How we handle complaints, by type

How does PanamaRegistrar sort a complaint?

We log it and place it in one of two tracks, under our abuse policy. On a domain with Domain protection, a person also reads it before any action on the domain. The first track covers abuse of the domain name system and fraud against victims. The second covers disputes about what a website says or shows.

The split follows Panamanian law. Under Law 51 of 2008, arts. 90–91, an internet intermediary is liable only once it has actual knowledge that content is unlawful. That knowledge exists once a competent authority has declared the content unlawful and ordered its removal. A complaint letter is not such a declaration.

The first track follows ICANN rules, which apply to us through our accredited registrar partner. ICANN amended the Registrar Accreditation Agreement (RAA) on 5 April 2024. Its section 3.18.2 says a registrar with actionable evidence of DNS abuse "must promptly take the appropriate mitigation action(s)". We add fraud that takes money from victims to that list by our own choice.

Every complaint, whatever its track, is logged and counted in the transparency report.

What happens to a copyright or DMCA-style complaint?

It is logged, forwarded to the domain holder and kept on file; the domain stays as it is until a Panamanian court decides.

• What we need. The work, the URL where it appears, proof that you hold the rights, and your contact details.
• What we do. We send the complaint to the holder's verified email. We answer you in writing with the next legal step.
• What we never do. Suspend, transfer or redirect the domain on the notice alone. Give your notice the effect of a court order.
• The law behind it. Panama's copyright law, Law 64 of 2012, contains no notice-and-takedown procedure and no service-provider safe harbour. Its arts. 175–178 give rightholders court remedies and precautionary measures, ordered by a judge.

A notice under the US Digital Millennium Copyright Act is handled the same way. The DMCA notices page explains why, and what works instead.

What happens to a defamation complaint?

A defamation complaint needs a decision from a Panamanian court before anything happens to the domain.

• What we need. The exact statement, its URL, why you say it is false and harmful, and any court decision you already hold.
• What we do. We forward the complaint to the holder, who can correct, remove or defend the text. We tell you the court route.
• What we never do. Decide ourselves whether a statement is true. Suspend a domain because a statement is unwelcome.
• The law behind it. Law 51 of 2008, art. 90: a host without actual knowledge of unlawfulness is not liable, and actual knowledge comes from a competent authority's declaration. Truth and harm are questions for a judge.

What happens to a privacy or personal data complaint?

It is forwarded to the holder, and the domain is acted on only on a Panamanian court decision.

• What we need. The personal data concerned, the URL, and how you are linked to it. Do not send us more personal data than the page already shows.
• What we do. We pass the complaint to the holder, who is usually the controller of what the site publishes. We point you to the authority that can order a change.
• What we never do. Release the holder's email to you so that you can contact them directly. Treat a request to unmask the holder as a complaint about content.
• The law behind it. Article 42 of the Constitution gives everyone the right to access, correct and delete their personal data. Law 81 of 2019 puts these rights under the national transparency authority, ANTAI, which hears complaints (art. 18). Article 44 adds the habeas data action before the courts.

How are trademark complaints handled?

Trademark disputes about generic domains go to the UDRP, or to the URS for new generic domains, as ICANN requires of every registrar.

• What we need. Nothing from you directly: file with an approved dispute provider, which contacts us.
• What we do. We lock the domain within 2 business days of the provider's verification request (UDRP Rules, para. 4(b)). We tell the holder after the lock, then apply the panel's decision.
• What we never do. Transfer a domain because a brand owner emails us. Tell the holder before the lock is applied, which the UDRP Rules forbid.
• The law behind it. The Uniform Domain-Name Dispute-Resolution Policy and its Rules (2015), and the URS Procedure (2013). Timelines are on UDRP and URS.

A brand impersonated to take money from victims is a different case: it falls under the fraud exception below.

What happens to complaints about political or government content?

They are logged and refused unless a Panamanian court has ruled; a request from a foreign government without Panamanian legal process is refused and counted.

• What we need. The request, the issuing authority, and the legal basis it relies on.
• What we do. We check whether the request comes through Panamanian legal process. Our rule: we confirm every order with the court or prosecutor's office that issued it, through its official contact details, before acting.
• What we never do. Suspend a domain because a government, a party or a public figure objects to its content.
• The law behind it. Law 51 of 2008, art. 87: an intermediary can be ordered to suspend a service once a competent authority has ordered the content removed. A foreign judgment binds us only after exequatur (Law 61 of 2015, art. 156).

