Head of Risk & Compliance

A venture-backed startup licensed by VARA for exchange and custody, running from Dubai. The product ships weekly, the customer base is real, and headcount is growing faster than the processes around it.Compliance today is one or two people. The Compliance Officer reports directly to the Board, which is a licensing requirement rather than an organisation chart preference. There is no department to sit inside, and there will not be one for a while.The RoleThe licence, and the person the regulator callsOwn the firm's regulatory position. The permissions it holds, the obligations attached to them, and the controls that have to work on a Tuesday afternoon when nobody is watching.This is a named role, not an advisory one. Compliance Officer and Money Laundering Reporting Officer, approved by VARA at licensing, full-time and resident. At this size it is also the data protection owner, because there is nobody else to be it. The approval attaches to a person, and so does the accountability.The judgement it turns on is where to hold the line and where to find the route. Say no to everything and you protect nothing, because the business routes around you. Say yes to everything and you hand the regulator a case. This role makes that call weekly, writes it down, and defends it.What is actually unsolvedThe VARA licence covers the activities it names. It does not cover payment tokens, which sit with the Central Bank, and a product growing this fast walks into that border without meaning to. Classification decides the licensing path, it usually gets settled after the architecture is already built, and unwinding it costs months the company does not get back. Somebody has to see it coming before the build, and there is nobody else.ResponsibilitiesOwn the regulatory position. Which activities the VARA licence covers, which ones need prior approval, and which ones belong to the Central Bank instead.Hold the named roles. Compliance Officer and Money Laundering Reporting Officer, approved by VARA, plus data protection across the platform.Run the financial crime programme. Customer due diligence, transaction monitoring and its tuning, the Travel Rule, sanctions and Local Terrorist List screening, and reporting through goAML.Build and run the risk register and the control testing calendar. Then write the Board report with the awkward part still in it.Lead client and partner assurance. Due diligence questionnaires, audit responses, evidence packs, and findings tracked to closure.Sit in product decisions before they are made. Say what is possible, what is not, and what the route is between them.Run the relationship with VARA. Returns, notifications, and prior approval for changes to the model.RequirementsYou have taken a firm through a licence application and come out holding the permission. The application, the regulator's questions, and the conditions attached at the end.You have held a named regulatory role approved by a regulator, or you are approvable for one.You have written a control framework that was tested by something real. An inspection, an external audit, an incident. Not a policy set that was never used.You have said no to your own executive team, in writing, and held it. And you have found the route that let the business do the thing another way.Nice to HaveDigital Assets under a live licence rather than a pilot. Custody, exchange, or transfer and settlement.Data protection under the UAE PDPL. Processing records, transfer mechanisms, vendor and sub-processor review.A certification a regulator recognises. ICA, ACAMS, or CISI.Professional Arabic.Fluency in the systems rather than the vendor pitch. Transaction monitoring, blockchain analytics. You chose one and lived with the choice.CultureSmall team, moving fast, inside a licensed perimeter. Decisions get made in the room and sometimes in a message thread, and this role has to be in both. The work arrives the day somebody asks whether the firm can launch something by Thursday. Three days a week in the office, and the named roles are resident by requirement, so this is not a role that runs from another country.The honest trade-off: wider scope than the same title carries at a bank, and thinner support underneath it. No second line to escalate to, because you are it. Anyone who wants the resources of a large institution should take the large institution's role. Anyone who wants the decision should take this one.