Compliance Officer for Fintech and Payments Firms: The Experience That Survives FCA Scrutiny

First, Which Regime Are You In?

“Fintech” covers firms regulated in very different ways, and it changes what the compliance role formally is:

• Authorised payment institutions and e-money institutions are authorised under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011, not as Part 4A FSMA firms. The Senior Managers and Certification Regime does not apply to them in the same way, so their compliance lead is not formally an SMF16. The FCA still assesses the people responsible for management, and the MLRO, closely at authorisation and in supervision.
• Fintechs with FSMA permissions, such as lenders, credit brokers, investment platforms and wealth apps, are within the SMCR. Their compliance leader holds SMF16 and needs FCA approval.
• Cryptoasset firms registered under the Money Laundering Regulations need an MLRO, and the FCA’s new regime for cryptoasset activities brings authorised firms under FSMA and the SMCR. See crypto-asset firm recruitment.

Many fintech groups have more than one of these in the same structure, for example an e-money institution alongside a consumer credit firm. The compliance leader then needs to understand both regimes. Our guide to the people the FCA expects at authorisation covers payments and e-money in detail.

What the Role Involves at a Payments or Fintech Firm

Alongside the usual compliance work, the compliance leader at a payments or fintech firm typically deals with:

• Safeguarding. Making sure customer funds are protected, reconciled and reported under the FCA’s safeguarding requirements. See safeguarding for payments and e-money firms.
• Consumer Duty. The Consumer Duty applies to payments and e-money firms that serve retail customers, including outcomes testing and the annual board report.
• Financial promotions and app journeys. Marketing, onboarding flows and in-app messages change constantly and need fast, practical review.
• Fraud and authorised push payment scams. Including reimbursement obligations, complaints and the customer experience when things go wrong.
• Outsourcing and third parties. Banking partners, card schemes, cloud providers and agents, each with oversight obligations.
• Growth. New products, markets and partnerships arrive faster than at most traditional firms, and compliance has to keep up without becoming a bottleneck.

Financial crime is usually the largest single risk. Whether the compliance leader is also the MLRO depends on volumes; our guide to sizing the financial crime team at a payments firm explains when to split the roles.

The Experience Profile That Survives Scrutiny

The candidates who succeed in these roles usually combine:

1. Direct payments or e-money experience. Safeguarding, agent and distributor oversight, and the specific rules for payment services. A strong compliance officer from a wealth manager will have a steep learning curve.
2. Experience of FCA supervision of a fast-growing firm. Information requests, Dear CEO letters, attestations and, ideally, a period of close supervision handled well.
3. Financial crime depth. Even where there is a separate MLRO, the compliance leader needs to understand transaction monitoring, onboarding and fraud risk.
4. Product and technology fluency. Comfortable working with product managers and engineers, reviewing user journeys and data rather than documents.
5. Pragmatism at pace. The ability to give clear, fast answers that let the business move, and the confidence to stop something when it matters.
6. Board and investor communication. Explaining regulatory risk to founders and investors who may not have worked in regulated businesses before.

Our guide to the experience that matters for your type of firm compares fintech with other sectors.

Red Flags in Fintech Compliance Candidates

For questions to ask, see our guide to interviewing a head of compliance or CCO.

Can a Fintech Outsource Its Chief Compliance Officer?

A fintech can use an outsourced or fractional compliance leader, and many early-stage firms do. But it cannot outsource the responsibility. The firm remains responsible for compliance with its regulatory obligations, and where the firm is within the SMCR, the approved SMF16 is accountable whether they are employed, fractional or supplied by a consultancy. Under the FCA’s outsourcing rules in SYSC 8, firms must also oversee any important functions they outsource.

In practice, the fractional model works best at the earliest stage: pre-authorisation, the first year after authorisation and while volumes are modest. As customer numbers grow, most payments firms move to an in-house head of compliance. Our pages on fractional compliance officers, outsourced compliance officers and compliance consultant or approved SMF16 explain the options, and when the managing director is also the compliance officer covers a common early-stage arrangement.

Pay and Timing

Fintech compliance leaders with payments experience are in demand, so pay sits towards the top of the compliance ranges in our salary guide, and equity is often part of the package at venture-backed firms. Allow time for the regulatory side too: FSMA firms need FCA approval for the SMF16, and payments firms need to notify the FCA of changes to the people responsible for management. If the role is needed for an authorisation application, the candidate should be identified before the application goes in.

How We Recruit for Fintech and Payments Firms

We recruit compliance leaders, MLROs and senior management for payments, e-money, crypto and fintech firms, permanent, interim and fractional. See payments and fintech recruitment for the full service and chief compliance officer and head of compliance recruitment for compliance leadership hires.

Frequently Asked Questions

Does a payment institution need an SMF16?

Not formally. Authorised payment and e-money institutions are not within the SMCR in the same way as FSMA firms, but they still need capable compliance leadership and an MLRO, and the FCA assesses those people closely.

Can a fintech outsource its chief compliance officer?

It can use an outsourced or fractional compliance leader, but it cannot outsource responsibility for compliance, and must oversee any important functions it outsources.

Should our compliance officer also be our MLRO?

At an early-stage firm with modest volumes, often yes. As transaction volumes and financial crime risk grow, most payments firms split the roles.

What experience matters most for a payments compliance officer?

Direct payments or e-money experience, including safeguarding, together with experience of FCA supervision of a fast-growing firm.