MLRO, Head of Risk & Data Protection Officer (DPO) (Netherlands based)

ABOUT INVOKAPAY

InvokaPAY B.V. is a Netherlands-based embedded payments business building an API-driven platform for card issuing and transaction processing. Our aim is to enable fintechs and digital platforms to integrate co-branded payment capabilities through scalable infrastructure, while InvokaPAY operates within a clear, robust and proportionate regulatory framework.

InvokaPAY is preparing for authorisation as a payment institution in the Netherlands. This is an opportunity to join at an early stage and help build the controls, operating model and customer experience required for a regulated payments business designed to scale across Europe.

ROLE PURPOSE

The MLRO, Head of Risk & Data Protection Officer (DPO) is a senior control-function role responsible for safeguarding InvokaPAY against money laundering and terrorist financing, overseeing the enterprise risk framework and fulfilling the statutory DPO mandate. The role provides independent oversight and challenge across AML/CFT, financial crime risk, enterprise risk and privacy, while maintaining direct access to the Management Board and Supervisory Board where required. As designated MLRO, the role owns internal suspicious-activity escalation and external reporting to FIU-NL.

As Head of Risk, the role develops and monitors InvokaPAY’s risk framework and risk appetite. As DPO, the role independently monitors GDPR compliance, advises on data-protection obligations and acts as a contact point for the Autoriteit Persoonsgegevens.

KEY RESPONSIBILITIES

AML/CFT & MLRO responsibilities

• Act as InvokaPAY’s designated MLRO and maintain an effective internal framework for the escalation, assessment, documentation and reporting of unusual or suspicious transactions.
• Make independent decisions on external suspicious transaction reporting to FIU-NL and maintain complete, confidential records of decisions and supporting rationale.
• Oversee the effectiveness of AML/CFT controls, including customer risk assessment, KYC/CDD/EDD, sanctions screening, transaction monitoring and financial crime escalation.
• Own and maintain AML/CFT and financial-crime policies, risk assessments, procedures and management information, ensuring material weaknesses are identified and remediated.
• Provide specialist advice, training and challenge to the business and report material AML/CFT matters to senior governance bodies.

Enterprise risk management

• Establish, maintain and continuously develop InvokaPAY’s enterprise risk management framework, risk taxonomy, risk appetite and key risk indicators.
• Provide independent second-line oversight and challenge across strategic, financial, operational, technology/cyber, outsourcing, conduct, compliance, liquidity and reputational risks.
• Coordinate risk assessments, scenario analysis, control assessments and risk-event reporting and ensure material exposures and remediation actions are tracked.
• Provide clear risk reporting to the Management Board and Supervisory Board and support regulatory engagement and supervisory reviews.
• Work with operational owners to strengthen controls without assuming first-line ownership of the risks or controls being overseen.

Data protection & DPO mandate

• Act as InvokaPAY’s designated Data Protection Officer and independently monitor compliance with GDPR and applicable Dutch data-protection requirements.
• Inform and advise InvokaPAY and its employees on data-protection obligations and promote privacy-by-design and privacy-by-default across products, processes and change initiatives.
• Advise on and monitor Data Protection Impact Assessments, records of processing, retention, data-subject rights and personal-data breach management.
• Act as a contact point for and cooperate with the Autoriteit Persoonsgegevens and maintain appropriate access to the highest level of management.
• Monitor data-protection training, awareness, policies and compliance testing while ensuring the DPO is not instructed on how to perform the statutory role.

Governance, independence & leadership

• Maintain direct and unfettered access to the Management Board and appropriate access/reporting to the Supervisory Board on matters within the role’s mandate.
• Provide independent challenge and escalate material concerns where management action is insufficient or risks exceed approved appetite.
• Support DNB, FIU-NL, AP, audit and other competent-authority engagements within the role’s remit and maintain inspection-ready records.
• Oversee and develop relevant risk/financial-crime resources as the organisation scales, including effective delegation while retaining appropriate oversight.
• Regularly assess whether the combined mandates remain adequately resourced and free from conflicts of interest; escalate any capacity, independence or segregation-of-duties concern promptly.

WHAT ARE WE LOOKING FOR

Essential

• At least 8 years’ senior experience across AML/CFT, financial crime and/or enterprise risk within regulated financial services.
• Experience acting as, deputising for, or working closely with an MLRO, including suspicious-transaction reporting decisions.
• Strong knowledge of Dutch/EU AML/CFT, payment-services, sanctions and risk-management requirements applicable to payment institutions.
• Strong working knowledge of GDPR and the statutory role, independence and responsibilities of a Data Protection Officer.
• Experience engaging with regulators, FIUs, auditors and senior governance bodies, including board-level reporting.
• Demonstrated independence, strong challenge skills and the credibility to escalate material issues to senior management and supervisory governance.
• Professional fluency in English and the ability to operate effectively in the Netherlands.

Desirable

• Experience within a Dutch payment institution, EMI, bank, card issuer, payment-initiation provider or embedded-payments business.
• Knowledge of DORA, PSD2 and evolving EU payments and AML frameworks, including their interaction with operational and technology risk.
• Relevant professional qualifications such as ICA/ACAMS/CAMS, FRM, CIPP/E or equivalent.
• Experience building control frameworks and teams in an early-stage or rapidly scaling regulated business.
• Professional proficiency in Dutch.
• Practical knowledge and experience applying AI tools.

How You Will Work

We are looking for a senior control-function professional who combines independence, sound judgement and practical execution.

You will:

• Act with integrity, sound judgement and personal accountability.
• Work hands-on in an early-stage environment, building and improving policies, processes and controls.
• Provide independent, evidence-based challenge to senior management and business owners.
• Maintain the authority, access and objectivity required to fulfil the MLRO, Head of Risk and DPO mandates.
• Use data and risk judgement to support decisions, identify weaknesses and drive improvements.
• Escalate material issues early and ensure agreed actions are followed through.
• Promote transparency and accountability while balancing regulatory requirements, commercial realities and customer outcomes without compromising independence.

What We Offer

• Competitive employment package and benefits appropriate to the Netherlands.
• Opportunity to help build a regulated European payments business from an early stage.
• Significant influence over InvokaPAY’s risk, AML/CFT and data-protection frameworks.
• Direct exposure to senior leadership and cross-functional decision-making.
• Professional development and the opportunity to shape governance and controls as the business scales.

Pre-Employment Screening

All appointments are subject to satisfactory completion of pre-employment screening and background checks appropriate to the role.

These checks are mandatory for new hires and form part of InvokaPAY's governance and regulatory framework. The scope of screening may vary depending on the role, seniority and regulatory responsibilities.

Candidates will receive relevant information regarding the screening process and any applicable consent requirements during the recruitment process.

Equal Opportunity

InvokaPAY B.V. is committed to equal opportunity and to building an inclusive workplace. We welcome applications from candidates with diverse backgrounds, experiences and perspectives.