
- Forward-looking supervisory framework:
  - Supervisory framework effective at identifying risks at time of assessment but places insufficient emphasis on forward-looking elements of banks’ and groups’ risk profiles.
  - Banks required to undertake periodic stress testing of capital adequacy, but this is not systematically built into the framework.
  - SBP has drafted framework for an Internal Capital Adequacy Assessment Process (ICAAP), but no timetable for implementation.
  - Recommendation: Systematic stress testing by banks and effective ICAAP roll-out; regular engagement with Board members and heads of key control functions.
- Prudential reporting and data verification:
  - SBP collects and analyzes a wide range of prudential reports on solo and consolidated basis.
  - SBP does not collect data on:
    - banks’ consolidated liquidity positions,
    - wider concentration risks (e.g., geographic, sectoral, currency),
    - interest rate risk in the banking book (IRRBB).
  - Verification: Accuracy of submitted data is verified via on-site examinations, but timing of on-site exams is periodic and not systematic.
  - No regulation requires prudential reports to be signed-off by an appropriate level of senior management certifying accuracy.
- Liquidity regulation and LCR:
  - Liquidity regulations generally comprehensive.
  - Liquidity Coverage Ratio (LCR) is calculated and reported on a Level 1 basis and not L2 or group-wide.
  - Material subsidiaries are omitted from the LCR calculation.
  - For offshore bank operations, SBP relies on host supervisor for liquidity limits and compliance.
  - Domestic non-bank subsidiaries’ liquidity needs are not captured in LCR reporting.
  - Result: No consolidated view of group-wide liquidity is achieved.
- Credit reporting and concentration risk:
  - Banks report detailed credit information (counterparty, collateral valuations, loan-to-value ratios, serviceability, vintage, loan type, region, geography).
  - SBP can analyze individual bank and sector vulnerabilities and identify credit risk build-up and outliers.
  - SBP implemented a framework for credit concentration risk and large exposure limits, but it does not apply to all material sources of concentration risk.
  - No formal requirement for stress testing concentration risks.
- Accounting, valuations, and transparency:
  - Regulations set comprehensive requirements for Board and senior management to prepare financial statements adhering to international accounting standards.
  - All banks apply IFRS.
  - SBP has not implemented a framework for prudential valuations as promulgated by the Basel Committee on Banking Supervision (BCBS).
  - SBP regularly publishes granular performance data on the banking system, including individual bank data.
- Market risk and IRRBB:
  - Regulations set minimum standards for market risk management, with Board responsibility for policies and procedures.
  - Regulatory framework has not been updated to include IRRBB; guidance for IRRBB remains in draft form, aligned with BCBS (2016), and SBP plans to formalize the draft.

### SUPERVISORY TOOLS, COOPERATION, AND AML/CFT
- On- and off-site activities:
  - SBP undertakes on- and off-site activities to test and verify compliance.
  - Off-site analysis frequent, using comprehensive suite of indicators and data points.
  - Supervisors’ analyses are detailed for large exposures and credit concentration risks.
- AML/CFT coordination:
  - SBP routinely liaises with the Financial Analysis Unit (UAF), exchanging data relevant to bank supervision.
  - Panama’s grey listing by the Financial Action Task Force (FATF) has elevated AML/CFT as a high priority for the SBP.

### MAIN SUPERVISORY THEMES (AS ORGANIZED IN THE SOURCE)
- Responsibilities, Objectives, Powers, Independence (CP 1–2)
- Supervisory Cooperation and Cross Border Supervision (CP 3, 12)
- Licensing, Changes in Control, and Acquisitions (CP 4–7)
- Supervisory Approach (CP 8–10)
- Corrective and Sanctioning Powers of Supervisors (CP 11)
- Consolidated Supervision (CP 12)
- Corporate Governance and Internal Audit (CP 14, 26)
- Risk Management Process (CP 15)
- Capital (CP 16)
- Credit Risk and Problem Assets, Provisions and Reserves (CP 17–18)
- Risk Management (CP 19–25)
- Disclosures and Transparency (CP 27–28)
- Abuse of Financial Services (CP 29)

### RECOMMENDED ACTIONS (HIGHLIGHTS)
- Amend the current Budget Law to restore SBP’s independence in budgetary matters and ensure future Budget Laws maintain this autonomy.
- Require banks and banking groups to notify SBP of acquisitions and investments below 25 percent of capital to enable assessment of risks from non-banking activities.
- Implement a timetable and roll-out for ICAAP and systematically integrate bank stress testing into supervisory framework.
- Collect data on consolidated liquidity positions, broader concentration risks (geographic, sectoral, currency), and IRRBB; require senior management certification of prudential reports.
- Expand LCR calculation to capture group-wide and L2 considerations and include material subsidiaries; address liquidity oversight for offshore operations and domestic non-bank subsidiaries.
- Establish formal requirements and supervisory processes for stress testing concentration risks.
- Implement a prudential valuation framework consistent with BCBS guidance.
- Finalize and formalize IRRBB guidance aligned with BCBS (2016).

*Source: EXECUTIVE SUMMARY — Detailed Assessment Report prepared by Christopher Wilson, IMF and Alan Ball, World Bank.*

### 9.      SBP possesses a range of supervisory enforcement tools that it can employ to address

### 9.      SBP possesses a range of supervisory enforcement tools that it can employ to address

### Supervisory enforcement powers and early remediation
- SBP powers include the ability to demand increased capital, improve liquidity, sell, or divest businesses or assets, and restructure banks’ operations.
- SBP operates an early warning system (Sistema de Alerta Temprana or SIAT) that:
  - collects a wide range of data to generate metrics tracking capital, liquidity, credit, asset quality, and other key indicators;
  - establishes trigger levels set for each bank given its business model, risk exposures, and risk management strength or weakness;
  - is employed to bring prompt attention to existing or emerging supervisory issues.
- Remediation pathway:
  - SBP seeks prompt remediation when management cannot address identified weaknesses to the SBP’s satisfaction or directives;
  - if conditions continue to deteriorate, the SBP will seek the bank’s voluntary liquidation or closure.

### AML/CFT responsibilities and international status
- SBP supervises banks’ compliance with obligations under the AML/CFT regulations and laws.
- In 2017, Panama introduced a national strategy for combating money laundering, the Financing of Terrorism and financing the proliferation of weapons of mass destruction.
- Panama is currently on the ”grey list” of FATF with pending obligations.
- Panama remains on the FATF-ICRG grey list and must address remaining action items to strengthen AML/CFT effectiveness and secure removal from the list.
  - Urgent actions include ensuring collection of and access to beneficial ownership of Panamanian legal entities, noting that "all timeframes have already expired."

### Resolution arrangements and SBP’s role
- SBP is the de facto resolution authority for banks in Panama.
- Administrative actions available to SBP (increasing levels of intervention):
  - appointment of an advisor;
  - appointment of a reorganizer or administrator to sell, reorganize or merge the bank;
  - compulsory liquidation.
- SBP prefers early identification and remediation and works to avoid compulsory liquidation.

### Ministry of Economics and Finance (MEF) role and state-owned banks
- MEF has no formal role in bank supervision or resolution under the current framework.
- MEF would be obligated to support the resolution of state-owned banks due to comprehensive, legislated state guarantees for all liabilities of the two, large state-owned banks.
- Under current framework MEF is given no formal role, authorities, or powers to effect corrective actions and resolve insolvent banks, but retains contingent exposure to provide equity and funding support for those state-owned banks.

### Scope of corrective action powers and gaps
- Corrective Action powers in the Banking Law apply only to banks, including state-owned banks.
  - SBP is the only agency granted power to exercise these corrective actions and resolution tools applicable to Panamanian banks.
  - Powers include authority to close or transfer banking establishments, authorize voluntary liquidation, order seizure of administrative control, compel reorganization, and order compulsory liquidation (Banking Law; Articles 59-60).
- Corrective action provisions extend only to banks, and not to non-bank or non-financial affiliates operating within banking groups.

### Supervision of non-bank financial entities and inter-agency coordination
- Non-bank financial entities within banking groups are supervised by sector-based regulators:
  - Insurance companies: Superintendency of Insurance and Reinsurance (SSRP or Insurance Commission).
  - Securities brokers, investment and pension funds: Superintendency of the Securities Market (SMV or Securities Commission).
- Each agency administers its own supervision, crisis management and resolution regime.
- Panama Stock Market licenses as of December 2016:
  - eighty-nine (89) current licenses for Brokerage Houses;
  - 63 classified as Independent Brokerage Houses;
  - 16 as Brokerage Houses of Securities Subsidiaries of Banks;
  - 10 as Banks with a Brokerage House License.
- Financial Coordination Council (FCC) established in 2011:
  - consists of six domestic supervisory agencies;
  - objective: strengthen information exchange and coordination on regulatory policies across supervisory agencies;
  - FCC Board chaired by the Superintendent of Banks and meets quarterly;
  - as per Article 9 of Title I of Law No. 67, FCC has power to make recommendations to its members ("soft power").

### Lack of central bank and implications
- Panama does not have its own currency or Central Bank.
- A state-owned commercial bank, the National Bank of Panama (NBP), operates some central-bank-like functions:
  - operates the payments system;
  - implements a liquidity fund that Panamanian banks can access if they experience liquidity difficulties.
- Absence of a Central Bank means Panama has relatively limited ex-post capacity to manage financial and macro stability problems.

### Market structure and size
- Financial sector contribution: around 6.5 percent to GDP, on average, each year.
- Banks represent approximately 90 percent of financial system assets.
- Total assets of the banking system: USD137.3 billion (191 percent of GDP) as of end-June 2022.
- Bank licensing and counts:
  - 56 banks total;
  - 42 general license banks;
  - 14 international license banks.
- General license banks:
  - largest five general license banks account for half of all general license bank assets;
  - ten Domestically Systemically Important Banks (D-SIBs);
  - ownership: two state-owned, 13 Panamanian, and 27 foreign-owned banks.
- International license banks:
  - funded from offshore (typically via a parent) and grant loans outside Panama;
  - hold 16 percent of banking sector assets and 14 percent of deposits.
- Business models and portfolios:
  - Household lending represents about 60 percent of private sector lending (mortgages and consumer loans);
  - Many mortgages issued by state banks = 46 percent of the total mortgage stock and are offered at subsidized rates;
  - General license banks hold more shorter-term securities and Panamanian government securities; international license banks invest in foreign government bonds and longer duration securities.

### Funding composition and trends
- General license banks’ total funding composition:
  - 70 percent deposits;
  - 16 percent securities issuance;
  - 10 percent shareholder capital;
  - 3 percent other liabilities.
- General license banks’ share of local deposits in total deposits increased from 60 percent in 2013 to 72 percent.
- International license banks are reliant on their related offshore parent for funding.

### Currency and legal tender
- Official currency: the Balboa, whose value is on a par with the United States dollar.
- US dollar circulates freely in Panama without restrictions in commercial and financial transactions.

### Capital, liquidity, profitability, and asset quality
- Bank capital ratios: 15.8 percent at end-2022, close to 8 percentage points above the minimum requirement of 8 percent.
- Legal Liquidity Index: 57.8 percent of short-term deposits as of end-April 2022 (regulatory minimum: 30 percent).
- Profitability fell during COVID-19 and remains a challenge.
- NPL ratios: remained stable at around 2.5 percent since the moratorium on servicing bank loans formally ended in June 2021.
- Loans subject to moratorium:
  - modified loans peaked at around 50 percent of loans outstanding during the height of the pandemic but have declined significantly to around 5 percent of total loans in August 2022.
  - Government introduced a mandatory period of loan forbearance inflating the percentage of loans categorized as modified.

### Preconditions for effective supervision and financial infrastructure
- Macroeconomic recovery:
  - Real GDP contracted by 17.9 percent in 2020;
  - unemployment peaked at 18.5 percent during the pandemic period.
- Financial infrastructure supports effective banking supervision in many respects:
  - accounting framework closely based on IFRS;
  - private credit bureau (Asociación Panameña de Crédito) reported to work efficiently;
  - contract and property laws modern; collateral repossession a relatively efficient process.
- Limitations: assessors were not able to make an in-depth assessment of the public infrastructure.

### Crisis management, recovery and resolution gaps
- Large and complex banking groups present unique resolution challenges due to multi-tiered holding companies, bank and non-bank subsidiaries, and non-financial affiliates.
- SBP lacks mapping of critical functions to multiple legal entities in large groups to determine which entities must be maintained during stress.
- SBP has drafted legislation to strengthen the bank resolution framework and improve compliance with international standards; the draft law has been submitted to the Minister of Economics and Finance and remains under deliberation.
  - If approved by the National Assembly, the draft framework will override the existing legal framework on bank resolution.

### Financial safety net gaps
- Panama lacks key institutional safety net pillars:
  - no deposit insurance framework;
  - no lender-of-last resort (LOLR) or emergency liquidity assistance (ELA) mechanism;
  - no other government safety net to provide financial stability.
- These gaps limit authorities’ capacity to respond to severe, systemic stress.
- State-owned banks benefit from explicit government guarantee.

### Corporate governance and accounting framework
- Corporate governance governed by Law 32 of 1927 (Corporation Law) and Panamanian Commercial Code of 1917; Decree Law 1 of 1998 (Securities Law) governs publicly traded companies.
- Panama Corporate Governance Institute (IGCP) is main local center for governance training and research; member of Latin American Corporate Governance Institutes (IGCLA).
- Accounting and auditing:
  - Law No. 57 of 1978, amended by Law 280 of 2021, authorizes Technical Board of Accounting (JTC) to set accounting and auditing standards;
  - Law No. 6 of 2005 requires application of IFRS and IFRS for SMEs since 2006;
  - listed companies and financial institutions required to use IFRS or U.S. Generally Accepted Accounting Principles (SBP Agreement No. 4 of 1999; SMV Agreement No. 8 of 2000);
  - Insurance companies required to apply IFRS as per SSRP Law No. 12 of 2012.

### Main findings (selected)
- Banking Law sets out SBP’s four objectives; two objectives (safeguarding soundness and fostering Panama as an international financial sector) may conflict. SBP’s primary objective should be to safeguard the soundness of the financial system.
- SBP independence is prescribed in law but operational independence constrained since 2019:
  - from 2019, all SBP recruitment and personnel decisions with budgetary impact require pre-approval by other state institutions;
  - prior to 2019, SBP only had to notify the MEF of recruitment and personnel expenditure;
  - delays in approval have contributed to a high level of vacancies in the SBP.
- Supervisory cooperation and cross-border supervision:
  - SBP has effective MOUs to support information sharing and coordination with domestic and foreign regulators;
  - SBP participates in multilateral college meetings under CCSBSO;
  - coordination to remediate weak banks is undertaken through sub-Committees of the CCSBSO (Liaison and Resolution and Crisis Committees), but these meetings do not specifically consider resolution plans for distressed banks.

*Source: 1panea2024003 - 9.      SBP possesses a range of supervisory enforcement tools that it can employ to address*

### 36.      The regulatory framework requires transfers of ownership of a bank or banking group

### 36.      The regulatory framework requires transfers of ownership of a bank or banking group

### Ownership transfers and notifications
- Transfers of ownership beyond 25 percent of capital require pre-approval by the SBP.
- Transfers of shares below the 25 percent threshold must be notified to the SBP.
- Identified weaknesses:
  - No requirement in law or regulation to notify the SBP of acquisitions or investments below 25 percent of capital.
  - No SBP power to reverse a share transaction or remove voting rights if a transfer of significant ownership is undertaken without prior approval or based on misleading information.
  - Lack of notification hinders SBP’s ability to assess risks from acquisitions of non-banking activities.
- Recommendations:
  - Introduce a threshold above which notifications are required and specify that such notifications should be immediate.
  - Set a threshold for acquisitions or investments above a percentage of a bank’s capital that require immediate notification to the SBP.

### Supervisory approach (CP 8–10)
- Strengths:
  - Effective methodology for assessing risks at the time of assessment.
  - Strategic plans reviewed during planning phase and discussed with senior management during on-site inspections.
  - Effective range of examination techniques and risk-based examination programs (full scope inspections to targeted reviews).
- Gaps:
  - Greater emphasis needed on forward-looking risks in the methodology.
  - Regular engagement with Board members and heads of key control functions is not built into the supervisory framework.
  - Internal management reports are not submitted systematically.
  - Stress testing of capital projections is required periodically by SBP but not systematically built into the supervisory framework.
  - SBP has drafted the framework for an Internal Capital Adequacy Assessment Process (ICAAP) but has not set an implementation deadline.
- Recommendation:
  - Incorporate ICAAP implementation proposals into the SBP’s strategic plan.

### Supervisory tools, reporting, and data verification
- SBP collects and analyzes a wide range of prudential reports on a solo and consolidated basis.
- Missing elements in reporting:
  - Consolidated liquidity returns.
  - Wider concentration risks (geographic, sectoral, currency).
  - Exposure to interest rate risk in the banking book.
- Verification practices:
  - Accuracy of data in reports is verified through on-site examinations.
  - Timing of on-site verifications is periodic and not systematic.
  - No regulation requiring prudential reports to be signed off by appropriate senior management certifying accuracy.
- Recommendation:
  - Require immediate notification and senior management certification for specified reports; expand scope to include consolidated liquidity and concentration metrics.

### Corrective and sanctioning powers (CP 11)
- SBP lacks a formal resolution regime.
- SBP demonstrated supervisory tools in practice, including:
  - Dismissing Board and senior management.
  - Forcing mergers.
  - Assuming control of a distressed bank.
  - Revoking banking licenses.
- Gap:
  - No specific power to ringfence a bank from actions of wider group entities which may impair safety and soundness.
- Recommendation:
  - Address gap by providing ringfencing powers in the regulatory toolbox.

### Consolidated supervision (CP 12)
- Legal and regulatory framework for consolidated supervision is robust.
- SBP has a good understanding of banking group structures and material activities (including non-banking), domestic and cross-border.
- Gap:
  - SBP does not collect data on consolidated liquidity positions of entities within banking groups.

### Corporate governance and internal audit (CP 14, 26)
- SBP has comprehensive corporate governance regulation and monitors compliance effectively via on- and off-site approaches.
- Supervisory assessment covers Board and senior management recruitment, responsibilities, compensation, effectiveness of risk and internal control functions, and organizational structure.
- Regulations require appropriate control environment and audit arrangements; governance arrangements for audit committees are in place.
- SBP’s on-site examinations provide opportunities to assess compliance, line 2 and Internal Audit (line 3).
- Gap:
  - Need for more frequent and structured engagements with Head of Internal Audit and Board Audit Committee to monitor findings and internal audit plans.

### Risk management process (CP 15)
- Regulations require banks to implement comprehensive risk management frameworks; SBP conducts annual on-site examinations for D-SIBs and higher risk banks; others assessed according to GREN-P rating methodology but not less than once every two years.
- Supervisory manual provides guidance and banks complete self-assessments ahead of on-site inspections.
- Regulatory gaps:
  - No regulation requiring a comprehensive approach to stress testing where all risks are considered against capital and liquidity.
  - No regulation requiring banks to undertake recovery planning.
  - No explicit provision requiring a bank to notify the SBP if the CRO is removed.
- ICAAP:
  - ICAAP can improve structured assessment of all material risks including stress testing results.
  - SBP plans near-term implementation of ICAAP.
- Supervisory practice gap:
  - Lack of routine contact with the Board to assess its role in implementing risk management frameworks.
- Recommendation:
  - Implement ICAAP and ILAAP to structure assessment of all material risks and strengthen Board engagement.

### Capital (CP 16)
- Capital framework largely aligned with Basel III; internationally active banks do not meet Basel III standards.
- Equivalence:
  - Definitions of capital, thresholds, calibration of risk-weighted assets and deductions are equivalent to Basel standards.
- Enhancements:
  - SBP implemented D-SIB supervision framework; systemic risk buffer has not been implemented.
  - No formal buffer framework implemented (e.g., capital conservation buffer, countercyclical buffer).
- Sector metric:
  - The average capital adequacy ratio of the sector is approximately 15 percent.
- Gaps:
  - Need for a formal buffer framework to standardize responses to capital deterioration.
  - Broaden assessment of capital adequacy to include a wider range of material risks, including Pillar II considerations:
    - Potential loss absorbency of instruments in the capital base.
    - Appropriateness of risk weights for exposure risk profiles.
    - Adequacy of provisions and reserves to cover expected losses.
    - Quality of risk management and controls.
- Recommendation:
  - Implement ICAAP to assess material risks annually and integrate stress testing into capital adequacy assessments.

### Credit risk, problem assets, provisions and reserves (CP 17–18)
- SBP has strong focus on credit risk management using frequent off-site analysis with detailed credit reporting (counterparty, collateral valuations, loan-to-value ratios, serviceability, vintage, loan type, region, geography).
- On-site examinations sample loan files for compliance verification.
- Regulations require classification of all on- and off-balance-sheet exposures using a prescribed framework; guidance for loan classification and collateral valuation is extensive.
- Reporting to supervisor is extensive and frequent.
- Supervisory emphasis on appropriate classification of loans, handling of problem assets and provisioning calculation.

### Risk management (CP 19–25) — concentration, related parties, market risk, IRRBB, liquidity, operational risk
- Concentration risk:
  - SBP implemented a framework for credit concentration risk and performs extensive analysis.
  - Prudential limits: exposures to single counterparties or groups of connected counterparties restricted to 25 percent of total capital.
  - Need to expand monitoring to other concentration sources (asset classes, products, collateral, currencies).
  - No formal requirement for stress testing concentration risks.
- Related party exposures:
  - SBP receives comprehensive reporting; banks must identify related party exposures; Banking Law caps related party exposures at 25 percent of total capital.
  - Gaps in regulation:
    - Requirement for material related party exposures to be monitored and reported to the Board.
    - Expansion of definition of exposures beyond credit-related (e.g., service contracts).
    - Need for Board approval to write-off.
    - Notification to the SBP when a material related party exposure has been entered into.
- Market risk:
  - Minimum standards set; Board responsible for policies and procedures; common tools include concentration limits, loss limits, VaR, sensitivities to interest rate movements.
  - Market risk exposure is de minimis relative to trading income and market risk weighted assets.
- Interest Rate Risk in the Banking Book (IRRBB):
  - Regulatory framework not updated; guidance remains in draft form aligned with BCBS frameworks (2016).
  - Issues: reliance on on-site examinations, inadequate off-site reporting for ongoing surveillance of risks to NII and capital, no specific stress testing requirements.
- Liquidity:
  - Liquidity regulations generally comprehensive for risk management; banks must maintain funding plans, stress tests, contingency funding plans.
  - LCR is calculated and reported on a Level 1 basis and not Level 2 or group-wide, omitting material subsidiaries from calculation.
  - Offshore operations: SBP relies on host supervisors for liquidity limits; domestic non-bank subsidiaries’ liquidity needs are not captured in LCR reporting.
- Operational risk:
  - Comprehensive regulations require governance elements, board responsibility for risk appetite and KRIs, capital calculated using the basic indicator approach, loss data collection included in risk measurement.
  - Contingency planning responsibilities are clearly described.

### Disclosures and transparency (CP 27–28)
- All banks apply IFRS.
- SBP has not implemented a framework for prudential valuations as promulgated by BCBS.
- Regulations place Board and senior management responsibility for preparing financial statements under international accounting standards.
- Gaps:
  - SBP lacks power to establish scope of external audits; external auditors meet SBP only by exception.
  - Opportunity for more frequent and periodic engagement with external auditors on audit scope, main findings, vulnerabilities, and internal control soundness.
  - SBP has not formally adopted Pillar III; public disclosure requirements exist but do not require full qualitative and quantitative information specific to a bank.
  - No direct guidance to banks on disclosures for remuneration or additional disclosures for systemically important banks.
- Recommendation:
  - Implement Pillar III framework to strengthen public disclosures and engage external auditors more systematically.

### Abuse of financial services (CP 29)
- SBP is responsible for supervision of banks’ compliance with AML/CFT risk management standards and undertakes on- and off-site verifications.
- SBP liaises with UAF exchanging data relevant to bank supervision; Panama’s FATF grey listing has prioritized ML/TF risk.
- Data shared on STR reporting is extensive and frequent; cooperation between SBP and UAF is strong.
- Gap:
  - Notification requirements should be strengthened to require banks to inform the SBP immediately if they become aware of suspicious activity that may impact safety and soundness.

*Source: 1panea2024003 - 36.      The regulatory framework requires transfers of ownership of a bank or banking group*

### 1. To safeguard the soundness and efficiency of the banking system;

### 1. To safeguard the soundness and efficiency of the banking system;

### Objectives and institutional scope
- SBP objectives (as set out in the Banking Law):
  - To safeguard the soundness and efficiency of the banking system;
  - To strengthen and foster favorable conditions for the development of the Republic of Panama as an international financial center;
  - To promote public trust in the banking system; and
  - To safeguard the judicial balance between the banking system and its clients.
- Banking sector composition (as noted in the source):
  - 57 banks regulated and supervised by the SBP;
  - 171 cooperative enterprises supervised by IPACO-OP;
  - SBP supervises 2 State Banks, 40 General License banks and 15 International License banks;
  - In addition, 2 banks under voluntary liquidation and 4 banks under compulsory liquidation.

### Cooperation with cooperatives
- Cooperatives are deposit-taking organizations controlled by their members and represent a small proportion of the overall banking sector.
- There is regular and effective liaison between SBP and IPACO-OP but no formal Memorandum of Understanding (MoU).
- Recommendation:
  - SBP should consider establishing a bilateral MoU agreement with IPACO-OP to formalize existing co-ordination and data-sharing arrangements.

### EC2 — Primary objective of supervision: description and findings
- Legal position:
  - SBP has four separate objectives in the Banking Law; the safety and soundness objective is considered primary in practice but is not explicit in the Banking Law.
- Risk of conflict:
  - Potential conflict exists between the objective to safeguard soundness and efficiency and the objective to strengthen Panama as an international financial center.
  - The objectives to promote trust in the banking system and safeguard judicial balance do not pose a potential conflict with safety and soundness.
- Recommendation:
  - Amend the Banking Law to make explicit that the SBP’s primary objective is to promote safety and soundness, with the remaining three objectives subordinate to that primary objective.

### EC3 — Legal framework for prudential standards: description and findings
- Legal powers and provisions:
  - Article 6(2) provides SBP power to ‘develop the regulatory framework for the banking system’.
  - Article 11(10) provides SBP power to issue necessary technical standards to comply with the Banking Law.
  - Article 70: minimum capital adequacy ratio of 8 percent; primary capital (equity) of no less than 4 percent of total risk weighted assets; SBP may require a higher capital adequacy rate when advisable given a bank’s risk profile.
  - Article 75: SBP may set and adjust percentage of liquid assets a bank should hold.
  - Article 11 delegates to the Directors of the SBP the power “to approve general standards for the identification, regulation, and consolidated supervision of banks and banking groups.”
- Supervisory discretion:
  - Supervisor has power to increase prudential requirements for individual banks and banking groups based on their risk profile and systemic importance.

### EC4 — Updating regulations and public consultation: description and findings
- SBP practice:
  - SBP updates prudential and other standards regularly; all revisions to Rules, Regulations, Circulars, and other supervisory requirements are disclosed on the SBP’s website.
  - Example output in 2022: 13 new Rules and 86 Circulars were issued in 2022.
  - SBP consults on all material changes, specifically with the Bankers’ Association and more widely with the public by posting consultation documents on its website.
  - SBP engages early with the Bankers’ Association on major proposals to understand implementation challenges.
- Concern:
  - Timelines for responses to routine changes are short (usually one month).
- Recommendation:
  - Review approach to consultation against international practice to ensure meaningful engagement with stakeholders and that respondents are given sufficient time to prepare responses.