The transparency report will list these requests by country of origin and outcome.

What if a competitor complains about my domain?

A competitor's complaint is handled like any other content complaint: no action without a court or panel decision.

• What we need. The same as for the underlying claim: trademark, copyright or unfair competition.
• What we do. We forward it to the holder and tell the competitor which procedure applies. A trademark claim goes to the UDRP or URS.
• What we never do. Act on a commercial rival's word. Tell a competitor who holds the domain.
• The law behind it. Whatever law the competitor invokes, applied by a Panamanian court or a dispute panel.

Do you act on spam complaints?

We act on spam when it carries phishing, malware or fraud; other spam complaints are forwarded to the holder.

• What we need. Full message headers, the sending domain, the links in the message and the date received.
• What we do. Spam that delivers phishing, malware or a scam follows track 1. Other spam is forwarded, and we suggest a report to the sending provider.
• What we never do. Suspend a domain for a single unwanted newsletter.
• The law behind it. The 2024 RAA amendments treat spam as DNS abuse only when it is a delivery mechanism for the other forms.

What happens to an impersonation or fraud report?

Fraud that takes money from victims is suspended on a well-documented report; other impersonation needs a court decision.

• What we need. The URL, what is being imitated, how victims pay (wallet address, payment page) and any victim report or police reference.
• What we do. The rule covers fake shops, investment and crypto scams and wallet drainers. It also covers impersonation of a bank or a brand, and sales of stolen data. Such domains are suspended within 24 hours of a well-documented report. We keep the record.
• What we never do. Require a victim to have lost money before we act. Treat a parody or a review site as fraud.
• The law behind it. Penal Code art. 289-A, added by Law 478 of 2025, punishes identity theft using computer data with 5 to 10 years. Our fraud exception is our own rule; it goes further than ICANN's definition of DNS abuse.

How are phishing and malware reports handled?

A well-documented report of phishing, pharming, malware or a botnet leads to suspension within 24 hours of a well-documented report.

• What we need. The full URL, a screenshot, the time you saw it, and for malware a file hash or a sandbox report.
• What we do. We check the evidence, suspend the domain and write to the holder with the evidence received.
• What we never do. Ask you to prove that credentials were actually stolen before we act.
• The law behind it. RAA §3.18.1 requires "reasonable and prompt steps to investigate and respond appropriately". RAA §3.18.2 requires mitigation of DNS abuse. Penal Code arts. 290, 290-A and 292-A cover data interference, system interference and misuse of devices.

To report, use the abuse form instructions.

How are reports of child sexual abuse material handled?

Child sexual abuse material (CSAM) is acted on immediately, and the URLs are reported to NCMEC.

• What we need. The URL only. Never attach, copy or download the material.
• What we do. We suspend the domain and keep the record for the authorities.
• What we never do. Wait for a court. Forward, store or view more of the material than the report requires.
• The law behind it. Penal Code arts. 184 and 185, as amended by Law 478 of 2025, punish the production, distribution and possession of child sexual abuse material. Possession alone carries 5 to 10 years.

What does the complainant receive?

You receive an automatic acknowledgement with a reference number, then a written answer that names the track and the outcome.

1. Acknowledgement. Quote the reference number in any follow-up.
2. Decision. Either the domain was suspended under a strict exception, or the complaint was forwarded and needs a court or a panel.
3. The legal route. For track 2, the answer names the procedure: Panamanian court, exequatur, UDRP or URS.

Other abuse reports get this answer within 2 business days. You do not receive the holder's email or account details; those leave us only on the routes of our data disclosure rule. The text of your complaint is forwarded to the holder, so write it knowing that they will read it.

What does the domain holder receive?

The holder is told before any action on your domain, unless the law or the court order forbids it.

The message goes to the verified email of the domain. It contains the complaint as received, the track we chose and what, if anything, we did. A holder can answer with evidence, and the answer is kept with the file.

The UDRP is the one case with a fixed order: the lock comes first, and the notice follows. When a Ministerio Público preservation order requires confidentiality (Code of Criminal Procedure art. 338-A, added by Law 478 of 2025), the notice waits. With Domain protection, our company is the registrant of record, a person reads every complaint before any action on the domain, and we still pass every complaint to you.