REGULATORY & COMPLIANCE LEAD (FOUNDING TEAM)

Compensation: €30k – €60k • No equity

ABOUT ZAHLN

Zahln, by Zysygy, is building Germany's zero-fee payment network. Merchants pay zero transaction fees. We route payments directly over SEPA Instant, bypassing Visa, Mastercard, and the entire card network chain. No hardware. No card reader. Just a phone.

Nearly every digital payment in Germany today moves over infrastructure owned outside Europe, and a share of each one leaves the continent as fees. We are building the alternative on European rails: a fully software-based merchant POS and a consumer super-app for everyday financial life, payments, transport, utilities and government services in one place, settling account to account over SEPA Instant, with European data residency by design. Think what UPI did for India. We are doing it for Germany, on infrastructure Europe controls.

We start on campus. Students pay in the mensa, at city merchants, and for university services from one wallet, and the institution pays no transaction fee. Building that in Germany means building it inside the rules from day one. This role owns that.

EXIST FUNDING

This role is open to students and recent graduates (within the last 5 years) of German universities who are eligible for EXIST Gründerstipendium funding.

LOCATION

Remote within Germany, with regular time in Augsburg. Open to students and graduates at any German university eligible for EXIST Gründerstipendium.

ROLE OVERVIEW

You will join the founding team as the person who owns regulation, compliance, and the legal operating system of the company. Not as support for someone else's work. This is the function, and you are it.

You will own the licensing structure we operate under, the AML and KYC framework, the documentation our banking partner and our institutional clients demand, the data protection regime, every contract we sign, and the corporate and tax-compliance backbone underneath all of it. Where a question genuinely requires specialist expertise, we bring in external advisers for that question. Everything else, from research to drafting to negotiation to the file that proves it, sits with you.

All of it is yours, which means you also decide the order. When everything collides in the same week, the partner workstream comes first. It is the gate everything else runs through, and the rest can wait a week. Knowing that, and acting on it without being told, is most of the job.

Be clear-eyed about what that means. This is a broad, heavy, document-intensive role in a regulated industry, at a company with no existing playbook. You will read primary sources. You will write policies that did not exist before. You will sit in conversations with a bank's compliance team, a Studierendenwerk's legal department, a notary, and our engineers, often in the same week. If you want a narrow, well-defined legal role with a supervisor above you, this is the wrong job. If you want to build an entire regulatory function from zero and own it, there are very few chances to do that at your career stage.

Some of what this role touches is commercially sensitive and we go through it properly at interview rather than in a public posting.

WHAT YOU WILL DO

Licensing and payments regulation

• Own our structure under PSD2 and ZAG. The interesting questions here are real ones: how a campus instrument and an open consumer wallet relate to each other under Article 3(k), where the boundary sits, and what each structure permits as the network expands. You will work these through with external specialist counsel, own the written analysis and the evidence file behind it, and set the boundaries our product roadmap is built inside. We will go through the specifics with you at interview.

• Track the statutory thresholds that change our obligations, prepare the notification and documentation packages ahead of time, and tell the founders early when a commercial decision would move us into a different regulatory category.

• Own the relationship with our regulated infrastructure partner end to end: due diligence questionnaires, programme documentation, AML policies and risk assessments, contract terms, and the partner's own compliance review cycles. This is the gate our launch runs through and it is the largest single workstream in year one.

• Own how student funds are safeguarded and how we describe that to institutions and users, in coordination with our partner.

• Translate authentication and security requirements (SCA, step-up authentication for sensitive actions, device and session rules) into requirements our engineers build against, rather than discovering the gap after launch.

AML, KYC and financial crime

• Build the AML and KYC framework in practice: onboarding rules for students and merchants, KYB for business accounts, sanctions and PEP screening, escalation paths, transaction-monitoring logic, suspicious activity handling, and the record-keeping and audit trail behind all of it. You will design this together with engineering so it lives in the product, not in a binder.

• Own the operational side once we are live: exceptions, screening hits, frozen accounts, and what we can and cannot tell a user when we act.

Data protection

• Own GDPR and DSGVO end to end: records of processing, DPAs with every vendor, privacy notices, retention rules, data subject requests, and the EU data residency evidence our institutional clients ask about before anything else.

• Handle the specific sensitivities of campus data: university SSO, digital student ID, matriculation data, and what the university is and is not allowed to share with us.

Contracts and institutional business

• Draft and negotiate our agreements with universities and Studierendenwerke, and run the public procurement processes those bodies require.

• Own merchant agreements, student terms and conditions, AGB, consumer law compliance, refund and dispute rules, and the partner contracts behind our service integrations in transport, telecoms, utilities and fitness.

