MLRO, Head of Risk & Data Protection Officer (DPO)

Wirex; Amsterdam; On-site; EUR 90,000 - 130,000; Full time

Job summary

InvokaPAY is seeking a senior control-function leader in Amsterdam to serve as MLRO, Head of Risk and Data Protection Officer. You will oversee AML/CFT, data protection, and enterprise risk with direct access to Management and Supervisory Boards.

You will guide risk governance and regulatory reporting while promoting privacy-by-design across products and processes. Netherlands-based candidates preferred.

Qualifications

• 8+ years in AML/CFT, financial crime or risk management.
• Experience as MLRO or deputy and making suspicious-transaction decisions.
• Knowledge of Dutch/EU AML, PSD2/DORA and payment-institution requirements.
• GDPR and DPO responsibilities and data-protection obligations.
• Experience engaging with regulators and governance bodies.

Responsibilities

• Act as MLRO and maintain a framework for escalation and reporting of suspicious transactions.
• Decide on external suspicious-transaction reporting to FIU-NL with supporting rationale.
• Oversee AML/CFT controls including KYC/CDD/EDD and sanctions screening.
• Maintain AML/CFT policies, risk assessments and BI reporting.
• Provide training and challenge to the business on AML/CFT matters.
• Develop enterprise risk management framework, risk taxonomy and appetite.
• Provide second-line oversight across risks (operational, cyber, conduct, liquidity).
• Coordinate risk assessments, scenarios and risk-event reporting with management.
• Support regulatory engagement and inspection readiness.
• Collaborate with owners to strengthen controls without first-line ownership.

Skills

AML/CFT expertise

Regulatory engagement

Independent governance

Data protection & GDPR

English fluency

Education

ICA/ACAMS/CAMS

FRM

CIPP/E

Job description

One of our group businesses, InvokaPAY B.V., an Amsterdam-based payments company, is building its team ahead of its DNB license. Wirex is proud to share its opportunities with our network. Please note: this role is with InvokaPAY, not Wirex.

ABOUT INVOKAPAY

InvokaPAY B.V. is a Netherlands-based embedded payments business building an API-driven platform for card issuing and transaction processing. We aim to enable fintechs and digital platforms to integrate co-branded payment capabilities through scalable infrastructure, while InvokaPAY operates within a clear, robust and proportionate regulatory framework.

InvokaPAY is preparing for authorisation as a payment institution in the Netherlands. This is an opportunity to join at an early stage and help build the controls, operating model and customer experience required for a regulated payments business designed to scale across Europe.

ROLE PURPOSE

The MLRO, Head of Risk & Data Protection Officer (DPO) is a senior control-function role responsible for safeguarding InvokaPAY against money laundering and terrorist financing, overseeing the enterprise risk framework and fulfilling the statutory DPO mandate. The role provides independent oversight and challenge across AML/CFT, financial crime risk, enterprise risk, and privacy, while maintaining direct access to the Management Board and Supervisory Board as needed. As designated MLRO, the role owns internal suspicious-activity escalation and external reporting to FIU-NL.

As Head of Risk, the role develops and monitors InvokaPAY’s risk framework and risk appetite. As DPO, the role independently monitors GDPR compliance, advises on data-protection obligations, and serves as the contact point for the Autoriteit Persoonsgegevens.

This position is open to candidates based in the Netherlands.

KEY RESPONSIBILITIES

AML/CFT & MLRO responsibilities

• Act as InvokaPAY’s designated MLRO and maintain an effective internal framework for the escalation, assessment, documentation and reporting of unusual or suspicious transactions.
• Make independent decisions on external suspicious transaction reporting to FIU-NL and maintain complete, confidential records of decisions and supporting rationale.
• Oversee the effectiveness of AML/CFT controls, including customer risk assessment, KYC/CDD/EDD, sanctions screening, transaction monitoring and financial crime escalation.
• Own and maintain AML/CFT and financial-crime policies, risk assessments, procedures and management information, ensuring material weaknesses are identified and remediated.
• Provide specialist advice, training and challenge to the business and report material AML/CFT matters to senior governance bodies.
• Establish, maintain and continuously develop InvokaPAY’s enterprise risk management framework, risk taxonomy, risk appetite and key risk indicators.
• Provide independent second-line oversight and challenge across strategic, financial, operational, technology/cyber, outsourcing, conduct, compliance, liquidity and reputational risks.
• Coordinate risk assessments, scenario analysis, control assessments and risk-event reporting and ensure material exposures and remediation actions are tracked.
• Provide clear risk reporting to the Management Board and Supervisory Board and support regulatory engagement and supervisory reviews.
• Work with operational owners to strengthen controls without assuming first-line ownership of the risks or controls being overseen.