### EC5 — Access and consolidated supervision: description and findings
- SBP powers:
  - (a) Access to documents and reports: Article 86 provides power to request documents and reports on activities and operations from any regulated bank or firm in the banking group, including parent companies and affiliates.
    - No explicit legislation for access to Board, management, and staff, but such meetings occur regularly and the power is implicit in Articles 59 and 66 (power to conduct inspections).
  - (b) Consolidated supervision of banking groups (domestic and cross-border): Article 61 provides this power.
  - (c) Supervision of foreign banks, their subsidiaries and branches: Article 62 provides this power.

### EC6 — Corrective powers, sanctions, and resolution cooperation: description and findings
- Powers to require corrective action:
  - Paragraph 18 of Article 16: power to issue regulations to mitigate or correct weaknesses that may threaten depositors’ interests, the stability of a bank or of the banking system.
  - Articles 124-130: power to appoint an independent advisor if deterioration or weakness exists or may arise.
- Sanctions:
  - Articles 184-190: sanctions range from fines to private or public admonition; may be applied to banks, directors, or staff.
- Revocation of license:
  - Paragraph 5 of Article 16 and Article 56 provide power to revoke a bank’s license for specified reasons, listed below:
    1. Failure to start operations within six months following the granting of a permanent license. The bank may solicit an extension of this term based on verified justifications.
    2. Ceasing in the exercise of the banking business.
    3. The intervention of the parent bank or the cancellation of its license by the home supervisor or, in the SBP’s best judgment, a lack of effective consolidated supervision by the home supervisor.
    4. Submission of false or fraudulent information or omission of information relevant to the obtainment of a license.
    5. Repeated serious violations of the provisions of this Decree Law.
    6. In all other cases provided for in this Decree Law (e.g., not maintaining the specified minimum capital requirement).
- Resolution cooperation:
  - Although Panama has no Resolution Framework, SBP has successfully cooperated with domestic and overseas regulators to effect orderly winddown and/or liquidation of banks.

### EC7 — Review of non-banking affiliates and group-wide risk: description and findings
- Article 63: SBP power to conduct consolidated supervision of activities of all non-banking and non-financial entities affiliated or related to banking groups, including holding companies.
- SBP can require measures to prevent or correct practices or conditions that might represent a material risk to banks owned by banking groups and can require necessary information to evaluate risks, management and control quality, and capital adequacy.

### Governance, independence, accountability and resourcing (selected findings)
- Legal independence:
  - Article 4 establishes SBP as an autonomous agency with its own capital and administrative, budgetary, and financial independence; SBP acts independently and is subject to oversight by the Office of the Comptroller General without interference in administrative powers.
  - SBP has exclusive power to regulate and supervise banks and related entities.
  - SBP funds are separate and independent from central government; main income sources are Banking Regulation Fees and Inspection Fees.
- Budgetary constraint and recommendation:
  - Budget Law of 2019 circumscribes SBP’s autonomy: since 2019, all recruitment and personnel decisions with budgetary impact require pre-approval by state institutions (previously only notification to MEF was required).
  - Recommendation:
    - Amend the Budget Law to restore SBP’s independence in budgetary matters, expressly providing that appointments made by the Superintendent are not subject to interference by other State authorities and are sent to the MEF for information and the Comptroller General for payroll incorporation only.
- Appointment and removal:
  - Superintendent: appointed for a term of five years, renewable once; prerequisites include Panamanian citizenship, no close relationships with Board members, relevant executive/managerial experience, no significant holdings above five percent in a regulated entity, and no bankruptcy or convictions for intentional or malicious crimes.
  - Directors: term of ten years, renewable once.
  - Removal: Superintendent and Directors may be dismissed by decision of the Supreme Court of Justice for reasons in Article 18, limited to:
    1. Permanent inability to discharge duties;
    2. Declaration of bankruptcy, involvement in insolvency proceedings or being in a manifest state of insolvency;
    3. Failure to comply with prerequisites for appointment;
    4. Lack of integrity in duty discharge;
    5. Repeated and unjustified absence from Board meetings;
    6. Failure to comply with obligations and prohibitions imposed by the Banking Law.
  - Historical note: last two Superintendents fulfilled five-year mandates in full (2009-2015 and 2015-2020); current Superintendent in situ since January 2021.
  - The Banking Law does not require public disclosure of removal reasons, but removal decisions by the Supreme Court would be in the public domain.
- Accountability and transparency:
  - SBP’s objectives are stated in Article 5 and the SBP’s strategic plan for 2020-2024 is published on its website.
  - Annually SBP presents results and its regulatory roadmap to the International Banking Center (CBI).
  - Article 26 of Law 6 – 2002 requires annual reporting materials from public institutions to the Legislative Body.

### Assessment of Principle 1 and key recommendations
- Assessment of Principle 1: Materially non-compliant.
- Summary findings:
  - Legal framework provides SBP with necessary legal powers to authorize banks, conduct supervision, address compliance, and undertake timely corrective actions.
  - Banking Law gives equal status to four objectives, creating potential conflict between safeguarding soundness and fostering international financial center development.
  - Consultation timelines are short (usually one month), limiting meaningful stakeholder engagement.
- Recommendations (consolidated):
  - Amend the Banking Law to make explicit that the SBP’s primary objective should be to promote safety and soundness, with remaining objectives subordinate.
  - Establish a bilateral agreement between the SBP and IPACO-OP to formalize co-ordination and data-sharing arrangements.
  - Review the current approach to consultation against international practice to ensure meaningful stakeholder engagement and sufficient time for responses.
  - Amend the Budget Law to restore SBP’s independence of action in respect of budgetary issues, including explicit protections for appointments made by the Superintendent.

*Source: Panama — Detailed Assessment of Compliance with the Basel Core Principles (excerpt).*

### 1. The number of information requests submitted to the institution.

### 1. The number of information requests submitted to the institution.

### EC4 — Governance and decision-making
- The SBP has a structured approach to decision-making on banking supervisory matters, with internal committees chaired at the appropriate level.
- Committee composition is set out in the MUSBER.
- Regulation 27-2022 sets out the rules of procedure of the Board of the SBP.
- Article 2 of Regulation 27-2022 provides for the Chair of the Board to convene regular and, as necessary, special meetings of the Board.
- Article 19 of the Banking Law requires the Superintendent or a member of the Board of Directors to abstain from attending a Board meeting when a subject is to be discussed with which any member may have a conflict of interest.
- In the absence of a voluntary recusal, the Board may formally require the Superintendent to refrain from attending the meeting.

### EC5 — Staff credibility, ethics, and conflict-of-interest rules
- The SBP has a comprehensive training and career development program for supervisory staff enshrined in the Banking Law (Articles 24-37).
- The integrity and professionalism of SBP staff are affirmed in discussions with industry.
- The SBP issued a Code of Ethics for its staff (Resolution 46-2011).
  - Sections 4 and 15 of the Code cover confidentiality when dealing with information obtained in the course of working in the SBP.
  - Section 7 sets out requirements around managing potential conflicts of interest.
  - Article 25 of the Code sets out sanctions to be imposed in the event of non-compliance with the Code.

### EC6 — Resources, budget, and operational independence
- Article 4, paragraph 2 of the Banking Law states that the SBP approves its income and expenditure budget, but the SBP no longer has autonomy over recruitment or internal promotions; approval is required from the MEF.
- The annual budget for staff is set with the intention of being sufficient to recruit and retain the staff required for effective supervision, but recruitment is constrained by the need for prior MEF approval.
- Vacancies within the SBP at 96 are at an all-time high.
- The SBP’s salary scale is based on a study of several salary surveys of the financial market; the objective is to develop and retain individuals with appropriate skills.
- Vacancies remain in specialist areas such as market risk, operational risk, technological risk and cybersecurity where private-sector competition is strongest.
- Currently, 18 percent of positions assigned (230) to the technical areas of the SBP remain vacant.
- Turnover levels in general are at acceptable levels at 5.03 percent for on-site supervision staff.

*Source: 1panea2024003 - 1. The number of information requests submitted to the institution.*

### 5.58 percent for supervisors overall.

### 1panea2024003 - 5.58 percent for supervisors overall.

### Principle 2 — Independence, resources, and legal protection (EC6–EC9)
- Finding: "5.58 percent for supervisors overall."
- EC7: Resource assessment and staffing
  - The SBP conducts a thorough annual assessment of resources to identify projected needs in the short and medium term.
  - Vacancy level: "at an all -time high."
  - Budget autonomy: Article 4 of the Banking Law established SBP autonomy, but autonomy "has been significantly constrained following the passing of the Budget Law in 2019."
  - Since 2019, "all recruitment and other personnel decisions which have a budgetary impact need to be pre-approved by the MEF."
  - Effect: Delays in MEF approval have given rise to the high level of vacancies in the SBP.
- EC8: Risk-based resource allocation
  - The SBP has adopted a risk-based approach to supervision and varies timing of examinations according to risk profile and systemic importance.
- EC9: Legal protection for supervisors and staff
  - Article 21 of the Banking Law provides all SBP staff, including former staff, the right to payment of legal expenses and costs necessary for their defense when subject to legal actions arising from discharge of duties.
  - Litigation: "In the past five years, there have been 19 cases of litigation against SBP decisions, none of which was successful."
- Assessment of Principle 2: "Materially non-compliant"
- Recommendation:
  - "Amend the Budget Law to restore the SBP’s independence of action in respect of budgetary issues."

### Principle 3 — Cooperation and collaboration (EC1–EC5)
- EC1: Domestic cooperation arrangements
  - Legal basis: Paragraph 21 of Article 16 of the Banking Law empowers SBP to establish cooperation links with public institutions and domestic regulatory authorities.
  - MoUs in place with: Superintendency of Insurance and Reinsurance of Panama; National Securities Commission of Panama; Superintendence of the Securities Market of Panama (including coordinated inspections and Prevention BC/FT/FPADM-Supervision of Retirement and Pension Funds).
  - Additional agreements with: Ministry of Trade and Industry (MICI); Financial Analysis Unit (UAF); Superintendency of Non-financial Institutions; Public Prosecutor's Office; General Revenue Directorate under MEF (MEF-DGI); Government Innovation Authority.
  - Representation: SBP is represented on the Financial Coordination Council (CCF), established in 2011 (Law 67), which meets every two months.
  - Gap: SBP does not have a formal MoU with the Panamanian Autonomous Cooperative Institute (IPACO-OP).
  - Assessors found collaboration and communication effective in practice.
- EC2: Cooperation with foreign supervisors
  - SBP has Agreements or MoUs with foreign supervisors of all overseas banks operating in Panama and countries where Panamanian banks operate.
  - Evidence of participation in Colleges of Supervisors and cross-border inspections.
  - SBP is party to the "Multilateral Memorandum of Exchange of Information and Mutual Cooperation for consolidated and cross-border supervision among the members of the Council of Superintendents of Banks, of Insurance and other financial institutions" (CCSBSO MOU) covering eight Latin American countries with a ninth in process.
  - CCSBSO MOU supports monthly Technical Liaison Committee (TLC) meetings and regular exchange of prudential information.
- EC3–EC4: Confidentiality safeguards
  - MoUs include clauses to ensure confidential information used only for bank-specific purposes.
  - Article 110 of the Banking Law: information related to individual clients "shall be maintained under strict confidentiality and may only be revealed when required by a competent authority in the course of criminal proceedings, as required by legislation in force."
  - Practical treatment: SBP treats information shared by other regulators as strictly confidential and would not share with third parties without consent of the providing supervisor.
  - Only the latest MoU signed with Colombia explicitly contains an express clause on disclosure of confidential information received from other regulators; "The clause will be added to all other MoUs as and when they are updated."
  - In practice, no requests to disclose such confidential information to third parties have occurred; if legally compelled, SBP would notify the originating regulator.
- EC5: Support for resolution authorities
  - SBP is not legally defined as Resolution Authority but "effectively undertakes this role" under Chapters XVI–XVIII of the Banking Law which allow appointment of administrator, receiver, or liquidator in event of failure.
  - As a formal resolution framework is established, SBP should ensure meeting standards of cooperation and collaboration for recovery and resolution planning and action.
- Assessment of Principle 3: "Compliant"
- Recommendation:
  - "Update existing MOUs with clause that covers the issue of disclosure of confidential information received from other regulators"

### Principle 4 — Permissible activities (EC1–EC5)
- EC1: Definition of "bank"
  - Paragraph 4 of Article 3 of the Banking Law defines ‘bank’ as any person engaged in the banking business or acting as a representative office. ‘Banking business’ is defined in paragraph 30 of Article 3.
- EC2: Permissible activities defined
  - Article 2: Only persons with a license from the SBP may undertake ‘banking business’.
  - Paragraph 30 of Article 3 defines banking business as "principally, the receipt of resources from the public or from financial institutions by means of the acceptance of time deposits or by any other means determined by the SBP or by banking practices, and the use of such resources for the bank’s benefit and at its own risk, to grant loans, make investments or for any other transaction authorized by the SBP."
- EC3: Use of the word "bank" controlled
  - Article 44: Only banks with a license may use "Bank" or derivatives in any language in names, corporate or commercial denominations, letterheads, advertising, etc.
  - Exceptions: humanitarian/charitable institutions, governmental entities financing social interest sectors, and multilateral/international organizations recognized by Panama.
  - SBP may exceptionally authorize non-banks to use "bank" in a name if it does not create confusion; "There have been no such cases to date."
- EC4: Deposit-taking reserved to licensed banks
  - Article 2 and Article 45 empower SBP to investigate and, if necessary, close operations of unlicensed deposit-taking entities.
- EC5: Public list of licensed banks
  - A schedule of banks licensed by the SBP is published on the SBP’s website.
- Assessment of Principle 4: "Compliant"

### Principle 5 — Licensing criteria (EC1–EC11)
- EC1: Licensing authority and powers
  - SBP is the authority responsible for granting and withdrawing banking licenses (Paragraph 1(1) and 1(5) of Article 16).
  - Article 7 of Regulation 3-2001 permits prudential conditions or limitations on newly licensed banks; SBP sets higher capital requirements for new banks in practice.
  - SBP conducts a formal inspection of newly licensed banks after six months.
- EC2: Legal criteria and grounds for refusal or revocation
  - Article 48 sets criteria for approval/refusal: identity, probity, experience of principal shareholders; capacity to contribute minimum capital; viability of business plan; corporate governance policies; and other criteria SBP deems relevant.
  - Article 56 lists causes for license cancellation including failure to commence operations within six months, ceasing banking business, intervention by parent overseas regulator, submission of false information, repeated serious violations, or other causes determined by SBP.
  - Licensing procedure steps include pre-application meeting with Superintendent, public notice, 15 calendar day window for opposition after publication, Analysis Committee and Evaluation Committee review, temporary permit validity "90 days, extendable," and pre-operational inspection coordination.
  - Market activity: "There have been no applications for new commercial banks in the past five years, but three applications for foreign banks have been approved. No applications have been denied."
- EC3: Consistency between licensing and ongoing supervision
  - Criteria for issuing licenses are the same as those applied in ongoing supervision.
- EC4: Assessment of structures for supervision
  - Article 27 of Regulation 7-2014 requires evaluation of banking group and economic group structure to determine impediments to consolidated supervision; license not granted unless impediments corrected.
  - Practical assessments include corporate governance, feasibility studies, management manuals, and internal control structures.
- EC5: Suitability of shareholders and UBOs
  - Article 48 and Section 9(c) of Regulation 3-2001 require detailed documentation on identity, residence, nationality, occupation, and participation percentage; assessment pursues ultimate beneficial owners, including looking behind trustees in Foundations.
- EC6: Minimum initial capital
  - Article 68 sets minimum paid-up share capital:
    - General license: USD 10 million
    - International License: USD 3 million of which, USD 2.5 million will be held as collateral in any of the official banks.
    - Representation License: no minimum capital requirement.
- EC7: Fit and proper assessment of Board and senior management
  - Regulation 3-2001 requires directors, officials and main stockholders to possess "a renowned moral and financial solvency."
  - License denied if any Board or senior management:
    - (a) Has been convicted of specified crimes (money laundering, illicit traffic of drugs, fraud, illegal traffic of arms or persons, kidnapping, extortion, embezzlement, corruption of public servants, acts of terrorism, international traffic of vehicles, or of any crime against property or legal authority).
    - (b) Is disqualified to practice commercial activities in Panama or another country.
    - (c) Has been declared bankrupt or in civil contest of creditors.
    - (d) Has been identified by the SBP as responsible for acts that lead to compulsory liquidation of the bank.
  - Article 3 expands fit and proper criteria requiring proven experience and gradual increment of financial capacity; SBP requires sufficient information to assess experience, competence, integrity and background. Assessors verified procedures followed in practice.
- EC8: Review of strategic and operating plans, governance, and controls
  - Article 4 of Regulation 3-2001 specifies corporate governance requirements for license applications, including separation of responsibilities, independent audit, compliance functions, and Board capacity for independent oversight.
  - Article 9(n) of Regulation 3-2011 requires documentation of short, medium, and long term plans and risk management manuals for all material risks; assessors verified procedures followed in practice.
- EC9: Review of pro forma financial statements and projections
  - Article 9(o) of Regulation 3-2011 requires financial projections and expected profitability for new domestic banks; Article 9(e) requires personal financial statements for directors and major shareholders.
  - For branches, Article 10(r) requires consolidated audited financial statements for last two closed fiscal years and temporary financial statements no more than sixty days old; Article 10(s) requires asset classification, maturity structure, main financial indicators, and most recent rating of the supervising authority. Assessors confirmed compliance in file reviews.
- EC10: Home supervisor no-objection and consolidated supervision
  - Article 43 requires authorization or non-objection from home supervisor for foreign banks requesting a license or representative office.
  - Article 62 requires foreign banks, branches and subsidiaries in Panama to be subject to consolidated supervision of their foreign supervisor. File reviews show procedures followed in practice.
- EC11: Monitoring progress of new entrants
  - SBP monitors progress against the bank’s plans in the first six months after license approval.
  - SBP conducts full inspections after six months and requires remedial action for identified weaknesses; evidence exists of Directors and senior management being called in to revise plans when insufficient progress made.
- Assessment of Principle 5: "Compliant"
- Comment: SBP’s licensing approach is thorough and consistent with supervision; prior consent of home supervisor is obtained when owner/parent is foreign.

### Principle 6 — Transfer of significant ownership (EC1 — beginning)
- EC1: Definition of change of control
  - Article 3 of Regulation 1-2004 "defines a change of control when, as a result of the transfer, the buyer or other linked natural or juridical person, or a group of natural or juridical persons acting in concert:" (text truncated in source content provided).

*Source: 1panea2024003 - 5.58 percent for supervisors overall.*

### 1. Become the sol  e or majority owners;  or

### 1. Become the sol  e or majority owners;  or

### Management control and definition of significant interference
- Management control occurs when the buyer or other linked or natural or juridical persons may directly or indirectly appoint the majority of the Board of Directors, members, the corporation’s President and legal representative, or the General Manager, or top executives.
- Article 4 of Regulation 1-2004 defines significant interference (control) as: “Transfers of shares of Banks and Economic Groups of which Banks are a member shall require prior authorization by the SBP whenever the acquirer or other natural or juridical persons, acting individually or in concert, obtain a Significant Interference by controlling 25 percent or more of the total shares as a result of said transfer.”

### EC2 — Requirements for supervisory approval or notification of ownership changes
- There are requirements to obtain supervisory approval or provide immediate notification of proposed changes that would result in a change in ownership, including beneficial ownership, or the exercise of voting rights over a particular threshold or change in controlling interest.
- Under Article 2 of Regulation 1-2004, transfers of shares of banks, and economic groups of which banks are a member, require the prior authorization of the SBP whenever such action causes a change in control, or there exists a concerted action causing a change in control or an acquisition of significant interference.
- Article 4 defines the threshold at which prior authorization of the SBP is required: prior approval is required whenever the acquirer or other natural or juridical persons, acting individually or in concert, obtain a significant interference by controlling 25 percent or more of the total shares.
- The SBP has approved 16 applications for changes in significant interference in the past 5 years. No application has been declined.
- There is no threshold below 25 percent above which the SBP should be notified of an acquisition of shares in a bank, although Rule 4-2021 provides that “any transfer of banks and economic groups stocks, of which banks are part, as well as any modification in stockholders’ participation in the equity of said banks, even if this does not cause a Change in Control or Significant Interference, must be notified to the SBP in advance. This notification must be made by the bank.” There was evidence cited of such notifications being received.

### EC3 — Power to reject or reverse ownership changes
- The supervisor has the power to reject any proposal for a change in significant ownership, including beneficial ownership, or controlling interest, or prevent the exercise of voting rights in respect of such investments to ensure that any change in significant ownership meets criteria comparable to those used for licensing banks. If the supervisor determines that the change in significant ownership was based on false information, the supervisor has the power to reject, modify or reverse the change in significant ownership.
- Article 14 of Regulation 1-2004 sets out the criteria that the SBP apply to reject a proposed change in significant ownership. These criteria are:
  1. The consolidated supervisor lacks the legal ability to supervise in a consolidated manner, or, if vested with such authority, has not exercised it at the time of submission of the application.
  2. The consolidated supervisor refuses to certify that it will provide all the information and cooperation necessary to carry out an effective supervision.
  3. The transaction may cause an adverse effect to banking competition in Panama that exceeds its potential positive effect to the public interest.
  4. The application is deemed incomplete after the term for submission to the Superintendency has expired.
  5. The information regarding the reputation and integrity of the applicants cannot be verified and confirmed.
  6. There is reasonable doubt concerning the reputation, integrity and experience of the applicants.
  7. There is reasonable doubt concerning the source of funds for the acquisition or transfer of shares leading to a change of control.
  8. The applicants submitted false information or documentation or omitted substantial information or documentation.
  9. There are marked weaknesses in the programs for the prevention of money laundering and prevention of financing of terrorism.
  10. The analyses and evaluations made by the SBP determine the inconvenience of the operation for the banking center.
  11. The analyses and evaluations made by the SBP determine the inconvenience of the operation for the acquired or acquiring entity.
- Article 16 (18) of the Banking Law provides the SBP with the general power to “issue regulations to avoid or correct irregularities or flaws in bank operations which, in the SBP’s judgment, may jeopardize the interests of depositors, the stability of a bank or the soundness of the banking system.” In broad terms, this power could be employed to reverse a share transaction or remove voting rights if a transfer of significant ownership were undertaken without prior approval or based on misleading information. But this has not been tested in practice as no such transfer of significant ownership without prior approval has occurred.
- The SBP would be in a stronger legal position if there were an explicit regulation which gave it the power to reverse an illegal share transfer or to remove voting rights in such a situation. As such, the SBP has no explicit power to reverse a share transaction or remove voting rights if the transaction were undertaken without prior approval or based on misleading information.

### EC4 — Information on significant shareholders and beneficial owners
- The supervisor obtains from banks, through periodic reporting or on-site examinations, the names and holdings of all significant shareholders or those that exert controlling influence, including the identities of beneficial owners of shares being held by nominees, custodians and through vehicles that might be used to disguise ownership.
- The SBP receives an annual statement from banks setting out the names and holdings of all significant shareholders and verifies these details as part of the on-site inspection process.

### EC5 — Power to address unauthorized changes of control
- The supervisor has the power to take appropriate action to modify, reverse or otherwise address a change of control that has taken place without the necessary notification to or approval from the supervisor.
- Although there has been no past incidence of a change of control that has taken place without the requisite notification or approval by the SBP, there is no specific law or regulation in place which provides the SBP with the power to modify, reverse or otherwise address such a change of control.

### EC6 — Requirement to notify supervisor of material changes in suitability
- Laws or regulations or the supervisor require banks to notify the supervisor as soon as they become aware of any material information which may negatively affect the suitability of a major shareholder or a party that has a controlling interest.
- There is no specific law or regulation which requires banks to notify the SBP immediately of any material change to the suitability of a major shareholder or a party that has a controlling interest.

### Assessment of Principle 6 and recommendations
- Assessment of Principle 6: Materially non-compliant
- Comments:
  - The definitions of significant ownership and change of control are clearly set out in the Banking Law. A threshold of 25 percent is set for pre-approval by the SBP of transfers of significant ownership or controlling interests held directly or indirectly in existing banks to other parties.
  - It is common for an additional threshold to be set (often 10 percent) above which any transfer of shares in a bank must be pre-notified to the SBP. At present, any transfer of shares in banks below the 25 percent pre-approval threshold must be notified by the bank in advance.
  - Although Article 16 (section 18) of the Banking Law provides the SBP with the general power to “issue regulations to avoid or correct irregularities or flaws in bank operations which, in its judgment, may jeopardize the interests of depositors, the stability of a bank or the soundness of the banking system”, the SBP has no specific power to reverse a share transaction or remove voting rights if a transfer of significant ownership were undertaken without prior approval or based on misleading information.
  - There is no specific law or regulation which requires banks to notify the SBP immediately of any material change to the suitability of a major shareholder or a party that has a controlling interest.
- Recommendations:
  - Introduce a regulation that provides the SBP with the power to modify, reverse or otherwise address a change of control that has taken place without the necessary approval.
  - Consider introducing a threshold below the 25 percent pre-approval level at which immediate notification to the SBP of transfers of bank ownership is required.

### Principle 7 — Major acquisitions: legal and regulatory framework
- Principle 7: The supervisor has the power to approve or reject (or recommend to the responsible authority the approval or rejection of), and impose prudential conditions on, major acquisitions or investments by a bank, against prescribed criteria, including the establishment of cross-border operations, and to determine that corporate affiliations or structures do not expose the bank to undue risks or hinder effective supervision.

### EC1 — Definition of acquisitions/investments requiring prior approval
- Laws or regulations clearly define:
  (a) what types and amounts (absolute and/or in relation to a bank’s capital) of acquisitions and investments need prior supervisory approval; and
  (b) cases for which notification after the acquisition or investment is sufficient. Such cases are primarily activities closely related to banking and where the investment is small relative to the bank’s capital.
- Description and findings re EC1:
  - (a) Article 99 of the Banking Law states that “Banks and bank holding companies are prohibited from acquiring or owning stock or participations in any other ventures not related to the banking or financial business whose aggregate value exceeds twenty-five percent of their capital funds. Investments made by the bank as trustee are excepted, as well as participations or stocks that the bank or the bank holding company has acquired in payment of obligations. In this case, they must be liquidated at the earliest opportunity in accordance with the bank’s best economic interests as judged by the SBP. The SBP may establish a timeline for this action.
  - (b) There is no requirement in law or in regulations for banks or banking groups to notify of any acquisition or investment below the pre-approval level of 25 percent of capital.

### EC2 — Criteria and process for assessing major acquisition proposals
- Laws or regulations provide criteria by which to judge individual proposals.
- Description and findings re EC2:
  - Rule 1-2004 sets out the process and criteria by which the SBP assesses applications by banks for major acquisitions. A preliminary meeting is held with representatives of the bank to discuss the proposal. The SBP undertakes a technical evaluation of the documentation provided at the preliminary meeting and decides whether to issue a preliminary opinion either to discourage or encourage the application. The preliminary opinion is without prejudice to the final decision and is issued within three working days as of the date of the preliminary meeting.
  - If the application proceeds, Article 14 of Rule 1-2004 sets out the criteria that the SBP consider when deciding whether to reject the proposal. These criteria are:
    1. The Consolidated Supervisor lacks the legal ability to supervise in a consolidated manner, or, if vested with such authority, has not exercised it at the time of submission of the application.
    2. The Consolidated Supervisor refuses to certify that it will provide all the information and cooperation necessary to carry out an effective supervision.
    3. The transaction may cause an adverse effect to banking competition in Panama that exceeds its potential positive effect to the public interest.
    4. The application is deemed incomplete after the term for submission to the Superintendency has expired.
    5. The information regarding the reputation and integrity of the applicants cannot be verified and confirmed.
    6. There is reasonable doubt concerning the reputation, integrity and experience of the applicants.
    7. There is reasonable doubt concerning the source of funds for the acquisition or transfer of shares leading to a Change of Control.
    8. The applicants submitted false information or documentation or omitted substantial information or documentation.
    9. There are marked weaknesses in the programs for the prevention of money laundering and prevention of financing of terrorism.
    10. The analyses and evaluations made by the SBP determine the inconvenience of the operation for the banking center.

