Compliance & Risk Officer (DPO)

Job description

Purpose of the role The candidate for this role will be responsible for leading compliance, AML/CFT, regulatory risk, and data protection activities within a regulated payment services environment, ensuring full compliance with Bank of Tanzania (BOT), Financial Intelligence Unit (FIU), and Personal Data Protection Commission (PDPC) requirements while protecting the organization’s payment services licence. Key Responsibilities Develop, implement, and maintain the AML/CFT compliance framework, including policies, procedures, transaction monitoring rules, alert thresholds, escalation protocols, and risk controls in line with BOT regulations and FATF standards. Monitor transactions and manage suspicious activity processes, including investigation and timely submission of Suspicious Transaction Reports (STRs) to the FIU, while ensuring merchant KYC/KYB and Enhanced Due Diligence (EDD) requirements are completed before account activation. Manage regulatory compliance with BOT and other authorities, including preparation and submission of regulatory reports, quarterly risk assessments, incident reports, regulatory correspondence, and pre-approval requirements for new payment instruments and services. Act as Data Protection Officer (DPO), overseeing compliance with the Personal Data Protection Act 2022, including data subject requests, breach management and notification, data protection records, annual compliance reporting, and staff awareness. Maintain comprehensive compliance records, audit trails, and regulatory documentation; coordinate BOT inspections and examinations; and ensure the organization remains audit-ready and compliant with applicable record-retention requirements. Develop and deliver AML/CFT and data protection training, liaise with BOT, FIU, PDPC, TRA, and other regulatory bodies, and provide management with advice on compliance risks, regulatory obligations, and remediation actions. Requirements Bachelor’s degree in Law, Business, Economics, Finance, or a related field. Mandatory PDPC certification and legal qualification to act as a Data Protection Officer from commencement. Mandatory AML/CFT certification such as CAMS, ICA Certificate in AML, or an equivalent qualification. Minimum of 5 years of compliance, risk management, or regulatory experience within the financial services sector. Mandatory experience in a licensed financial institution, microfinance institution, mobile money operator, or Payment Service Provider (PSP). Strong working knowledge of the National Payment Systems Act 2015, BOT Payment System Directives, Anti-Money Laundering Act Cap 423, Personal Data Protection Act 2022, and FATF Recommendations. Proven experience preparing and submitting STRs to the FIU Tanzania. Experience managing BOT regulatory examinations, inspections, and compliance audits. Strong knowledge of merchant KYC/KYB, Enhanced Due Diligence, transaction monitoring, and regulatory risk management. Location: Dar es Salaam, Tanzania