• Handle vendor contracts, insurance (D&O, cyber), and NDAs.

Corporate, tax and grant administration

• Run GmbH formation with the notary, Handelsregister filings, shareholder resolutions, minutes, and clean corporate records from day one.

• Coordinate the tax and fiscalisation workstream (KassenSichV, TSE, GoBD, Kassenbuch, DATEV export, VAT treatment) between our engineers, our Steuerberater and our fiscalisation vendor, so nothing falls between the three.

• Own EXIST grant administration and reporting, and the compliance side of employment and contractor arrangements as the team grows.

• Protect our marks across the jurisdictions we operate in.

Ongoing

• Track regulatory change across German and EU payments law and translate it into decisions the founders can act on, with a clear view of what is settled, what is arguable, and what needs outside expertise.

• Build the internal system: policy templates, a register of obligations and deadlines, a clean evidence trail. Six months in, someone should be able to open your documentation and understand exactly why we are allowed to do what we do.

WHO YOU ARE

• Enrolled in a Master's, LL.M. or PhD program at a German university, in Referendariat, or graduated from a German university within the last 5 years. Volljuristen, Wirtschaftsjuristen and Staatsexamen candidates with a Schwerpunkt in Bank- und Kapitalmarktrecht or Finanzrecht fit this role particularly well. What matters more than the degree is that you have already worked in a legal, compliance or regulatory function, in a bank, payment institution, fintech, Kanzlei or authority, and know what the work actually looks like rather than what the seminar said about it.

• A background in Wirtschaftsrecht, Finanzrecht, Bank- und Kapitalmarktrecht, Compliance, or a comparable legal or regulatory field.

• Native-level German and confident professional English. You will be the one producing and negotiating German-language documentation with banks, Studierendenwerke, notaries and public-sector counterparties, while our engineering team works in English.

• You are genuinely interested in finance and payments. You want to understand how the money actually moves, not only what the statute says about it.

• You care that Europe runs its own payment infrastructure, and you want to be on the side of building it rather than auditing someone else's.

• You can work from primary sources. Given a directive, a statute and a set of guidelines, you can work out what actually applies to us and write it down clearly, without waiting for someone to hand you the answer.

• You are organised to an almost irritating degree. You keep a document trail, you track deadlines before anyone asks, and you know where every version of everything is.

• You know the limits of your own judgment and say so early. Knowing which question needs outside expertise, and raising it before it becomes expensive, is one of the most valuable instincts in this role.

• You can explain a regulatory constraint to an engineer in terms they can build against, and explain an engineering constraint to a lawyer or a public-sector counterparty.

• Comfortable with ambiguity and early-stage risk. There is no playbook yet. You will help write it.

STRONG BONUS (NOT REQUIRED)

If any of the following apply to you, you will hit the ground running faster than most:

• You have worked as a Werkstudent, Referendar or intern in the compliance or legal function of a bank, payment institution or fintech, or in a law firm's banking and finance practice, or at BaFin.

• You have read PSD2, ZAG, the GwG or the EBA guidelines on the limited network exclusion for an actual purpose rather than an exam.

• You have been on either side of a bank or partner due diligence process and know what those questionnaires really demand.

• You have worked on AML processes in practice: onboarding, screening, escalation, documentation.

• You have dealt with German public procurement and know how precisely and slowly those processes move.

• You have worked on DSGVO implementation rather than only studying it.

• You use AI tooling seriously in your own work for research, drafting and document review, and you know where it is reliable and where it is not.

BENEFITS

• Be part of a founding team eligible for EXIST Gründerstipendium, a grant from the German government that funds you to build.

• This is European payment infrastructure, not a wrapper on somebody else's. Sovereignty in payments is a regulatory question before it is a technical one: who holds the funds, under whose supervision, where the data sits, which rails the value moves on. You are the person who answers those questions here.

• Flexible hours and remote within Germany.

• You own a function, not a task list. You will speak directly with banking partners, universities, Studierendenwerke, notaries and external specialists, and you will be the one who decides what goes in the file.

• The depth is real. In two years you will have built a payments compliance framework from nothing, which is a rarer and more marketable thing than two years of reviewing other people's contracts.

• Regulation is not a side function at Zahln. Whether we can launch, where we can launch, and how fast we can grow are regulatory questions first. You sit at the centre of that, not at the end of it.

• You will work with people who left stable paths to build a faster, simpler way to move money in Germany. Less bureaucracy, more momentum. If that sounds like your kind of problem, you will fit right in.

Connect with the Founder Connect with me on LinkedIn: www.linkedin.com/in/shabbir-maimoon