*Source: 1panea2024003 - 1. Become the sol  e or majority owners;  or*

### 11. The analyses and evaluations made by the Superintendency of Banks determine

### 11. The analyses and evaluations made by the Superintendency of Banks determine

### Acquisitions and investments (EC3–EC5)
- In the past five years, the SBP has received and approved 16 applications representing a major acquisition or investment. No applications have been declined.
- The supervisor reviews file documentation and confirmed that required procedures were followed in all cases reviewed.
- Objective criteria used by the supervisor include that new acquisitions and investments:
  - do not expose the bank to undue risks;
  - do not hinder effective supervision; and
  - will not hinder effective implementation of corrective measures in the future.
- The supervisor can prohibit banks from making major acquisitions/investments (including the establishment of cross-border banking operations) in countries with laws or regulations prohibiting information flows necessary for adequate consolidated supervision.
- The SBP assesses whether it would lack the legal ability to supervise in a consolidated manner should a proposed acquisition be approved and can prohibit major overseas acquisitions if the host country refuses to certify cooperation and information necessary for effective supervision (including consolidated supervision).
- Rule 1-2004 requires submission of information in support of major acquisition proposals, including:
  - evidence of funds available and their origin;
  - evidence of the acquirer’s ability to execute the transaction; and
  - a business plan setting out development plans once the acquisition has been authorized.
- File reviews show the SBP considered financial, managerial and operational resources available to the acquirer in applications.
- There is no law or regulation requiring banks to notify the SBP of acquisitions of non-banking activities up to the pre-approval level of 25 percent of capital. Banks provide an annual notification of their organizational structure, but may acquire interests in non-banking activities up to 25 percent of their capital throughout the year without notification or prior approval.

### Assessment of Principle 7
- Rating: Materially non-compliant
- Key finding: SBP can approve or reject major acquisitions/investments above 25 percent of capital, but there is no legal or regulatory requirement to notify the SBP of acquisitions or investments below the 25 percent threshold.
- Effect: This lack of notification hinders SBP’s ability to assess risks that non-banking activities may pose to a banking group.
- Recommendation:
  - Introduce a threshold below the 25 percent pre-approval level at which immediate notification to the SBP is required after an acquisition or investment is made.

### Supervisory approach (Principle 8) — framework and forward-looking assessment
- Principle summary: Supervisor must develop and maintain a forward-looking assessment of banks’ risk profiles, identify/address system-wide risks, have early intervention framework, and plans for orderly resolution with other authorities.
- EC1 — Methodology and risk-based framework:
  - SBP adopted a risk-based approach and methodology in 2012, set out in the supervisory manual “Manual Unico Supervision Basada en Riesgos” (MUSBER).
  - MUSBER details the supervisory framework and bank rating system (GREN-P) and processes for the Risk Assessment System (SER).
  - SER matches inherent risks against quality of risk management and internal controls to derive residual risks; areas with greatest residual risk receive more rigorous scrutiny.
  - GREN-P components: Governance (G), Risks (R), Economic and financial evaluation at consolidated level (E), Regulatory compliance (N), and Prevention (P). Components are divided into subcomponents; ratings assigned 1-5 by a senior committee; composite rating derived. Rating process conducted annually between August and December for all banks.
  - Methodology does not consider resolvability of banks.
- EC2 — Forward-looking view:
  - GREN-P provides effective methodology to assess residual risks at assessment time but gives limited consideration to future risks.
  - Methodology includes review of a bank’s strategic plan in Governance (G) and discussions during on-site inspections.
  - Regular engagement with Board members and heads of key control functions is not systematically built into the supervisory framework.
  - SBP requires periodic stress of capital projections by banks but not systematically incorporated.
  - SBP has drafted, but not implemented, an Internal Capital Adequacy Assessment Process (ICAAP); implementation should be incorporated within SBP’s strategic plan.
  - Recommendation (see BCP9 EC7): introduce regular meetings with senior management (General Manager, Chief Risk Officer, Chief Financial Officer, Head of Internal Audit).
- EC3 — Compliance with prudential regulations:
  - Compliance is considered under the ‘N’ component of GREN-P; assessment combines on-site and off-site observations.
- EC4 — Macroeconomic environment and cross-sectoral developments:
  - Financial Research Directorate provides macroeconomic assessment during bank risk assessment at planning stage; macro assessment feeds into inherent risk profile.
  - SBP has active engagement with domestic and overseas regulators.
- EC5 — System-wide risk monitoring and coordination:
  - Law No. 67 of 2011 established the Financial Coordination Council (CCF), chaired by the Superintendent of Banks, to assess main risks and coordinate corrective actions among financial supervisory bodies.
  - Supervision Directorate, Financial Research, Risk Management, and Directorate for Prevention and Control of Illicit Operations monitor accumulation of risks, trends, and concentrations; this informs bank risk analysis planning.
  - SBP publishes an annual Financial Stability Report setting out financial sector performance and macro-prudential assessment.
- EC6 — Resolvability:
  - SBP does not currently have a Resolution Framework in place and does not consider resolution issues in its supervisory framework.
- EC7 — Framework for handling banks in stress:
  - Banking Law (Articles 131-183) sets out grounds and timelines for seizure of failing bank (Chapter XVI), reorganization (Chapter XVII), and compulsory liquidation (Chapter XVIII).
- EC8 — Bank-like activities outside perimeter:
  - SBP acts when entities conduct banking business without a license; has powers to examine books and order closure and fines of up to one million balboas.
  - SBP reviews organizational structure of banking groups on an ongoing basis to ensure effective consolidated supervision.
- Assessment of Principle 8:
  - Rating: Largely Compliant
  - Comment: Effective methodology for assessing residual risks but limited forward-looking consideration; limited systematic engagement with Boards and key control function heads; ICAAP drafted but not implemented.
  - Recommendations:
    - Introduce regular meetings with heads of finance and control functions into supervisory process.
    - Request regular submission of key internal management information (e.g., Internal Audit and Risk Committee reports) as part of supervisory process.

### Supervisory techniques and tools (Principle 9)
- Principle summary: Supervisor uses appropriate techniques/tools proportionate to risk profile and systemic importance.
- EC1 — Mix of on-site and off-site supervision:
  - Banking teams comprise on-site supervisors and off-site analysts.
  - Financial Conglomerate Department: supervises 26 banking groups; 63 staff, 9 off-site analysts.
  - Bank Department: supervises 39 banks and 60 Trusts; 69 staff, 10 off-site analysts.
  - There are 20 vacancies across these two teams.
  - Risk Department: 23 staff, 6 vacancies.
  - Prevention Department: 86 staff, 13 vacancies; covers AML across 392 entities.
  - Regulatory Department: 6 staff, 4 vacancies.
  - Financial Stability Department: 18 staff, 1 vacancy.
  - Budget Law requirements exacerbate recruitment difficulties (see BCP2 EC1).
  - SBP undertakes periodic reviews of on- and off-site effectiveness and updates MUSBER accordingly.
- EC2 — Planning and execution:
  - MUSBER defines on-site and off-site inspection planning and implementation.
  - On-site process: Planning Committee (Directors of Supervision, Risk Management, Legal, Prevention and Control of Illicit Operations) determines inspections, type, start date, duration, and staff.
  - Inspection planning: preliminary evaluation of bank/business, preliminary assessment of quality of risk management, and strategy and scope definition. Banks receive a letter at least 10 days before inspection detailing scope and required documentation.
  - Off-site process: three stages — monthly regulatory/prudential analysis; half-yearly update of risk profile for money laundering/terrorist financing; review of compliance with regulations. Off-site findings update the SER.
- EC3 — Information variety and reliability:
  - Regulatory reports provide broad data but SBP does not receive reported data on banking groups’ consolidated liquidity positions (see BCP 10).
  - Assessment supplemented by sectoral analysis from Financial Research and Risk Management Directorates.
  - Internal management information reviewed during on-site inspections but not routinely requested. SBP validates reliability of data during on-site inspections.
- EC4 — Tools used:
  - MUSBER covers G, R, E, N, P components; within these, business model analysis, corporate governance analysis, and financial statement reviews are conducted.
  - SBP has not issued specific guidance on stress tests banks should perform; quality of submitted tests varies by bank size.
  - Findings and GREN-P ratings communicated in writing at end of inspection or earlier if urgent; all supervisory actions subject to follow-up.
- EC5 — Identification and mitigation of emerging system-wide risks:
  - Financial Research Directorate conducts macro-financial risk analysis informing the Financial Stability Report (FSR).
  - Directorates perform sensitivity analyses of liquidity risk (deposit withdrawals, decreases in bond subscription expected to be paid within 186 days, impairment in investment values using legal liquidity as basis).
  - System-wide stress tests under baseline and adverse scenarios performed for systematically important and most vulnerable entities; results inform GREN-P ratings.
- EC6 — Internal audit evaluation:
  - SBP assesses effectiveness of internal audit via on-site inspections and annual questionnaire submitted by internal audit units; reviews manuals, reports, work plan compliance and follow-up.
- EC7 — Contacts with Board and management:
  - Superintendent and technical team meet Boards and senior management on serious concerns; meetings are ad-hoc and not systematically built into supervisory framework.
  - Meetings with Board members and heads of finance, risk, internal audit occur as part of on-site inspections but rarely outside these visits.
  - Recommendation: build regular meetings with heads of material business units, finance and control functions into supervisory plans.
- EC8 — Communication of findings:
  - Closing meeting held with senior management after on-site inspection; written Matrix of Findings and Recommendations presented to bank.
  - Meetings with Board or independent board members are not routine but held when appropriate.
- EC9 — Follow-up and escalation:
  - Banks must draw up action plans with specific deadlines to address inspection issues; regular progress reports required.
  - SBP undertakes follow-up inspections where necessary.
- EC10 — Advance notification of substantive changes:
  - Article 13 of Regulation 5-2011 requires Board to “keep the SBP informed about situations, events or problems that significantly affect or could affect the bank and the concrete actions to face and/or correct the identified deficiencies.”
  - Other regulations require notification on portfolio purchase/transfer of deposits (Regulation 2-2004), legal proceedings, and mergers and acquisitions (Regulation 1-2004).
- EC11 — Use of third parties:
  - Article 66 of the Banking Law permits SBP to carry out inspections with its own personnel or outsource to independent external auditors or specialized professionals; outsourced reports must be evaluated by qualified SBP staff.
  - SBP has not used third parties to date for supervisory activities.
- EC12 — Information systems:
  - SBP’s IT system (ITBANK) records and processes regulatory data and populates early warning indicator system identifying trends across metrics.
- Assessment of Principle 9:
  - Rating: Largely compliant
  - Comment: Effective range of techniques and tools; structured risk-based examination program; all banks inspected at least every two years; supervisory planning thorough. Shortcomings: internal management information is not requested routinely and regular meetings with heads of material units and control functions are not part of supervisory plans. Increased use of internal management information and more frequent engagement with senior management would enhance forward-looking risk assessment.

### Supervisory reporting (Principle 10) — collection, review, analysis
- Principle summary: Supervisor collects, reviews, analyzes prudential reports and statistical returns on solo and consolidated basis and independently verifies them.
- EC1 — Power to require reports and reporting schedule:
  - Article 86 of the Banking Law provides SBP power to request information from banks or banking groups; in practice applies to both solo and consolidated entities.
  - Resolution 2-2022 sets out reporting schedule.
  - Required reports on both solo and consolidated basis include:
    - balance sheet and profit and loss data (AT21 and BAN21);
    - capital adequacy (ADECAP and BAN16);
    - liquidity (AT7, and 10, LS03 and BAN12-14);
    - large exposures (BAN03);
    - asset quality and provisioning (AT03 and BAN10);
    - market risk (BAN17 and 18).
  - No reporting requirements for consolidated liquidity positions, wider concentration risk (geographic, sectoral, currency), or interest rate risk in the banking book.
- EC2 — Reporting instructions and accounting standards:
  - SBP issues detailed reporting instructions for each reporting requirement.
- EC3 — Valuation methodologies and independent validation:
  - Article 11 of Rule 3-18 requires banks to use methods technically appropriate and validated in international banking practice to identify, measure, analyze, value, monitor and mitigate positions; must include retrospective stress and worst-case scenarios.
  - SBP reviews compliance in on-site inspections through sampling and measuring valuations against Bloomberg prices.
  - Instruments are mainly vanilla with very few level three valuations.
  - Internal audit evaluates compliance with bank policies, procedures and the Rule.
- EC4 — Reporting frequency:
  - Regulation 1-2000 sets reporting schedule; reports submitted weekly, monthly, quarterly, and annually depending on information nature. Frequency considered appropriate and does not differ between Domestic Systemically Important Banks (DSIBs) and other domestic banks.
- EC5 — Comparable data for meaningful comparisons:
  - Separate reporting requirements for banks and banking groups are prepared on a consistent basis and dates.
- EC6 — Power to request information from wider group, including internal management information:
  - Article 86 extends power to request documentation and reports from any firm in the banking group, bank holding companies and non-banking affiliates, including internal management information.
- EC7 — Access to bank records and staff:
  - Article 16 provides SBP power to access all bank records for its functions.
  - While no specific power to access all staff is codified, Article 59 and practice provide full and free access to staff.
- EC8 — Enforcing timely and accurate submission:
  - Paragraph 2 of Regulation 4-2014 sets out sanctions for late reporting and permits SBP to impose sanctions at its discretion according to severity and damages caused to third parties.

*Source: PANAMA — INTERNATIONAL MONETARY FUND*

### 1. Private admonition.

### 1. Private admonition.

### Penalties for late reporting
- A fine of up to five hundred thousand balboas (B/.500,000.00), to be calculated for each business day, cumulatively, that the report is late, as follows:
  - a. A fine of one hundred fifty balboas (B/.150.00) to two hundred fifty balboas (B/.250.00) for each of the first ten (10) business days that the report is late;
  - b. A fine of two hundred fifty balboas (B/.250.00) to five hundred balboas (B/.500.00) for each of the next ten (10) business days that the report is late;
  - c. A fine of five hundred balboas (B/.500.00) to one thousand balboas (B/.1,000.00) for each of the next ten (10) business days that the report is late;
  - d. In the case of delays of over thirty (30) business days in reporting required Atoms, BAN Charts, reports and other documents, a fine of one thousand balboas (B/.1,000.00) to one thousand five hundred balboas (B/.1,500.00) for each business day exceeding the first thirty (30) business days that the report is late.
- “The Superintendent will determine the amount of the fine that will be applied according to the provisions above and according to each case.”

### Sign-off and verification of regulatory reports
- Regulations do not specify the seniority of the individual within a bank who should sign/attest to the accuracy of the reports submitted to the SBP.
- In practice, the regulatory reports are often signed by the Compliance Officer of the bank.
- Statement of best practice: Regulatory Reports should be signed off by a senior manager of the bank to verify accuracy.

### EC9 — Validation and integrity of supervisory information
- The supervisor utilizes policies and procedures to determine the validity and integrity of supervisory information. This includes a program for the periodic verification of supervisory returns by means either of the supervisor’s own staff or of external experts.
- Description and findings:
  - The SBP currently has tools that allow for the validation of information submitted by banks through the automated reporting information system, but these validations do not assure the accuracy of the data submitted.
  - On-site inspections are used periodically to evaluate the accuracy of regulatory reports submitted by a bank to the SBP, but these exercises are not systematic.
  - The SBP does not engage external experts to ensure the accuracy of regulatory reports submitted to the SBP.

### EC10 — Use and oversight of external experts
- The supervisor clearly defines and documents the roles and responsibilities of external experts, including the scope of the work, assesses suitability and quality, and considers conflicts of interest.
- Description and findings:
  - Although Article 66 of the Banking Law provides the SBP with the power to “outsource [inspections] to independent external auditors or to specialized, qualified professionals. In the latter case, the inspection reports submitted must be evaluated by qualified members of the Superintendency staff”, the SBP has not made use of this power to date.

### EC11 — Prompt reporting of material shortcomings by external experts
- The supervisor requires that external experts bring to its attention promptly any material shortcomings identified in the course of any work undertaken by them for supervisory purposes.
- Description and findings:
  - See EC10. Not applicable. The SBP does not currently engage external experts in its supervisory process.

### EC12 — Periodic review of collected information
- The supervisor has a process in place to periodically review the information collected to determine that it satisfies a supervisory need.
- Description and findings:
  - Although there is no systematic approach to reviewing the information collected by the SBP from banks, the reporting package is evaluated by supervision and technical teams on an ongoing basis to determine whether new reporting requirements or changes to existing reporting requirements are required.

### Assessment of Principle 10
- Assessment: Largely compliant
- Comments:
  - The SBP collects and analyzes a wide range of prudential reports from banks on both a solo and a consolidated basis, but they do not cover consolidated liquidity returns, the wider concentration risks that banks or banking groups may run (e.g., geographic, sectoral, currency), or a bank or banking group’s exposure to interest rate risk in the banking book.
  - Verification of the accuracy of the data within the reports submitted by banks is undertaken by supervisors through on-site examinations, but the timing of such examinations is periodic and not systematic, and there is no regulation requiring the prudential reports to be signed-off by an appropriate level of the bank’s senior management certifying their accuracy.
- Recommendations:
  - Introduce reporting requirements capturing consolidated liquidity positions
  - Introduce reporting requirements capturing wider concentration risks run by banks and banking groups (e.g., geographic, sectoral, currency)
  - Introduce reporting requirements capturing interest rate in the banking book
  - Require regulatory reports to be signed off by a senior manager of the bank to verify the accuracy of reports.

### Principle 11 — Corrective and sanctioning powers of supervisors (overview)
- Principle: The supervisor acts at an early stage to address unsafe and unsound practices or activities that could pose risks to banks or to the banking system. The supervisor has at its disposal an adequate range of supervisory tools to bring about timely corrective actions, including the ability to revoke the banking license or to recommend its revocation.

#### EC1 — Early engagement and remediation
- Description and findings:
  - The SBP identifies concerns through both off-site analysis and on-site inspections.
  - The SBP operates an early warning system (Sistema de Alerta Temprana or SIAT) that collects a wide range of data to generate various metrics that track banks’ financial conditions (e.g., capital, liquidity, credit, asset quality, and other key indicators).
  - Trigger levels are set for each bank given its business model, risk exposures, and risk management strength.
  - The SBP uses SIAT to bring prompt attention to existing or emerging supervisory issues.
  - Where management cannot address identified weaknesses to the SBP’s satisfaction, the SBP will seek prompt remediation and, if conditions continue to deteriorate, seek the bank’s voluntary liquidation or closure.
  - Findings of on-site inspections are communicated via letter to the Chairman of the Board, copied to the General Manager. The bank must draw up a plan with timely deadlines, provide quarterly updates, and be subject to follow-up inspections when required.

#### EC2 — Range of supervisory tools
- Description and findings:
  - Paragraphs 15, 16, 18 and 22 of Article 16 of the Banking Law set out supervisory tools available to the SBP, including:
    - 15. Appoint advisors, supervisors or administrators in those banks that require special attention from the SBP
    - 16. Impose the relevant sanctions for violations of the provisions contained in this Decree Law or in regulations issued thereby.
    - 18. Issue regulations to avoid or correct irregularities or flaws in bank operations which, in the SBP’s judgment, may jeopardize the interests of depositors, the stability of a bank or the soundness of the banking system.
    - 22. Evaluate the financial indicators of banks and banking groups to permit an adequate follow-up on principal banking risks such as capital adequacy, credit, liquidity, operating and market risks, and other risks that the Superintendency may consider appropriate.
  - Evidence of tools used: removing President, General Manager and Directors after identifying capital shortfall; requiring main shareholder to recapitalize; requiring capital and liquidity injections; forced liquidations in 2017 (two banks) and 2019 (one bank); requiring mergers and asset sales; raising capital and liquidity standards; stopping dividends.

#### EC3 — Power to act when banks fall below regulatory thresholds
- Description and findings:
  - See EC2 examples.
  - Chapters XV–XVIII of the Banking Law set out broad powers when a bank falls below prudential limits.
  - Article 124: power to appoint an Advisor when there exists or may exist deterioration.
  - Article 125: SBP may order or implement preventive, restrictive or limiting measures and may delegate powers to the advisor.
  - Paragraph 7 of Article 132: SBP may seize administrative and operating control if capital adequacy, solvency, or liquidity has deteriorated to require action.

#### EC4 — Broad range of early measures
- Description and findings:
  - Paragraphs 4, 9, 15, 18, and 22 of Article 16 of the Banking Law set out broad powers to take corrective action.
  - Regulations do not specify the range of supervisory tools, but evidence exists of actions up to dismissing Board and senior management, forcing mergers, assuming control of a distressed bank, and revoking a banking license.

#### EC5 — Sanctions also applied to individuals
- Description and findings:
  - Paragraph 9 of Article 16 provides the SBP power “to order the banks to remove its directors, officers or executives if, in his/her judgment, there is sufficient reason to do so.”
  - Evidence: SBP removed President, General Manager and Directors of a bank prior to requiring major shareholder capital injection.

#### EC6 — Ring-fencing powers
- Description and findings:
  - The SBP has broad powers, including:
    - Article 63: power to require banking groups, including holding companies, to take measures necessary to prevent or correct practices or conditions that might represent a material risk to banks owned by these banking groups;
    - Article 18: powers to issue regulations to avoid or correct irregularities or flaws in bank operations;
    - Article 20: power to establish cooperative agreements with foreign supervisory bodies to strengthen control mechanisms and exchange information.
  - Limitation: The above do not specifically provide the SBP with the power to ring-fence a bank from the actions of wider group entities which may impair its safety and soundness.

#### EC7 — Cooperation on resolution
- Description and findings:
  - The SBP does not have a formal resolution regime but has successfully wound down banks in the past in a timely and orderly fashion with no loss to depositor funds or contagion.
  - The SBP has cooperated with overseas regulators via the CCSBSO and bilateral/multilateral MoUs.
  - At domestic level, MoUs with all relevant regulators exist to share information if corrective measures for a banking group are required.

### Assessment of Principle 11
- Assessment: Largely compliant
- Comments:
  - Although the SBP does not have a formal resolution regime, it has demonstrated an adequate range of supervisory tools to address concerns and the ability to revoke banking licenses.
  - Actions taken include dismissing Board and senior management, forcing mergers, assuming control of distressed banks, and revoking banking licenses.
  - Limitation: The SBP does not have the specific power to ring-fence a bank from the actions of wider group entities which may impair its safety and soundness.
- Recommendations:
  - Introduce the power to ring fence a bank from the actions of wider group actions which may impair its safety and soundness.
  - Consider introducing a Resolution framework.

### Principle 12 — Consolidated supervision (EC1 and EC2)
- EC1 — Understanding group structure and material activities
  - Circular 200-2015 requires a bank holding group’s Board of directors to submit an annual report to the SBP within 120 calendar days after its fiscal year closure. The annual report must contain, as a minimum:
    - Introduction with the banking group’s general information
    - Banking group’s structure
    - Economic, financial and regulatory context in which the banking group operates
    - Summary of the banking group’s corporate governance structure
    - Established principles for the banking group’s comprehensive risk management regarding:
      - Credit risk
      - Market risk
      - Liquidity risk
      - Operational risk
      - Risk of money laundering, terrorism financing and financing the proliferation of weapons of mass destruction
      - Social and environmental risk
    - Analysis of the banking group’s solvency
    - Summary of the regulatory impact in areas where the banking group has a presence
    - Consolidated audited financial statements.
  - Any changes to the group’s structure during the year must be notified to the SBP within five days.
  - Additional reports received by the SBP providing qualitative and quantitative data on banking groups:
    - BAN03 (Table of Economic Groups and Related Parties)
    - SBP-CF01 (Report of the Board of Directors on the Ownership of Banking Group Shares)
    - BAN21 Consolidated Balance Sheet and Profit and Loss Statement of Banks (Consolidation Sheet)
  - The SBP off-site team assesses documentation and reports in line with the consolidated off-site supervision process set out in Chapter X of MUSBER. Qualitative assessment is undertaken through the consolidated on-site inspection process set out in Chapter X of MUSBER.
  - Reviews of supervisory files showed detailed risk assessment by on- and off-site supervisors of organizational structure and wider risks.

- EC2 — Prudential standards on a consolidated basis
  - Article 14 of Rule 1-2015 sets out the consolidated capital adequacy requirements for banking groups:
    - “The capital adequacy index of a banking group will be calculated as the ratio of the capital funds on the consolidated balance sheet of the banking group to the risk-weighted assets obtained from the consolidated financial statements, using the consolidation perimeter defined in Article 12. At no time can this index be less than eight percent of the sum of the risk weighted assets.”
  - Article 14 of Regulation 7-14 sets out concentration limits for banking groups on two exposure levels.

*Source: 1panea2024003 - 1. Private admonition.*

### 1. Of  the  banking  group  with  a  party  not  related  to  the  banking  group,  including

### 1panea2024003 - 1. Of  the  banking  group  with  a  party  not  related  to  the  banking  group,  including

### Consolidated exposure concentration limits
- Article 16: The banking group may not directly or indirectly maintain exposures with a single party, including those parties that form an economic group with that party, of more than twenty-five percent of the consolidated equity fund of the banking group.
- Article 18:
  - The banking group may not directly or indirectly maintain unsecured single related party exposures of more than five percent of the consolidated equity funds of the banking group.
  - When the loan is backed by collateral other than deposits, the applicable limit shall be ten percent of the consolidated equity funds of the banking group.
  - The banking group may not directly or indirectly maintain exposures with its related parties, including those making up an economic group with the banking group, of more than twenty-five percent of the consolidated equity fund of the banking group.
- Scope of consolidated exposure limits:
  - Consolidated exposure limits include any funding, investment, derivatives and off-balance transactions that represent an irreversible contingency, among others.
  - The application of consolidated exposure concentration limits of the banking group shall also be made even though the exposure or loan is not directly granted to the person classified as a member of or party related to the economic group, but to one or more entities, corporations or people that, in the SBP’s judgment, have that classified person as a beneficial owner or ultimate beneficiary.

### Reporting and supervisory data requirements
- Circular 200-2015 sets out the banking group’s reporting requirements that relate to Regulation 7-2014. Summarized reports include:
  - BAN03 (Table of Economic Groups and Related Parties)
  - BAN10 (Calculation of the Dynamic Provision)
  - SBP-CF01 (Report of the Board of Directors on the Ownership of Banking Group Shares)
  - BAN21 Consolidated Balance Sheet and Profit and Loss Statement of Banks (Consolidation Sheet)
- The SBP does not collect any data on the consolidated liquidity positions of banking groups (see BCPs 10 and 24).
- Since August 2020, the liquidity of all regional financial groups has been monitored weekly at the Technical Liaison Committee level of the CCSBSO, both in local currency and in foreign currency.

