Manager: Compliance Advisory (and Data Protection)

Griffin is a fully regulated UK bank building accounts and payments products for fintechs and platforms. The Manager will advise first-line operations, commercial and product teams on compliance, embedding regulatory requirements throughout product development and lifecycle management. The role also owns Griffin’s data protection agenda as Data Protection Officer.

Responsibilities:

• Product development: turning regulation into clear requirements, customer journeys, T&Cs and fair value assessments, from first idea through product approval to launch, with data protection built in from the start
• Product lifecycle management: keeping live products compliant through periodic fair value assessments, outcome monitoring, reviews, changes and closures
• Sales: helping our commercial team check early whether potential partners fit our risk appetite, and reviewing sales material
• Marketing: working on marketing materials, both ours and our customers’, to make sure they comply with regulation and our own policies, and that our financial promotions are properly challenged
• Service (Operations): building regulatory and data protection requirements into how Service works day to day, with procedures and controls people actually use
• Regulatory change: working out what new rules mean for us, and making sure the right teams make the right changes on time
• Issues and reporting: investigating and fixing compliance issues, including personal data breaches, and reporting clearly on compliance risks and customer outcomes
• Working with second line (Protect): bringing them in early, sharing the evidence they need, and acting on their challenge
• Advising our teams on their obligations, including data protection impact assessments (DPIAs) and transfer risk assessments (TRAs)
• Monitoring how well we comply with the UK GDPR, other global data protection laws and our own policies
• Training colleagues and raising awareness of data protection
• Being our contact point for the ICO and for people with questions or requests about their data

Requirements:

• Compliance experience in the first (preferred) or second line of a UK regulated firm, ideally a bank, e-money institution or payments firm
• Practical knowledge of the rules behind our products, like Consumer Duty, BCOBS, CASS, FISMA, the Payment Services Regulations and the Money Laundering Regulations
• As well as familiarity with HMRC requirements like BBSI and AEOI reporting
• Hands-on experience turning regulation into practical requirements for product, sales or operations teams
• An openness to picking up data protection as part of the role: a genuine interest is enough, DPO experience isn't required
• A curious, questioning approach
• You know the right questions to ask before signing something off, not just the rules to check it against
• The confidence to challenge, clearly and kindly, when something isn't right
• A love of writing
• We have a major amount of written documentation that you will be contributing to, and we place a high degree of importance on clarity and readability
• Have deep expertise in at least one specialist area, such as payments, cards, Consumer Duty, BCOBS, financial promotions or similar
• Have been a DPO, or worked closely with one, in a regulated firm
• Have worked in finance or banking