Internal Auditor

Remote | EU/EEA | Regulated Crypto & Payments Company | Part-time B2B Consultancy

About the Client

Our client is a global fintech company operating at the intersection of crypto and traditional payments. It serves millions of users worldwide through two business lines: a B2C retail platform for buying, selling, and swapping crypto, and B2B infrastructure providing on/off-ramp APIs, payouts, and compliance infrastructure for fintechs, wallets, and platforms.

The company's EU operating entity holds a MiCA CASP authorisation and a Payment Institution licence under PSD2, serving EU customers and powering a regulated B2B platform that fintechs, neobanks, PSPs, and Web3 companies build on - under the company's licences. Its control environment is part of the product, not back-office overhead.

About the Role

The company is looking for an Internal Auditor to run the third line of defence for its EU-licensed entity.

This is not a compliance role and not a monitoring role with an audit title. You audit Compliance controls - you do not execute them. You report functionally to the Management Board, you set your own severity ratings, and you deliver findings to the people who run the company, including when the finding is about them.

The function already exists. The Charter, Audit Universe, Internal Audit Plan and findings register are in place and Board-approved. This is not a rebuild of the methodology - it is delivering the plan with rigour, keeping the register alive and closed out with evidence, and putting the Board and the supervisor in a position where the control environment can be answered from the file.

• What You'll Do

Own and maintain the risk-based Internal Audit Plan across MiCA CASP and PSD2 PI obligations, AML/KYC/CTF controls, ICT and security (DORA), custody and segregation of client assets, safeguarding of client funds, outsourcing and third-party risk, governance and financial controls.

• Execute engagements end-to-end - design the programme, select samples, test controls, rate severity and regulatory impact.

• Write Board-ready audit reports with findings that hold up under challenge and recommendations someone can actually act on.

• Obtain remediation plans with named owners and deadlines; track and verify closure against evidence, not assertion.

• Present findings and remediation status to the Management Board - quarterly updates and the annual Internal Audit Report.

• Deliver the annual independent AML/CFT audit and the DORA ICT framework audit and follow-up.

• Scope, direct, and challenge external specialists where an engagement needs deep technical testing.

• Maintain the audit evidence that supports regulatory supervisory reviews and inspections.

What We're Looking For

Required

• 5+ years of internal audit or internal control experience in a regulated financial services entity - bank, payment institution, EMI, investment firm, insurer, regulated fintech or crypto/VASP. Unregulated-only experience will not be considered.

• Hands-on audit experience with at least one fintech, payment institution, EMI, crypto exchange or VASP - execution, not advisory theory.

• Working knowledge of at least two of MiCA, PSD2, AMLD5/6 and DORA, with the ability to turn a regulatory obligation into a test programme.

• Strong understanding of AML/KYC/CTF frameworks and how to audit their effectiveness.

• Evidence of independence in practice - critical findings delivered to senior management or a Board and held under challenge.

• Ability to run an engagement unsupervised and to make and defend a professional judgement on control severity.

• Sufficient ICT and information security audit literacy to scope a DORA engagement and to direct and challenge an external technical specialist.

• Fluent professional English - reports go to the Board and to the regulator as written.

• Hands-on use of AI tools in audit work - planning, analysis, testing or reporting - with concrete examples.

• Right...