### EC3 — Oversight of foreign operations by management and supervisory access
- Supervisory objectives:
  - The supervisor reviews whether the oversight of a bank’s foreign operations by management (of the parent bank or head office and, where relevant, the holding company) is adequate having regard to their risk profile and systemic importance.
  - The supervisor ensures there is no hindrance in host countries for the parent bank to have access to all the material information from their foreign branches and subsidiaries.
  - The supervisor determines that banks’ policies and processes require local management of any cross-border operations to have the necessary expertise to manage those operations in a safe and sound manner, and in compliance with supervisory and regulatory requirements.
  - The home supervisor takes into account the effectiveness of supervision conducted in the host countries in which its banks have material operations.
- Description and findings:
  - During an inspection of the home/host arrangements for an overseas branch of a Panamanian bank, the SBP verifies that the policies and procedures for integrated risk management are carried out in a consolidated and consistent manner.
  - The SBP verifies the application of local regulations, corporate guidelines, and aspects of the home regulator's regulations at the consolidated level.
  - The SBP has the power to request documents and reports from any bank, any company of a banking group, the owner of bank shares, or nonbank affiliates, on their operations and activities.
  - The SBP considers the effectiveness of the host country’s supervisory regime before agreeing to the establishment of an overseas operation of a Panamanian bank.

### EC4 — Home supervisor on-site visits to foreign offices
- Supervisory policy:
  - The home supervisor visits the foreign offices periodically, with location and frequency determined by the risk profile and systemic importance of the foreign operation.
  - The supervisor meets host supervisors during these visits.
  - The supervisor has a policy for assessing whether it needs to conduct on-site examinations of a bank’s foreign operations or require additional reporting, and has the power and resources to take those steps as and when appropriate.
- Description and findings:
  - Chapter IX.2 of MUSBER sets out the SBP’s supervisory approach to cross-border on-site inspections.
  - The frequency of inspections of overseas offices of Panamanian banks is determined by the level of risk posed by the operation to the wider group.
  - The SBP always coordinates such visits with the host supervisor (see BCP13).
  - Decisions on which overseas operations should be subject to inspection are determined in discussions with senior management as part of the SBP’s annual supervisory planning process and are risk-based.

### EC5 — Supervision of parent company activities and affiliates
- Supervisory objective:
  - The supervisor reviews the main activities of parent companies, and of companies affiliated with the parent companies, that have a material impact on the safety and soundness of the bank and the banking group and takes appropriate supervisory action.
- Description and findings:
  - (Description and findings re EC5 provided in source.) 

*Source: 1panea2024003 - 1. Of  the  banking  group  with  a  party  not  related  to  the  banking  group,  including*

### Section IX.1.2 of MUSBER sets out the SBP’s approach to reviewing the activities of parent

### Section IX.1.2 of MUSBER sets out the SBP’s approach to reviewing the activities of parent

### Consolidated supervision (Principle 12 — assessment: Compliant)
- Primary objective: understand ownership and organizational structure of the banking group and be able to reach the ultimate owner — Ultimate Beneficial Own–r (UBO) — or at least identify the economic group, family or group of people exercising effective control.
- Initial evaluation: information provided by the bank on its structure, followed up by on-site investigation or additional information requests if ownership is unclear.
- On-site review: SBP visits the holding company or the parent bank to understand activities; if activities present a threat to safety and soundness, supervisory action is incorporated into the banking group’s supervisory plan.
- SBP powers and practice:
  - Paragraph 2 of Article 16 of the Banking Law authorizes SBP to authorize closure or transfer of establishments and opening abroad of branches or subsidiaries, and to object to establishments in territories where, in SBP’s opinion, local supervision does not guarantee proper oversight.
  - SBP has exercised these powers in the past by closing the overseas operations of a bank.
- Limits on group activities and locations: SBP may limit activities or locations (including closing foreign offices) when it determines that:
  - (a) activities expose the bank or banking group to excessive risk and/or are not properly managed;
  - (b) supervision by other supervisors is not adequate relative to the risks presented; or
  - (c) exercise of effective supervision on a consolidated basis is hindered.
- Consolidated prudential coverage gap:
  - SBP applies most prudential standards to consolidated entities, but does not collect any data on the consolidated liquidity positions of banking groups — see BCPs 10 and 24.
  - Since August 2020, liquidity of all regional financial groups has been monitored weekly at the Technical Liaison Committee level of the CCSBSO, both in local currency and in foreign currency; this arrangement does not constitute effective consolidated supervision of banks’ liquidity positions. The grading of BCP 24 reflects this issue.

### Supervision of individual entities within groups (EC7)
- Responsible supervisor also supervises individual banks in the group on a stand-alone basis and understands their relationships with other group members.
- SBP practice:
  - Sets separate prudential limits for individual banks within a wider banking group.
  - Individual banks within a banking group are subject to standard reporting requirements and all other supervisory requirements applicable to banks not part of a consolidated banking group.

### Home-host relationships (Principle 13 — assessment: Largely Compliant)
- Supervisory colleges and regional cooperation (EC1):
  - SBP, as home supervisor, organizes supervisory colleges; overseas regulators with material presence in Panama participate.
  - Three supervisory colleges convened in 2022 and four colleges in 2021.
  - Agendas are circulated and agreed in advance to target bank-specific risks.
  - SBP participates in bimonthly Liaison Committee meetings of the Central American Council of Superintendents of Banks, Insurance, and Other Financial Institutions (CCSBSO).
  - Liaison Committee functions include planning and coordinating annual consolidated and cross-border supervision of regional financial conglomerates, sharing information on material events or changes in shareholder ownership, requesting performance reviews from origin supervisors, and exchanging information on events that could jeopardize cross-border establishments.
- Information sharing (EC2):
  - SBP has signed MoUs with 29 overseas regulators, covering all foreign-owned banks operating in Panama.
  - Evidence of information shared bilaterally, in colleges, and in CCSBSO technical meetings demonstrates free and full sharing of risk assessments.
- Coordination of supervisory activities (EC3):
  - Articles 3 and 4 of Resolution 1-2005 require SBP to coordinate information exchange and/or joint supervisions with relevant foreign supervisors.
  - Cross-border inspections are carefully planned with home/host supervisors; initial meetings are held ahead of colleges to agree topics and coordinate findings and supervisory actions.
- Communication strategies (EC4):
  - Home and host supervisors agree on communication strategies and coordinate with banks on supervisory actions and outcomes.
- Crisis cooperation and resolution (EC5 and EC6):
  - SBP does not currently require banks to draw up resolution plans.
  - Cross-border coordination on weak banks occurs through Liaison and Resolution and Crisis Committees under CCSBSO.
  - The Resolution and Crisis Committee is developing a "Multilateral Memorandum of Understanding of Resolution".
  - Although no formal resolution regime in Panama, SBP successfully wound down/closed two foreign banks since 2017 in an orderly fashion without loss to depositors or contagion.
- Host jurisdiction prudential parity (EC7 and EC9):
  - Prudential regime and supervisory approach for foreign subsidiary banks is the same as applied to domestic banks.
  - Foreign branches are not subject to capital adequacy or LCR requirements and large exposure limits do not apply in Panama (no dedicated capital in Panama); they are subject to home country prudential rules and limits on a consolidated basis.
  - SBP does not allow booking offices or shell banks to be established in Panama; all licensed banks must have a physical presence and undertake banking business as defined in Articles 2 and 3 of the Banking Law.
- On-site access and inspection cooperation (EC8 and EC10):
  - Article 64 of the Banking Law permits foreign supervisory bodies, exclusively for supervisory purposes, to request information and carry out inspection visits in Panama to foreign banks they home-supervise, subject to confidentiality guarantees and provision of inspection reports to the Superintendency.
  - Access by overseas regulators to local branches and subsidiaries is granted per MoU conditions.
  - SBP confirms it would always consult with an overseas supervisor before taking consequential supervisory action based on information from that supervisor; examples cited where coordination occurred for branches subject to intervention due to parent concerns.

### Corporate governance (Principle 14 — selected EC findings and practices)
- Legal and regulatory framework (EC1):
  - Article 55 of the Banking Law requires banks to comply with Corporate Governance regulations issued by the Superintendency; noncompliance is penalized.
  - Regulation 5-2011 sets Corporate Governance requirements; Article 13 lists Board responsibilities including promoting security and soundness, understanding regulatory framework, establishing effective corporate governance and internal controls, overseeing working conditions, promoting ethical standards, approving business strategies and policies, understanding risk exposures, keeping SBP informed, approving organizational structure, selecting and evaluating general manager and audit personnel, approving and reviewing internal control objectives and audit programs, and reviewing unaudited financial statements at least once every three months.
  - SBP has issued guidance on Board responsibilities in multiple numbered guides (No. 10-2000 through No. 1-2022 — list preserved as in source).
- Supervisor assessment and remediation timelines (EC2):
  - Corporate governance is a key component (G) of SBP’s internal risk assessment methodology; assessment covers Board practices, senior management, quality of shareholders, risk control and management environment, compensation system, information and transparency, and customer service.
  - Findings and recommendations are recorded in SBP’s internal monitoring tool.
  - Timelines for remedial action: high materiality issues remediated in 3 months, medium materiality issues in 6 months, and low materially issues in 9 months.
- Board composition and committees (EC3):
  - SBP reviews governance structures and assesses Board member experience through routine inspections and Board minutes.
  - Regulation 5-2011 requires a minimum of seven Board members with relevant knowledge/experience; majority should be non-executive directors and at least two independent directors.
  - Banks must have an Audit Committee, a Compliance Committee, and a Risk Committee (the latter two by specific decision); a Corporate Governance Committee is recommended. SBP may require additional committees based on risk profile.
- Fit and proper standards for Board members (EC4):
  - Board members require prior SBP approval before appointment.
  - SBP assesses technical and professional knowledge, experience in the financial sector, and other relevant background information.
  - On-site inspections assess directors’ performance on committees, corporate governance performance of the Board, and mechanisms to manage conflicts of interest.
- Board oversight of strategy, risk appetite, and controls (EC5):
  - Regulations 5-2011 (Article 13) and 7-2014 (Article 4) require Boards to set strategic direction, risk appetite, corporate culture, conflict of interest policies, and an appropriate risk management and internal control framework; SBP verifies application and effectiveness in supervision.
- Senior management selection, succession, and oversight (EC6):
  - Regulation 5-2011 (Paragraph I of Article 13) requires banks to choose and evaluate general manager and personnel responsible for external audit duties, ensuring appointments are fit and proper.
  - Supervision assesses how senior management executes Board strategy, aligns activities with business strategy and risk tolerance, and whether Boards have policies to review general manager performance at least once a year.
- Compensation oversight (EC7):
  - SBP assesses that Boards actively oversee design and operation of compensation systems, ensuring incentives are aligned with prudent risk taking and long-term objectives; deficiencies are to be rectified (source contains further description of EC7 findings).

*Source: Section IX.1.2 and related sections of the MUSBER assessment as provided in the supplied content.*

### Section 111.111.10 of the MUSBER requires the SBP is required as part of its supervisory

### 1panea2024003 - Section 111.111.10 of the MUSBER requires the SBP is required as part of its supervisory

### Supervisory requirements on compensation systems and Board oversight
- Section 111.111.10 of the MUSBER requires the SBP, as part of its supervisory process, to:
  - Evaluate that shareholders monitor the design and operation of the compensation system and the compensation system.
  - Evaluate that the Board of Directors actively monitors the design and operation of the compensation system, evaluates and reviews said system ensuring that it operates in the desired manner.
  - Assess that employee compensation is consistent with prudent risk-taking (adjusted for all types of risk; aligned to risks assumed; sensitive to the time horizon of risks; and that the mix of cash, equity and others is consistent with the risk assumed).
- In supervision of banks and banking groups, the SBP assesses how the Board has established appropriate incentives, including evaluation of long-term policies regarding selection and remuneration of Board members, senior management, executives, and other personnel.
- Supervision includes confirmation of how the Board maintains and discloses incentive, remuneration, and compensation policies and evaluates:
  - The type of shareholder oversight of the design and operation of the compensation system.
  - Whether the Board’s oversight of the design and operation of the compensation system evaluates and reviews the compensation system to ensure it is functioning as intended.
  - Whether employee compensation is commensurate with prudent risk-taking (adjusted for all types of risk; aligned to the risks assumed; sensitive to the time horizon of the risks; and the mix of cash, equity and other compensation is consistent with the risk assumed).

### EC8 — Board and senior management understanding of group structure and risks
- Supervisory expectation:
  - The supervisor determines that the bank’s Board and senior management know and understand the bank’s and banking group’s operational structure and its risks, including those arising from use of structures that impede transparency (e.g., special-purpose or related structures).
  - The supervisor determines that risks are effectively managed and mitigated, where appropriate.
- Description and findings re EC8:
  - There is no systemic approach in the SBP’s supervisory framework for confirming that the Board and senior management understand a banking group’s organizational structure, as regular meetings with the Board and senior management do not form part of the supervisory approach.
  - Board members and/or senior management are engaged during each inspection when opportunities arise to challenge their knowledge of the structure and risks posed.
  - When assessing effectiveness of a group’s governance arrangements, the SBP considers:
    - The structure of the bank and the banking group to determine alignment of governance with nature, complexity, and inherent risks.
    - The organizational and functional structure of the internal control system and how senior management verifies its effectiveness.
    - How the management structure established by senior management complies with assigned roles and levels of responsibility.
  - The SBP undertakes a review of impediments to consolidated supervision as part of the licensing process and as and when changes occur to the organizational structure.
  - Where banks or banking groups intend to include or exclude banking or financial entities, they must inform the SBP and obtain its approval in accordance with applicable regulations.
  - For effective consolidated supervision, the SBP may require inclusion of other financial or nonfinancial entities and has powers to reject proposed structural changes that would hinder consolidated supervision; the SBP has used this power in the past.

### EC9 — Powers to require changes in Board composition
- Supervisory expectation:
  - The supervisor has the power to require changes in the composition of the bank’s Board if it believes any individuals are not fulfilling their duties related to these criteria.
- Description and findings re EC9:
  - Paragraph 9 of Article 16 of the Banking Law provides the SBP with the power to order a bank “to remove its directors, officers or executives if ... there is sufficient reason to do so”.
  - Article 107 provides that “any person who holds the position of director or officer or holds a management position in a bank, will cease his/her job and be disqualified from performing in those positions in any bank, if any of the following should occur:
    1. The person is declared bankrupt or involved in insolvency proceedings.
    2. The person is found guilty of crimes against property or the public trust.
    3. The person is found guilty of grievous mismanagement of the affairs of the bank, as determined by the Board of Directors of the Superintendency.”
  - The SBP has made use of these powers in practice; in one case the SBP removed the President, certain Board members and the General Manager of a bank in distress and replaced them with other individuals to restore the bank’s viability.

### Assessment of Principle 14 — Summary finding
- Assessment: Largely Compliant
- Comments:
  - The SBP has a comprehensive regulation covering corporate governance arrangements in banks and banking groups, and monitors compliance through regular on- and off-site supervisory approaches.
  - Supervisory assessment is tailored to the risk profile and systemic importance of the entity and covers Board and senior management recruitment, responsibilities and compensation, effectiveness of risk and internal control functions, and whether organizational structure hinders effective consolidated supervision.
  - However, outside on-site inspection, the SBP has limited engagement with Board members or senior management within a bank. This lack of dialogue constrains the authority’s ability to maintain an ongoing understanding of the bank’s strategic direction, group and organizational structure and control environment.

### Principle 15 — Risk management process (EC1)
- Principle summary:
  - The supervisor determines that banks have a comprehensive risk management process (including effective Board and senior management oversight) to identify, measure, evaluate, monitor, report and control or mitigate all material risks on a timely basis and to assess the adequacy of their capital and liquidity in relation to their risk.
- EC1 expectations:
  - The supervisor determines that banks have appropriate risk management strategies approved by the Boards and that Boards set a suitable risk appetite. The Board ensures:
    (a) a sound risk management culture is established throughout the bank;
    (b) policies and processes for risk-taking consistent with the risk management strategy and established risk appetite;
    (c) uncertainties attached to risk measurement are recognized;
    (d) appropriate limits consistent with the bank’s risk appetite, risk profile and capital strength are established, understood by, and regularly communicated to relevant staff;
    (e) senior management monitors and controls all material risks consistent with approved strategies and risk appetite.
- Description and findings re EC1:
  - The SBP implemented regulation 8-2010 requiring banks to implement a risk management framework, including definition of a comprehensive approach; components of risk management; types of risks; structure: responsibilities of the BoD; responsibilities of senior management; the need to implement a Board Risk Committee (BRC) and duties of the BRC; the need to establish an independent risk management unit (line 2); and reporting.
  - Risks covered by the regulation include:
    - Credit and counterparty risk;
    - Liquidity risk;
    - Market Risk (price risk, interest rate risk and exchange rate risk);
    - Operational risk;
    - Reputational risk;
    - Country risk;
    - Transfer risk;
    - Political risk; and
    - Sovereign risk.
  - SBP supervisory activities to assess implementation:
    - Off-site and on-site activities (see also CPs 8 & 9).
    - (a) Assess manuals, processes, procedures, supervision manual form – integrated risk management assessment form. SBP assesses BRC minutes and reporting. To assess risk management culture the SBP interviews the three lines of defense. Regulations refer to promoting a sound risk management culture across the banking group and discussions with management.
    - (b) Regulations require banks to submit a report every three years for future capital needs. Banks must identify risks in addition to capital; they assess changes across different bank groups, indicators, limits. The SBP receives this annually and makes an assessment.
    - (c) Risk measurement systems are evaluated on-site. Models are not used to calculate regulatory capital, but models are used for risk management. Model validation reports are assessed on-site.
    - (d) Limits are assessed across all risks. SBP meets with all three lines of defense to assess implementation of limits and the compliance framework.
    - (e) The SBP interviews senior management during on-site examinations.
  - SBP assigns a Director responsible for addressing findings from on-site examinations and meets BoD directors during on-site examinations when warranted.
  - There is scope for more routine meetings with bank Boards and in particular with the Chair of the Audit Committee, Chair of the Risk Committee, and the Chair of the BoD.
  - Processes in the supervisory manual to assess risk management include:
    - Chapter III. Banking Supervision Process
    - III.10. Rating detail by individual GRENP component and subcomponent.
    - Section III.10.2 R – Risks
    - III.11. Rating detail by consolidated GRENP component and subcomponent.

*Source: 1panea2024003 - Section 111.111.10 of the MUSBER requires the SBP is required as part of its supervisory*

### Section III.11.2 R – Consolidated GRENP Risks

### Section III.11.2 R – Consolidated GRENP Risks

### Forms used
- At the individual bank level:
  - Form 7 FEGOB, Objectives 1, 2, 5, 6, 15, and 17–19
  - Form 8 FEGRI, Comprehensive Risk Management, Objectives 1–12
- At the banking group level:
  - Form 20 FESCIG, Objectives 1, 3, 4, 7, 10, 11–14, and 18

### EC2 — Comprehensive bank‑wide risk management
- Regulatory requirement: banks must implement a comprehensive risk management framework to identify, measure, evaluate, monitor, report and control or mitigate all material risks.
- Supervisor determines processes are adequate:
  - to provide a comprehensive “bank-wide” view of risk across all material risk types;
  - for the risk profile and systemic importance of the bank; and
  - to assess risks arising from the macroeconomic environment affecting the markets in which the bank operates and to incorporate such assessments into the bank’s risk management process.
- Supervisory approach and practices:
  - SBP undertakes an annual on-site examination program for D-SBs and higher risk banks; other banks assessed according to the GRENP rating but not less than once every two years.
  - Supervisory manual contains guidance for supervisors to assess bank risk management frameworks for all material risks.
  - Banks required to complete a self-assessment with evidentiary materials prior to on-site; weaknesses/high-risk areas explored via interviews, file sampling, testing and review of reporting and policies.
  - After general assessment, in-depth evaluation of control environment specific to each risk and relevant business lines, including:
    - application of policies on acceptance levels of risk (risk exposure limits);
    - clear assignment of responsibilities at operational (approval and/or authorization) levels;
    - methodology used to determine product and service prices.
- Specific EC observations:
  - Regulation 7-2014 requires a group-wide approach; SBP assesses group-wide policies and includes on-site examinations to subsidiaries and offshore operations; supervisory colleges and communication with host supervisors are used for cross-border activities.
  - SBP implemented a D-SIB framework raising supervisory intensity; expectations for risk management commensurate with size, scale and complexity and risk profile.
  - Financial Stability and Systemic Risk Division assesses macroeconomic factors and makes this available to off-site analysis teams; analysis of assumptions in bank business plans is undertaken.
- Identified scope for improvement:
  - ICAAP framework not yet implemented; SBP plans to implement in the near-term future. ICAAP would contribute to structured assessment of all material risks and stress testing to inform capital adequacy assessment.

### EC3 — Documentation, review and communication of risk strategies/policies
- Supervisor determinations:
  - strategies, policies, processes and limits should be properly documented, regularly reviewed and adjusted for changing risk appetites/profiles and market/macro conditions, and communicated within the bank.
  - exceptions to policies/processes/limits should receive prompt attention and authorization by appropriate management level and Board where necessary.
- Findings:
  - Reviews determine whether entities have appropriate strategies, policies, processes, rules, and procedures to identify and limit risks for operations, services, and business lines.
  - Procedures for treatment of exceptions and management accounting for exceptions are evaluated.
  - Policies verified as approved by the Board and distributed to staff.
  - For banking groups, mechanisms for senior corporate management to inform the corporate Board of business situation and risk management are reviewed.

### EC4 — Board and senior management understanding of risks and linkage to capital/liquidity
- Supervisor determinations:
  - Board and senior management must obtain sufficient information on nature and level of risk and how this relates to adequate capital and liquidity; must understand implications and limitations (including measurement uncertainties) of risk information received.
- Findings:
  - SBP annual on-site for higher risk banks and D-SIBs assesses adequacy of capital and liquidity relative to risks; reviews business plans and developments.
  - In-depth assessment of risk committees (management and board) to assess reporting and governance; reviews Board minutes for discussions on risk levels and relationship to capital, liquidity, and provisions.
  - Assessment of senior management's involvement in implementing policies and systems for comprehensive risk management as directed by the Board.
- Identified gaps:
  - Annual liquidity self-assessment process not included in regulation although extensive liquidity risk management requirements exist (see CP24).
  - Differentiated supervision of D-SIBs implemented, but calibration against capital and liquidity not explicitly mentioned in regulations and not evidenced that D-SIBs are subject to higher capital and liquidity requirements reflecting size, scale, complexity and systemic importance.

### EC5 — Internal processes for assessing capital and liquidity adequacy (ICAAP/ILAAP)
- Supervisor determinations:
  - banks should have internal processes for assessing overall capital and liquidity adequacy relative to risk appetite and profile; supervisor reviews/evaluates banks’ internal capital and liquidity adequacy assessments and strategies.
- Findings:
  - Regulations require processes for managing risks and assessing impacts on capital and liquidity by risk type.
  - No current requirements for internal liquidity adequacy assessment process (ILAAP).
  - Draft decision produced for ICAAP regulation.
  - Risk Unit responsibilities include informing Risk Committee, Board, and senior management of impact on capital adequacy of risk-taking, considering sensitivity analyses and stress testing including external events.
  - Review of internal control system (policies, principles, rules, procedures, prevention/verification/evaluation mechanisms) undertaken as part of on-site examinations to demonstrate management of risks and relationship with capital and liquidity.

### EC6 — Use and oversight of models
- Supervisor determinations:
  - banks must comply with supervisory standards when using models; Boards and senior management must understand model limitations/uncertainties; banks must perform regular independent validation/testing of models; supervisor assesses reasonableness of model outputs.
- Findings:
  - Internal models cannot be used to calculate capital adequacy; banks use models for internal management and risk measurement which are subject to regulator assessment.
  - Manager of Risk Management Unit must monitor ongoing strengthening and development of risk management systems, policies, processes, quantitative models, and reports to ensure robustness and effectiveness.
  - Policies and procedures to measure risks are reviewed during management quality supervision by the Supervision Directorate.

### EC7 — Risk information systems and reporting
- Supervisor determinations:
  - banks must have information systems adequate under normal and stress conditions for measuring, assessing and reporting exposures across all risk types, products and counterparties; reports must reflect risk profile and capital/liquidity needs and be timely and suitable for Board and senior management.
- Findings:
  - Banks and groups must establish strategies, organization, policies, procedures, manuals, and information systems appropriate to complexity, volume and risk level, including group-wide compliance review and monitoring systems.
  - Supervisor assesses Risk Management Unit reports for at least quarterly preparation and verifies that Risk Committee or responsible body, general manager, and decision-making units have been informed of effectiveness of risk measurement mechanisms, degree of exposure, limits, and risk management in accordance with established policies and procedures.

### EC8 — Risk management for new products, material modifications and major initiatives
- Supervisor determinations:
  - banks must have adequate policies/processes to ensure Board and senior management understand risks in new products, material modifications, and major initiatives; Board approval required for major activities.
- Findings:
  - Regulations require new products to undergo internal due diligence by the three lines of defense and risk governance (No6.2016).
  - Article 3 requires application of the risk-based approach for new products/services and geographic locations, and for new/developing technologies for new or pre-existing products.
  - Regulated entities must assess risks of money laundering, financing of terrorism, and financing of proliferation of weapons of mass destruction arising from:
    1. The development of new products and new commercial practices; and
    2. The use of new and developing technologies for new and pre-existing products.
  - Banks must carry out careful evaluation before entering new businesses to ensure risks are known and properly controlled; risk assessment must be conducted before launching new products/commercial practices or before use of new/developing technologies.
  - If a new product includes a technology application, prior authorization of the SBP is required.

### EC9 — Risk management function resources, independence and reporting
- Supervisor determinations:
  - banks must have risk management functions covering all material risks with sufficient resources, independence, authority and access to Boards; duties must be segregated from risk-taking functions; risk management must report directly to Board and senior management; internal audit must review risk management function regularly.
- Findings:
  - Regulations stipulate risk management for all Pillar I risks integrated into supervisory manual and on-site examinations; several Pillar II risks (e.g., legal and reputational risks) are embedded, included in operational risk assessments and credit concentration risks.
  - Interviews with the three lines of defense assess independence of risk functions.
  - Reporting to the BRC is a key element of assessment.
  - Strategic and reputational risks are part of risks defined in Article 4 of Decision No. 8-2016.

*Source: Section III.11.2 R – Consolidated GRENP Risks, 1panea2024003 - Section III.11.2 R – Consolidated GRENP Risks*

### 2010.  The  supervision  process  is  outlined  in  Form 8  FEGRI  on

### 1panea2024003 - 2010.  The  supervision  process  is  outlined  in  Form 8  FEGRI  on

### Supervision process, strategic and reputational risk
- Supervision emphasizes review of strategy and the methodology for its preparation during the corporate governance management evaluation to ensure the business plan approved by the Board:
  - takes into account the long-term strategy,
  - its exposure to risk, and
  - the ability to manage those risks effectively.
- SBP supervisory checks include:
  - Reviews that the quantitative and qualitative objectives and targets have been defined for each business line and that the parties responsible for their execution, control, and monitoring have been identified.
  - Analyzes the reasonableness of the business plan with the assumptions used.
  - Reviews that the customer segments to be served have been defined based on market studies.
  - Reviews that growth strategies (for current products, new products, new markets, new customers, the acquisition of new business units or lines, the expansion of the banking group, discontinuation of business/product lines, etc.) have been defined.
  - Verifies the application of the policies, procedures, and controls defined in the growth strategies; where a monitoring committee exists, requests minutes of its meetings.

### EC10 — Risk management unit and CRO
- Requirement and scope:
  - Risk Management Unit requirement is applied across all banks; a head of the unit needs to be appointed.
  - All regulated entities must have a unit for managing risk.
  - Banking groups can use existing group risk management units; for larger and/or more complex groups the Superintendency may require a dedicated Risk Management Unit solely for the banking group.
  - The CRO function reports to the BRC.
- Removal and disclosure:
  - There is no requirement for removal of the CRO to be notified to the SBP, nor for public disclosure.
  - In practice, notifications to the SBP have taken place; CRO dismissals are not common.

