PAC Panama 2026: migrating off the DGI free invoicing portal without halting operations

What changed on January 1, 2026

Since January 1, 2026, Panama's DGI free invoicing portal (CFEG) is blocked for companies with more than $36,000 in annual gross income or more than 100 documents per month. CCIAP estimates 18,000+ taxpayers must migrate to a certified PAC during the year. Fines start at $500 per document.

This is not a soft deadline. DGI has already suspended CFEG access by RUC for taxpayers who missed the Q1 cutoff. Anyone still emitting through the free portal in February — with the tax notice already on the way — opened a file with accumulated sanctions for every document not issued through a PAC.

This pillar covers the exact requirements of the December 2025 DGI Resolution, the technical architecture of a PAC, common migration mistakes, and concrete scenarios for a Panamanian SMB on Odoo. No empty promises. Just what to do and how to do it before DGI cuts off your RUC.

One-minute summary

• New CFEG limits (January 2026): the free invoicing portal stays available only when both conditions hold — ≤$36,000 in annual gross income and ≤100 documents/month. Cross one threshold and you must migrate to a PAC.
• 18,000+ taxpayers fall under the migration obligation during 2026, per CCIAP estimates.
• Sanctions under Panama's Fiscal Code: $500 per document, up to $10,000 for repeat offenses within 12 months, plus temporary closure of 3 to 10 days in systematic cases.
• A PAC (Proveedor Autorizado Calificado) is the DGI-certified third party that signs the XML, transmits it to DGI, and returns the CAFE with CUFE and QR.
• For Odoo: the OCA's l10n_pa module covers the basics, but integrating with a specific PAC requires custom middleware. No plug-and-play connector exists as of May 2026.

How Panama got to the 2026 migration

DGI launched the Sistema de Facturación Electrónica de Panamá (SFEP) in 2020 via Executive Decree 766. The decree introduced the CFE (Comprobante Fiscal Electrónico), the CUFE (Código Único de Factura Electrónica), and the PAC role. Adoption rolled out in phases: voluntary for large taxpayers first, then mandatory by sector across 2022 to 2024.

By the end of 2024, virtually every active legal entity and active sole proprietor issued CFE through one of two channels:

• CFEG (Comprobante Fiscal Electrónico Gratuito) — the DGI free web portal at dgi-fep.mef.gob.pa. Built for micro-SMBs: type the data into a form, get the CFE with CUFE and QR back. No ERP integration, no batch upload, no API.
• PAC (Proveedor Autorizado Calificado) — a DGI-certified private provider that signs and transmits the CFE programmatically.

Many SMBs with $50,000 to $200,000 in revenue used CFEG far beyond its intent — issuing 200 to 400 documents a month by hand through the portal, saving $80 to $150 monthly on PAC fees. DGI flagged two side effects: the CFEG portal was never designed for heavy use, so peak-hour response times reached 3 to 5 minutes per document; and manual entry let companies split transactions into smaller CFEs, eroding the audit trail and weakening ITBMS oversight.

DGI has analytics by RUC. At the end of 2025 it published the new CFEG thresholds, which took effect on January 1, 2026.

The new CFEG limits: a double filter

Breaking either condition is enough — CFEG is locked. DGI tracks this by RUC automatically: if you issued more than 300 CFEs through the free portal in the previous quarter, or you appear in the taxpayer registry above $36,000, the system cuts your access and requires PAC enrollment.

The technical note from LLB Solutions and the article in La Estrella de Panamá document both sides of the cutoff. La Estrella was the first outlet to cover CFEG removal for taxpayers above $36,000, back in December 2025.

Sanctions, in numbers

Per Panama's Fiscal Code (Article 756 in the December 2025 DGI update):

• First offense: $500 per document issued with anomalies or not issued at all.
• Repeat offense within 12 months: up to $10,000 for each subsequent violation.
• Temporary closure: DGI may close the business for 3 to 10 days for systematic SFEP violations.

How a PAC works technically

A PAC (Proveedor Autorizado Calificado) is a DGI-certified third party that performs five functions:

1. Receives the XML CFE payload from your ERP.
2. Signs the XML with an X.509 digital certificate issued by an accredited certificate authority (CA).
3. Transmits the signed XML to DGI over a secure channel (SOAP or REST).
4. Receives the DGI response — either the CAFE (Constancia de Autorización de Facturación Electrónica) with CUFE and QR, or a rejection with an error code.
5. Returns the CAFE to your system for printing, sending to the customer, and archiving.

