Director Criminal Liability in Panama: Ley 517 (2026), Playbook for Companies, Directors & Executives

Last updated: May 17, 2026

Panama’s criminal liability landscape shifted on 15 April 2026, when Ley 517 entered into force and materially expanded the circumstances under which companies, directors and senior executives face criminal prosecution and asset-recovery action. For general counsel, compliance officers and board members overseeing Panamanian operations, understanding director criminal liability in Panama is no longer an academic exercise, it is an operational imperative. This playbook distils the new law into concrete, prioritised steps: what changed, who is exposed, how to respond to an investigation, how to negotiate outcomes, and how to build compliance controls that reduce personal and corporate risk.

It is designed to be read in full by those building a programme from scratch, or scanned section-by-section by those already responding to enforcement pressure.

Executive Summary: What Ley 517 Means for Directors and Companies

Ley 517 does three things that demand immediate board-level attention. First, it clarifies and broadens the attribution rules that connect a company’s criminal conduct to its directors, officers and managers, including through failure-to-prevent standards. Second, it expands prosecutors’ asset-recovery toolkit, giving the Ministerio Público wider powers to freeze, seize and place precautionary liens on corporate and personal assets during an investigation. Third, it formalises negotiated resolution pathways, including plea agreements and remedial measures, creating both risk and opportunity for those who engage early. The Ministerio Público’s existing guidance on attributing corporate criminal responsibility now operates alongside Ley 517’s expanded framework, amplifying enforcement capabilities.

Top 5 immediate risks under Ley 517:

• Personal criminal exposure. Directors and officers may be prosecuted individually, not just the company, for authorising, directing or failing to prevent offences.
• Asset freezes without prior notice. Prosecutors can seek provisional measures, including asset freezing, at the outset of an investigation, before charges are filed.
• Involuntary dissolution. In extreme cases, courts may order the dissolution of the legal entity, eliminating the corporate structure entirely.
• Reputational and banking fallout. An investigation alone, even without a conviction, can trigger bank de-risking, loss of correspondent-banking relationships and regulatory scrutiny.
• Cross-border enforcement. Panama’s mutual-legal-assistance treaty network means asset-recovery orders and information requests can reach foreign jurisdictions rapidly.

Top 5 immediate actions for boards and GCs:

• Map exposures. Identify which business lines, contracts and counterparties carry the highest criminal-liability risk under the new framework.
• Review governance documents. Ensure board minutes, delegations of authority and compliance policies document active oversight and decision-making.
• Engage local criminal counsel. Retain Panamanian criminal defence counsel now, not after service of process.
• Prepare an incident-response plan. Document who does what in the first 24 hours of a search, subpoena or asset-freeze order.
• Audit insurance coverage. Check whether D&O policies cover criminal investigation costs and defence under Panamanian proceedings.

Quick Legal Primer: Ley 517 at a Glance

Ley 517, which entered into force on 15 April 2026, amends key provisions of Panama’s Penal Code and Criminal Procedure Code to create a more structured regime for corporate criminal liability in Panama. The reform aligns Panama more closely with international standards on corporate accountability, particularly those promoted by the Financial Action Task Force (FATF) and the Organisation for Economic Co-operation and Development (OECD). Below is a plain-language summary of the provisions most relevant to directors and senior executives.

Statutory Triggers for Corporate and Individual Liability

Ley 517 establishes that a legal entity may be held criminally responsible when an offence is committed on its behalf or for its benefit by a person exercising a leadership, management or supervisory role. Critically, the law also captures situations where a subordinate employee commits the offence due to a failure of oversight or control by those in positions of authority. For directors, this means that mere delegation of operational management does not sever the liability chain. If a director authorised, consented to, or negligently failed to prevent the offending conduct, individual criminal exposure may arise.

Panama’s Commercial Code, particularly Article 444, already imposed fiduciary duties of loyalty and diligence on directors, Ley 517 now adds a criminal dimension to those obligations, as local practitioners have long noted.

Sanctions and Remedies Available to Prosecutors

The sanctions available under Ley 517 are deliberately graduated to encourage cooperation. They include monetary fines calculated by reference to the benefit obtained or harm caused; prohibition from participating in public procurement for a defined period; court-supervised compliance monitors; partial or full suspension of activities; and, in the most serious cases, involuntary dissolution of the legal entity. For individuals, penalties include imprisonment, fines and disqualification from holding corporate office. Importantly, the law also codifies plea agreements as a formal mechanism, creating a structured pathway for negotiated resolutions that may reduce sanctions in exchange for cooperation, admission and remediation.