### EC11 — Standards for credit, market, liquidity, interest rate and operational risk
- SBP regulatory instruments covering major risk types include:
  - No. 4-2008 "Issuing new provisions for compliance with” the legal liquidity ratio"
  - No. 6-2009 "Establishing the rules for limits on risk concentration in economic ”groups and related parties"
  - No. 8-2010 “Issuing provisions on comprehensive risk management”
  - No. 5-2011 “Issuing a new Decision to update the provisions on corporate governance”
  - No. 4-2013 “Establishing provisions on the management and administration of credit risk inherent to the credit portfolio and off-balance sheet operations"
  - No. 7-2014 “Establishing rules for the consolidated supervision of banking groups"
  - No. 11-2017 "Establishing guidelines for operations with derivative financial instruments"
  - No. 2-2018 "Establishing provisions on liquidity risk management and the short-term liquidity coverage ratio"
  - No. 3-2018 “Establishing the capital requirements for financial instruments registered in the trading portfolio”
  - No. 7-2018 “Establishing provisions on country risk management”
  - No. 11-2018 "Issuing new provisions on operational risk"
  - No. 12-2019 “Issuing provisions on investments in securities”
  - Banking book interest rate: Draft Decision, General Resolution No. 2-2000 on Interest Rate Risk Management

### EC12 — Contingency arrangements, recovery and resolution
- Findings:
  - No integrated linkage between stress testing, contingency planning, and recovery planning; requirements are often separate and based on individual risks.
  - There is no resolution framework although the SBP is the resolution authority.
  - Recovery and resolution planning has not been developed.
  - Banks must include policies and contingencies in risk measurements for scenarios resulting from backward-looking stress analysis and forward-looking worst-case scenario analysis.
  - No explicit regulatory requirement for banks to undertake recovery planning (identified as a deficiency).

### EC13 — Forward-looking stress testing
- Findings:
  - No regulation stipulates a comprehensive approach to stress testing where all risks are considered against an assessment of capital and liquidity.
  - Individual risk areas include requirements for stress testing but scope for improvement exists.
  - SBP released a guide to assist regulated entities in developing stress testing content and strengthen internal self-assessment of capital adequacy.
  - Forward-looking stress tests do not currently have to be carried out, according to their risk profile and systemic importance, as an integral part of the risk management process.
  - During supervision, entities’ practices are evaluated and recommendations made.
  - Conclusion: This EC is not met.

### EC14 — Internal pricing, performance measurement and new product approval
- Findings:
  - Supervision of selected business lines assesses whether entities have appropriate strategies, policies, processes, rules and procedures to identify and limit risks inherent to each business line.
  - Banks recognize and consider links between liquidity risk and other types of risk for significant products, services and business lines.
  - Under normal conditions, forward-looking measurements help identify projected cash outflow needs versus financing sources.
  - In stress situations, forward-looking measurements should identify liquidity mismatches across horizons and support limits and early-warning indicators.
  - Senior management must adapt liquidity risk measurement and analysis to the entity's business model, complexity, and risk profile.

### AC1 — Other material risks (reputational and strategic)
- Findings and assessment:
  - Regulations require banks to implement a comprehensive risk management framework.
  - SBP undertakes annual on-site examination program for D-SIBs and higher risk banks; other banks at least once every two years.
  - Supervisory manual guides supervisors to assess bank risk management frameworks for all material risks.
  - Preparation for on-site: banks complete a self-assessment with evidence; weaknesses and high-risk areas explored with interviews, sampling, testing and review.
  - Areas needing development:
    - No regulation stipulating comprehensive stress testing across all risks against capital and liquidity.
    - No regulation requiring banks to undertake recovery planning.
    - No explicit requirement for a bank to notify the SBP if the CRO is removed (EC10).
  - ICAAP not implemented yet; SBP plans to implement ICAAP in near-term future to support structured assessment of all material risks including stress testing and capital adequacy.
  - Supervisory practice: lack of routine contact with Boards; ICAAP/ILAAP implementation would help.

### Principle 16 — Capital adequacy (overview and essential criteria)
- Legal and regulatory framework and instruments:
  - Banking Law, Article 67 (Capital Composition) and Article 70 (Capital Adequacy Ratios)
  - Decision No. 1-2015 "Establishing the capital adequacy rules applicable to banks and banking groups"
  - Decision No. 3-2016 "Establishing the rules for determining assets weighted by credit risk and counterparty risk"
  - Decision No. 3-2018 “Establishing the capital requirements for financial instruments registered in the trading portfolio”
  - Decision No. 11-2018 “Issuing new ”provisions on operational risk" (Chapter VI on capital and reporting requirements, Articles 26 and 27)
- Capital composition and minimums:
  - Article 67: capital funds consist of primary, and secondary capital.
  - Article 70: all banks with a general or international license must maintain capital funds equivalent to at least eight percent of total assets and off-balance sheet operations weighted by risk, and primary capital not less than four percent of assets and off-balance sheet operations weighted by risk.
  - Article 11 of regulations: “Common tier 1 capital cannot be less than four and a half percent (4.5 percent) of its risk-weighted assets, and tier 1 capital cannot be less than six percent (6 percent) of its risk-weighted assets.”
  - SBP sets a leverage ratio of 3 percent measured against common tier 1 capital to total exposure to non-risk-weighted assets; leverage ratio cannot be less than 3 percent.
- Definition and alignment:
  - CET1, AT1 and Tier 2 definitions closely align with Basel III; T2 reduced on straight-line depreciation of 20 percent per year.
  - Regulation 3-2016 sets risk-weight buckets: [0, 10, 20, 35, 50, 100, 125, 150, 200, 250] percent; mortgage risk-weight 35 percent subject to conditions.
- Buffer framework and systemic buffers:
  - No formal buffer framework (capital conservation buffer, countercyclical buffer) implemented.
  - Average capital adequacy ratio of the sector is approximately 15 percent.
  - D-SIB framework exists, but a systemic risk buffer has not been implemented; minimum capital remains uniform at 8 percent.
- Assessment of compliance with Basel thresholds:
  - For internationally active banks, minimum thresholds are lower than Basel III (minimum 8 percent rather than Basel III minimum of 10.5 percent including 2.5 percent capital conservation buffer).
- Powers and supervisory practice:
  - SBP may apply higher minimum capital requirements for banks on an individual basis (Article 70).
  - Pillar II process undertaken annually using on-site and off-site outputs.
  - SBP uses moral suasion frequently though has power to impose higher capital requirements; industry average capitalization approximately 15 percent.
- EC2 and EC4 findings:
  - EC2: Definition of capital largely aligns with Basel III but absence of formal buffer framework means internationally active banks do not meet Basel capital standards — material deviation.
  - EC4: SBP can require higher ratios for specific banks; scope to deepen assessment of capital adequacy to include potential loss absorbency of capital instruments, appropriateness of risk weights, adequacy of provisions and reserves, and quality of risk management and controls.
- EC5 — Internal models:
  - Banks are not approved to use internal models to calculate regulatory capital; prescribed risk-weights and definitions are applied for regulatory capital calculation.
- EC6 — Forward-looking capital management and stress testing:
  - SBP has power to require forward-looking capital management; Circular 72-2016 (Report on future capital requirements) requires annual statement of capital needs and replacement where significant changes occur.
  - SBP assesses capital plans, meets banks to test assumptions; formal stress tests are not undertaken routinely and minimum standards for stress testing are not prescribed.
  - SBP’s regulatory roadmap includes plan to implement ICAAP including role for stress testing.
- Overall assessment of Principle 16:
  - Graded Materially Non-compliant.
  - Comments emphasize alignment with Basel III definitions but lack of buffer framework, divergence for internationally active banks, need to implement ICAAP/ILAAP and deepen capital adequacy assessment.

### Principle 17 — Credit risk (overview and essential criteria)
- Regulatory basis:
  - Decision No. 4-2013 “Establishing provisions on the management and administration of credit risk inherent to the credit portfolio and off-balance sheet operations" is the main regulation.
  - Regulations require bank-wide credit risk management processes; policies assessed annually.
- Supervisory approach:
  - On-site reviews for higher risk banks and D-SIBs annually; loan sampling focuses on concentrations, restructured loans, high risk loans, classification, collateral, approval delegations, governance and minutes.
  - SBP uses credit risk specialists, industry benchmarking and analyzes loan files and committee minutes.
  - Off-site analysis uses ATOM with 73 fields and multiple reporting forms (see General Resolution No. SBP-RG-0001-2022 of July 6, 2022) including AT03, AT04, AT10, AT12, AT15, AT21, BAN03, BAN05, BAN06, BAN07, BAN10, BAN16, EVAP, SB-CAP-A to F.
- Sector composition and data as of June 2022:
  - Corporate loans approximately 63 percent of system loan portfolios; mortgages second.
  - Home mortgage and consumer loans reached 58 percent of loans to the private sector as of June 2022.
  - Personal loans data (source SBP as at June 2022):
    - Mortgages: 19,204 (Millions of USD), 281,767 (Quantity), 68,155 (Banking System Average Debt USD)
    - Personal Car loans: 1,755 (Millions of USD), 153,342 (Quantity), 11,446 (Average USD)
    - Personal loans: 8,985 (Millions of USD), 694,758 (Quantity), 12,933 (Average USD)
    - Credit Cards: 2,235 (Millions of USD), 607,590 (Quantity), 3,678 (Average USD)
    - Total: 32,179 (Millions of USD), 1,737,457 (Quantity), 18,521 (Average USD)
- EC1–EC8 findings:
  - EC1: Banks required to have bank-wide credit risk management processes; SBP performs thorough on-site and off-site supervision.
  - EC2: Board responsibilities set out in Article 5; Board must approve credit strategies, policies, limits, organizational structure, incentive alignment, new products, delegation systems and credit committees; SBP assesses minutes and implementation.
  - EC3: Decision No.3-2013 articles cover required components (Article 11, 12, 14, 15, 17, 22-24) and SBP verifies implementation across subcriteria (a) through (g) including documented strategies, underwriting standards, credit administration, MIS, limits, exception tracking, and model controls (internal models used for assessment but not regulatory capital).
  - EC4: Regulations require assessment of total indebtedness and unhedged FX risk in debt serviceability ratios; banks have access to credit registry.
  - EC5: Regulations require arm’s length credit decisions; SBP reviews files to ensure related party transactions administered appropriately.
  - EC6: Large exposures framework (Banking Law and Decision No. 6-2009): large exposures defined as exposures greater than 10 percent with maximum limit of 25 percent measured against total regulatory capital.
  - EC7: SBP has full access to information and bank officers to assess credit risk.
  - EC8: Regulation (4-2013) requires independent risk units to develop and maintain stress testing methodology; risk management guidelines require measurement and monitoring under different scenarios.
- Assessment of Principle 17:
  - Compliant.
  - Comment: SBP has strong focus on credit risk management, frequent off-site analysis with comprehensive indicators, detailed regulations emphasizing segregation of duties, governance, delegations, three lines of defense, hind-sighting and collateral/serviceability review.

### Principle 18 — Problem assets, provisions and reserves (overview and essential criteria)
- Regulatory framework and classification:
  - Decision No. 4-2013 requires structured and integrated credit risk and loan administration system with manuals approved by BoD and available to internal/external auditors and SBP.
  - Banks must implement credit scoring systems, mechanisms for monitoring payment behavior and conditions affecting default probability (Articles 16 and 17).
  - Asset classification: five categories — Normal, Special Mention, Substandard, doubtful, and unrecoverable (Article 18).
  - Write-offs: Article 27 requires banks to write off all loans classified as unrecoverable within no more than a year from classification; unrecoverable can be aged up to 360 days and then another 365 maximum 2 years (see proviso 2 under Article 19).
- Provisions and dynamic provisioning:
  - Articles 33-38 provide guidance: two types of provisions — specific and dynamic.
    - Specific provisions for loans classified as special mention, substandard, doubtful, or unrecoverable; apply to individual loans and portfolios.
    - Dynamic provisions established on loans classified as normal according to prudential criteria.
  - IFRS and prudential differences:
    - Regulated entities apply IFRS; SBP established treatment of differences by General Resolution SBP-GJD-0003-2013 (July 9, 2013).
    - IFRS9 implemented in 2018; differences include calculation of credit loss for performing loans and broader consideration of collateral under IFRS.
    - Banks calculate two sets of provisions: regulatory (SBP) and IFRS.
    - Article 34: surplus in specific reserve under IFRS is registered in a regulatory reserve of capital (credited to retained earnings); regulatory reserve not considered regulatory capital for capital adequacy, concentration limits, or other prudential relationships.
- Supervisory reporting and monitoring:
  - General Resolution No. SBP-RG-0001-2022 (July 6, 2022) requires granular monthly, quarterly, semi-annual and annual reporting including AT03, AT21, BAN03, BAN05, BAN06, BAN16, SB-CAP-D, SB-CAP-E, SB-CAP-F etc.
  - Off-site data analyzed by SBP; trends and irregularities queried with banks.
  - On-site examinations focus on loan life cycle, classification, collateral valuation and provisioning; supervisory manual provides structured approach.
- EC2–EC7 findings:
  - EC2: SBP assesses adequacy of policies and processes through self-assessment questionnaires, on-site file reviews, internal and external audit outputs.
  - EC3: Off-balance sheet exposures included in provisioning; SBP samples entire client file to ensure on- and off-balance sheet treatment.
  - EC4: Regulations require write-offs and loan administration processes to monitor classification and collateral valuations; one-year write-off requirement appropriate; no explicit recognition to consider market and macroeconomic conditions when writing off loans.
  - EC5: Regulations assign responsibilities to risk management unit for credit risk tracking, classification methodology, stress testing, forecasting cash flows, and valuation comparisons; SBP evaluates implementation during on-site reviews.
  - EC6: SBP obtains detailed information on classification and provisioning via required reports (AT03, AT21, BAN03, BAN05, BAN06, BAN16, SB-CAP-D, SB-CAP-E, SB-CAP-F) and verifies data on-site and off-site.
  - EC7: SBP assesses adequacy of classifications and provisioning and has power to require reclassification and additional reserves; SBP has exercised this power in practice.
- Dynamic reserves:
  - SBP has implemented dynamic reserves (Articles 36 and 37); dynamic reserves established on a quarterly basis based on last-day-of-quarter data; amount calculated using specified components (details follow in source).

*Source: 1panea2024003 - 2010.  The  supervision  process  is  outlined  in  Form 8  FEGRI  on (PANAMA, INTERNATIONAL MONETARY FUND).*

### 1. Component #1: The amount obtained by multiplying the balance of risk-weighted

### 1. Component #1: The amount obtained by multiplying the balance of risk-weighted

### Dynamic reserve components and calculation
- Component #1: The amount obtained by multiplying the balance of risk-weighted assets for loans classified under the normal category by the Alpha coefficient of 1.5 percent.
- Component #2: The amount obtained by multiplying the quarterly variation in risk-weighted assets for loans classified under the normal category, if positive, by the Beta coefficient 5 percent. If the variation is negative, the amount is zero.
- Component #3: The amount of the variation in the balance of specific reserves during the quarter.
- The amount of dynamic reserves that must be maintained at the end of the quarter is the sum of Components #1 and #2 minus Component #3, taking its mathematical sign into account (i.e., if Component #3 is negative, it must be added).
- Restrictions on the dynamic reserve:
  - It cannot be greater than 2.5 percent of the risk-weighted assets of the loans classified under the normal category.
  - It cannot be less than 1.25 percent of the risk-weighted assets on the loans classified under the normal category.
  - It cannot be less than the amount established in the previous quarter unless the decrease is the result of a conversion to specific provisions. The Superintendency of Banks will establish the criteria for the above conversion.
- The reserve called “global minimum” will be considered part of the dynamic reserve for the purpose of meeting the required reserve on the date in which the dynamic reserves are calculated.

*Findings*
- The framework defines explicit mathematical components (Alpha 1.5 percent; Beta 5 percent) and clear upper and lower bounds (2.5 percent and 1.25 percent) tied to risk-weighted assets for loans in the normal category.
- Superintendency of Banks retains authority to set conversion criteria to specific provisions that can affect dynamic reserve floor adjustments.

### Collateral valuation and eligibility (EC8) — regulatory requirements and scope
- The supervisor requires banks to have appropriate mechanisms for regularly assessing the value of risk mitigants, including guarantees, credit derivatives and collateral; valuation reflects net realizable value, taking into account prevailing market conditions.
- Article 24 requires each bank to have a clear policy on acceptable collateral, including:
  - A formal evaluation of the support and reliability of the collateral.
  - An assessment of the coverage and liquidity of the collateral, establishing its current value based on a current appraisal and considering liquidation scenarios, time, cost and expense, and including the debtor risk rating.
  - Criteria and requirements for acceptable evaluation experts.
  - Methodology for assessing intangible collateral and payment sources represented by the cession of economic rights.
  - Risk assessment criteria for counterparts such as trust agents, custodians, issuers and originators of assets granted as collateral.
- Eligible collateral for provisioning is specified and must be legally established and validated by the lending bank; when applicable collateral must have current insurance policies issued or endorsed to the bank, and must permit direct legal action for payment in case of noncompliance.
- For calculation of specific reserves under IFRS and prudential valuation, banks must consider the time value of money, uncertainty of actual cash value of liquidated collateral, and recovery costs. Article 34 requires application of current values (present values) established in Article 42.

### Collateral present values required for reserve calculations (Article 34 / Article 42)
- Pledge Current Value
  - Deposits in the bank itself or in other banks, be they pledged or given as trust funds. 100%
  - Fixed or variable income securities traded in active markets. 70%
  - Panamanian sovereign debt. 90%
  - Fixed or variable income securities lacking an active market. 50%
  - Sovereign debt traded in an active market. 70%
  - Standby letters of credit, warranties, sureties, endorsements and irrevocable export/import letters of credit issued by banks. 90%
  - Cession of promissory notes with a discount code from the Social Security Fund. 85%
  - Residential real property. 70%
  - Commercial real property. 60%
  - Land. 50%
  - Land used exclusively to agricultural purposes. 50%
  - Personal property (mortgages on private automobiles). 50%
  - Cattle. 75%
  - Agricultural products properly identified by the bank. 40%

*Findings and limitations*
- Article 41 stipulates collateral revaluation frequency that typically reflects good practice.
- What is not required: an independent external appraisal of collateral as additional validation; Article 44 requires banks to establish policies and procedures to ensure adequate knowledge of appraisal companies and methods but does not mandate independent appraisals.

### Loan classification, provisioning mechanics (EC9)
- The regulations classify loans into three types: (i) corporate and other loans; (ii) personal consumption loans; and (iii) personal mortgage loans (Article 18).
- Article 34: banks must calculate and maintain, at a minimum, specific reserves determined by:
  1. Basis for reserve calculation: the difference between the loan amount in a category subject to reserve and the amount of collateral mitigating possible loss; if difference is negative, basis is zero. Values for collateral per Article 42 apply.
  2. Reserve is calculated by multiplying the weight established for each risk category by the calculation basis.

- Reserve Calculation Weight Chart
  - Category
    - Special mention 20%
    - Substandard 50%
    - Doubtful 80%
    - Unrecoverable 100%

- Article 18 criteria for classifying credit risk consider days of arrears, financial situation, debtor's ability to pay, among other aspects.
- Article 21: Additional general criteria include presumption of deterioration where payment behavior or legal entity financial indicators worsen (Free Operating Cash Flow, Operating Profit, EBITDA, Total Indebtedness, EBITDA Interest Coverage).

*Findings on reclassification and restructuring*
- The regulations fulfil criteria to identify a problem loan (reason to believe amounts due will not be collected as contracted).
- Local practice allows restructuring with prospective financial viability; Agreement 4-2013 Article 19 sets conditions and cure periods for reclassification of restructured loans. A restructured loan is reclassified as performing only when all arrears have been cleared and the loan brought fully current.

### Governance and supervisory oversight (EC10, EC11, EC12)
- EC10: Article 5 (Board Responsibilities) requires the Board to ensure an appropriate, effective, feasible and documented framework for credit risk management and loan administration (structured and integrated risk and loan administration system). The Board must oversee classification and provisioning rates; on-site assessments evaluate the role of the Board, credit committee, senior management and risk units.
- EC11: Regulations do not specify a threshold for exposures to be classified on an individual item basis; banks are permitted to set their own thresholds.
- EC12: Regulatory reporting is reviewed monthly and quarterly, assessed on an individual bank and system basis. Analysis is integrated into SBP supervision and system-wide trends are published on the SBP’s website. Data from banks via the ITBank system supports economic reports, statistics and financial indicators.

*Findings*
- Governance requirements and on-site supervisory focus support timely Board information on asset portfolio condition, classification, and provisioning.
- Absence of a regulator-set threshold for individual-item classification allows bank discretion.
- Supervisor conducts regular system-level trend and concentration assessments and considers provisions/reserves adequacy.

### Assessment and commentary (Principle 18)
- Assessment of Principle 18: Compliant
- Comments: Regulations are generally sound; they require classification of all on- and off-balance sheet exposures using a prescribed framework. Guidance for loan classification is extensive and reporting to the supervisor is extensive and frequent. On-site supervision focuses on loan classification, handling of problem assets and provisioning calculation. Guidance on collateral valuation is extensive and a prescribed set of eligible collateral types for provisioning is provided.

### Concentration risk and large exposure limits (Principle 19, EC1)
- Regulatory framework components:
  - Banking Law, Article 95 (Concentration in a Single Person), Article 96 (Concentration in Related Parties), Article 98 (Economic Groups)
  - Decision No. 4-2013 (Article 15-Exposure Limits)
  - Decision No. 6-2009 (Article 3-Concentration Risk Management)
  - Decision No. 7-2014 (Articles 14 and 16) on consolidated supervision of banking groups
- Decision No.4-2013 Article 3 requires banks to have policies, procedures and internal controls to mitigate material exposure risk affecting the bank or banking group, and to observe quantitative concentration limits in Articles 95 and 96 of the Banking Law.
- Banks must develop monitoring for concentration by economic sectors, industries, geographic regions and products or services; Risk Management Unit, Risk Committee and Board define limits (Decision No.4-2013, Article 14).
- Decision No.7-2014 Article 14/16: consolidated concentration managed at two exposure levels: (1) banking group with a party not related to this banking group; (2) banking group with parties related to it. Banking group's consolidated exposure concentration calculated on consolidated information. Exposure concentration limits include financing, investments, derivatives and off-balance sheet irrevocable contingencies. The banking group may not maintain exposures with a single person (including economic group members) for more than twenty-five percent (25 percent) of the banking group's consolidated capital fund.

*Specific numeric limit*
- The credit exposure limit to a single name or group of connected borrowers is 25%.

*Findings*
- The 25% limit is the principal prescribed concentration limit; it applies at both bank and banking-group consolidated levels (capital stock basis).
- The capital stock is total capital (sum of Tier 1 and Tier 2).
- The framework requires banks to establish internal maximum and minimum limits by business line, economic sector, geographic region and client, subject to the statutory concentration limits.
- Exceptions: three exceptions to Article 7 are noted but not detailed in the supplied content.

_Italic: Source — 1panea2024003 - 1. Component #1: The amount obtained by multiplying the balance of risk-weighted_

### 1. When the credit facility is duly secured by pledging deposits in the same bank for

### 1panea2024003 - 1. When the credit facility is duly secured by pledging deposits in the same bank for

### Exceptions to large-exposure treatment
- When the credit facility is duly secured by pledging deposits in the same bank for up to the secured amount;
- When the credit facility is granted to the Panamanian State or is secured by the same;
- When the credit facility is granted to a Foreign State or is secured by the same, as long as the same has investment grade international risk rating.

### Definition of "connected counterparties" (Article 6)
- The following persons will be deemed to form an economic group with a credit facility HOLDER:
  - 1. Any legal person over whom the HOLDER exerts control.
  - 2. Any natural or legal person that exerts control on the HOLDER.
  - 3. Any legal person with whom the HOLDER has a common controller.
  - 4. Any legal person who is the bank’s main debtor in another credit facility wherein the HOLDER is also a co-debtor or guarantor.
  - 5. The HOLDER’S spouse.

### EC2 — Information systems, identification and aggregation of exposures
- Supervisory determination: a bank’s information systems must identify and aggregate on a timely basis, and facilitate active management of, exposures creating risk concentrations and large exposure to single counterparties or groups of connected counterparties.
- Description and findings:
  - The SBP requires a comprehensive suite of routine reporting for off-site analysis (see also CPs 10 and 17). The off-site analysis verifies the accuracy and timeliness of data reporting.
  - On-site examinations evaluate bank credit management systems and aggregation rules.
  - Article 25 of No 4-2013 requires each bank to have clear policies and methodologies that, as a minimum, determine:
    - 1. Statistical information related to the historic behavior of portfolios and loans.
    - 2. Updated information on the characteristics of the debtors, their loans and collateral.
    - 3. Information on the debtor’s credit behavior with other entities, if known.
    - 4. Updated information that will permit the bank to evaluate the debtors’ financial condition and payment capacity at all times.
  - The regulation also requires that annually the risk committee will submit to the BoD a report on the portfolio classification in accordance with the debtors’ inherent risk, including a segment analysis by portfolio, business line, product and any other segmentation indicated in the bank strategy.
  - Verification of counterparties is carried out through information sent by the regulated through the ITBank system.
  - General Resolution SBP-RG-0002-2021 Article 5 “Quality of Information” establishes that information sent by banks through Atoms, BAN tables, printed or technological media, must be duly verified and endorsed by the manager of the operational area as appropriate.
  - The supervisory manual has guidelines for on-site examinations to evaluate bank information systems and they sample connected borrowers and compare against the data submitted by banks across the sector.

### EC3 — Risk management policies, thresholds and governance for concentration risk
- Supervisory determination: a bank’s risk management policies and processes must establish thresholds for acceptable concentrations of risk, reflecting the bank’s risk appetite, risk profile and capital strength, understood by and regularly communicated to relevant staff; and require all material concentrations to be regularly reviewed and reported to the bank’s Board.
- Description and findings:
  - Decision No-8-2010 Article 4 sets out the responsibility of the BoD for credit risk concentrations and requires the Board to adopt policies, controls and procedure manuals to ascertain that:
    - 1. The material concentration exposures on a single person, or on someone that forms an economic group with that person, as well as concentrations on related parties of the bank, on and off-balance sheet, are adequately monitored and controlled by Management.
    - 2. The Board of Directors of the bank periodically reviews the material exposures on a single person and on related parties.
    - 3. Transactions with related parties of the bank that exceed the levels authorized by management due to their high amounts will be sent to the Board of Directors for their approval or rejection; this process will not have the participation of any member that, due to the transaction, has a conflict of interests.
    - 4. The entity has systems that allow it to obtain the information needed to identify, measure and monitor the concentration risk.
  - Article 10 of Decision No. 8-2010 states that the Risk Committee's functions include endorsing limits, strategies, and policies that contribute to effective risk management and defining the scenarios and time horizon in which exceedances of the limits or exceptions to the policies can be accepted, upon approval by the Board, in addition to the possible courses of action or mechanisms for resolving the situation.
  - The provisions ensure that concentration risks are escalated to the BRC and Board as part of the governance process.
  - SBP undertakes on-site examinations with emphasis on sampling credit files including a sample for large exposures and concentration risks in the credit portfolio.
  - When assessing an exposure, SBP will examine the total counterparty exposure which includes off-balance sheet exposures (such as credit lines, guarantees etc.) and derivatives or other instruments, to assess total exposure and adherence to policies and limits.