Technical components of a CFE

Every CFE includes:

• CUFE — unique identifier (the Panamanian equivalent of Mexico's CFDI UUID or Colombia's DIAN folio).
• XML payload following the official XSD schema published at dgi-fep.mef.gob.pa.
• Digital signature (XAdES-BES standard) applied to the XML, backed by the X.509 certificate.
• QR code with the DGI validation URL — mandatory in both the printed and PDF representation.
• Sucursal + punto de emisión — multi-location reference you must register with DGI before issuing.

The certified PAC registry

DGI publishes and updates the list of accredited PACs. At the start of May 2026 it held roughly 18 providers. The main market players:

• Cuenti — local provider with a REST API and active Spanish-language technical docs. Profile and pricing at cuenti.com.pa.
• The Factory HKA — regional provider with LATAM plugins for multiple ERPs.
• Edicom Panamá — Tier-1 European vendor headquartered in Spain. Pricier ($5k+ setup) but enterprise-ready, with native SAP and Oracle connectors.
• Sovos — geared for multinationals.
• DataPro and Pandora E-Factura — niche providers focused on local SMBs in specific industries.

Market pricing bands:

• Setup: $300 to $5,000 depending on integration complexity.
• Monthly subscription: $30 to $500 depending on document volume.
• Typical SMB ticket (500 to 1,500 CFEs/month): $80 to $150/month.

CFEG vs PAC: what shifts

For a business above $200,000 in revenue and 500+ documents per month, CFEG is irrational even without the migration obligation: 5 to 10 minutes of manual entry per document equals $40 to $80 of hidden staff cost per CFE. At a 6,000-CFE annual volume that translates to $240,000 to $480,000 in operating cost against a $1,500 PAC subscription.

Migrate Odoo to a PAC, step by step

The full CFEG-to-PAC migration takes 7 to 21 days, depending on data readiness and integration complexity. If you're hiring an Odoo implementation partner in Panama from scratch, add another week for initial discovery.

#1. Pick the PAC (1-3 days)

Hard selection criteria:

• Open REST API — critical for Odoo and any modern ERP. A closed SOAP with a proprietary XML-RPC is vendor lock-in in disguise.
• Latency — DGI response time through the PAC. Critical for POS: the customer must not wait more than 2 seconds for the CFE.
• Webhook support — to process the CAFE asynchronously without polling.
• Sandbox environment — without it, end-to-end testing before production is impossible.
• Documentation in Spanish (English ideally too) — engineering teams often include developers who don't read Spanish.
• Data export terms — what happens if you switch PAC in 12 months? The contract must spell out the procedure.

#2. Get the digital certificate (3-7 days)

The X.509 certificate is issued by accredited CAs: Firma Electrónica de Panamá, Tribunal Electoral, or ANATI. Cost: $50 to $200/year. For legal entities the process runs through a notary; for individuals it requires in-person verification. This is the slowest stage of the entire migration — CA verification takes 3 to 7 business days regardless of urgency.

#3. Register with DGI as a PAC user (1-3 days)

Inside e-Tax 2.0 (or its successor, DGI Online), four actions are required:

• Link the company RUC to the chosen PAC.
• Register every sucursal (physical location).
• Register every punto de emisión (issuing point inside each sucursal).
• Electronically sign the "Convenio de Adhesión SFEP".

#4. Integrate Odoo with the PAC (3-10 days)

The base integration architecture:

1. Install l10n_pa — the OCA Panama localization. It covers the chart of accounts, ITBMS configuration (7%), and basic tax mappings. Without it, stock Odoo does not understand Panama's tax structure.
2. Custom connector — PAC-specific middleware. Most PACs do not ship a public Odoo module, so you need a middleware layer:
   • Outgoing: transform account.move into XML per the DGI schema and send to the PAC API.
   • Incoming: parse the CAFE response, save CUFE and QR into account.move fields.
   • Storage: the signed XML and the CAFE PDF are saved as attachments on account.move for audit.
3. Templates: add the QR and CUFE to account.report_invoice_document for the PDF the customer receives.
4. Sucursal mapping: stock Odoo has no native sucursal concept — resolve it through res.company (when sucursales are separate legal entities) or via a custom field on account.journal (when they're different issuing points inside the same RUC).

