Regulatory & Compliance Lead (founding team)

ABOUT ZAHLN

Zahln, by Zysygy, is building Germany's zero-fee payment network. We route payments directly over SEPA Instant, bypassing Visa, Mastercard and the entire card network chain. No hardware, no card reader, just a phone.

Nearly every digital payment in Germany moves over infrastructure owned outside Europe, and a share of each one leaves the continent as fees. We are building the alternative on European rails: a software-based merchant POS and a consumer super-app for everyday financial life, payments, transport, utilities and government services in one place, settling account to account over SEPA Instant, with European data residency by design. What UPI did for India, on infrastructure Europe controls.

We start on campus. Students pay in the mensa, at city merchants and for university services from one wallet, and the institution pays no transaction fee. Building that in Germany means building it inside the rules from day one. This role owns that.

EXIST FUNDING AND LOCATION

Open to students and recent graduates (within the last 5 years) of German universities who are eligible for EXIST Gründerstipendium funding. Remote within Germany, with regular time in Augsburg.

ROLE OVERVIEW

You will join the founding team as the person who owns regulation, compliance and the legal operating system of the company. Not as support for someone else's work. This is the function, and you are it.

Where a question genuinely needs specialist expertise, we bring in an external adviser for that question. Everything else, from research to drafting to negotiation to the file that proves it, sits with you.

All of it is yours, which means you also decide the order. When everything collides in the same week, the partner workstream comes first: it is the gate everything else runs through. Acting on that without being told is most of the job.

Be clear-eyed about what that means. This is a broad, heavy, document-intensive role in a regulated industry at a company with no playbook. You will write policies that did not exist before. You will sit with a bank's compliance team, a Studierendenwerk's legal department, a notary and our engineers, often in the same week. If you want a narrow legal role with a supervisor above you, this is the wrong job. Building a regulatory function from zero and owning it is a rare thing to get at this career stage.

Some of what this role touches is commercially sensitive and we go through it properly at interview rather than in a public posting.

WHAT YOU WILL DO

• Licensing and payments regulation

- Own our structure under PSD2 and ZAG. The open questions are real ones: how a campus instrument and an open consumer wallet relate under Article 3(k), where the boundary sits, and what each structure permits as the network expands. You work these through with external specialist counsel, own the analysis and evidence file behind it, and set the boundaries our roadmap is built inside.

- Own the regulated infrastructure partner relationship end to end: due diligence questionnaires, programme documentation, AML policies and risk assessments, contract terms, and their compliance review cycles. This is the gate our launch runs through and the largest workstream in year one.

- Track the statutory thresholds that change our obligations, prepare notification packages ahead of time, and flag early when a commercial decision would move us into a different regulatory category.

- Own how student funds are safeguarded and how we describe that to institutions and users, in coordination with our partner.

- Translate authentication and security requirements (SCA, step-up authentication, device and session rules) into something our engineers build against, rather than finding the gap after launch.

• AML, KYC and financial crime

- Build the framework in practice: onboarding for students and merchants, KYB, sanctions and PEP screening, escalation paths, transaction monitoring, suspicious activity handling and the record-keeping behind it. You design this with engineering so it lives in the product, not in a binder.

- Own the operational side once we are live: exceptions, screening hits, frozen accounts, and what we can and cannot tell a user when we act.

• Data protection

- Own DSGVO and GDPR end to end: records of processing, DPAs with every vendor, privacy notices, retention rules, data subject requests, and the EU data residency evidence institutional clients ask about first. That includes campus data: university SSO, digital student ID, matriculation data, and what the university is and is not allowed to share with us.

• Contracts and institutional business

- Draft and negotiate our agreements with universities and Studierendenwerke, and run the public procurement processes those bodies require.

- Own merchant agreements, student terms and conditions, AGB, consumer law compliance, refund and dispute rules, the partner contracts behind our integrations in transport, telecoms, utilities and fitness, plus vendor contracts, insurance (D&O, cyber) and NDAs.