### EC4 — Supervisory information on sectoral, geographical and currency concentrations
- Supervisory determination: the supervisor regularly obtains information that enables concentrations within a bank’s portfolio, including sectoral, geographical and currency exposures, to be reviewed.
- Description and findings:
  - Concentrations by sector, activity, and geographic area (the reported currency is US Dollar) are assessed monthly based on information received from banks, with requests for further information.
  - A report is received quarterly from economic groups and related parties on consolidated capital funds.
  - In on-site reviews, verifications are carried out of the facility conditions granted so that, in the event of any exceedance in the allowable limits, the entity makes immediate adjustments to reduce the respective degree of exposure.
  - Banks submit annual reports to the SBP which are examined and include data on concentration risk by single names, connected counterparties, sectors, geography and currency.

### EC5 — Legal/regulatory definition and supervisory discretion for groups of connected counterparties
- Supervisory determination: laws or regulations explicitly define, or the supervisor has the power to define, a “group of connected counterparties” to reflect actual risk exposure; the supervisor may exercise discretion in applying this definition on a case-by-case basis.
- Description and findings:
  - The regulations give the SBP the power to define connected counterparties.
  - Decision No. 6-2009 "Establishing the rules for limits on risk concentration in economic groups and related parties" (Article 6-Economic Group) defines "Economic group".
  - The following persons shall be deemed to form an economic group with the HOLDER of a credit facility:
    - 1. Any legal person over which the HOLDER exercises control.
    - 2. Any natural or legal person who exercises control over the HOLDER.
    - 3. Any legal person with which the HOLDER has a common controller.

*Source: 1panea2024003 - 1. When the credit facility is duly secured by pledging deposits in the same bank for*

### 4. Any legal person as principal debtor of the bank in another credit facility of which

### 4. Any legal person as principal debtor of the bank in another credit facility of which the HOLDER is in turn co-debtor or guarantor

### Large exposures and concentration risk (EC6; AC1; Assessment of Principle 19)
- Regulation: Decision No. 6-2009, Article 7 sets the concentration limit for a single person, individually or jointly, at twenty-five percent (25 percent) of the capital funds established under Article 95 of the Banking Law. The established limit is measured based on the consolidated capital funds.
- Material exposure definition: A material exposure is 10 percent of capital (the regulation defines a material exposure as 10 percent of capital).
- Definition of credit facility for LE calculation: “Means loans, investments in fixed-income securities, or off-balance sheet transactions that represent an irrevocable contingency as well as any other instrumentation or documentation modality through which a bank assumes a credit risk.”
- Scope of exposures included: On-balance sheet and off-balance sheet exposures such as lines of credit and guarantees.
- Supervisory practice:
  - SBP evaluates more material off-balance sheet exposures (notably counterparties with import-export businesses) during onsite examinations.
  - SBP verifies credit approval limits by amounts and levels for the Board, the Credit Committee, and Bank Management.
  - Information presented to control and decision-making bodies is evaluated for compliance with internal and regulatory limits at individual bank, bank and subsidiaries, and consolidated levels.
- Additional criteria (AC1):
  - (a) ten per cent or more of a bank’s capital is defined as a large exposure; and
  - (b) twenty-five per cent of a bank’s capital is the limit for an individual large exposure to a private sector non-bank counterparty or a group of connected counterparties.
- Assessment: Largely Compliant.
- Comments and gaps:
  - Regulations focus predominantly on credit-related exposures; Principle 19 envisages a broader view including market and other concentration sources (EC1).
  - No formal requirement for stress testing concentration risks (EC7).

### Stress testing of concentration risk (EC7)
- Regulatory position: The requirement to include risk concentrations in stress testing is not stipulated explicitly in the regulations.
- Supervisory actions since the pandemic: SBP has undertaken additional evaluations of concentration risk (example: tourism sector exposures) and conducts scenario analyses during inspections to determine portfolio performance and management.
- Risk management unit mandates (Decision No. 8-2010):
  - Fully identify, assess, and control all relevant risks.
  - (i) Use risk measurement systems and models consistent with complexity and volume of operations.
  - (ii) Present at least quarterly to the Risk Committee or responsible body tools and techniques for identifying and analyzing risks and methodologies, models, and parameters to measure and control various types of risks.

### Transactions with related parties (Principle 20: EC1–EC7; Assessment)
- Legal framework:
  - Banking Law, Article 96 (Credit to parties related to the bank) establishes prohibitions and limits on related party exposures, including a maximum aggregate related party exposure limit not to exceed 25 percent of the capital funds (the aggregate ... may not in any case exceed the percentage of capital funds established periodically by the Superintendency, which will, in no case, exceed 25 percent of the capital funds of the bank).
  - Decision No. 6-2009 expands and defines related parties (Article 9) and permits SBP discretion to treat holders/beneficiaries as assumed related parties (Article 10).
- Specific prohibitions (Article 96):
  - Prohibits granting unsecured loans to employees in amounts greater than annual salary/emoluments.
  - Prohibits granting loans under more favorable market conditions to managers, officers, employees, or persons/entities owning five percent of bank stock or forming an economic group with them.
  - Prohibits unsecured credits exceeding five percent of capital funds or loans secured with real collateral other than deposits exceeding ten percent of capital funds in favor of specified insiders or related entities.
- Definitions and scope:
  - Banking Law defines economic groups; Decision No. 6-2009 provides extensive definitions capturing a wide range of natural and legal associations.
  - SBP has discretion to require information and to consider parties as assumed related parties if information is refused or insufficient.
- EC2 (arm’s length terms):
  - Banking Law, Article 96 prohibits granting related party transactions on more favorable terms than typical market conditions.
  - Policies/conditions are verified to ensure related party credits are not more favorable in amount, term, interest, and/or guarantee than those granted to other debtors.
- EC3 (Board approval and conflict exclusion):
  - Decision No. 6-2009 requires BoD to approve related party transactions above an internally set threshold (Article 4, paragraph 3).
  - Regulation requires BoD approval where conflict of interest exists and Board members not to participate in case of conflict.
  - On-site review of Board minutes verifies discussion/approval of related party accounting recognition of losses and ensures related parties do not participate in approval of credits recognized as a loss.
- EC4 (preventing beneficiaries from participating in approval/management):
  - Supervisory manual and on-site examination sampling verify that banks’ policies prevent persons benefiting from transactions from participating in approval and management.
- EC5 (limits, capital deduction, collateralization):
  - Regulations establish prudential limits; maximum exposure of 25 percent of regulatory capital aligns with single counterparty limits.
  - Regulations are not sufficiently specific regarding setting specific limits or deducting from capital.
  - Credit risk regulation (4-2013) gives SBP power to apply greater reserves for an exposure (Article 32).
  - SBP has broad powers and has used them in related party cases.
- EC6 (identification, monitoring, independent review):
  - Banks required to have policies/processes to identify individual related party exposures.
  - Credit exposures subject to independent review by risk units and internal audit.
  - SBP on-site examinations assess coverage and due diligence and review board/risk committee minutes to ensure monitoring and governance.
- EC7 (aggregate reporting):
  - Article 14 requires entities to submit reports on credit facilities granted to a single person or economic group and to related parties.
  - SBP receives comprehensive regulatory reporting: full balance sheet quarterly and detailed credit information; credit records include economic groups and related parties.
- Assessment: Largely compliant.
- Remaining regulatory shortcomings identified:
  - No explicit requirement for material related party exposures to be monitored and reported to the Board.
  - Definition of exposures could be expanded beyond credit-related transactions (e.g., service contracts).
  - Need for explicit Board approval requirement to write-off related party exposures.
  - No mandatory notification to the SBP when a material related party exposure has been entered into.
  - Banks have discretion to set thresholds for Board approval of related party transactions; a more dynamic limit framework and governance requirements are warranted.

### Country and transfer risk (Principle 21: EC1–EC6; Assessment)
- Regulatory framework:
  - Decision No. 7-2018 Country Risk Management Policies is a dedicated standard to manage and mitigate country risk.
  - Decision No. 8-2010 “Issuing provisions on comprehensive risk management” is also relevant.
- EC1 (policies/processes):
  - Banks are required to develop and implement policies/processes to manage country and transfer risk.
  - Banks’ strategic plans (including cross-border exposure plans and country risk appetites) are assessed by SBP.
  - Country risk limits and types of exposures must be established; banks required to monitor regional developments.
- EC2 (Board approval and oversight):
  - Article 4 stipulates BoD responsibility to develop and implement policy framework for country and transfer risk.
  - SBP reviews BoD and Board Risk Committee minutes to evaluate policy quality, reporting obligations, and limit framework commensurate with risk profile.
- EC3 (information systems and aggregation):
  - Article 7 requires banks to establish and implement appropriate information systems to identify and aggregate country risk exposures; effectiveness evaluated on-site.
- EC4 (provisioning oversight):
  - External auditors set percentage ranges for provisions in relation to country risks; SBP communicates with auditors and banks to ensure prudent valuations.
  - SBP has past experience adjusting provisioning (example mentioned: Venezuela).
- EC5 (stress testing):
  - Stress testing is not prescribed by the SBP for country risk; experience in banks is mixed.
- EC6 (supervisory information):
  - SBP receives information through the ITBank system on exposures by country and monitors country risk exposures via regulatory reports.
- Assessment: Compliant.
- Comment: Regulatory framework is comprehensive except for absence of stress testing (EC5); stress testing deficiencies are graded in CP15.

### Market risk (Principle 22: EC1 — opening findings)
- Regulatory instruments:
  - Decision No. 3-2018 “Establishing the capital requirements for financial instruments registered in the trading portfolio” (Chapter II- Market Risk and Trading Portfolio Management and Administration) addresses traded market risk.
  - Decision No. 12-2019 “Issuing provisions on investments in securities” (Chapter II-Management of Investments in Securities) is also relevant.
- Requirement summary:
  - Regulations clearly stipulate the need for banks to establish an appropriate market risk management process and governance arrangements applied bank-wide (see Article 4).

*Source: https://www.imf.org/-/media/files/publications/cr/2024/english/1panea2024003.pdf*

### 1. Trading activity is relatively limited across the sector. With respect to what is part

### 1. Trading activity is relatively limited across the sector. With respect to what is part of the regulatory trading book, the most common instruments traded are:

### Trading activity and instrument composition
- Fixed income instruments: 73 percent — agency bonds, corporate bonds, sovereign bonds and public company bonds.
- Equity instruments: 16 percent — shares, shares in investment funds, ETFs.
- Trading derivatives: 10 percent.

### Accounting classification of banks' securities investment portfolios (before provisions) as of June 2022 (Working paper 191.2)
- 59 percent Fair value investments with changes in other comprehensive income
- 36 percent Investments at amortized cost
- 5 percent Fair value investments with changes in profit and loss

### Market risk exposures (regulatory trading book definition)
- Main sources of market risk identified by the SBP:
  - 1. Interest Rate Risk
  - 2. Stock price risk
  - 3. Credit risk
  - 4. Exchange rate risk
- Note: There is a portfolio classified at fair value with changes in other comprehensive income that is part of the bank book (not the trading book), made up mostly of fixed income instruments issued in US dollars; its primary exposures are Interest rate risk and credit risk.

### Measurement scope and regulatory framework
- Market risk of the trading book, in terms of capital requirements, is measured at three levels:
  - Individual Bank
  - Bank and Subsidiaries of a financial nature
  - Banking Group
- Regulation (3-2018) provisions:
  - Defines the trading book (Article 2) and grants the SBP power to direct assets to be included in the traded portfolio.
  - Addresses boundary issues between the traded book and banking book (Article 5).
  - Sets minimum standards for market risk management (Article 4).
  - Article 6 assigns responsibilities to the Board of Directors (BoD) and top management for identifying and appropriately managing market risks, including approval of internal models and limitation policies proposed by the risk unit.
- Common measurement and management tools used by banks:
  - concentration limits, loss limits, Value at Risk (VaR), VaR limits, rating limits, sensitivities to movements in interest rates.
- Reporting: Risk Units report this information at Risk Committee and Board of Directors meetings.

### Supervisory approach and activities
- The SBP undertakes risk-based on-site examinations.
  - For D-SIBs on-site examinations are undertaken on an annual basis.
  - For lower risk banks, an examination at least every two years.
- The supervisory manual (MUSBER) contains extensive procedures for assessment of risk management.
- Supervisory assessments include:
  - Annual receipt and assessment of policies by SBP to evaluate BoD role in developing and approving market risk policies and processes.
  - Assessment of Board minutes to evaluate risk governance.
  - Off-site review of Board-approved policies and on-site meetings with senior management, ALCO, and BRC minutes.

### Supervisory enhancements in progress
- The Risk Directorate is preparing a project to request weekly information from banks on aggregate losses of investment portfolios (fair value with changes in other comprehensive income, amortized cost, and fair value with changes in loss and gain).

### Findings re EC2 (Board governance and oversight)
- The supervisor determines that banks’ strategies, policies and processes for management of market risk have been approved by the banks’ Boards and that the Boards oversee management to ensure effective implementation and integration into overall risk management.
- Regulatory and guidance references:
  - Decision No. 8-2010 “Issuing provisions on comprehensive risk management” (Articles 6 and 7).
  - Decision No. 3-2018 Article 6: primary responsibility of the board of directors and top management to establish policies and procedures to identify and manage market risks, including approval of internal models and limitation policies proposed by the risk unit.
- MUSBER provides the framework for assessing governance arrangements and risk management frameworks via off-site and on-site procedures.

### Findings re EC3 (Market risk environment and controls)
- The supervisor determines that banks’ policies and processes establish an appropriate and properly controlled market risk environment including:
  - (a) effective information systems for accurate and timely identification, aggregation, monitoring and reporting of market risk exposure to the bank’s Board and senior management;
  - (b) appropriate market risk limits consistent with the bank’s risk appetite, risk profile and capital strength, and with management’s ability to manage market risk, communicated and understood by relevant staff;
  - (c) exception tracking and reporting processes ensuring prompt action at appropriate senior management or Board level;
  - (d) effective controls around the use of models to identify and measure market risk, and set limits;
  - (e) sound policies and processes for allocation of exposures to the trading book.
- Decision No. 3-2018 (Articles 7, 10, 11, and 13) requires market risk management frameworks to include at least:
  1. Organization, duties and delimited and segregated responsibilities;
  2. Policies and procedures manuals;
  3. Suitable employees and professionals;
  4. Documentation, reports and reporting;
  5. Methods for the identification, prevention, measurement, analysis and valuation of market risks;
  6. Trading book fair value daily registry;
  7. Controls and limits for market risk exposure;
  8. Appropriate computer systems;
  9. Allocation of equity pursuant to the provisions herein;

*Table 1. Panama: Detailed Assessment of Compliance with the Basel Core Principles*

### 10. Disclosing  in  the  financial  statements,  at  least,  the  policies,  composition  and

### 10. Disclosing  in  the  financial  statements,  at  least,  the  policies,  composition  and  changes  to  the  trading  book,  capital  requirements,  and  the  profits  and  losses  resulting from the trading book.

### Trading book disclosure, reporting, and supervisor access
- Banks report quarterly data on positions by asset class (IT Bank tables BAN 17 and BAN 18).
- The atom of investments in securities (AT15) is received monthly and identifies securities that are part of the regulatory trading portfolio to monitor the volume of this portfolio.
- The accounting regulatory return (atom AT21) is reported monthly; the SBP identifies and tracks profits and losses of investment portfolios that have gone through the results of the period using the following securities profit and loss accounts:
  - Profit/Loss on Buying and Selling Securities
  - Gain/Loss on Financial Instruments at fair value with changes in profit or loss
  - Gain/Loss on Financial Instruments at fair value with changes in other comprehensive income
  - Profit/Loss on Marketable Derivatives
- The Risk Directorate analyzes this information during on-site inspections and in specialized reports.
- Banks must report monthly the unrealized loss/gain of the fair value portfolio with changes in other comprehensive income via the investment atom; this is reviewed during inspections.

### Regulatory requirements and supervisory practices related to market risk (EC4)
- Supervisory determinations:
  - Systems and controls ensure banks’ marked-to-market positions are revalued frequently.
  - All transactions are captured timely; valuation uses consistent and prudent practices and reliable market data verified by a function independent of the relevant risk-taking business units (or, in absence of market prices, internal or industry-accepted models).
  - Model reliance for valuation requires validation by a function independent of the relevant risk-taking business units.
  - Banks must establish and maintain policies and processes for valuation adjustments for positions that cannot be prudently valued, including concentrated, less liquid, and stale positions.
- Relevant regulation excerpts:
  - Article 12: internal operating and administrative controls; authorized activities and internal limits by segment of the trading book; limits must consider cumulative realized and unrealized losses in designated periods.
  - Article 4: model validation and governance; SBP assesses governance of models and inputs.
  - Article 5: strict limitations on transfers between trading book and banking book; transfers permitted only in extraordinary circumstances, at substantiated request of top management and public disclosure; market events, liquidity changes, or change of trading intent alone are not valid reasons.
  - Article 7: trading book to be valued daily with oversight by an independent risk unit.
- Supervisory analysis and on-site testing:
  - Market risk management systems are subject to internal audit (Article 14 of Agreement 3-2018).
  - Supervisors meet with the three lines of defense during on-site examinations to assess controls, reporting of limits and management of market risks.

### Market risk capital and EC5 findings
- SBP confirms capital calculations are correct; valuation adjustments are rare and not significant.
- Majority of instruments valued using publicly available prices and rates (e.g., Bloomberg).
- Mark-to-model valuations are not regularly used.
- Market risk capital for the system is approximately 1.7 percent RWAs.

### Stress testing and EC6 findings
- There is no explicit regulatory stipulation requiring banks to perform stress testing; general risk management requirements exist (see EC1 and EC2).
- SBP recommends banks implement stress testing as part of an integrated approach to market risk management.
- Absence of formal SBP guidance places emphasis on SBP on-site examinations; standards are at different stages.

### Assessment of Principle 22
- Rating: Compliant
- Key points:
  - Regulations set minimum standards for market risk management and necessary policies and processes.
  - Banks must identify and manage market risks; Board of Directors has primary responsibility.
  - Common measurement/management tools: concentration limits, loss limits, Value at Risk (VaR), VaR limits, rating limits, sensitivities to movements in interest rates.
  - Exposure to market risk is de minimis in terms of proportion of total income derived from trading and in terms of market risk weighted assets.
  - On-site examination frequency: D-SIBs annually; lower risk banks at least every two years.
  - No explicit regulatory requirement for stress testing — deficiency noted and graded in CP15.

### Interest Rate Risk in the Banking Book (IRRBB) — Principle 23 overview and specific EC findings
- Overall assessment: Materially non-compliant
- Regulatory status:
  - No dedicated regulation updated to align with Basel standards (April 2016).
  - Decision No. 8-2010 is a general risk management standard including IRRBB identification and management.
  - SBP developed a draft Agreement for IRRBB (Working paper 194.2 - AGREEMENT ON THE MANAGEMENT OF INTEREST RATE RISK OF THE BANK BOOK VERSION 1 01_01_2019) aligned with Basel, but draft not in force.
- Reporting and supervisory practice:
  - SBP uses inspection processes and ITBank reports to evaluate IRRBB:
    - Accounting Atom (AT21): monthly; contains information on interest income and expenses used to analyze financial margin trends.
    - Interest Rate Atom (AT09): monthly; banks report interest rates on assets and liabilities.
  - SBP does not receive routine reporting on IRRBB; on-site examinations are opportunity for in-depth review.
  - SBP has authority to survey banks system-wide when necessary (e.g., 2019 survey on IRRBB management, Working paper 195.1).
  - A template project is underway to collect information to measure IRRBB as part of Market Risk Management objectives.
- EC1 findings:
  - Draft Agreement contemplates criteria and metrics banks must perform to measure IRRBB (Articles 5–11).
  - MUSBER includes procedures for evaluation and metrics reporting; Risk Directorate does not regularly measure IRRBB at system level.
- EC2 findings:
  - Measures and limits for IRRBB are reviewed during inspections; Board approval of management framework is verified.
  - Regulations relatively general; draft regulations more specific.
  - Relevant instruments: Decision No. 8-2010; Decision No. 5-2011 (Article 13); IRRBB Draft Agreement (Articles 13, 14, and 16).
- EC3 findings:
  - Regulatory framework not formalized but draft guidelines cover EC specifics; internal processes developed and incorporated into supervisory manual.
  - Banks have implemented internal processes for IRRBB; inclusion in on-site examinations evidenced.
- EC4 findings (stress testing):
  - No detailed specific stress test guidelines currently; draft Agreement Article 19 requires:
    - "Banks shall carry out at least once a year, and when required by the Superintendency of Banks, stress tests of the interest rate risk of the bank book to which it is exposed. To do this, the bank must properly document the work done. Stress tests will be performed for both economic value and profits. One of the results of the tests should be to explain the additional capital requirements needed in stress scenarios."
  - Absence of formal regulation problematic for enforcing robust stress testing; steepening of the yield curve in 2022 necessitated additional attention to IRRBB.
- Additional assessment comments:
  - Reliance on on-site examinations for IRRBB assessment; off-site reporting inadequate for ongoing surveillance of NII and capital impacts.
  - No specific stress testing requirements; SBP does not receive routine IRRBB reporting and does not assess banks’ internal capital systems for IRRBB.

### Liquidity risk framework — Principle 24 EC1 and EC2 findings
- Prescribed liquidity ratios and monitoring:
  - Banks required to meet two prudential liquidity ratios:
    - Legal liquidity index (LLI)
    - Liquidity Coverage Ratio (LCR)
  - LCR addresses short-term liquidity risk measuring coverage of high-quality liquid assets on net cash outflows within 30 days.
  - LLI sets a minimum weekly limit of coverage of eligible liquid assets on net computable deposits within 186 days.
  - Article 4 of Decision No. 4-2008: minimum LLI for General License and International License Banks is 30 percent; LLI will be 20 percent for banks with an interbank deposit quarterly average greater than 80 percent of their total deposits.
  - EVAP (table of Maturity Structure of Assets and Liabilities) is sent weekly at the close of every Friday with a deadline to report until Sunday (General Resolution SBP-RG-0001-2022).
  - Articles 30, 37, and 40 of Decision No. 2-2018 revise liquidity regulation; Rule No. 2-2018 is comprehensive.
- Long-term liquidity:
  - No prudential requirement for long-term mismatch; NSFR not implemented.
  - Article 76 of the Banking Law requires banks maintain a maturity structure for assets and liabilities favoring adequate financial liquidity.
- Qualitative standards and governance (selected regulatory excerpts):
  - Article 3: liquidity position must be commensurate with scale of funding gaps.
  - Article 4: liquidity risk strategy should include policies on normal liquidity needs and liquidity implications in stress.
  - Article 9: Board must be informed about increase in liquidity deficit.
  - Article 21: banks must have an information system enabling effective management and monitoring of net financing needs.
  - Article 13: banks must identify, measure, monitor and control liquidity positions from future cash flows and contingent liquidity sources.
  - Article 15: banks must have robust frameworks for dynamic future forecasts, scenario analysis, realistic short- and long-term liquidity assumptions, and analysis of asset quality for collateral use.
  - Article 16: banks must identify, measure, monitor and control potential cash flows from irrevocable off-balance sheet commitments and contingent liabilities.
  - Article 18: banks must use indicators projecting cash flows and future liquidity positions across horizons, under normal and stress conditions.
- EC2 findings:
  - Article 3 of Decision No. 2-2018 sets comprehensive liquidity risk management principles to ensure the bank can meet liquidity obligations intraday and during major stress scenarios.

*Source: https://www.imf.org/-/media/files/publications/cr/2024/english/1panea2024003.pdf*

### 1. To maintain sufficient liquidity, composed of assets easily tradable in the market,

### 1panea2024003 - 1. To maintain sufficient liquidity, composed of assets easily tradable in the market,

### Objectives of bank liquidity management
- 1. To maintain sufficient liquidity, composed of assets easily tradable in the market, putting it in a position to survive periods of liquidity stress;
- 2. To achieve a liquidity position matching the complexity of its on- and off-balance sheet operations, its assets and liabilities liquidity, the scale of financing gaps, the diversity of its business model and its funding strategy;
- 3. To use sufficiently conservative assumptions on the possibility of trading the assets making up its liquidity position in the market and on its access to funding during stress scenarios;
- 4. To not allow competition-related stress to compromise the integrity of the bank’s management, control functions and liquidity risk limitation systems, nor its liquidity position.

### Regulatory calibration and market context
- The prescribed liquidity requirements (mainly the LCR) are risk sensitive in the calibration of run-off assumptions for liabilities.
- The absence of a central bank in Panama means banks do not have access to a lender of last resort and emergency liquidity assistance; as a result, the calibration of the two liquidity ratios is conservative.
- Example calibrations:
  - minimum run off rate is 10 percent (compared with a 3 percent run-off rate under Basel).
  - the definition of HQLA is closely aligned with the BCBS definitions with one major exception: deposits with the Banco National Panama (BNP) are included as Level 1 assets.
- The ratios are a reflection of market conditions and macroeconomic factors.

### EC3 — Supervisor assessment of liquidity management frameworks
- Supervisor determination:
  - banks have a robust liquidity management framework requiring maintenance of sufficient liquidity to withstand a range of stress events;
  - frameworks include appropriate policies and processes approved by the banks’ Boards;
  - policies provide a comprehensive bank-wide view of liquidity risk and are consistent with banks’ risk profile and systemic importance.
- Description and findings:
  - Regulations: Banking Law, Chapter VI (Bank Liquidity), Article 73 (Liquidity Requirements); Articles 3, 4, and 5 of Decision No. 4-2008 require banks to implement a liquidity risk management strategy commensurate with the size, scale and complexity of the bank and banking group.
  - Articles 6 & 7 require senior management to be responsible for developing and implementing the liquidity risk management framework and communicating through the organization.
  - Boards of Directors (BoDs) are required to be responsible for developing and implementing the liquidity risk management framework, including strategy, funding plans, risk limits, measurement tools, reporting obligations and policies and processes.
  - The SBP assesses banks’ liquidity risk management frameworks in depth during on-site examinations and takes into consideration systemic importance and a bank’s liquidity risk profile.

### EC4 — Liquidity strategy, policies and governance
- Supervisor determination:
  - banks’ liquidity strategy, policies and processes establish an appropriate and properly controlled liquidity risk environment that includes:
    - (a) clear articulation of an overall liquidity risk appetite approved by the banks’ Boards;
    - (b) sound day-to-day, and where appropriate intraday, liquidity risk management practices;
    - (c) effective information systems for identification, aggregation, monitoring and control of liquidity risk exposures and funding needs (including active management of collateral positions) bank-wide;
    - (d) adequate oversight by the banks’ Boards to ensure management implements policies and processes consistent with liquidity risk appetite;
    - (e) regular review by the banks’ Boards (at least annually) and appropriate adjustment of strategy, policies and processes in light of changing risk profile and external developments.
- Description and findings:
  - On-site supervision processes aligned with EC4 are found in Form 19 – FEN – Technical Relations – Objective 2.
  - Rules and processes cited: Article 6, MUSBER: FEGRI, Liquidity Risk, Objective 2, Procedures 3 and 4; Chapter II; Articles 23 and 24, MUSBER: FEGRI, Liquidity Risk, Objective 2, Procedures 3 and 5; Article 21, MUSBER: FEGRI, Liquidity Risk, Objective 3, Procedure 9; Articles 6 and 9, MUSBER: FEGRI, Liquidity Risk, Objective 2, Procedures 2, 3, and 5; Article 4, MUSBER: FEGRI, Liquidity Risk, Objective 2, Procedures 3 and 4.