For an SMB with 1 to 3 sucursales and standard products, this is 30 to 50 hours of senior developer work. Harder cases: retail with POS (needs an offline buffer), manufacturing with multiple CFEs per shipment, or services in Zona Libre de Colón (special fields required).

#5. Test in sandbox (3-7 days)

At least 50 test CFEs: regular invoice, credit note, debit note, export invoice, and Zona Libre invoice if applicable. Every scenario is checked for correct ITBMS amount, a valid CUFE, and a QR that actually opens the DGI portal URL.

#6. Production cutover (1 day)

• Swap sandbox endpoints for production endpoints in the PAC connector.
• Register the first issued CFE with DGI as the "PAC operation start".
• Close CFEG access (or keep it as a 30-day fallback for critical PAC failures — recommended).

When it works and when it doesn't

The playbook above does not apply equally to every SMB. Five common scenarios we see with clients running Odoo in Panama:

#1. SMB with $80,000 to $300,000 revenue on Odoo 17/18

Works cleanly. PAC through a middleware connector plus l10n_pa for taxes. Two to three weeks of work, $3,000 to $6,000 for the audit and migration kit. Once live, outgoing CFE is generated automatically from account.move on validation, with zero manual intervention.

Condition: Odoo runs on-premise, Odoo.sh, or Enterprise SaaS with permission to install custom modules. Vanilla Odoo Online (no custom modules) does not work — there's no way to install the middleware.

#2. POS (restaurant, retail) with dozens of CFEs per hour

Works with caveats. The PAC must support synchronous mode with latency under 2 seconds, otherwise the cashier waits at checkout. Cuenti and The Factory HKA handle this; cheaper PACs do not. You also need an offline buffer: when the PAC goes down, CFEs queue locally and ship once the service returns. Without a buffer, a PAC outage halts sales: no receipt out the door, the line grows, revenue stops.

#3. CFEG taxpayer with $25,000 revenue and 60 CFEs/month

CFEG stays available. No need to migrate yet — neither threshold is breached and DGI will not revoke access. Keep documentation current and monitor revenue quarterly. When you sit 2 to 3 months out from the threshold, start the process before the crossing, not at it.

#4. Operations in Zona Libre de Colón

Does not work out of the box. Zona Libre has a special customs regime: the CFE requires additional fields and validations (régimen aduanero, declaración de zona franca). Most PACs support this as an add-on, but confirm it before signing the contract. The OCA's l10n_pa does not cover Zona Libre — you need a custom extension built by a developer who knows the specifics.

#5. Pre-revenue startup or freelancer at $5,000 to $15,000/year

CFEG is enough. No PAC needed, no Odoo needed. Use direct entry into the DGI portal or a lightweight accounting package with CSV export for audit. PAC and Odoo costs do not pay back at that revenue level.

Common mistakes during migration

Five patterns SMBs repeat during every PAC migration. If any of these show up in your current plan, stop before cutover.

#1. "We'll handle it in December"

Migration requires 3+ weeks at minimum. CA certificate: 3 to 7 days. DGI sandbox approval: 5 to 10 days. Start the paperwork at the end of December and the first CFE through PAC ships in February or March — 6 to 8 weeks under $500-per-document sanctions. We have seen SMBs rack up $15,000 to $25,000 in a single quarter of delay.

#2. PAC with a closed API

The cheapest PAC often runs a proprietary interface — XML over FTP, no webhooks, no REST. Six months later, when you want to switch provider, data migration is impossible: sucursales and the historical CFE archive stay locked to the original PAC. Verify three things before signing: a documented REST API exists, the schema documentation is public, and public case studies show clients migrating off that PAC to another.

#3. Sucursales and puntos de emisión left unregistered

DGI registers every physical location and every issuing point separately. Three warehouses + 2 stores + 1 office = 6 sucursales × 1 to 2 puntos de emisión each. If you only register the headquarters, every CFE from the other points gets rejected by DGI with the code "Punto de emisión no autorizado". The fix: build a sucursal/punto/RUC table before the migration and register everything in one batch through e-Tax 2.0.

