Important: Regulatory Compliance Role - Not IT or Cybersecurity
This position requires deep, hands-on expertise in consumer debt collection law, CFPB regulation, and multi-state collection agency licensing. Proficiency in cybersecurity frameworks, IT governance, or infosec compliance does not satisfy the requirements of this role. Only candidates with direct ARM industry experience will be considered.
Why This Position Matters
Kompato AI is an AI-native collections agency, built to operate at national scale with compliance embedded into every layer of the technology stack. We are backed by leading institutional investors and part of a global AI group serving major financial institutions. Kompato AI only collects in jurisdictions where it holds an active, valid collection agency license. Compliance is not a checkbox here - it is a core product capability.
We are hiring a Compliance Manager who will serve as the company's Qualifying Individual (QI) - the named, personally accountable license holder across all jurisdictions where Kompato AI is licensed to operate. This is not a policy maintenance role. You will work hands-on with AI-powered compliance tools, automated monitoring, and data-driven workflows, embedding compliance directly into how the business and technology operate.
You will own the Compliance Management System and the Third-Party Risk Management program, partnering closely with Legal, Product, Operations, and Client Success in a fast-growing, high-expectation environment.
Qualifying Individual (QI) - Personal Accountability
As QI, your name and credentials will be formally associated with the company's active collection agency licenses. Maintaining eligibility to serve in this capacity across all licensed jurisdictions is an ongoing condition of employment.
State licensing authorities require QI candidates to complete state-mandated background screening as part of the licensing process. These are requirements of the licensing authorities, not discretionary company requirements. Full details, including your rights under applicable federal and state law, will be provided at the offer stage.
What you will do
Multi-State Licensing & Qualifying Individual Obligations
- Serve as the named Qualifying Individual on collection agency licenses across all jurisdictions where Kompato AI is licensed to operate, including any jurisdictions added as the company's footprint expands.
- Complete state-mandated background screening required by applicable licensing authorities as part of the QI designation process.
- Submit and maintain personal credentials, documentation, and filings required by each state licensing authority on an ongoing basis.
- Manage the full license lifecycle across all active jurisdictions: new applications, renewals, amendments, and QI substitution filings.
- Monitor QI eligibility requirements across all licensed jurisdictions and proactively ensure ongoing personal and organizational compliance.
- Maintain active NMLS registration and profile compliance where required.
Compliance Management System
- Own and evolve the Compliance Management System - monitoring cadences, issue tracking, escalation workflows, and executive and board-level reporting.
- Maintain audit-ready policies, SOPs, vendor files, and documentation for internal, regulatory, client, and partner audits as a standing operational state - not a periodic preparation exercise.
- Monitor federal and state regulatory developments; assess business impact; implement policy and procedural updates on a defined review cycle.
- Design and deliver compliance training for operations, product, and client-facing teams, translating regulatory requirements into clear, practical guidance.
Third-Party Risk Management
- Lead the company's Third-Party Risk Management program: vendor due diligence, compliance risk assessments, ongoing monitoring, and documentation.
- Maintain a vendor risk register and escalation framework for elevated-risk vendor relationships.
- Conduct initial and periodic vendor reviews covering regulatory compliance posture, data handling practices, financial stability, and regulatory history.
Operational & AI-Embedded Compliance
- Embed compliance controls into AI-driven workflows and automated processes - not as a downstream review, but as a built-in component of how the technology operates.
- Review and approve AI model use cases prior to deployment; assess automated decisioning for consistency with consumer protection standards, including ECOA and UDAAP.
- Partner with Engineering to automate compliance functions: validation notice generation, opt-out enforcement, Mini-Miranda delivery, and call recording disclosures.
- Own the consumer complaint management system: intake, classification, root-cause analysis, and remediation tracking. Conduct regular UDAAP risk reviews of AI model outputs and consumer-facing communications.
- Support internal and external audits - regulatory, client, and partner.
Federal Regulatory Compliance
- FDCPA (15 U.S.C. § 1692): Own all policies governing collector conduct, communication timing, validation notices, dispute handling, cease-and-desist protocols, and Mini-Miranda delivery.
- Regulation F (12 CFR Part 1006): Maintain and enforce the company's Reg F communication framework, including call frequency limits, electronic communication consent architecture, and model validation notice deployment.
- FCRA / FACTA: Oversee all credit reporting obligations, Metro 2 compliance, dispute handling procedures, and furnisher accuracy requirements.
- TCPA: Build and enforce a consent management framework for all outbound call and text campaigns; manage opt-out registries; coordinate with dialer operations on applicable dialing compliance requirements.
- UDAAP: Conduct regular risk reviews of collection scripts, AI model outputs, and consumer-facing communications for unfair, deceptive, or abusive practices.
- CFPB Guidance: Monitor supervisory bulletins, advisory opinions, and enforcement actions and brief leadership on material operational impacts.