A
US_West | Audit Specialist _L3
Apolis
- 🇺🇸 United States
- On-site
- Staff / Principal
- 1 day ago
- $110 – $115 / hour
- Regulatory Compliance
- BSA/AML
- OFAC
- CAMS
1 day ago
Location:3 day / week in NYC office
European banking group seeking a mid-to-senior Regulatory Compliance Consultant to serve as the independent second-line compliance lead for its New York branch. Starting October 1st, this is an initial 6-week engagement with ongoing part-time support thereafter.
Responsibilities include developing a risk-based compliance plan, performing compliance testing and risk assessments, defining and monitoring KRIs, producing quarterly compliance reports, and overseeing regulatory compliance governance. A key workstream is assessing and certifying the applicability of U.S. regulations and exemptions (SEC, CFTC, BSA/AML, OFAC) to the bank's European operations, including extraterritorial requirements.
Candidates should have significant experience in U.S. banking, broker-dealer, or foreign bank branch compliance, strong knowledge of securities and derivatives regulations, and proven expertise in compliance testing, risk assessments, remediation oversight, and regulatory reporting. Experience with trade finance, lending, treasury activities, and European banking organizations is highly desirable.
Location: New York City (on-site)
Start: October 1
Duration: 6 weeks initially, then ongoing part-time support.
Skillset required:
Cf below
Roles and Responsibilities:
Cf below
Regulatory Compliance Specialist
Client
New York branch of a European banking group
Location
New York, NY — on-site at the branch office
Consultant level
mid-to-senior
Engagement type
Part-time, ongoing; effort agreed on a rolling basis
Start date
October 1st
Duration
6 weeks to start and then ongoing
Role summary
The branch is seeking an experienced compliance consultant to act as the local, independent second-line compliance resource for its New York operations. The role is the branch's compliance function in practice: it owns the local risk-based compliance plan, performs compliance testing, sets and monitors local key risk indicators, and produces quarterly compliance risk reporting to Group Compliance.
A distinctive element of the mandate is a U.S. regulatory certification workstream: establishing the full population of U.S. requirements, obligations and available exemptions that apply extraterritorially to the Group's European home-market operations, with particular focus on securities and derivatives activity in scope of the SEC and the CFTC.
The consultant applies the risk assessment, testing and reporting methodology of their own firm and is expressly not bound by the Group's standard operating procedures. Deliverable templates are provided by Group Compliance.
Business context
The New York branch supports a narrow, wholesale-only activity set:
Liquidity management for Group Treasury, including execution of transactions in financial instruments
Financing products and trade finance, including guarantees and standby letters of credit — predominantly supporting client guarantees to public authorities and rental obligations
Facilitation of international trade finance products that are subsequently offered and documented in the Group's home market
Direct loans, syndicated loans and revolving credit facilities
The branch does not provide cash management services (no client accounts, payments or FX) and does not hold licences to provide financial instruments services to clients.
The branch currently carries no major or critical residual compliance risks. Historically, risk-based monitoring and testing has been performed roughly annually by Group compliance staff based in Europe; this engagement establishes a permanent local capability.
Key responsibilities
1. Risk-based compliance plan
Develop and maintain an annual risk-based Compliance Plan for the branch, operationalising the Group Compliance mandate to run risk-based monitoring and testing programmes.
Perform a local compliance risk assessment covering the Conduct Risk and Financial Crime risk categories, using the Group's Risk and Control Objective Library (generic risks, control objectives and expected controls) as the reference set. Group Compliance supplies equivalent input for Regulatory Compliance Risk.
Assess inherent risk, evaluate actual controls, and conclude on residual risk.
Document conclusions in a local compliance plan that concludes on the control environment and proposes and prioritises compliance activities by residual risk.
Calibrate conclusions with Group Compliance so the plan feeds consistently into quarterly risk communication. Group Compliance consolidates local plans into the Group plan.
Update the plan when material risks emerge and report changes to Group Compliance.
2. Risk-based activities
Subject to annual approval of the compliance plan by Group Compliance:
Compliance testing — the primary activity. In-depth testing of one or more controls within a process or area, assessing both design and operating effectiveness of key compliance controls.
Embedded controls — where the compliance function is control owner and executes the control. May or may not become relevant.
Model validation — in-depth assessment of model risk across design, governance and implementation. Applicable only to systems used exclusively by the branch, i.e. not in the Group's home markets. Where model validation is outside the consultant's own competence profile, the consultant coordinates qualified external resources and reports the outcome independently.
Review and challenge of testing or validation performed by other external specialists, reporting on the adequacy of that work.
Document all testing activity and formally report findings, severity assessments and remediation plans to the relevant branch and Group Compliance stakeholders.
3. Regulatory screening
Verify that the branch maintains effective processes for identifying and assessing local U.S. requirements alongside Group-level requirements, and that these are adequately aligned and translated into local branch regulations. Screening is operationally performed by the first line; the consultant retains independent oversight.
Provide structured information transfer to Group Compliance on regulatory developments, trends, emerging risks, implementation status and identified gaps.
U.S. scope certification: independently establish and certify the full scope of U.S. regulatory requirements, associated obligations and potential exemptions applicable to the Group's European home-market business operations. This requires navigating a framework characterised by fragmentation across multiple regulators, frequent change, and extraterritorial reach over foreign banks with limited U.S. exposure. Primary focus: securities and derivatives trading in scope of the SEC and the CFTC.