#4. Ignoring credit and debit notes

Many teams test only the regular invoice in sandbox and skip the correction documents. In production, the first refund or discount breaks: the PAC requires a reference to the original CFE via CUFE_referenciado, and stock Odoo does not have that field — you must add a custom field on account.move and populate it when creating the refund. The fix: build the credit-note flow into the connector from day one and run 5+ test cases in sandbox.

#5. No fallback plan

What do you do if the PAC drops for 4 hours in the middle of a business day? Without a fallback, you lose revenue. Minimum acceptable: a documented procedure for "PAC down → manual CFEG for N hours (if revenue still allows) or offline buffer in Odoo → batch send after recovery". Negotiate the SLA and outage compensation with the PAC before signing the contract, not after the first incident.

Anonymous case: packaging manufacturer, $1.2M/year, 1,800 CFEs/month

Family-owned industrial packaging business in Panama City. 22 employees, two sucursales (Calidonia and Tocumen). Running Odoo 16 Enterprise with a basic configuration. Until December 2025, half their CFEs went out through CFEG (manual entry, for large clients) and half through an old PAC without integration (manual XML upload). They found out about the new CFEG limits five weeks before January 1, 2026.

The audit surfaced three problems:

1. No l10n_pa installed — taxes were handled manually with generic taxes.
2. The Tocumen sucursal was not registered with DGI as an independent issuing point.
3. The old PAC had no REST API — every CFE required manual XML export and upload into the PAC portal.

The 21-day plan executed:

• Week 1: picked Cuenti as the new PAC (REST API, sandbox, $120/month). In parallel, filed with Firma Electrónica de Panamá for the new X.509 certificate under the legal representative.
• Week 2: installed l10n_pa, built the middleware connector (~40 hours of senior development). Registered the Tocumen sucursal and two puntos de emisión in DGI e-Tax 2.0.
• Week 3: sandbox testing with 80 CFEs (including credit notes and an export invoice to Costa Rica). Production cutover on a Friday night with weekend monitoring and a developer on call.

"On cutover night we sat with the console open until 3 a.m. Monday morning the first invoice for the major client went out, validated, without touching the PAC portal. That's worth the $4,800 we paid."

Results verified 30 days after go-live:

• 100% of CFEs through the new PAC since January 1, 2026, zero DGI sanctions.
• CFE issuance time: from ~7 minutes (manual) to ~15 seconds (automatic on account.move validation).
• One accounting FTE reassigned from "manual issuance" to cash management and reconciliations — more valuable work for the business.
• Total project cost: $4,800 (audit + connector development + sandbox + first 30 days of production support).

Without migration, theoretical Q1 2026 sanction exposure at 1,800 CFEs/month × 3 months would have hit $2.7M at $500/CFE. DGI rarely applies the maximum in practice, but even 5% of that risk is unacceptable for a family business running on a 12% margin.

Download the PAC Panama migration checklist

31 items to migrate from CFEG to PAC: provider selection, X.509 certificate, sucursales and puntos de emisión registration, sandbox testing of 5 CFE types, production cutover, fallback procedures for PAC outages. Spanish PDF, ready to print and share with the team. → Get the checklist.

What's next?

PAC migration is not a compliance task — it's an operational upgrade. A PAC properly integrated into your Odoo in Panama stack adds 30 to 50% in issuance speed, eliminates manual errors, and builds a complete audit trail for DGI. Set up poorly, it becomes $300/month of cost without visible value, plus latent risk on the first non-standard document.

To go deeper:

• Odoo in Panama: SMB guide — country pillar with l10n_pa configuration and industry use cases (banking, logistics, Zona Libre).
• Odoo audit: framework — how to score system readiness and compliance requirements in 30 minutes.
• Odoo implementation — full deployment methodology for SMBs, including SFEP and PAC integration.
• DGI CFE 25.1 (Uruguay) — same regulatory pattern in another jurisdiction, useful as a comparison.
• SAT CFDI Real Operations (Mexico) — analogous architecture with PAC, useful as a benchmark.

If you run a business in Panama and aren't sure whether the 2026 obligation applies, book a 30-minute audit. We review the RUC, the revenue, and the current system, then walk out with a concrete migration plan in one session.

Frequently asked questions