Head of Risk – EU

OSL; Poland; On-site; PLN 517,000 - 775,000; Full time

Job summary

OSL is seeking a Head of Risk to own the risk function end-to-end for its newly licensed European entity. You will manage risk across custody, on-chain transfers, fiat on/off ramps, spot trading and OTC, aligning with MiCAR and DORA requirements.

You will lead the risk framework, set appetite, and ensure audit-ready controls while reporting to the Management Board and regulators. Strong leadership and crypto risk expertise are essential.

Qualifications

• 7–10 years in risk management with leadership experience.
• Strong knowledge of MiCAR and DORA.
• Experience with crypto-asset risk, custody and on-chain settlement.
• Proven ability to build or reshape a risk framework.
• Experience in a B2B or institutional setting with regulatory liaison.
• Fluent in English; German is a plus.

Responsibilities

• Own the enterprise risk management framework, including risk taxonomy, appetite and policies.
• Lead implementation and governance of risk standards, turning policies into live processes.
• Chair local risk governance bodies and participate in executive management meetings.
• Set and monitor limits and indicators across custody, transfers, fiat rails, trading and OTC.
• Own third-party and outsourcing risk framework and ICT-related risk.
• Oversee operational resilience, business continuity and disaster recovery.
• Provide independent second-line challenge and support audits/regulatory exams.
• Lead risk reporting to Management Board, group, and regulator (FMA).
• Sign-off risk assessments for new products and partners within risk appetite.
• Build and lead the risk team as the entity scales.

Skills

Risk management

Leadership

MiCAR knowledge

DORA knowledge

Regulatory compliance

Stakeholder communication

Audit readiness

Crypto risk

Third‑party risk

Data-driven decisions

English fluency

Job description

This is a rare chance to own risk end to end at the birth of a regulated European crypto entity, with the autonomy to build the function your way and the backing of an established, publicly listed global group. We are looking for a Head of Risk to take full ownership of risk management at our newly licensed Austrian entity, across custody, on-chain transfers, fiat on and off-ramp, spot trading and the OTC desk.

You will own the risk function end to end. The framework, the risk appetite the board signs off on, the enterprise risk assessment, and the limits and indicators the business runs against day to day. You will not be starting from a blank page. You will inherit a strong policy framework and the backing of an established global risk function, and take local ownership, turning documented policies into a live, operating, audit-ready risk environment. The work spans the risks of holding and moving crypto, custody, key management and on-chain settlement, and the market, liquidity and counterparty risk that come with trading and OTC, alongside the operational resilience and third-party risk that DORA puts front and centre.

You will act as the independent second-line voice in the entity, working across Operations, Technology & Security, Trading and Finance, and alongside Compliance, the AMLO and the DORA officer, giving challenge without owning what they run. The B2B model shapes all of it. You will report risk to the Management Board and the group in terms people can act on, be a steady voice in front of the FMA, and build the risk team as the entity scales toward its full operating model.

Key Responsibilities

• Own the enterprise risk management framework. The risk taxonomy, the risk appetite statement and the policies beneath them, aligned with group risk appetite and sized to a MiCAR CASP and the firm's B2B model, and set the strategic direction for operational risk management locally.
• Lead the implementation and continuous enhancement of risk standards, frameworks and governance, turning the inherited policies into live, operating processes, running the enterprise risk assessment and the risk registers, and keeping them current as regulation, products and the business change.
• Chair the local risk governance bodies, including the OSL EU Risk Committee and its sub-committees, and sit as a core participant in executive management meetings so strategic decisions are risk-informed.
• Set and monitor risk limits and key indicators across custody, transfers, fiat rails, spot trading and OTC, covering market, liquidity, credit and counterparty exposure on the trading book.
• Own the third-party and outsourcing risk framework. Risk-based due diligence, criticality assessment, ongoing monitoring and exit planning, working with the DORA officer on ICT-specific requirements and with Technology & Security on ICT concentration and exit risk.
• Own the operational resilience framework, including the business impact analysis, scenario analysis and independent oversight of business continuity and disaster recovery, alongside the functions that operate them.
• Provide independent second-line challenge of first-line risk taking, including the information security and ICT incident picture, and support internal and external audits and regulatory examinations.
• Lead the reporting and presentation of risk status, trends and key developments to the Management Board, the group and the FMA, and provide risk input to capital and prudential assessments led by Finance.
• Provide risk assessment and sign-off for new products, new crypto-assets and new B2B2X partners, so the business grows inside its stated risk appetite.
• Build, develop and lead the risk team as the entity scales.

Requirements

• 7–10 years in risk management, including leadership at Head or senior level, ideally in regulated financial services or a crypto-asset business.
• Strong working knowledge of MiCAR and DORA, and how a CASP's risk obligations turn into a framework that actually runs.
• Able to define what good looks like in this domain and operate autonomously, setting the standard rather than waiting for direction.
• Real understanding of crypto-asset risk. Custody and key management, on-chain settlement, and the market, liquidity and counterparty risk that come with trading and OTC.
• Track record of building or substantially reshaping a risk framework, not only operating one that already exists.
• Experience with third-party and outsourcing risk, and with operational resilience and business continuity under a regulatory lens.
• Comfortable giving independent challenge to first-line functions and senior stakeholders, and credible in front of a regulator.
• Strong process and documentation discipline, able to turn a policy framework into demonstrable, audit-ready controls.
• Experience in a B2B or institutional setting, where relationships are fewer, larger and more complex than in retail.
• Clear, plain communicator, strong with data, who turns risk into decisions the board and the business will use.
• Fluency in English is required; German is an advantage.

Why this role

Few roles offer this mix: the autonomy of building and running a risk function yourself, the safety of an established global group behind you, and the challenge of getting risk right for a regulated crypto platform from day one. You will take local ownership of a strong framework, sharpen the limits and controls that protect client assets and the firm, and build the risk function the whole business leans on. MiCAR is still young, and few people have stood up and run risk for a licensed CASP. If you are a senior risk leader who wants genuine ownership, a regulated environment worth getting right, and the chance to build a high-performing team from the start, we would like to hear from you.

Vision & Mission

• OSL is the first SFC-licensed digital asset platform in Hong Kong and a PayFi innovator. Through stablecoin payments, cross-border settlement and global licensing, we are building the next-generation payments network. Stablecoins have become everyday money across emerging markets and are widely viewed as blockchain’s “killer app,” with industry focus shifting from token issuance to real-world consumer and enterprise payment adoption. The strongest growth lies in cross-border B2B payments, where providers embedding stablecoins into corporate settlement flows can capture significant volume and float. Long-term defensibility comes from regulatory licences, banking partners and cross-border corridors.
• OSL holds or has acquired licences in Hong Kong, Japan, Australia, Bermuda and Indonesia, and is expanding into Europe, Brazil, Southeast Asia and Africa through acquisitions and licence applications. With OSL Pay and StableX, we embed stablecoin settlement into bank accounts and card networks, support 150+ digital assets, and provide 24/7 fiat–stablecoin conversion. As a regulated pioneer with a startup mindset, we believe the future of payments will be driven by real adoption and scalable deployment, not technology narratives. We welcome builders who are passionate about crypto and payments to join us in shaping compliant, global payment infrastructure.