Manager, Compliance

FINEXUS GROUP; Kuala Lumpur; On-site; MYR 180,000 - 300,000; Full time

Job summary

Finexus is seeking a Compliance Manager to lead regulatory advisory and assurance across its payment and financial services platforms in Malaysia. You will translate complex regulations into practical controls, govern policy lifecycle, and enable the business to launch and pass audits without bottlenecks.

The role requires cross-functional collaboration with Product, Technology, Legal and Risk, strong stakeholder management, and experience with SOC 2, ISO 27001 or PCI DSS.

Qualifications

• 8–10 years of relevant experience in Compliance, Regulatory, Risk or Assurance.
• Experience in BNM-regulated payments, e-money, banking or similar fintech/regulatory environments.
• Hands-on experience with SOC 2, ISO 27001 or PCI DSS.
• Ability to translate regulatory requirements into practical business requirements, controls and remediation actions.
• Board-level writing and communication skills with the ability to articulate exposure in commercial terms.
• Strong cross-functional collaboration with Product, Technology, Legal, Risk and Operations.
• Experience handling client due diligence, security questionnaires and audit rights exercises.
• Independent second line Compliance Officer with ability to challenge and escalate.

Responsibilities

• Lead regulatory advisory across Finexus' entire business lines, including licence readiness and post-licence compliance.
• Own the compliance gap register and drive remediation with named owners and deadlines.
• Drive policy lifecycle and ensure alignment with SOC 2, ISO 27001, PCI DSS and other standards.
• Build and maintain a single consolidated control framework across regulatory and assurance needs.
• Act as first responder for client security questionnaires, audits and assurance requests.
• Coordinate regulatory examinations, certifications and client audits with cross-functional teams.

Skills

Regulatory compliance

Stakeholder management

Regulatory risk

Audit readiness

Policy governance

Vendor due diligence

Job description

Compliance Manager, Regulatory Advisory & Assurance

Why This Role Matters:

As Finexus operates across multiple regulated businesses and serves banks, financial institutions and enterprise clients, Compliance needs to do more than interpret regulations. It must help the business understand its obligations, identify exposure early, build sustainable controls and demonstrate assurance to regulators, clients and partners.

About the Role:

The Compliance Manager is responsible for providing compliance advisory and assurance across Finexus' business lines, including BNM-regulated e-money, merchant acquiring and remittance businesses, as well as moneylending and PCI DSS-related activities.

This is a hands-on role for someone who can move comfortably between interpreting regulatory requirements, challenging the business, formalising controls and policies, driving remediation, supporting regulatory and client engagements, and translating compliance exposure into clear commercial implications for senior management and the Board.

You will work closely with Product, Technology, Information Security, Operations, Legal, Risk and other business teams while maintaining the independence expected of a second-line Compliance function.

Mission / Expected Outcomes:

The mission of this role is to create a clear, scalable and commercially practical compliance environment across Finexus — where regulatory obligations are understood, gaps are visible and addressed, controls can be demonstrated, and the business can move with confidence.

Success in this role means:

• Finexus' regulated businesses receive timely, practical and well-reasoned compliance advice.
• Compliance gaps have clear ownership, exposure, remediation plans and closure dates, with aged or material gaps escalated appropriately.
• Policies and procedures accurately reflect how Finexus operates and remain current, approved and auditable.
• Regulatory, certification and client requirements are mapped to a consolidated control framework, reducing duplicated controls and evidence requests.
• New products, licences and business initiatives incorporate compliance requirements early rather than addressing them retrospectively.
• Regulatory examinations, client due diligence, audits and assurance exercises are handled efficiently and consistently.
• Management and the Board receive clear visibility of compliance exposure in regulatory, contractual, financial and commercial terms.
• Compliance acts as an effective independent second line while enabling the business to launch, sell and pass audits without becoming the bottleneck.

Key Responsibilities:

1. Regulatory Advisory & Business Enablement

• Lead compliance advisory across Finexus' entire business lines, including but not limited to BNM-licensed e-money, merchant acquiring and remittance businesses, moneylending and PCI DSS-related matters.
• Provide compliance input relating to contracts, new products, regulator submissions, thematic reviews, examinations and information requests.
• Lead licence readiness, applications and post-licence compliance for new lines of business.
• Enable the business to launch, sell and pass audits without Compliance becoming the bottleneck.
• Work with relevant stakeholders to translate regulatory requirements into practical requirements and controls for the business.