### EC5 — Funding strategies and monitoring
- Supervisor determination:
  - banks are required to establish, and regularly review, funding strategies and policies and processes for ongoing measurement and monitoring of funding requirements and effective management of funding risk.
  - policies must consider interaction with other risks (credit, market, operational and reputation risk) and include:
    - (a) analysis of funding requirements under alternative scenarios;
    - (b) maintenance of a cushion of high quality, unencumbered, liquid assets usable without impediment to obtain funding in times of stress;
    - (c) diversification in sources (counterparties, instruments, currencies and markets) and tenor of funding, with regular review of concentration limits;
    - (d) regular efforts to establish and maintain relationships with liability holders;
    - (e) regular assessment of the capacity to sell assets.
- Description and findings:
  - Regulations: Decision No. 2-2018 (see Articles 11 and 14). Article 11 requires banks to consider interaction between funding liquidity risk and market liquidity risk exposures and cautions that financial markets may not function perfectly in stress scenarios.
  - Guidelines for contingency funding plans are extensive (see Article 27); CFP must be consistent with bank complexity, risk profile, scale, and role in financial systems.
  - Banks submit funding plans annually and strategic business plans; plans are assessed under normal and stressed circumstances.
  - SBP evaluates assumptions, economic and market context, reasonableness and reliability of sources of funds; on-site reviews include ALCO minutes, BRC minutes and reporting, and interviews with Treasury staff.

### EC6 — Contingency funding plans (CFP)
- Supervisor determination:
  - banks must have robust CFPs to handle liquidity problems, formally articulated, adequately documented, not reliant on lender of last resort support, with clear lines of responsibility, communication plans (including with the supervisor), and regularly tested and updated.
  - supervisor assesses feasibility in light of risk profile and systemic importance and requires remediation of deficiencies.
- Description and findings:
  - Rules and processes: Articles 4, 9, and 27 of Decision No. 2-2018.
  - Article 27 requires a CFP to cover policies, regulations, procedures and action plans to respond to severe disruptions of funding in a timely manner and at a reasonable cost; CFP must be consistent with bank complexity, risk profile and scale.
  - CFP must contain:
    1. A clear description of a diversified set of potential contingent funding measures that are viable, easy to make and flexible, oriented towards maintaining liquidity and eliminating treasury deficits under different adverse situations;
    2. Identification of the potentially available contingent funding sources and the volume of funds that the bank believes could be available from these sources;
    3. Clear reinforcement and prioritization procedures describing when and how any of the measures could and should be activated, as well as the necessary time period for obtaining additional funds from each of the contingent sources;
    4. A very flexible framework that permits the bank to react rapidly in very diverse situations.
  - SBP evaluates CFP design, implementation, and connection with continuous liquidity risk analysis, scenario results and stress-testing; CFP must be operative for different temporary horizons, including intraday.

### EC7 — Liquidity stress testing
- Supervisor determination:
  - banks must include a variety of short-term and protracted bank-specific and market-wide liquidity stress scenarios (individually and in combination), using conservative and regularly reviewed assumptions, into stress testing programs.
  - results of stress tests must be used to adjust liquidity risk management strategies, policies, positions and to develop effective CFPs.
- Description and findings:
  - Articles 25, 26, and 27 of Decision No. 2-2018 address short-term and protracted liquidity stress events and need for risk management tools.
  - Article 25 requires liquidity risk stress testing on a consolidated banking group basis, using scenarios for different temporary horizons including intraday.
  - The survival horizon for the LLI is 186 days which is significantly longer than the LCR at 30 days providing banks with buffers that should provide access to liquidity for a significant period.
  - The guidelines are extensive and the SBP undertakes analysis of scenarios and outcomes of stress testing results.

### EC8 — Foreign currency liquidity and currency-specific monitoring
- Supervisor determination:
  - supervisor identifies banks carrying out significant foreign currency liquidity transformation and requires separate analysis and monitoring for each significant currency, including stress testing and limits on cash flow mismatches, monitoring ability to transfer liquidity across currencies, jurisdictions and legal entities.
- Description and findings:
  - Regulations require banks to evaluate liquidity risk in foreign currency and undertake:
    1. Evaluate the added liquidity requirements in the foreign currency and determine the collateral exposure for acceptable currencies;
    2. Perform a separate analysis of the bank’s strategy for each currency in which it has a significant stake, including potential restrictions in stress scenarios. The scale of collateral exposure for the currency must take into account:
       - The bank’s capacity to capture funds in currency markets;
       - The ability to acquire financial terms backed by foreign currency in one’s own national market;
       - The ability to transfer liquidity surpluses of one currency to another, as well as between jurisdictions and legal entities;
       - The possible convertibility scenarios for currencies in which the bank has operations, including the possibility of deterioration or total closure of currency swaps markets for certain currency pairs.
    3. Understand and be capable of managing exposures coming from using deposits and short-term lines of credit denominated in a foreign currency to fund assets in the national currency, as well as those resulting from funding assets in foreign currency with national currency;
    4. Take into account sudden risk fluctuations in exchange or market liquidity rates, or both, given their potential to sharply expand the liquidity gaps and alter the efficiency of currency coverage and coverage strategies.

*Source: https://www.imf.org/-/media/files/publications/cr/2024/english/1panea2024003.pdf*

### 5. Evaluate the possibility of losing access to currency markets, as well as the possible

### 1panea2024003 - 5. Evaluate the possibility of losing access to currency markets, as well as the possible

### Liquidity risk: currency market access and convertibility
- If the bank has significant exposures to liquidity risk in a given currency, the bank must negotiate backup liquidity terms in that currency or develop a contingency strategy.
- The absence of a central bank where a lender of last resort facility is available makes ex ante liquidity risk management vital to the stability of the system and individual banks.
- In relation to offshore bank operations, the SBP places reliance on the host supervisor to set liquidity limits and to ensure compliance with liquidity requirements and risk management standards.

### Assessment of Basel Core Principle 24 (Liquidity risk management)
- Assessment: Materially non-compliant
- Findings:
  - Liquidity regulations are generally comprehensive and reflect the BSBC Principles for Sound Liquidity Risk Management.
  - Banks must meet two prudential ratios to manage short term liquidity and funding risk: the LLI and LCR.
  - Regulations are prescriptive regarding (i) inclusion of HQLA and eligibility criteria; and (ii) calibration of run-off assumptions.
  - Banks must establish and regularly update funding plans that take into account disruptions to liquidity and funding conditions; plans are regularly stress tested and contingency funding plans are developed for idiosyncratic and market-wide shocks.
  - The Board of Directors (BoD) takes responsibility for developing and implementing the liquidity risk management framework.
  - Supervisory assessments (on-site and off-site) include analysis of liquidity returns; funding plans; stress testing and scenario analysis; policies, processes and strategies; reporting to BoD; and discussions with ALCO and Treasury staff.
  - The LCR is calculated and reported on a Level 1 basis and not Level 2 (or group-wide), resulting in material subsidiaries being omitted from the calculation.
  - Domestic non-bank subsidiaries’ liquidity needs are not captured in LCR reporting; thus a consolidated view of group-wide liquidity is not achieved.
  - The lack of a consolidated approach impairs both liquidity supervision and the effectiveness of consolidated supervision; this omission is material for the assessment.

### Operational risk: Principle 25 overview
- Principle statement: The supervisor determines that banks have an adequate operational risk management framework that takes into account their risk appetite, risk profile and market and macroeconomic conditions, including policies and processes to identify, assess, evaluate, monitor, report and control or mitigate operational risk.

### EC1 — Legal and regulatory requirements for operational risk management
- Relevant regulation: Decision No. 11-2018 "Issuing new provisions on operational risk".
- Key regulatory components:
  - Article 4 – organizational structure with an independent risk management unit.
  - Article 5 – strategy for operational risk management approved annually by the BoD.
  - Article 6 – policies and processes addressing measurement, monitoring and management tools (e.g., risk matrices, limits, indicators, databases).
  - Article 19 – Risk management unit.
  - Article 27 – operational risk capital requirements.
- Operational risk capital framework:
  - ARTICLE 25. Bank up for potential losses. The Superintendency may establish capital requirements to cover operational risk, based on international standards and according to the situation in the banking center or of a particular bank.
  - ARTICLE 26. Determining operational risk-weighted assets. Operational risk-weighted assets are determined by multiplying the Business Index (IN, for its acronym in Spanish) amount, as defined in the Technical Appendix of this Rule, by 0.75.
  - ARTICLE 27. Operational risk capital requirements. Minimum operational risk capital requirements are determined by multiplying the operational risk-weighted assets established above by the capital coefficient for the due date. The calculation should be made on a quarterly basis following the operational rules established by the Superintendency.
- Calculation approach: Banks use the basic indicator approach. The Business Index (IN) is defined as: IN = CIAD + CS + CF. CIAD is the interest, leasing and dividend component, CS is the service component and CF is the financial component.
- Supervisory assessment tools and on-site activities include:
  - Assessment of management and board committee minutes.
  - Interviews with senior management responsible for operational risk management.
  - Assessment of policies and processes with sample testing.
  - Assessment of control and risk self-assessments (CRSAs).
  - Evaluation of risk appetite and limit frameworks.
  - Interviews with bank staff from the three lines of defense.
  - Evaluation of loss data and scenario analysis.
  - Assessment of staff training and capital adequacy calculations for operational risk.
  - Analysis of business environment and internal control factors.

### EC2 — Board oversight and approval of operational risk framework
- Regulatory expectation: Article 16 of Decision No. 11-2018.
- Board responsibilities (selected):
  - Approve the operational risk management policies and relevant methodology.
  - Approve business continuity plans that permit effective reaction to adverse situations.
  - Approve necessary resources for operational risk management (infrastructure, methodology, staff).
  - Ensure the risk committee complies with operational risk duties.
  - Know exposures, main operational risk principles, and required regulatory capital for operational risk.
  - Ensure operational risk is within established tolerance limits and require periodic reports from the risk committee.
  - Document operational risk matters and decisions in board meeting minutes.
- Governance requirements:
  - Regulations require banks to establish a risk committee with responsibility for operational risk, typically the Board Risk Committee (Article 17).
  - The SBP reviews the operational risk management framework annually for systemic banks and every two years for smaller/lower risk banks (MUSBER: Appendix 8, Objective 1, Procedures 1–4).

### EC3 — Implementation and integration of operational risk policies
- Regulatory basis: Articles 16–20 and Article 10.
- Implementation expectations:
  - Policies and processes must be implemented enterprise-wide.
  - Banks must continuously evaluate events and incidents using:
    - Risk maps.
    - Global limit and specific limits.
    - Operational Risk Indicators (IROs).
    - Operational risk databases.
  - Article 22 requires banks to carry out at least once (1) a year self-assessments to detect strengths and weaknesses in the control environment; documentation of the self-assessment is required.
- Supervisory procedures: MUSBER Appendix 8 describes procedures for supervisors to verify implementation, including on-site examinations, reports, and off-site analysis.

### EC4 — Disaster recovery and business continuity planning
- Regulatory basis: Article 21 and Article 22 of Decision No. 11-2018.
- Requirements and findings:
  - Banks must implement a business continuity plan aimed at providing effective responses to ensure service and banking business continuity; the plan must be tested once a year at minimum and included in the operational risk manual.
  - Banks must carry out an annual self-assessment to detect strengths and weaknesses in control of operations and services; the self-assessment captures DR and continuity planning.
  - Additional reinforcing standards:
    - Decision No. 8-2010 “Issuing provisions on comprehensive risk management”
    - Decision No. 6-2011 "Establishing guidelines on electronic banking and the management of related risks"
    - Decision No. 03-2012 "Establishing guidelines for the management of information technology risk”
    - General Resolution SBP-RG-0192-2019 “Expanding the reporting requirement established in Article 28 of Decision No. 011-2018”
  - Supervisory assessment of DR and business continuity planning is set out in MUSBER: Appendix 8, Objective 4, Procedure 12.
  - Technology infrastructure mix: on-site data centers and third-party service providers; banks do not use cloud service providers for critical systems (such as core banking) though cloud is used for some applications such as platform development.
  - Article 21 requires banks to test DR plans annually and submit DR test results to the SBP for assessment and potential follow-up.
  - The SBP has access to operational risk experts in the Risk Bureau to benchmark and identify sector-wide improvements.

### EC5 — Information technology governance and resilience
- Regulatory basis: Article 21 and Agreement 3-2012.
- Requirements and findings:
  - Article 21 requires an information security management system oriented to ensure integrity, confidentiality and availability of information.
  - Agreement 3-2012 establishes guidelines for IT risk management including: Information Technology Governance; Information Technology Risk Management; Information technology or "IT"; Information Security.
  - The regulation is relatively comprehensive for governance and risk management standards for IT security risk.
  - Inspection planning tailors scope and procedures, including specialized inspections: special information security – cybersecurity, special electronic banking, special legal department, SAC case inspection, specialized reports.
  - In some inspection types (Legal Management and SAC case), resulting reports are for internal use with only general findings shared externally.

*Source: 1panea2024003 - 5. Evaluate the possibility of losing access to currency markets, as well as the possible (PDF).*

### conclusions of the case are shared with the Legal Department and the Customer Service

### 1panea2024003 - conclusions of the case are shared with the Legal Department and the Customer Service

### Supervisory activities with a technology focus
- Recent inspections in the last two years included: IT Governance and Risk Management inspections; inspections based on cybersecurity risk; special inspections; comprehensive monitoring; fraud through electronic channels.
- Supervisory inspection types described:
  - Comprehensive inspections (SB_I): the most general and in-depth monitoring measure provided for in MUSBER. Evaluates Technology Risk, IT Governance, IT Organizational Infrastructure, Policies and Procedures, and is broad enough to draw conclusions regarding banks' GRENP assessment and rating methodology.
  - Follow-up inspections (SB_S): supervisory action with a specific and limited scope focusing on aspects where weaknesses or deficiencies were detected previously or in follow-up of recommendations.
  - Special Follow-up Inspections (SB_SE): focus on a certain product, area or risk and verify relevant points found in the previous inspection; for Technological Risk, issues of Cybersecurity and Electronic Channels are reviewed.
  - Special Technology Risk Inspections (RT-E): cover topics of IT Governance, Cybersecurity, Management with Suppliers among others.
  - Continuous Supervision Inspections Electronic Banking and Digitalization (GRT_SCBED): review controls and processes in the authorizations of the electronic channels.
  - Electronic Banking Inspections Claims Service Case (BE_CSAC): address customer complaints about unrecognized transactions and security controls applied to electronic channels.

*EC6, EC7, and EC8 supervisory findings and legal/regulatory references follow below.*

### EC6 — Information systems to monitor operational risk
- EC6 expectation: supervisor determines that banks have appropriate and effective information systems to:
  - (a) monitor operational risk;
  - (b) compile and analyze operational risk data; and
  - (c) facilitate appropriate reporting mechanisms at the banks’ Boards, senior management and business line levels that support proactive management of operational risk.
- Relevant regulatory sections: Articles 8, 9, 10, 13, 16–19, and 23.
- Article 23 requirements for operational risk loss databases:
  - Banks must design and implement centralized and high-quality databases to record, order, classify, and have available information on events and incidents, and guarantee staff involved are trained.
  - Databases must meet the following criteria: operational risk (events or incidents) originated anywhere in the bank must be recorded, and policies and procedures must be developed for their capture and communication.
  - Minimum information to be recorded about each event and/or incident:
    - Category: event or incident;
    - Type of occurrence;
    - Identification code (assigned by the bank);
    - Business line, according to Appendix 2 of this Rule;
    - Another business line, according to Appendix 2 of this Rule;
    - Origin;
    - Affected product;
    - Process or area to which it belongs;
    - Type of risk (according to level one of Appendix 1 of this Rule);
    - Risk cause (according to level two of Appendix 1 of this Rule);
    - Description of the event.
- Supervisory verification per MUSBER:
  - MUSBER: Appendix 8, Objective 8, Procedure 18 — verification involves evaluating existence and content of manuals, policies and procedures for collection of loss data, analysis to determine causes, and confirmation that corrective actions have been implemented.
  - SBP supervision procedures include verifying that financial institutions have implemented tools to measure behavior of losses (incidents) and events that could cause losses against established limits.
  - Procedures applied are described in Appendix F8, objective No. 5 of the Single Manual for Risk-Based Supervision (MUSBER).

### EC7 — Reporting mechanisms to keep supervisor apprised of operational risk developments
- EC7 expectation: supervisor requires banks to have appropriate reporting mechanisms to keep the supervisor apprised of developments affecting operational risk.
- Relevant regulatory provisions and findings:
  - Articles 28 and 29 are the two most relevant sections for notification requirements:
    - ARTICLE 28. REPORTING REQUIREMENTS. Banks shall submit an annual report containing the main issues and results of the operational risk management program, electronically and in the format the Superintendency provides, by January 31 of each year.
    - ARTICLE 29. ADDITIONAL REQUIREMENTS. Banks will make available to the Superintendency any information, database, policies, processes, procedures, management systems, strategies, plans, and others mentioned in this Rule, as well as reviews by auditors and the parent company if the parent company is abroad.
  - Assessment: These requirements are relatively broad but do not necessarily capture the requirement to apprise the SBP, especially an immediate notification in the event of an operational risk event.

### EC8 — Outsourcing: policies, processes, and supervisory oversight
- EC8 expectation: supervisor determines that banks have established appropriate policies and processes to assess, manage and monitor outsourced activities, covering:
  - (a) conducting appropriate due diligence for selecting potential service providers;
  - (b) structuring the outsourcing arrangement;
  - (c) managing and monitoring the risks associated with the outsourcing arrangement;
  - (d) ensuring an effective control environment; and
  - (e) establishing viable contingency planning.
- Regulatory framework and supervisory focus:
  - Majority of Panamanian banks are adopting digitalization strategies that make use of outsourced service providers; SBP has increased focus on outsourcing arrangements, especially for technology service providers.
  - Decision No. 9-2005 "Developing outsourcing" Articles 3–8 relate to outsourcing.
    - Article 3: activities that do not require SBP approval (examples: administrative activities, general services, transportation etc.).
    - Article 4: except for activities in Article 3, all outsourcing contracts will need to be authorized by the Superintendency of Banks. The analysis of the authorization request will be done in a term not greater than thirty (30) business days, and until the banking entity has been notified of the decision made, it cannot carry out the requested outsourcing.
    - Article 5: minimum requirements include:
      - Setting detailed policies or specific criteria for assessments and decision-making related to outsourcing;
      - Analyzing and assessing feasibility;
      - Developing, implementing and supervising effective programs for continuous and adequate management of all risks inherent to outsourcing;
      - Not decreasing capacity to completely fulfill obligations to customers and the regulatory authority;
      - Satisfying obligations with the Superintendency of Banks regarding effective supervision—outsourcing should not interfere with the Bank’s capacity to observe regulatory requirements;
      - Executing due diligence regarding the provider and verifying necessary financial soundness, reputation, policies and controls, and ability to fulfill obligations;
      - Relationship between the banking entity and the provider must be governed by a written contract clearly describing rights, guarantees, responsibilities and expectations of both parties;
      - Establishing and keeping, jointly with the service provider, contingency plans regarding the activity or process, including recovery plans in case of disasters and the periodic tests pertinent to the provider’s support systems;
      - Requiring the service provider to protect and maintain due reticence on all confidential information furnished regarding the banking entity and its customers;
      - A viable alternate plan in case of the provider’s service discontinuance.
    - Article 6: refers to the need for Internal Audit and External Audit to have influence in the process.
    - Article 7: relates to general obligations of the bank such as record keeping.
  - Banking entities may outsource activities specific to their raison d'être with the prior authorization of the SBP, in accordance with Article 4 of Agreement 9-2005.

*Source: 1panea2024003 - conclusions of the case are shared with the Legal Department and the Customer Service*

### 2005. The assessment of the application for authorization for outsourcing shall determine

### 1panea2024003 - 2005. The assessment of the application for authorization for outsourcing shall determine

### Outsourcing and operational risk (references: Article 9; Article 14 Agreement 3-2012; Article 19 Agreement 6-2011)
- Assessment requirement: determine whether the outsourcing contract or agreement contains at least Article 9 of that agreement.
- Agreement 3-2012 (Article 14) requires banks outsourcing IT functions to ensure compliance with the Agreement on Outsourcing issued by the Superintendency of Banks and its numerals 1 and 2, regulating:
  - access by the Superintendency of Banks to IT infrastructure, information systems and databases; and
  - obligation of the contracted company to send the bank all information required by the Superintendence.
- Agreement 6-2011 (Article 19) addresses relationships with third parties and security providers of the Electronic Banking service.
- Additional criterion AC1: supervisor regularly identifies common points of exposure to operational risk or potential vulnerability (e.g., outsourcing of key operations by many banks to a common service provider or disruption to outsourcing providers of payment and settlement activities).

### Principle 25 — Operational risk: findings
- Assessment: Compliant
- Findings:
  - Comprehensive regulations provide a solid foundation for banks’ management of operational risks.
  - Regulations require BoD responsibility for setting a risk appetite and require KRIs to be developed as forward-looking indicators.
  - Board reporting is via the risk committee; SBP dedicates time during on-site examinations to review adequacy of reporting and identifies weaknesses.
  - Capital is calculated using the basic indicator approach.
  - Banks collect loss data included in their risk measurement and monitoring.
  - Contingency planning responsibilities are clearly described in regulations.
  - Gap: a specific regulatory requirement to keep the SBP apprised of developments affecting operational risks is warranted.

### Principle 26 — Internal control and audit: framework and supervisory practice
- Principle statement: supervisor determines banks have adequate internal control frameworks (delegation of authority, separation of functions, reconciliation, safeguarding assets, independent internal audit/compliance).
- Relevant regulations: Decision No. 5-2011 (Articles 4–7 and 27); Decision No. 7-2014 (Articles 4, 5, 7, 9).
- EC1 (regulatory requirements for internal control):
  - Regulations require an effective internal control system with authority, independence, resources, and Board access; accounting systems must have established procedures for identifying, consolidating, classifying, computing, analyzing, recording, summarizing, and reporting operations.
  - Articles 4–7 of Decision No. 5-2011 fully address CP (a)–(d).
- EC2 (balance of skills and resources in control functions):
  - Supervisory practice: annual self-assessment questionnaire; SBP validates responses and uses them in on-site scoping; on-site meetings with back office and compliance staff verify adequacy commensurate with bank risk profile; higher risk areas attract more SBP attention.
- EC3 (compliance function):
  - Inspections analyze accounting, IT control environment, AML controls, and business-line specific controls.
  - MUSBER requires on-site meetings with Board Risk Committee, compliance, internal audit, and risk unit.
- EC4–EC5 (internal audit function and effectiveness):
  - Decision No. 5-2011 Articles 8–10 set duties and minimum standards for IA; Decision No. 7-2014 complements for consolidated groups.
  - SBP interacts frequently with IA via inspections and continuous monitoring (quarterly or occasional visits).
  - Circular No. SBP-DR-0301-2020 requires annual internal audit questionnaire based on BCBS principles; questionnaire areas include charter, characteristics, HR, scope, planning, reports, quality control, outsourcing.
  - SBP assesses IA resources off-site and on-site; Head of IA reports directly to BAC; SBP receives IA plan after BAC and BoD ratification.
  - Scope for improvement: more frequent and structured SBP engagement with Head of IA and BAC; more structured review of IA plan achievement.
- Assessment of Principle 26: Compliant
- Comments:
  - Regulations require appropriate control environment and audit arrangements; SBP dedicates considerable attention to line 2 (compliance/back-office) and line 3 (IA) during extensive on-site examinations.
  - Improvement area: more frequent and structured engagements with Head of IA and BAC to keep apprised of IA findings on an ongoing basis.

### Principle 27 — Financial reporting and external audit: framework and supervisory powers
- Principle statement: banks prepare financial statements per internationally accepted accounting practices; external audit with adequate governance and oversight.
- EC1 (Board responsibility and accounting standards):
  - Relevant instruments: Banking Law Article 87; Decision No. 1-2010 Article 2; Decision No. 4-2010 Article 2; Decision No. 5-2011 Articles 6,7,13; Decision No. 7-2014 Article 33.
  - Banking Law: banks with general or international license must submit audited financial statements within three months following fiscal year close.
  - Accounting standards: IFRS implemented in 2018 (Article 2 of Agreement 6-2012).
- EC2 (external auditor opinion and audit standards):
  - External auditors must issue independent opinion in accordance with International Standards on Auditing; governance overseen by BAC and BoD.
  - Relevant legal sources: Banking Law Articles 81, 82, 87; Decision Nos. 1-2010, 4-2010, 5-2011, 7-2014.
- EC3 (valuation and fair value):
  - IFRS mandatory; SBP reviews audited financials annually and compares notes to regulatory returns.
  - No formal framework for prudential fair value adjustments; inputs derived from market prices and public indexes; trading activities relatively limited with traded market risk comprising approximately 1 percent of total risk weighted assets for the system.
- EC4 (scope of external audits and SBP powers):
  - SBP does not have power to establish scope of external audits, though it can influence scope informally and require a ‘special report’ (Agreement 4-2010 Article 9) where warranted.
  - Appointment of external auditor does not require SBP prior approval, but Article 8 of Agreement 4-2010 requires notice of hiring and audit team details; contracting letter/audit contract must be available and sent to SBP on request.
  - Decision No. 6-2012 Article 4 aligns reports/opinions with International Standards on Auditing.
- EC5 (audit coverage of material areas):
  - Decision No. 6-2012 and Decision No. 4-2010 Article 9 specify comprehensive audit report areas including accounting principles, provisioning, consolidation, fair value, questionable transactions, related party transactions, and compliance with prior recommendations.
- EC6 (power to reject external auditor):
  - Banking Law Article 84 empowers Superintendency to reject or order removal of external auditors lacking experience, specialization, or independence.
- EC7 (rotation):
  - Decision No. 4-2010 Article 14: audit firm rotation on a five-year basis; partners and managers rotated on a three-year period.
  - No formal rules separating consulting and EA for same firm; SBP assesses independence where same firm provides extra services.
- EC8 (SBP meetings with external auditors):
  - No routine individual SBP–external auditor meetings; SBP meets audit profession collectively, and convenes meetings before year end (Oct, Nov) to present supervisory concerns.
- EC9 (external auditor reporting to SBP):
  - Decision No. 4-2010 Article 9 lists documents to be made available to SBP (audit letter, audit plan, audit committee communications, management letters, sheets of audit differences, special reports).
  - Current practice: external auditor reports typically channelled via the bank to SBP; SBP does not have power to require external auditors to report directly to SBP (EC9 not met).
- AC1 (access to working papers):
  - AC1: supervisor power to access external auditors’ working papers where necessary — described but SBP lacks full formalized power.
- Assessment of Principle 27: Largely compliant
- Comments:
  - All banks apply IFRS; SBP lacks a prudential valuations framework (BCBS-style).
  - SBP should increase periodic engagement with external auditors (scope, main findings, vulnerabilities, views on internal controls).
  - SBP lacks formal power to establish audit scope (EC4) and to require external auditors to report directly to SBP (EC9).