4. Key risk indicators
Assess the relevance of implementing local equivalents of the Group's KRI set, and the need for additional local KRIs, including for Regulatory Compliance Risk.
Collect quarterly KRI data.
Act as the liaison to the first line on KRI matters: communicate first-line requests for new, amended or revoked KRIs, and host an annual session for the first line to present proposed changes.
For implemented KRIs, manage first-line communication on threshold breach escalation and remediation action plans.
5. Quarterly compliance risk reporting
Prepare structured quarterly reporting to a Group-defined template, covering Financial Crime Risk, Conduct Risk and Regulatory Compliance Risk. Reporting must give a consolidated view of the branch's compliance risk landscape, identify material changes in exposure, assess control effectiveness, include forward-looking considerations, and remain consistent and comparable with Group-level reporting standards. Components:
Audit and control results — structured oversight of all compliance-related findings from compliance testing, internal audit, local audit functions, regulatory inspections and first-line control reviews. Report open findings, overdue findings, criticality classification and remediation status, with particular attention to high-risk or stalled remediation. Independently assess the adequacy of remediation measures.
KRIs, monitoring and escalation — assess trends, threshold breaches, deteriorating indicators and potential systemic weaknesses; provide root-cause commentary; ensure material deviations are escalated to Group Compliance.
Material events and emerging risks — report medium and high-risk incidents, regulatory breaches, systemic control failures and significant operational changes; assess and report emerging risks and material business model changes in structured form.
Regulatory interactions — the Branch Manager remains responsible for managing regulatory interactions and findings, and for their documentation and archiving. The consultant ensures Group Compliance is informed of all regulatory interactions concerning the branch and holds oversight of all material interactions and findings.
Coverage of the workstreams above — risk-based plan and activities, new product approvals, and regulatory screening.
6. New product approval and advisory (on request)
New Product Approval Process (NPAP): the first line leads as change owner and Group Compliance participates per existing routine. The consultant assesses compliance implications and reports noteworthy developments arising from an approval — for example actual or suspected regulatory breach, significant incidents, or regulatory contacts.
Advice and support: ad hoc and regulatory-driven questions route first to first-line Compliance and Risk Managers, then to the Group's non-financial risk function. The consultant is engaged only when specifically requested by Group Compliance.
Training: delivered by first-line Compliance and Risk Managers or Group Compliance on a risk-based approach. The consultant is engaged only when specifically requested.
Scope boundaries summary
Area
Consultant
Risk-based plan
Performs local risk assessment and writes the local compliance plan
Risk-based activities
Performs testing, validation, reporting
KRIs
Assesses relevance of local KRIs and need for additional KRIs incl. RCR. Collects quarterly KRI data
Reg. screening (home-market operations)
Certifies full scope of applicable rules & exemptions
Reporting
Quarterly FCR, Conduct and RCR reporting. Reporting on risk-based plan and activities, NPAP, reg. screening, audits, material events and KRIs
Advice & support
On Compliance request
Training
On Compliance request
NPAP (New Product Approval Process)
Assesses and reports noteworthy developments post NPAP
Reg. screening (U.S. branch operations)
Independent oversight and verifies 1 LoD processes
Regulatory interactions
Provides Compliance with oversight
Required experience
Substantial hands-on compliance experience in a U.S. banking or broker-dealer environment, ideally including a foreign banking organisation's U.S. branch or agency.
Demonstrable command of the U.S. regulatory perimeter relevant to a wholesale branch: BSA/AML and OFAC sanctions obligations, federal and state supervisory expectations for foreign bank branches, and the SEC and CFTC regimes governing securities and derivatives activity — including how those regimes reach non-U.S. entities.
Proven track record designing and executing second-line compliance testing: scoping from a risk and control library, testing design and operating effectiveness, rating findings by severity, and agreeing remediation with control owners.
Experience performing compliance risk assessments using an inherent / control / residual methodology, and producing plans that prioritise activity by residual risk.
Experience defining and monitoring KRIs, including threshold breach escalation.
Experience producing board- or group-level compliance risk reporting to a prescribed template.
Ability to work with genuine independence from the first line while operating as an embedded local resource, and to challenge work performed by other external specialists.
Excellent written English; reporting will be consumed by a European Group Compliance function.
Preferred
Familiarity with trade finance, guarantees and standby letters of credit, syndicated and revolving lending, and treasury liquidity execution.
Prior experience supporting a European banking group in the U.S. market.
Model validation capability, or an established network of qualified specialists to coordinate where validation is required.
Relevant certification (for example CAMS, CRCM, or equivalent).
Experience with anti-bribery and corruption, and data protection control environments in a banking context.
Ways of working
The consultant applies their own firm's methodology for risk assessment, planning, execution and report writing, and is not bound by Group Compliance standard operating procedures.
Group Compliance provides the risk and control library, KRI decision documents, and templates for the compliance plan and quarterly reporting.
Delivery is on-site at the New York branch, part-time, with effort scaled to the approved annual plan.
Core deliverables
Annual risk-based local Compliance Plan, with local compliance risk assessment
Compliance testing reports with findings, severity ratings and remediation plans
Local KRI relevance and gap assessment; quarterly KRI data collection
Quarterly compliance risk report covering Financial Crime, Conduct and Regulatory Compliance Risk
Certified scope of U.S. requirements, obligations and exemptions applicable to the Group's home-market operations
Ad hoc reporting on material events, emerging risks, NPAP outcomes and regulatory interactions
US_West | Audit Specialist _L3 · Apolis