Data protection & DPO mandate

• Act as InvokaPAY’s designated Data Protection Officer and independently monitor compliance with GDPR and applicable Dutch data-protection requirements.
• Inform and advise InvokaPAY and its employees on data-protection obligations and promote privacy-by-design and privacy-by-default across products, processes and change initiatives.
• Advise on and monitor Data Protection Impact Assessments, records of processing, retention, data-subject rights and personal-data breach management.
• Act as a contact point for and cooperate with the Autoriteit Persoonsgegevens and maintain appropriate access to the highest level of management.
• Monitor data-protection training, awareness, policies and compliance testing while ensuring the DPO is not instructed on how to perform the statutory role.

Governance, independence & leadership

• Maintain direct and unfettered access to the Management Board and appropriate access/reporting to the Supervisory Board on matters within the role’s mandate.
• Provide independent challenge and elevate material concerns where management action is insufficient, or risks exceed approved appetite.
• Support DNB, FIU-NL, AP, audit and other competent-authority engagements within the role’s remit and maintain inspection-ready records.
• Oversee and develop relevant risk/financial-crime resources as the organisation scales, including effective delegation while retaining appropriate oversight.
• Regularly assess whether the combined mandates remain adequately resourced and free from conflicts of interest; elevate any capacity, independence or segregation-of-duties concern promptly.

WHAT WE ARE LOOKING FOR

• At least 8 years’ senior experience across AML/CFT, financial crime and/or enterprise risk within regulated financial services.
• Experience acting as, deputising for, or working closely with an MLRO, including suspicious-transaction reporting decisions.
• Strong knowledge of Dutch/EU AML/CFT, payment-services, sanctions and risk-management requirements applicable to payment institutions.
• Strong working knowledge of GDPR and the statutory role, independence and responsibilities of a Data Protection Officer.
• Experience engaging with regulators, FIUs, auditors and senior governance bodies, including board-level reporting.
• Demonstrated independence, strong challenge skills and the credibility to elevate material issues to senior management and supervisory governance.
• Professional fluency in English and the ability to operate effectively in the Netherlands.
• Experience within a Dutch payment institution, EMI, bank, card issuer, payment-initiation provider or embedded-payments business.
• Knowledge of DORA, PSD2 and evolving EU payments and AML frameworks, including their interaction with operational and technology risk.
• Relevant professional qualifications such as ICA/ACAMS/CAMS, FRM, CIPP/E or equivalent.
• Experience building control frameworks and teams in an early-stage or rapidly scaling regulated business.
• Professional proficiency in Dutch.
• Practical knowledge and experience applying AI tools.

How You Will Work

We are looking for a senior control-function professional who combines independence, sound judgement and practical execution.

You will:

• Act with integrity, sound judgement and a strong sense of personal accountability.
• Work comfortably in a hands-on, early-stage environment where processes are being built and improved.
• Provide independent, evidence-based challenge to senior management and maintain the authority, access and objectivity required of the role.
• Use data and evidence to make decisions, document outcomes and identify opportunities to improve controls, commercial performance and customer outcomes.
• Escalate material issues early and constructively and contribute to a culture of transparency and continuous improvement.

What We Offer

• Competitive employment package and benefits appropriate to the Netherlands.
• Opportunity to help build a regulated European payments business from an early stage.
• Significant influence over InvokaPAY’s risk, AML/CFT and data-protection frameworks.
• Direct exposure to senior leadership and cross-functional decision-making.
• Professional development and the opportunity to shape governance and controls as the business scales.

Pre-Employment Screening

All appointments are subject to satisfactory completion of pre-employment screening and background checks appropriate to the role. These checks are mandatory for new hires and form part of InvokaPAY's governance and regulatory framework. The scope of screening may vary depending on the role, seniority and regulatory responsibilities.

Candidates will receive relevant information regarding the screening process and any applicable consent requirements during the recruitment process.

InvokaPAY B.V. is committed to equal opportunity and to building an inclusive workplace. We welcome applications from candidates with diverse backgrounds, experiences and perspectives.