Who Can Be Prosecuted and When: Directors, Officers and the Corporate Entity

Ley 517 creates a dual-track system. The corporate entity itself may be prosecuted for offences committed on its behalf, and, separately or concurrently, the natural persons who directed, authorised or failed to prevent the conduct may face individual prosecution. This dual exposure means that a single set of facts can generate both a corporate case and individual cases against multiple directors or officers. The law does not require proof that a director personally carried out the offending act.

Prosecution may arise from authorisation (the director approved or instructed the conduct), complicity (the director facilitated or aided the offence), negligence (the director failed to implement adequate controls), or failure to prevent (the director, despite having the authority and duty to do so, did not take reasonable steps to prevent the offence). The standard of knowledge required varies: for some offences, awareness of risk is sufficient; for others, specific intent must be established.

Director Liability Panama: Directors vs. Managers vs. Company, Practical Distinctions

Understanding where the lines of director criminal liability in Panama fall in practice requires distinguishing between board-level directors, operational managers and the company itself. Board directors typically face exposure through authorisation and oversight failures, their risk is greatest when they approved high-risk transactions, failed to question red flags or did not ensure that compliance systems were adequate. Operational managers, by contrast, face exposure through direct involvement in day-to-day decision-making that facilitated the offence. The distinction between shareholder, director and manager liability is critical for defence strategy: shareholders who do not hold management positions are generally insulated from criminal prosecution unless they exercised de facto control.

The corporate entity itself may be convicted even if no individual is prosecuted, and vice versa, reinforcing the importance of separate legal representation for each potential defendant.

Immediate Response Playbook If an Investigation Starts

When a company or director learns of an investigation, whether through service of a subpoena, a dawn raid, an asset-freeze notification, a media report or a tip from a counterparty, the response within the first hours materially shapes the outcome. The following step-by-step emergency checklist, structured by timeframe, provides a practical framework for director criminal liability in Panama situations.

First 24 hours:

1. Activate the incident-response team. Notify in-house counsel, the compliance officer, the CEO and the board chair. If no incident-response team exists, designate one immediately.
2. Engage Panamanian criminal defence counsel. Do not rely solely on corporate or commercial lawyers. Criminal procedure in Panama has distinct rules on privilege, evidence and provisional measures that require specialist expertise.
3. Preserve all evidence. Issue an immediate litigation hold covering emails, messaging platforms, financial records, contracts and electronic devices. Disable automatic-deletion policies for relevant custodians.
4. Restrict communications. Directors and officers should not discuss the investigation on company channels, social media or with third parties. Issue a sample holding statement: “The company is aware of the matter and is cooperating with its legal advisors. No further comment will be made at this time.”
5. Secure privileged material. Physically and digitally segregate documents protected by legal professional privilege. If law enforcement executes a search, assert privilege over identified documents and request that disputed materials be sealed pending judicial review.

24–72 hours:

1. Assess the scope of the investigation. Review any subpoena, court order or communication to understand which offences are alleged, which entities and individuals are targeted, and what documents or testimony are sought.
2. Map assets at risk. Identify corporate and personal assets that could be subject to freezing or seizure. Consider whether assets in foreign jurisdictions may also be vulnerable to mutual-legal-assistance requests.
3. Notify D&O insurers. Most policies require prompt notification; failure to notify within the policy window can void coverage for defence costs.
4. Prepare individual directors. Each director or officer who may be personally exposed should consider retaining separate personal legal counsel to avoid conflicts of interest with the company’s defence.

First two weeks:

1. Launch a privileged internal fact-finding review. Under counsel direction, collect and review key documents and interview critical witnesses to understand the company’s exposure.
2. Evaluate cooperation strategy. Determine whether early voluntary cooperation with the Ministerio Público may mitigate sanctions, or whether a defensive posture is more appropriate given the facts.

30-day plan:

1. Formalise the defence strategy. Present the board with a written assessment of exposure, recommended posture (cooperation, defence or hybrid) and a timeline for key procedural milestones.
2. Remediation. Begin implementing any compliance improvements identified during the fact-finding review, as demonstrable remediation strengthens negotiating position.

Practical Checklist: Evidence Preservation and Chain of Custody

Preserving evidence correctly is essential both for mounting a defence and for demonstrating good faith to prosecutors. Industry observers expect Panamanian courts to scrutinise evidence-handling practices closely under the new framework.

• Litigation hold notice. Issue in writing to all relevant custodians within 24 hours; document receipt and acknowledgment.
• IT forensic imaging. Engage a certified forensic examiner to create verified copies of hard drives, servers and mobile devices before any review occurs.
• Chain-of-custody log. Maintain a contemporaneous log recording who accessed, copied or transported each item of evidence, with dates, times and signatures.
• Cloud and messaging platforms. Ensure preservation extends to cloud-hosted email, collaboration tools (e.g., Teams, Slack) and encrypted messaging applications.
• Physical documents. Secure relevant paper records in a locked, access-controlled location with a sign-in/sign-out register.