### Principle 28 — Disclosure and transparency: public disclosures and SBP publications
- EC1 (periodic public disclosures):
  - Banking Law Article 88 requires banks to publish audited financial statements within 30 days after submission to SBP and display them for 90 days in a public location.
  - Banking Law Article 92 obliges the Superintendency to disclose financial/statistical information for the banking system and each bank; Article 33-A requires consolidated financial statements published on website and main banking establishment within seven (7) business days of submission to SBP.
  - Decision No. 7-2014 Articles 33-A2, 35, 36 set consolidated publication and reporting requirements.
  - General Resolution SBP-RG-0001-2022 sets submission frequencies; audited financial statements – Annual frequency.
  - High comparability of financial statements due to IFRS; SBP publishes portfolio classification and amended portfolio data on its website (system and individual bank disclosures).
  - Public disclosures for largest banks typically quarterly; solo and consolidated disclosures available; quarterly financials and semiannual/annual audited statements.
- EC2 (scope and detail of disclosures):
  - SBP has not formally adopted Basel Pillar III; full extent of qualitative and quantitative Pillar III-type disclosure is not required.
  - Circular 200-2015 expanded annual report content and requires submission within one hundred and twenty (120) calendar days after fiscal year closure; required items include governance, risk management summaries, solvency analysis, consolidated audited financial statements.
  - Disclosure gaps: transactions with related parties and compensation not specified; no SBP framework for senior management remuneration (e.g., FSB principles); no additional disclosure tailoring for systemically important banks.
- EC3 (group structure disclosures):
  - SBP requires group information submissions (e.g., BAN03 Chart on Economic Groups and Related Parties quarterly within thirty (30) calendar days); however, regulation does not explicitly require banks to publicly disclose all material entities in the group.
- EC4 (enforcement of disclosure standards):
  - SBP reviews audited financial statements and uses Corporate Governance Evaluation Form (FEGOB) "Reporting and Transparency" subcomponent; SBP compares annual reports to regulatory reporting.
- EC5 (SBP publishes aggregate banking system information):
  - SBP publishes comprehensive monthly and annual banking sector reports and "Dynamic Financial Statistics" with individual bank and system-level balance sheet and performance data.
- Assessment of Principle 28: Largely compliant
- Comments:
  - SBP regularly publishes granular system and individual bank data; banks publish consistent reports under IFRS on solo and consolidated basis.
  - Missing elements relative to Pillar III: standardized publication requirements for related party transactions, LE asset quality, remuneration, and D-SIBs data; absence of Pillar III framework means certain disclosure aspects (related party loans, LE asset quality, remuneration, D-SIB data) are not met.

### Principle 29 — Abuse of financial services / AML-CFT supervision
- Legal and regulatory framework:
  - Banking Law Chapter III (Articles 112–114) on Prevention of Money Laundering.
  - Law No. 23 of 2015 (Articles 19, 20, 26, 41, 42, 49, 53, 54, 56, 57) on measures to prevent ML/TF/FPWMD.
  - Decision No. 10-2015 "Prevention of the misuse of banking and trust services" (Articles 3, 6, 9, 10, 14, 15, 16, 19, 22–31, 33, 35–39, 41, 42, 47).
  - Decision No. 6-2011 on electronic banking (Article 11-Security Incident Reports).
- EC1 (supervisor duties/powers): laws/regulations establish SBP duties, responsibilities, and powers for AML/CFT supervision.
- EC2 (bank policies/processes): Decision No. 10-2015 requires manuals, minimum due diligence, unusual/suspicious transaction rules (Articles 3, 10, 29–31).
- EC3 (reporting to SBP): no explicit compulsion for banks to notify SBP of suspicious activity materially affecting safety/soundness/reputation; fraud notification requirements exist; CTRs and STRs reported to FIU via electronic platform.
- EC4 (SBP informing FIU): Decision No. 10-2015 Article 32 requires SBP to inform FIU if it becomes aware of a STR; SBP confirms it does so when on-site or if it becomes aware.
- EC5 (CDD program elements):
  - Law No. 23 of 2015 Articles 26–28, 34, 36–40; Decision No. 10-2015 Articles 3, 6, 9, 10, 14–16, 19, 22–31 require documented CDD manual approved by Board, automatic warning systems, enhanced due diligence for high-risk and PEPs, record retention (at least five-year retention period).
  - Supervisory testing: off-site review of self-assessments and documentation; on-site sampling of files and systems; supervisory colleges; routine meetings with UAF.
- EC6 (correspondent banking):
  - Decision No. 10-2015 Articles 7 and 8 require due diligence on correspondent relationships and prohibit relationships with banks lacking physical presence in home jurisdiction or not subject to consolidated supervision.
  - SBP tests correspondent due diligence on-site; self-assessment questionnaire includes correspondent due diligence questions.
- EC7 (controls and systems):
  - Law No. 23 of 2015 and Decision No. 10-2015 set requirements; SBP tests adequacy via on-site sampling of customer files, ML committee minutes, STR sampling, and assessment of detection metrics and processes.
- EC8 (sanctions powers):
  - Law No. 23 of 2015 Article 20 and Articles 59–60 enable SBP action and penalties.
  - Decision No. 10-2015 Article 39: penalty for noncompliance ranges from five thousand balboas (B/.5,000.00) to one million balboas (B/.1,000,000.00), depending on seriousness or recidivism.
  - Decision No. 9-2015 sets administrative procedure for violations; published penalties on Superintendency website.
- EC9 (internal audit/compliance/HR/training):
  - Law No. 23 of 2015 Article 45; Decision No. 10-2015 Article 37 on internal audit independent evaluation.
  - Requirements for compliance officers (Law No. 23 Article 12; Decision No. 10-2010 Article 30).
  - HR screening and Know Your Employee (Law No. 23 Article 42; Decision No. 10-2015 Article 27).
  - Ongoing training obligations (Law No. 23 Articles 42, 47; Decision No. 10-2015 Article 28).
- EC10 (reporting channels and MIS): legal framework requires policies/processes and SBP verifies training and implementation.
- EC11 (whistleblower protection): Law No. 23 Article 56 and Article 57; Decision No. 10-2015 Article 35 provide exemptions from liability and protection for employees reporting in good faith.
- EC12 (domestic/foreign cooperation): SBP coordinates with UAF, participates in Joint Task Force with Public Prosecutor's Office; signed Memoranda of Understanding with 29 foreign supervisors and interinstitutional agreements with multiple domestic authorities (listed agreements and dates in source).
- EC13 (SBP specialist resources): SBP has annual inspection plan; all banks inspected at least once every two years; systemic banks inspected every year; SBP has specialist team dedicated to prevention; resources assessed as adequate.
- Assessment of Principle 29: Largely Compliant
- Comments:
  - SBP clearly established responsibilities and conducts on-site and off-site supervisory activities; routine liaison with UAF provides extensive STR reporting data.
  - Panama’s FATF grey listing has elevated AML/CFT as a high SBP priority.
  - EC4 partially met: SBP notification requirements cover fraud and technology incidents, but not explicitly all suspicious activity; EC4 requires SBP to inform FIU of additional suspicious transactions it becomes aware of — immediate notification is perceived as significant for reputation risk.

### Key statistics, timeframes, and numeric requirements preserved from source
- Banks with general or international license shall, within three months following the close of each fiscal year, submit audited financial statements to the Superintendency.
- Publication/display requirements:
  - Publish audited financial statements within 30 days after submission to SBP.
  - Display them for the next 90 days in a location accessible to the public in each establishment.
- Consolidated financial statements publication: within seven (7) business days of submission to SBP.
- Annual report submission by bank holding group’s board: within one hundred and twenty (120) calendar days after fiscal year closure (Circular 200-2015).
- Audited financial statements submission frequency: Annual frequency (General Resolution SBP-RG-0001-2022).
- Rotation requirements:
  - Audit firm rotation on a five-year basis.
  - Partners and managers must be rotated on a three-year period.
- Trading activities: traded market risk comprises approximately 1 percent of total risk weighted assets for the system.
- Penalties for AML/CFT noncompliance: from five thousand balboas (B/.5,000.00) to one million balboas (B/.1,000,000.00).
- Banks inspected: all banks at least once every two years; systemic banks inspected every year.
- Self-reporting and submission timelines: BAN03 Chart on Economic Groups and Related Parties submitted quarterly within thirty (30) calendar days after quarter expiry.
- Record retention period for CDD records: at least five-year retention period.

### Summary of supervisory strengths and areas for enhancement
- Strengths:
  - Comprehensive regulatory framework for internal control, audit, financial reporting, AML/CFT.
  - Mandatory IFRS adoption (implemented 2018) leading to high comparability.
  - SBP publishes extensive system and individual bank data monthly and annually; dynamic financial statistics available.
  - Dedicated AML/CFT supervisory resources; routine cooperation with UAF and other domestic and foreign authorities; specialist team and inspection cadence defined.
- Areas for enhancement (identified in source):
  - Formal requirement for banks to inform SBP of material developments affecting operational risk.
  - More frequent and structured engagement between SBP and Heads of Internal Audit and Board Audit Committees.
  - SBP lack of formal power to set scope of external audits (EC4) and to require external auditors to report directly to SBP (EC9); consider formalizing such powers.
  - Adoption of a prudential valuation framework (BCBS-style) for fair value adjustments.
  - Formal adoption of Pillar III-style disclosure requirements to capture related party transactions, compensation, and disclosures adjusted for systemic importance (D-SIBs).

*Source: 1panea2024003 - 2005. The assessment of the application for authorization for outsourcing shall determine (PDF chapter).*

### 1. Responsibilities, objectives, and powers MNC

### 1. Responsibilities, objectives, and powers MNC

### Legal framework and SBP responsibilities
- The legal framework provides the SBP, as sole regulator of banks and banking groups in Panama, with the necessary legal powers to authorize banks, conduct ongoing supervision, address compliance with laws and undertake timely corrective actions to address safety and soundness.
- The Banking Law sets out the SBP’s four separate objectives, which have equal status in the Law.
  - Two objectives—safeguarding the soundness and efficiency of the banking system and strengthening and fostering the Republic of Panama as an international financial sector—have the potential to conflict.
  - The SBP’s primary objective should be to safeguard the soundness of the financial system, with the remaining three objectives subordinate to this objective.
  - The remaining two objectives—promoting trust in the banking system and safeguarding the judicial balance between the banking system and its clients—do not pose a potential conflict with the SBP’s safety and soundness objective.
- The SBP consults on all material changes to its regulatory framework, but timelines for responses are short (usually one month).

### Independence, accountability, resourcing, and legal protection for supervisors
- Article 4 of the Banking Law established the SBP with full legal status as an autonomous agency, including administrative, budgetary, and financial independence, but this autonomy has been significantly constrained following consecutive annual Budget Laws since 2019.
- Since the passing of the 2019 Law:
  - All recruitment and other personnel decisions that have a budgetary impact need to be pre-approved by the relevant state institutions.
  - Prior to 2019, the SBF had only to notify the MEF of its recruitment and other budgetary expenditure.
  - Delays in getting approval for the initiation of new recruitments have given rise to the high level of current vacancies in the SBP.

### Cooperation and collaboration
- The Banking Law provides the SBP with appropriate powers to establish cooperation links with all domestic and foreign regulatory authorities.
- MoUs, both bilateral and multilateral, have been agreed with all relevant authorities.
- The Banking Law enshrines strict confidentiality requirements on information received in the course of supervisory activities.
- Recent MoUs have included full confidentiality clauses, and these should be incorporated in all MoUs when updated.

### Permissible activities, licensing, and ownership transfers
- Permissible activities of institutions licensed and supervised by the SBP are clearly defined and the use of the word “bank” in names is controlled. (Grade: C)
- Licensing criteria:
  - The SBP’s approach to licensing banks is thorough. The legal framework provides the SBP with the necessary powers to set criteria and reject applications.
  - The process involves early-stage discussions and detailed assessment of ownership structure, fitness and propriety of Board members and senior management, financial viability of the proposal, and corporate governance arrangements.
  - Where the proposed owner or parent organization is a foreign bank, the prior consent of its home supervisor is obtained. (Grade: C)
- Transfer of significant ownership:
  - Definitions of significant ownership and change of control are clearly set out in the Banking Law.
  - A threshold of 25 percent is set for pre-approval by the SBP of transfers of significant ownership or controlling interests held directly or indirectly in existing banks to other parties.
  - Transfers of shares below the 25 percent pre-approval threshold must be notified by the bank in advance.
  - The SBP has no power to reverse a share transaction or remove voting rights if a transfer of significant ownership were undertaken without prior approval or based on misleading information. (Grade: MNC)
- Major acquisitions:
  - The SBP can approve or reject major acquisitions or investments by banks or banking groups above a threshold of 25 percent of capital.
  - There is no legal or regulatory requirement for banks or banking groups to notify acquisitions or investments below the 25 percent threshold, hindering the SBP’s ability to assess risks from acquisitions or investments in non-banking activities. (Grade: MNC)

### Supervisory approach, techniques, and reporting
- Supervisory approach:
  - The SBP’s supervisory framework provides an effective methodology for assessing risks at the time of assessment, but limited consideration is given to future risks a bank or banking group may run.
  - The methodology includes review of a bank’s strategic plan within the Governance (G) component and discussions during on-site inspections.
  - The SBP requires banks periodically to stress their capital adequacy requirements, but this process is not systematically built into the supervisory framework.
  - The SBP has drafted an ICAAP framework but has set no timeline for implementation.
  - ICAAP implementation proposals should be incorporated within the SBP’s strategic plan.
  - Regular engagement with Board members and heads of key control functions is not built into the supervisory framework; such meetings would complement forward-looking risk assessment. (Grade: LC)
- Supervisory techniques and tools:
  - The SBP employs an effective range of examination techniques and tools; on-site and off-site monitoring is integrated within supervisory departments.
  - Supervisory planning is thorough and structured, with detailed processes in the supervisory manual (MUSBER).
  - The examination program is risk-based, ranging from full scope inspections to targeted reviews.
  - All banks must have a full scope inspection at least every two years.
  - Findings are communicated to banks with clear deadlines; mandated corrective actions are monitored in quarterly updates and follow-up on-site examinations are conducted where necessary.
  - Bank internal management information is reviewed during on-site examinations but is not requested as a matter of routine supervisory practice; regular meetings with heads of material business units, finance and control functions are not part of supervisory plans.
  - Greater use of internal management information and more frequent engagement with bank senior management would enhance risk assessment and inspection planning. (Grade: LC)
- Supervisory reporting:
  - The SBP collects and analyzes a wide range of prudential reports on a solo and consolidated basis, but reports do not cover consolidated liquidity returns, wider concentration risks (e.g., geographic, sectoral, currency), or exposure to interest rate risk in the banking book.
  - Verification of report accuracy is undertaken through on-site examinations, but timing is periodic and not systematic.
  - There is no regulation requiring prudential reports to be signed-off by an appropriate level of the bank’s senior management certifying their accuracy. (Grade: LC)

### Corrective and sanctioning powers; resolution aspects
- Although the SBP does not have a formal resolution regime, it has demonstrated an adequate range of supervisory tools to address concerns and revoke banking licenses.
- Actions taken have included dismissing Board and senior management, forcing mergers, and assuming control of a distressed bank.
- The SBP does not have specific power to ringfence a bank from actions of wider group entities which may impair its safety and soundness. (Grade: LC)

### Consolidated supervision and home-host relationships
- Consolidated supervision:
  - The legal and regulatory framework for consolidated supervision is robust.
  - The SBP has a good understanding of the overall structure of banking groups and their material activities (including non-banking activities), domestic and cross-border.
  - The SBP applies most prudential standards to consolidated entities but does not collect data on consolidated liquidity positions of banking groups (see BCPs 10 and 24).
  - Since August 2020, the liquidity of all regional financial groups has been monitored weekly at the Technical Liaison Committee level of the CCSBSO, both in local currency and in foreign currency. (Grade: C)
- Home-host relationships:
  - The SBP has agreed bilateral MoUs with all foreign regulators of banking groups with cross-border activities and holds periodic colleges of regulators with relevant host regulators.
  - The SBP participates in multilateral college meetings under the umbrella of the CCSBSO.
  - The CCSBSO provides an effective forum for information sharing and cooperation; Liaison and Resolution and Crisis Committees provide a useful channel for coordination on weak banks.
  - These meetings do not specifically consider resolution plans for distressed banks. (Grade: LC)

### Corporate governance
- The SBP has comprehensive regulation covering corporate governance arrangements in banks and banking groups and monitors compliance through regular on- and off-site supervisory approaches.
- Supervisory assessment is tailored to risk profile and systemic importance and covers Board and senior management recruitment, responsibilities and compensation, effectiveness of risk and internal control functions, and organizational structure impediments to effective consolidated supervision.
- Outside on-site inspection, the SBP has limited engagement with Board members or senior management, constraining ongoing understanding of strategic direction, group and organizational structure, and control environment. (Grade: LC)

### Risk management, capital adequacy, credit risk, and problem assets
- Risk management process:
  - Regulations are generally comprehensive but need development in several areas:
    - No regulation stipulates a comprehensive approach to stress testing where all risks are considered against capital and liquidity.
    - No regulation requires banks to undertake recovery planning.
    - No explicit regulatory provision requires notification to the SBP if the CRO is removed.
  - The ICAAP framework is planned for near-term implementation; ICAAP and ILAAP would structure assessment of all material risks.
  - Weaknesses in stress testing are evident in other Principles (e.g., market risk - CP22 and IRRBB - CP23).
  - A differentiated approach to supervising D-SIBs has been implemented, but calibration against capital and liquidity is not explicitly mentioned in regulations and it is not evidenced that D-SIBs are subject to higher capital and liquidity requirements. Reflecting these material weaknesses, an MNC rating is appropriate. (Grade: MNC)
- Capital adequacy:
  - The capital framework is largely aligned with the Basel III Accord: definitions of capital, thresholds, calibration of risk-weighted assets and deductions are equivalent to Basel standards.
  - The differentiated approach to supervising D-SIBs has not changed the capital framework; a systemic risk buffer has not been implemented.
  - No formal buffer framework (e.g., capital conservation buffer and countercyclical buffer) has been implemented.
  - Internationally active banks are not meeting the Basel capital standards (EC2), a material deviation from the Principle.
  - There is scope to deepen capital adequacy assessment to include a broader range of risks (mainly Pillar II risks) and to assess:
    - potential loss absorbency of instruments included in capital base;
    - appropriateness of risk weights as proxy for exposure risk profile;
    - adequacy of provisions and reserves to cover expected losses;
    - quality of risk management and controls.
  - Implementation of ICAAP will support annual assessment of all material risks and integrated risk management with qualitative and quantitative inputs and stress testing.
  (Grade: MNC)
- Credit risk:
  - The SBP has a strong focus on credit risk management with frequent off-site analysis using comprehensive indicators and data.
  - Banks report detailed credit information (counterparty, collateral valuations, loan-to-value ratios, serviceability, vintage, loan type, region, geography).
  - The SBP undertakes individual bank and sector-wide analysis to identify early vulnerabilities and credit risk build-up.
  - On-site examinations sample files from a range of portfolios; loan files are tested and verified for compliance with banks’ internal policies and SBP regulations.
  - Regulations include detailed risk management for governance and risk management, emphasizing segregation of duties, governance, delegations, the three lines of defense, appropriate due diligence to assess serviceability and collateral management. (Grade: C)
- Problem assets, provisions, and reserves:
  - Regulations require banks to classify all on- and off-balance sheet exposures using a prescribed framework.
  - Guidance for classifying loans is extensive and reporting to the supervisor is extensive and frequent.
  - On-site, the SBP focuses on appropriate loan classification, handling of problem assets, and calculation of provisioning.
  - Guidance on collateral valuation is extensive and there is a prescribed set of eligible collateral types for provisioning. (Grade: C)

*Source: 1panea2024003 - 1. Responsibilities, objectives, and powers MNC*

### 19. Concentration risk and large exposure

### 19. Concentration risk and large exposure limits

### Findings on concentration risk framework
- The SBP has implemented a framework for credit concentration risk and large exposure limits.
- Regulations require banks to have policies and processes to identify, measure, evaluate, monitor, report and control or mitigate concentrations of credit risk on a timely basis, reported on a monthly and quarterly basis.
- The SBP sets prudential limits to restrict bank exposures to single counterparties or groups of connected counterparties of 25 percent total capital.
- The SBP undertakes extensive analysis to assess concentration risk based on detailed reporting.
- The regulations for concentration risk are focused predominantly on management of credit-related exposures.
- Supervisory analysis is detailed for large exposures and credit concentration risks, but:
  - A broader definition of concentration risk is needed to capture all significant sources (such as market and other risk concentrations where a bank is overly exposed to particular asset classes, products, collateral, or currencies).
  - Additional data and supervisory processes are required to support a comprehensive view.

### Related supervisory grades and context (selected)
- Principle 19: LC (linked to need to expand definition and include stress testing; see Recommended Actions).
- Principle 24 (Liquidity risk) and Principle 23 (IRRBB) observations highlight gaps in consolidated reporting and off-site monitoring that interact with concentration risk oversight.

### Key operational gaps affecting concentration risk oversight
- Off-site reporting is insufficient in some areas (e.g., IRRBB) inhibiting ongoing surveillance of risks to net interest income (NII) and capital.
- Liquidity supervision is not undertaken on a consolidated basis; LCR is calculated and reported on a Level 1 basis and not Level 2 or group wide, omitting material subsidiaries.
- Lack of consolidated view of group-wide liquidity impairs liquidity supervision and the effectiveness of consolidated supervision, with implications for concentration risk assessment.

### Recommended actions specific to concentration risk (Principle 19)
- Expand the definition of concentration risk in the regulations to include all sources of concentration risk.
- Include the requirement for stress testing of all material sources of concentration risk.

*Authorities’ response highlights and related references*
- Authorities acknowledge progress since the last assessment in 2012 and commit to implementing most recommendations.
- On Principle 15 and stress testing: SBP states there is no specific regulation for comprehensive stress tests in banks but notes macroeconomic assessments by the Financial Stability Directorate, analyses of political and macroeconomic factors, and monthly housing price analyses by real estate experts as mitigants.
- On ICAAP: SBP considers Circular 37-2020 as an initial step guiding entities to develop the Future Capital Needs Report, noting ICAAP’s complexity and the need for time for adoption.
- On powers regarding changes of control (relevant to concentration and ownership): SBP references Article 16, paragraph 18 of the Banking Law empowering the Superintendent “to issue regulations to avoid or correct irregularities or flaws in bank operations which, in his/her judgment, may jeopardize the interests of depositors, the stability of a bank or the soundness of the banking system.” Banking Rule No. 1-2004 on acquisition or transfer of shares establishes in article 28 the sanction for non-compliance.

*Panama: IMF–World Bank FSAP assessment chapter excerpt*

### 68.        Regarding the ILAAP, we accept that its main goal is to demonstrate that the bank

### Regarding the ILAAP, we accept that its main goal is to demonstrate that the bank has sufficient liquidity to function as usual while surviving the stresses of liquidity risk and that it can manage the liquidity risks it faces.

### ILAAP and liquidity risk management
- Main goal: demonstrate that the bank has sufficient liquidity to function as usual while surviving liquidity stress and can manage its liquidity risks.
- Article 3 of the Banking Rule 2-2018 establishes general principles of liquidity risk management to ensure banks can meet liquidity obligations in the short and long term, even during a major liquidity stress scenario.
- Principles include:
  - maintaining an adequate liquidity position adjusted to operational complexity and business model diversity;
  - using conservative assumptions about tradability of assets and access to financing in times of stress;
  - preventing competition from jeopardizing the integrity of management and control functions.
- All banks in this banking center, regardless of size or business model, must comply with all aspects of liquidity risk management according to the LCR.
- Recovery plans: no universal standard required, but recovery actions related to technology, business continuity plans and liquidity exist; Rule 2-2018 sets specific guidelines on the Liquidity Contingency Plan.

### Governance, Risk Management Unit, and CRO
- Supervisor requires larger and more complex banks to have a dedicated risk management unit overseen by a Chief Risk Officer (CRO) or equivalent.
- Removal of a CRO:
  - should be done with prior approval of the Board and generally disclosed publicly;
  - the bank should discuss reasons for removal with its supervisor.
- Risk Management Unit requirement applies across all banks; unit must have a head.
- Banking groups:
  - can fulfill roles through existing group risk management units;
  - for larger and/or more complex groups, the Superintendency may require a dedicated Risk Management Unit for the banking group that does not simultaneously perform functions for subsidiaries.
- The CRO function reports to the CRJ [risk committee of the board of directors].
- Dismissals, resignations and hiring of CROs are reported in practice.
- If shareholders, board members, top management and key personnel do not meet integrity criteria, banks must take measures in policies and immediately inform the Superintendency of reasons for measures taken.
- Banks have notified the SBP of changes in their key personnel.

### Capital adequacy and dynamic provisions (Principle 16)
- Dynamic provisions serve as a countercyclical capital buffer with a minimum of 1.25% and maximum of 2.50%.
- Objectives and effects of dynamic provisioning:
  - reduce procyclicality and strengthen banks' capital, especially during loan portfolio growth periods;
  - subsequent use during stress (e.g., pandemic) proved effective in safeguarding the banking sector and maintaining financial system stability.
- Banking Law grants SBP authority to:
  - request banks to increase current capital at any time;
  - require banking entities to maintain a capital adequacy ratio higher than the minimum, prompting capital injections to bolster higher-quality capital (Primary Capital) to absorb losses.
- Alignment with Basel III:
  - dynamic provisioning implemented since 2013, fulfilling countercyclical buffer purpose;
  - a draft regulation for a capital conservation buffer (as proposed in Basel III) has been presented to the SBP board of directors.
- Treatment and scope of dynamic provisioning:
  - serves as a capital buffer and is not considered when calculating the minimum capital requirement;
  - only taken into account if the capital adequacy ratio exceeds 8%;
  - required for all banks with a loan portfolio, regardless of branch status or international license under host supervision;
  - applies to individual banks, banks and subsidiaries, and banking holding companies.

### Design and implementation details of dynamic provisioning
- Activation parameter: not based on GDP performance or gap behavior due to significant cross-border participation.
- Calculation basis: growth of loan portfolios.
- Caps and floors at establishment: cap of 2.5% and a minimum of 1.25%.
- Pandemic measures:
  - accumulation of dynamic provisioning was suspended;
  - use up to 80% authorized for creation of specific capital provisions.
- Dynamic provisioning does not count toward the 8% requirement.
- General Board Resolution SBP-GJD-R-2023-01125 of June 6, 2023, reinstated the establishment of dynamic provisioning.

### Interest rate risk in the banking book (Principle 23)
- December 2022: Superintendency sent banks a format to report periodic information for interest rate risk in the banking book; instructions sent via announcement SBP-2022-06901 of December 15, 2022.
- Data collection: begin collecting the information in the fourth quarter of 2023.
- Design basis: format and instructions based on principles of the IRRBB standard set by the Basel Committee in 2016.
- Existing data: Superintendency already receives the Rate Atom (AT09) monthly, providing detailed information on assets and liabilities distributed according to yield/repricing rates and applicable fees, used to analyze effects of interest rate fluctuations on Net Interest Income (NII).

### Liquidity supervision and LCR adaptation (Principle 24)
- Supervisory approach: both off-site and on-site liquidity risk management at individual and consolidated levels are significant aspects of banking supervision.
- Evidence provided: tools used for supervision at three levels of consolidation and inspection report extracts demonstrating supervisory impact at individual and consolidated levels.
- December 2022: adaptation period given to banks ended, consistent with Basel deadlines when the standard was issued.
- High-quality liquid asset (HQLA) principles used for LCR calculation were already part of the basket of liquid assets for legal liquidity.
- Context: absence of a central bank; main liquidity elements used by banks in Panama historically included deposits in banks, which are not considered HQLA for the LCR.
- Implication: change represented operational, strategic, and business shifts, considering profitability from tier one assets needed adequate measurement.
- Banking Rule 2-2018 allows incorporation of the indicator calculation at the holding level.

### AML/CFT/FPADM reporting and corporate governance (Principle 29)
- FSAP report observation: “No explicit notification requirement to the SBP if a bank becomes aware of a suspicious activity that could threaten its safety and soundness.”
- Clarification: Corporate Governance Rule No. 5 of 2011, Article 13, literal i) requires the board of directors to:
  - “keep the Superintendency informed about the situations, events, and problems affecting or that may affect the bank and the specific actions to face and/or correct the deficiencies identified.”
- Conclusion: SBP maintains a regulatory requirement obliging banks to report situations, events, or issues that could pose a threat.

### Authorities’ stance and commitments
- Panamanian authorities reiterate commitment to continue advancing implementation of international recommendations and standards to ensure soundness, credibility, and competitiveness of Panama's financial system.

*Source: Panama (paragraphs 68–76) from the provided IMF content unit*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2024/english/1panea2024003.pdf_