Offshore domain law: what stays illegal everywhere

Is it lawful to register a domain through a company in another country?

Yes. No rule of ICANN ties a registrant to a registrar in their own country, and accredited registrars operate from many countries. Picking one abroad is a commercial choice, like choosing a bank or a host abroad.

What the choice changes is procedure. The company you deal with answers to the courts of its home country. PanamaRegistrar holds no ICANN accreditation of its own. Domains are registered through our ICANN-accredited registrar partner. PanamaRegistrar is a domain registration service under Panamanian jurisdiction, paid in crypto with no ID upload: we act on Panamanian court orders, not on unverified complaints. A foreign judgment binds us once it has been recognised by Panama's Supreme Court through exequatur (Law 61 of 2015, Arts. 155–157).

What the choice does not change is the law that applies to you and to your content. If something is illegal where you live, the registrar's address does not make it legal.

What stays illegal whatever the registrar's country?

The serious online offences are crimes almost everywhere, Panama included, and registrars act on them.

• Phishing and pharming: fake login pages and DNS tricks to steal credentials.
• Malware and botnets: distributing malicious code or controlling infected machines.
• Child sexual abuse material: Panama's Penal Code punishes possession with 5 to 10 years in prison (Art. 185, as amended by Law 478 of 2025).
• Fraud that takes money from victims: fake shops, investment and crypto scams, wallet drainers, impersonation of a bank or brand, sale of stolen data. Identity theft using computer data carries 5 to 10 years in Panama (Penal Code Art. 289-A, added by Law 478 of 2025).

These are the strict exceptions in our policy: suspension on a well-documented report, without waiting for a court. Trademark, copyright and defamation disputes are civil matters decided by the law of the countries concerned; a registrar abroad does not erase them. Our full list is in the acceptable use policy.

Why do registrars that promise protection from takedowns end badly?

Because the promise collides with the ICANN contract, and ICANN enforces it. The clearest recent case is Trustname.

According to Domain Name Wire (10 June 2026), Trustname marketed itself to sensitive niches and promised its customers protection from takedowns. ICANN Compliance sent breach notices. Then, in a notice dated 27 August 2026, ICANN terminated Trustname's accreditation, effective 11 September 2026.

The termination notice gives the reasons:

• breaches of RAA §3.18.1 and §3.18.2, the abuse-handling clauses;
• demanding proof that credentials had been stolen before acting on a phishing report;
• acting weeks after reports were made;
• 4 breach notices in 78 days;
• a median rate of domains reported for phishing that rose from about 0.7 % to about 10 % between January and August 2026, measured by ICANN Domain Metrica.

The lesson is simple. A registrar that sells protection from takedowns ends up without an accreditation, and then it cannot sponsor gTLD domains at all. Its customers bear that risk.

How does PanamaRegistrar handle abuse under these rules?

By writing the line down and keeping it. Reports go to [email protected], with no account needed, and each gets an automatic acknowledgement with a reference number.

• Phishing, malware and fraud: acted on within 24 hours of a well-documented report.
• Child sexual abuse material: immediately, and the URLs are reported to NCMEC.
• Other abuse reports: answered within 2 business days.
• Everything else (copyright, defamation, political or competitor complaints): no takedown without a decision from a Panamanian court. With Domain protection, every complaint is also read by a person before any action on the domain.

The counts will appear in the transparency report, every quarter, first issue January 2027. No figure exists yet. How to report: report abuse.

Is it legal to keep my name out of WHOIS?

Yes. ICANN's Registration Data Policy, in effect since 21 August 2025, governs what registration data is published, and privacy and proxy services are recognised in the RAA itself. Keeping your name out of public WHOIS/RDAP is lawful.

Giving false details is another matter. In the United States, knowingly giving a registrar materially false contact information for a domain used in an infringement creates a presumption of wilful infringement (15 U.S.C. §1117(e)). We ask for one real, verified email and nothing to invent. If a registry needs a name and address, Domain protection supplies our company's, openly.