Asset Freezing Panama: Seizure and Interim Measures, What to Expect

One of Ley 517’s most immediately consequential features is the expansion of prosecutors’ powers to obtain provisional measures at an early stage of an investigation. Asset freezing in Panama can now be sought on a broader basis, and companies and directors may receive notice only after the order has been executed. Understanding the types of measures and the available defences is critical for preserving the resources needed to fund a defence and maintain business operations.

The Superintendencia de Bancos’ existing AML guidance already requires Panamanian banks to comply with freeze orders and report suspicious transactions, meaning that asset-freeze orders are typically enforced rapidly through the banking system.

The likely practical effect of these expanded powers will be that companies need to maintain a current, confidential asset map, listing all corporate and key-individual assets by jurisdiction, account and type, so that counsel can respond quickly when a freeze order lands.

Conducting Internal Investigations in Panama Under the Ley 517 Framework

An internal investigation, properly designed and executed, serves two functions: it helps the company understand its own exposure, and it generates a record that can demonstrate good faith and cooperation if negotiations with prosecutors follow. Under Panama’s procedural rules, however, a poorly managed internal investigation can create evidence that prosecutors use against the company. Getting this right under the Ley 517 regime is therefore a matter of both legal strategy and practical discipline.

Evidence Preservation and IT Forensic Steps

All internal investigations in Panama should begin with the forensic steps outlined in the evidence-preservation checklist above, conducted under the direction and supervision of legal counsel to maximise the prospect of privilege protection. Key additional steps include:

• Define the scope in writing. The investigation mandate, drafted by counsel, should set clear boundaries on subject matter, time period and custodians.
• Engage independent forensic specialists. Where the investigation involves digital evidence, engage a third-party forensic firm with recognised certifications to conduct imaging and analysis.
• Segregate investigation materials. Store all investigation documents, interview notes and analyses in a dedicated, access-restricted repository, clearly marked as privileged and confidential.
• Document methodology. Record every step of the investigation process to defend its integrity if challenged by prosecutors or in court.

Witness Interviews and Witness Strategy

Witness interviews are often the most sensitive element of an internal investigation. Under Panamanian law, statements made during internal interviews are not automatically privileged, and interviewees may be compelled to testify about them in subsequent proceedings. The following best practices help manage this risk:

• Upjohn-style warnings. At the start of every interview, inform the witness that counsel represents the company (not the individual), that the conversation may not be privileged as to the individual, and that the company may choose to disclose the substance of the interview to authorities.
• Separate counsel for witnesses. Where a witness may be personally exposed, advise them of their right to retain independent legal representation before the interview proceeds.
• Contemporaneous notes. Assign a dedicated note-taker (not the interviewer) to create a factual record of each interview, clearly labelled as prepared at counsel’s direction.
• Avoid coaching. Do not suggest answers, share documents before asking about them, or interview witnesses in the presence of other potential witnesses.

Negotiating Outcomes: Plea Agreements Panama, Remediation and Remedial Measures

Ley 517’s formalisation of plea agreements in Panama represents a significant shift. Prior to the reform, negotiated resolutions were ad hoc and lacked clear procedural footing. The new framework gives both prosecutors and defendants a structured mechanism to resolve cases without full trial, typically in exchange for cooperation, admission, restitution and compliance undertakings. Early indications suggest that prosecutors will favour negotiated outcomes in cases involving corporate offences where the company demonstrates genuine remediation efforts.

Negotiation checklist for companies and directors:

1. Timing. Engage with the Ministerio Público early, ideally before formal charges are laid. Voluntary self-reporting and cooperation from the outset typically yield the most favourable terms.
2. Scope of admission. Define precisely what facts the company or individual is prepared to admit. Avoid open-ended admissions that could create exposure in other jurisdictions or civil proceedings.
3. Restitution and disgorgement. Be prepared to quantify and offer restitution to victims and disgorgement of any benefit derived from the offending conduct.
4. Compliance undertakings. Propose specific, verifiable compliance improvements, not vague promises. A credible compliance programme, independently audited, strengthens negotiating leverage significantly.
5. Monitor provisions. Anticipate that prosecutors may request the appointment of a court-supervised compliance monitor for a defined period. Negotiate the scope, cost-sharing and duration of any monitorship.
6. Confidentiality. Negotiate the terms under which the plea agreement and cooperation materials will be treated as confidential, particularly with respect to information that could be used in foreign proceedings.

