Reporting To: Head – Legal / Chief Compliance Officer / CRO, as applicable
Location: MG Road, Gurugram
Work Mode: Work from Office
CTC: Up to ₹30 LPA
Experience: 5+ Years
Industry Preference: NBFC / Digital Lending / Fintech / BFSI

Role Purpose

We are looking for an experienced professional to lead Operational Risk Management and Outsourcing Risk Management for the organization.The role will be responsible for establishing and maintaining the Operational Risk Management (ORM) framework, overseeing outsourced activities and vendor risks, supporting AML/KYC and transaction monitoring processes, managing regulatory and audit requirements, and ensuring alignment with applicable RBI, PMLA, DPDP, outsourcing, customer protection, and internal governance requirements.The incumbent will act as a key control-function stakeholder, working closely with the CRO, CCO, Legal, Compliance, Business, Technology, Operations, and other functional teams to identify, assess, monitor, and mitigate operational and outsourcing risks.

Key Responsibilities

1. Outsourcing Risk Management

• Act as the designated Outsourcing Supervisor responsible for governance and oversight of outsourced activities.
• Maintain a comprehensive and up-to-date Outsourcing Services Register covering all outsourced activities, service providers, and vendors.
• Ensure complete documentation of organizational agreements and outsourcing arrangements.
• Lead and coordinate vendor due diligence and maintain records of all due diligence documentation.
• Review outsourcing agreements and ensure arrangements comply with applicable RBI outsourcing guidelines, DPDP requirements, and internal policies.
• Conduct and coordinate periodic vendor due diligence, including assessment of vendor performance, compliance status, business continuity, and operational risks.
• Identify and monitor risks arising from material and critical outsourcing arrangements.
• Coordinate outsourcing reviews, audits, regulatory inspections, and remediation activities.
• Ensure timely escalation and closure of significant outsourcing-related incidents and risk observations.

2. Operational Risk Management

• Establish, implement, and continuously maintain the organization's Operational Risk Management Framework.
• Identify, assess, monitor, and report operational risks across business and support functions.
• Maintain the Operational Risk Register and ensure periodic updates by respective stakeholders.
• Coordinate with business and functional teams for identification and mitigation of operational risks.
• Monitor operational incidents, root-cause analysis, corrective actions, and remediation status.
• Track operational risk events and ensure appropriate escalation of material incidents.
• Develop and maintain operational risk reports, dashboards, and management information.
• Identify opportunities to strengthen controls and reduce operational losses and process failures.

3. Risk Management Committee (RMC)

• Coordinate and facilitate Risk Management Committee (RMC) meetings at least quarterly.
• Prepare RMC agendas, risk updates, presentations, minutes, and supporting documents in consultation with the CRO.
• Present operational and outsourcing risk updates to the relevant stakeholders.
• Track RMC decisions and action items through closure.
• Ensure adherence to the approved RMC framework and governance calendar.

4. AML/KYC & Transaction Monitoring Support

• Review transaction monitoring alerts generated and reviewed by the appropriate AML/Financial Crime team through manual and automated monitoring systems.
• Conduct detailed review of relevant transaction alerts and prepare review notes and recommendations for escalation to the Principal Officer under applicable PMLA requirements.
• Support assessment and documentation relating to potential Suspicious Transaction Reports (STRs).
• Support implementation and enhancement of sanction screening, customer verification, KYC, and transaction monitoring controls.
• Coordinate with Compliance and relevant stakeholders to implement changes arising from regulatory requirements or control assessments.
• Ensure AML/KYC processes and controls are appropriately documented and implemented.

5. Policy, SOP & Governance

• Review and update policies relating to:
  • Operational Risk Management
  • Outsourcing Risk Management
  • AML/KYC
  • Transaction Monitoring
  • Vendor Risk Management
• Draft and maintain SOPs and operational guidelines relating to ORM, outsourcing governance, and AML/KYC processes.
• Recommend policy and process changes to management based on regulatory requirements, risk assessments, audit observations, and industry practices.
• Obtain appropriate stakeholder approvals for policy and SOP changes.
• Assist in preparation of Risk Management Committee notes and management reports.
• Maintain complete regulatory compliance documentation and supporting evidence.

6. Regulatory Inspection & Audit Support

• Support RBI inspections, statutory audits, internal audits, compliance reviews, and regulatory assessments.
• Coordinate responses to RBI/regulatory queries and audit observations.
• Provide required documentation, records, risk assessments, vendor information, and control evidence.
• Track audit and regulatory observations through remediation and closure.
• Ensure timely implementation of corrective and preventive actions.
• Maintain appropriate evidence of remediation and closure.

7. Risk Reporting & Management Information

• Prepare periodic operational and outsourcing risk reports for senior management and relevant committees.
• Monitor key operational risk indicators, incidents, vendor risks, and remediation actions.
• Develop meaningful KRIs, dashboards, and risk reports to support management decision-making.
• Escalate material risks, control failures, and overdue remediation actions to appropriate stakeholders.
• Ensure risk reporting is accurate, timely, and supported by appropriate documentation.

Key Performance Indicators (KPIs)

A. Outsourcing Risk Management – 35%

KPIMeasurementOutsourcing Inventory Maintenance100% updated and complete recordsVendor Agreement Compliance Review100% critical vendors reviewedVendor Risk AssessmentPeriodic completion as per vendor materialityVendor Due Diligence100% critical/material vendors covered as per policyOutsourcing Incident MonitoringTimely escalation and closureOutsourcing Audit & ReviewTimely completion and remediation of observations

B. Operational Risk Management – 45%

KPIMeasurementOperational Risk FrameworkFramework maintained and effectively operationalOperational Risk RegisterMonthly/quarterly updates as applicableOperational Incident ManagementTimely analysis, escalation, and closureRisk MitigationEffective tracking and closure of identified risk actionsRMC ManagementAt least one RMC meeting every quarterRMC Action TrackingTimely closure of committee action itemsRisk ReportingAccurate and timely operational risk reporting

C. AML/KYC & Transaction Monitoring Support – 20%

KPIMeasurementTransaction Alert ReviewCompletion within defined TATSTR Case Assessment SupportQuality of analysis and documentationSanction Screening SupportEffective implementation of required controlsAML Process ImplementationTimely deployment of approved changesKYC Control SupportEffective implementation and monitoringRegulatory AlignmentTimely implementation of applicable regulatory requirements

Ideal Candidate Profile

• 10+ years of relevant experience in Operational Risk, Outsourcing Risk, Risk Governance, Compliance, Legal, AML/KYC, or related control functions.
• Strong experience in NBFC, Digital Lending, Fintech, Banking, or BFSI environments.
• Experience in establishing or managing Operational Risk Management frameworks.
• Strong understanding of outsourcing risk management and vendor governance.
• Experience in dealing with regulated environments and supporting RBI inspections/audits.
• Working knowledge of RBI outsourcing requirements, PMLA, AML/KYC, DPDP, operational risk, and customer protection requirements.
• Experience coordinating with senior management, CRO/CCO, Risk Committees, auditors, compliance teams, and business stakeholders.
• Strong experience in policy drafting, SOP development, risk registers, KRI reporting, committee governance, and regulatory documentation.

Core Competencies

• Operational Risk Management
• Outsourcing Risk Management
• Vendor Risk Management
• Risk Governance
• RBI Regulatory Compliance
• AML/KYC
• PMLA
• Transaction Monitoring
• Sanction Screening
• Risk Management Committee Governance
• KRI & Risk Reporting
• Policy & SOP Management
• Audit & Regulatory Inspection
• Incident Management
• Control Assessment
• Stakeholder Management