Deputy MLRO — HitPay

## About HitPay

HitPay is a full-stack payments platform serving 15,000+ SMEs across Southeast Asia and beyond, regulated in six jurisdictions: a Major Payment Institution under MAS (Singapore), a BSP-registered Operator of a Payment System (Philippines), a BNM-regulated merchant acquirer (Malaysia, via our subsidiary), an AUSTRAC-registered remittance provider (Australia), a FinCEN-registered MSB (United States), and a DIA-supervised FSP (New Zealand).

We run an AI-native compliance function: automation does the heavy first-pass work, and a lean team of experienced humans makes every decision that matters. You will not be grinding through raw alert queues — you will be exercising judgment at the top of a machine that has already done the reading.

## The role

You are the second statutory officer in the group — and the regulatory brain behind the operating teams. The Group MLRO is accountable to six regulators; your job is to make that accountability resilient and researched: you read the regulations at source, keep our policy library current against them, and translate obligations into concrete recommendations the Ops leaders (KYC Ops Lead, Financial Crime seats) can act on. The ideal candidate comes from regulatory/compliance advisory at a Big 4 firm — someone who has spent years turning dense regulatory text into policy frameworks and practical advice for financial-services clients, and now wants to own the outcome instead of the deliverable.

## What you'll own

- Regulation research & interpretation: be the person who can pick up any of our regimes (MAS PSA/PSN01, BSP Circular 950, BNM AML/CFT PD, AUSTRAC AML/CTF Act, 31 CFR 1022, NZ AML/CFT Act) or a new one, read it at source, and come back with a defensible position — fast. Horizon-scan for regulatory change across all six jurisdictions and own the gap analysis when rules move.

- Policy library, maintained live: our internal compliance policies and AML/CFT framework documents. You keep them current against the regulations, close gaps before inspectors find them, and version them properly. Nothing goes stale on your watch.

- Advisory to Ops leaders: the KYC Ops Lead and Financial Crime team run the queues; you tell them what the rules require — CDD/EDD standards, periodic-review cycle expectations, record-keeping, tipping-off boundaries, new-product/partner flow assessments. Written recommendations, clear enough to operationalise without a follow-up meeting.

- Regulatory reporting calendar: MAS returns and PSN04 reports; BNM PSP returns; AUSTRAC IFTI submissions and annual compliance report; NZ DIA annual report; AMLC ad-hoc filings. You are the second pair of hands on every one from day one, first pair on several.

- STR/SAR lifecycle & deputisation: case review, drafting, and filing across STRO/AMLC/AUSTRAC/FinCEN/NZ FIU with delegated sign-off; documented back-up for the Group MLRO's statutory functions in SG and interim officer appointments in PH/US/NZ.

- Regulator correspondence & inspection readiness: support MAS/BNM/BSP/AUSTRAC correspondence and production orders, and keep us permanently inspection-ready.

## What you'll bring

- 4–8 years in regulatory or financial-crime advisory at a Big 4 / major consulting firm (risk & regulatory, forensic, or financial-services compliance practice), or equivalent in-house policy/advisory depth at a regulated payments firm or bank.

- Proven ability to work from primary sources: you look up the regulation, read it properly, and form your own view — you don't wait for a summary or outside counsel for routine questions.

- Policy craftsmanship: you have written, maintained, or overhauled AML/CFT policy suites or compliance frameworks for financial institutions, and can show it.

- Advisor's communication: structured written recommendations that busy operators can execute — you've spent years making complex regulation land with non-specialist stakeholders.

- Working knowledge of MAS PSA/PSN01; exposure to any of AUSTRAC, BSP, BNM, FinCEN, or NZ DIA regimes is a strong plus.

- Fit-and-proper: able to satisfy regulator probity requirements and comfortable being a named officer.

- AI-leverage mindset: you're comfortable using and supervising AI research and casework tools (our compliance wiki and detection stack are AI-assisted) — challenging their output and owning the final call.

## Nice to have

- ACAMS / ICA certification.

- Hands-on STR/SAR drafting and regulatory-return submission experience (if not, you'll learn it here fast — the calendar never stops).

- Experience in a multi-entity group (subsidiary officer appointments, intercompany compliance arrangements).

- Prior deputy or named MLRO/AMLCO appointment.

## Why this role is unusual

If you're in Big 4 advisory today: this is the client-side seat where your recommendations actually ship. Six live licences, a policy library you fully own, Ops leaders who act on your advice the same week, and a compliance stack more automated than most banks'. You'll see more jurisdictions and more real casework in a year than most consultants see across an entire client portfolio — with a direct line to the Group MLRO and the CEO, and a named statutory seat of your own.