Fractional · Interim · 25+ years
Fractional Chief Compliance Officer for payments businesses.
PCI DSS, AML and KYC, PSD2, scheme rules and multi-jurisdiction licensing, owned by one person who has done it across nine licensing regimes for a listed group, and reported to the board in a page it can challenge.
When you need this seat filled
- You hold, or are applying for, licences in several jurisdictions and the obligations overlap and conflict.
- PCI DSS, AML, PSD2 and data protection each have an owner, but nobody owns the whole.
- A regulator, auditor, scheme or sponsor bank has asked for evidence you cannot produce quickly.
- Compliance is seen as the department that says no, and growth is routing around it.
- The compliance lead has resigned and the regulator expects continuity.
What I do in the first 90 days
- Build one obligations register across every licence, scheme rule and regulation you are subject to.
- Own PCI DSS as a continuous process, not an annual scramble.
- Align AML, KYC, transaction monitoring and reporting with how your customers actually behave.
- Own the relationships with regulators, schemes, auditors and acquirers, so every question is answered once, in writing, with evidence attached.
- Rebuild training so the operation stays compliant without me.
What done looks like
- Compliance across licences in Europe, the UK, Latin America, Africa, Asia Pacific and Oceania run from one framework.
- Board reporting that states the exposure, the control and the residual risk in one page.
- Faster onboarding of merchants, partners and markets because the answers already exist.
- An audit, scheme review or regulator visit that goes smoothly because the evidence was already filed.
Scope
Compliance that lets the business move.
Payments compliance fails in two ways. Either it is fragmented, with PCI DSS in technology, AML in operations and scheme rules with whoever last spoke to the acquirer, or it is monolithic, and everything stops for a review. The seat I take sits between the two: one framework, owned by one person, designed so product and commercial teams get fast answers and the board gets an honest picture.
Reference points: payments, fraud and AML compliance owned across nine licensing jurisdictions and 180+ processor relationships for a FTSE 100 group, PCI DSS ownership for a Nasdaq-listed group, and regulator liaison in three countries, with the KYC and AML operations teams that made the controls real. As a non-executive director at an EU-licensed crypto exchange from 2019 to 2025, this was the board's question every quarter.
Covered in this seat
- PCI DSS programme ownership and scope reduction
- AML and KYC programme design, transaction monitoring, reporting
- PSD2, payment institution and e-money obligations, safeguarding
- Card scheme rules and programme compliance
- Data protection in payments and risk data flows
- Licence applications and multi-licence operation
- Regulator, auditor, scheme and acquirer liaison
- Board and committee reporting
Questions people ask
Payments compliance officer FAQ
Which regulations and standards does a payments compliance officer need to cover?
PCI DSS for cardholder data, anti-money-laundering and KYC obligations, PSD2 and its national implementations, payment institution or e-money rules where you hold a licence, card scheme rules, data protection, and the sector regulation of each licence you hold. The job is to run them as one framework rather than six separate programmes.
Can a fractional CCO be the named compliance owner?
Often, for the operational ownership of PCI DSS, scheme compliance and the compliance framework. Whether a regulator accepts a part-time named officer for a statutory role such as MLRO depends on the jurisdiction, the firm's size and the time committed. I will tell you plainly where a full-time appointment is required.
We hold licences in several countries. Is that a problem?
It is the normal situation. I have owned payments, fraud and AML compliance across nine licensing jurisdictions for one listed group and managed regulators in three countries for another. One obligations register, one control set, local variations where they genuinely differ.
How do you report compliance to the board?
One page: the exposure, the control, the residual risk and the trend, for each material obligation. Boards and non-executive directors should be able to challenge it without a glossary.
A regulator, scheme or auditor asking questions?
Tell me which one and what they asked. I will tell you what the first week would produce.