• Corporate, tax and grant administration

- Run GmbH formation with the notary, Handelsregister filings, shareholder resolutions, minutes and clean corporate records from day one.

- Coordinate the tax and fiscalisation workstream (KassenSichV, TSE, GoBD, Kassenbuch, DATEV export, VAT) between our engineers, our Steuerberater and our fiscalisation vendor, so nothing falls between the three.

- Own EXIST grant administration and reporting, the compliance side of employment and contractor arrangements as the team grows, and our marks in the jurisdictions we operate in.

• Ongoing

- Track regulatory change across German and EU payments law and turn it into decisions the founders can act on.

- Build the internal system: policy templates, a register of obligations and deadlines, a clean evidence trail. Six months in, someone should be able to open your documentation and understand exactly why we are allowed to do what we do.

WHO YOU ARE

- Enrolled in a Master's, LL.M. or PhD at a German university, in Referendariat, or graduated from a German university within the last 5 years. Wirtschaftsrecht, Finanzrecht, Bank- und Kapitalmarktrecht and Compliance backgrounds fit best, and Volljuristen, Wirtschaftsjuristen and Staatsexamen candidates with a Schwerpunkt in Bank- und Kapitalmarktrecht particularly well. What matters more than the degree is that you have already worked in a legal, compliance or regulatory function, in a bank, payment institution, fintech, Kanzlei or authority, and know what the work actually looks like.

- Native-level German and confident professional English. You will produce and negotiate the German-language documentation with banks, Studierendenwerke, notaries and public-sector counterparties, while our engineering team works in English.

- You are genuinely interested in finance and payments. You want to understand how the money actually moves, not only what the statute says about it.

- You care that Europe runs its own payment infrastructure, and you want to build it rather than audit someone else's.

- You can work from primary sources. Given a directive, a statute and a set of guidelines, you work out what applies to us and write it down clearly.

- You are organised to an almost irritating degree. You keep a document trail, you track deadlines before anyone asks, and you know where every version of everything is.

- You know the limits of your own judgment and say so early. Spotting which question needs outside expertise, before it becomes expensive, is one of the most valuable instincts in this role.

- You can explain a regulatory constraint to an engineer in terms they can build against, and an engineering constraint to a lawyer or a public-sector counterparty.

- Comfortable with ambiguity and early-stage risk. There is no playbook yet. You will help write it.

STRONG BONUS (NOT REQUIRED)

If any of the following apply to you, you will hit the ground running faster than most:

- You have worked as a Werkstudent, Referendar or intern in the compliance or legal function of a bank, payment institution or fintech, or in a law firm's banking and finance practice, or at BaFin.

- You have read PSD2, ZAG, the GwG or the EBA guidelines on the limited network exclusion for an actual purpose rather than an exam.

- You have been on either side of a bank or partner due diligence process and know what those questionnaires really demand.

- You have worked on AML processes in practice: onboarding, screening, escalation, documentation.

- You have dealt with German public procurement and know how precisely and slowly those processes move.

- You have worked on DSGVO implementation rather than only studying it.

- You use AI tooling seriously in your own work for research, drafting and document review, and you know where it is reliable and where it is not.

BENEFITS

- Be part of a founding team eligible for EXIST Gründerstipendium, a German government grant that funds you to build. Flexible hours, remote within Germany.

- This is European payment infrastructure, not a wrapper on somebody else's. Sovereignty in payments is a regulatory question before it is a technical one: who holds the funds, under whose supervision, where the data sits, which rails the value moves on. You answer those questions here, which is why regulation is not a side function at Zahln. Whether we can launch, where, and how fast we grow are regulatory questions first.

- You own a function, not a task list. You will speak directly with banking partners, universities, Studierendenwerke, notaries and external specialists, and you decide what goes in the file.

- In two years you will have built a payments compliance framework from nothing, a rarer and more marketable thing than two years reviewing other people's contracts.

- You will work with people who left stable paths to build a faster, simpler way to move money in Germany.

Connect with the Founder

You can also connect with me on LinkedIn at

www.linkedin.com/in/shabbir-maimoon