Suggested remedial measures to include in negotiation proposals:

• Implementation or enhancement of an anti-corruption and anti-money-laundering compliance programme
• Independent compliance audit by a recognised firm
• Mandatory compliance training for all directors, officers and relevant employees
• Establishment or strengthening of a confidential whistleblower channel
• Restitution or community-benefit payments as appropriate to the offence

Corporate Compliance Panama: Controls to Reduce Director and Corporate Risk

The most effective way to reduce director criminal liability in Panama is to ensure that a robust compliance programme is in place before any investigation begins. Under Ley 517, the existence and effectiveness of a compliance programme is likely to be a material factor in both prosecutorial charging decisions and judicial sentencing. The following ten controls, tailored to Panamanian operations, provide a practical starting framework for corporate compliance in Panama.

Top 10 compliance controls:

• 1. Written anti-corruption and AML policy. Adopt a clear, board-approved policy covering bribery, money laundering, fraud and sanctions, distributed to all employees and counterparties.
• 2. Tone from the top. Board minutes should document regular compliance reporting, discussion of risks and approval of resources for the compliance function.
• 3. Risk assessment. Conduct an annual compliance risk assessment, documented in writing, covering all business lines, geographies and counterparty relationships.
• 4. Third-party due diligence. Implement risk-based due diligence on agents, intermediaries, suppliers and joint-venture partners, the most common channel for corporate criminal exposure.
• 5. Whistleblower channel. Establish a confidential, preferably anonymous, reporting channel with documented procedures for escalation, investigation and non-retaliation.
• 6. Escalation protocols. Define clear escalation paths so that red flags identified at operational level reach senior management and the board promptly.
• 7. Transaction monitoring. Implement automated or manual monitoring of financial transactions for anomalies consistent with bribery, laundering or fraud.
• 8. Record retention. Adopt and enforce a document-retention policy that complies with Panamanian legal requirements and preserves evidence that may be needed for defence.
• 9. Training. Deliver annual compliance training to all directors, officers and relevant employees, with attendance records and assessment of comprehension.
• 10. Periodic independent audit. Engage an independent compliance auditor at least every two years to test the effectiveness of controls and recommend improvements.

Worst-Case Outcomes and Contingency Planning

The most severe sanction under Ley 517 is involuntary dissolution in Panama, the court-ordered termination of the legal entity. While this remedy is reserved for the gravest cases (typically repeat offenders or entities found to have been created or used primarily for criminal purposes), its codification means that boards must treat it as a realistic, if remote, possibility. Other worst-case outcomes include lengthy imprisonment for directors, substantial fines that exceed the company’s liquid assets, disqualification from public procurement and cross-border enforcement that freezes assets in multiple jurisdictions simultaneously.

Contingency planning should include the following steps:

• Insolvency counsel. Identify and pre-engage a Panamanian insolvency specialist who can advise on creditor protection and corporate-rescue options if dissolution proceedings are initiated.
• D&O and crime insurance review. Confirm that existing policies cover criminal defence costs, regulatory investigations and, where available, disgorgement or restitution payments.
• Succession and business-continuity planning. Ensure that the company’s operations, key contracts and banking relationships can survive the removal or incapacitation of key directors or officers.
• Cross-border asset protection. Where assets are held in multiple jurisdictions, engage local counsel in each jurisdiction to monitor for incoming mutual-legal-assistance requests and to prepare defensive filings.

Comparison Timeline and Key Dates for Director Criminal Liability in Panama

Conclusion: 6-Point Action Plan for Boards and GCs

Director criminal liability in Panama has entered a new phase. The following six-point action plan provides a prioritised roadmap for boards and general counsel operating under the Ley 517 framework:

1. Conduct a Ley 517 exposure assessment across all business lines and counterparty relationships within 30 days.
2. Retain Panamanian criminal defence counsel and establish a standing engagement before any investigation arises.
3. Implement or upgrade the compliance programme using the ten-control framework above, with board-documented oversight.
4. Prepare and test an incident-response plan that covers the first 24 hours through to 30-day remediation.
5. Map all corporate and key-individual assets by jurisdiction, account type and vulnerability to provisional measures.
6. Review D&O insurance and business-continuity plans to ensure adequacy under the expanded enforcement landscape.

Sources

1. Ministerio Público de Panamá, Guide to Attribution of Corporate Criminal Responsibility (2019)
2. Icaza, González-Ruiz & Alemán, Responsibility of Directors in the Administration of a Panamanian Company
3. Pacífica Legal, Shareholders’ and Directors’ Liability in Panamanian Corporations
4. Pardini & Asociados, Directors and Managers Liability in Panama
5. Kraemer & Kraemer, Entities Criminal Responsibility in Panama
6. Superintendencia de Bancos de Panamá, Circular on AML Obligations