2. Compliance Gaps, Remediation & Exposure Management

• Own the compliance gap register. For each gap, record the rating, root cause and potential exposure — regulatory, contractual and financial.
• Follow up on aged gaps, track remediation and drive closure of gaps with named owners and dated commitments.
• Record exceptions, approvals and escalations to senior management or the Board where appropriate.
• Report gap status, ageing and exposure to management and the Board in commercial terms.
• Maintain appropriate challenge and escalation where remediation is delayed, insufficient or exposes Finexus to unacceptable compliance risk.

3. Policy, Process & Compliance Governance

• Drive process design and formalisation: convert informal practices into approved procedures and retire duplicative or obsolete ones.
• Own the compliance policy lifecycle, including drafting, approval routing in accordance with the delegation of authority, periodic review and attestation.
• Extend the same discipline to adjacent internal policies and external certification requirements, including but not limited to SOC 2 Type II, ISO 27001, applicable ISMS requirements, NCII and CSA-related requirements.
• Work with control owners across the organisation to ensure policies, procedures and actual operating practices remain aligned.

4. Consolidated Control & Assurance Framework

• Build and maintain a single consolidated control framework, mapping each control once against all applicable standards so that evidence is collected once and used many times.
• Map overlapping requirements to common controls across the regulatory and assurance universe governing Finexus' lines of business, including BNM, card schemes, PayNet, PCI DSS, ISO, SOC 2 and client audits.
• Identify opportunities to rationalise duplicated controls, testing and evidence requirements across different regulatory and assurance frameworks.
• Track and report the reduction in evidence requests and improve the efficiency of assurance activities across the organisation.

5. Client, Audit & External Assurance

• Act as first responder for client and prospect security questionnaires, due diligence requests and audit rights exercises, maintaining a reusable answer library.
• Support the client-facing trust centre and controlled distribution of assurance reports, certifications and related compliance documentation.
• Coordinate with Technology, Information Security, Legal and other control owners to provide accurate, consistent and appropriately approved responses.
• Support regulatory examinations, thematic reviews, certification exercises and client audits by coordinating responses, evidence and remediation where required.

6. Regulatory Incidents & Escalation

• Serve as the Compliance lead during incidents, assessing regulatory notification triggers and applicable timelines.
• Advise relevant stakeholders on regulatory obligations, escalation requirements and required documentation arising from incidents.
• Coordinate regulatory notifications and follow-up responses where required, ensuring decisions and rationale are appropriately documented.
• Escalate material regulatory exposure to senior management and the Board in accordance with Finexus' governance requirements.

Qualifications/Requirements:

• Approximately 8–10 years of relevant experience in Compliance, Regulatory, Risk or Assurance, with at least 5 years in BNM-regulated payments, e-money, banking or similar products regulated by the Securities Commission Malaysia, or experience serving comparable fintech, payments or regulated financial services providers, either in Malaysia or other markets.
• Working knowledge of BNM requirements covering e-money, merchant acquiring, technology risk, outsourcing, business continuity management (BCM), customer information and AML/CFT. The candidate needs this knowledge to advise, not to operate.
• Hands-on experience with at least two of SOC 2, ISO 27001 or PCI DSS, preferably as a coordinator or control owner rather than solely as an auditor.
• A proven track record of driving cross-functional remediation to closure, including working with business and control owners to address identified compliance gaps.
• Experience handling bank client due diligence, security or compliance questionnaires and audit rights exercises, ideally from the vendor or service-provider side.
• Experience handling regulatory incidents, including assessing regulatory implications, notification requirements, escalation and follow-up actions.
• Strong ability to interpret regulatory requirements and translate them into practical business requirements, controls, policies and remediation actions.
• Board-quality writing and communication skills, with the ability to articulate regulatory, contractual and financial exposure in clear commercial terms.
• Strong stakeholder management skills and the ability to work effectively across Product, Technology, Information Security, Operations, Legal, Risk, senior management and other business functions.
• Comfort being an independent second line — willing to challenge, say no, escalation and document decisions when required, particularly when acting as a Compliance Officer.
• Able to balance regulatory expectations with commercial realities while maintaining the independence and integrity of the Compliance function.
• Advantageous: consumer credit or moneylending licensing experience, and certifications such as ICA, CAMS, ISO 27001 Lead Auditor or CISA.