Compliance Officer Outsourcing for Regulated Businesses

I take on the work, not the post.

I build and maintain compliance inside your business: procedures, appointments, training, contact with the regulator. I go deep enough into the organisation to know it from the inside, and I stay.

What I do not take on are the functions the law requires you to assign to someone within your own organisation. Appointing the board member and the senior manager responsible for AML (articles 7 and 8 of the Polish AML Act, and their equivalents across the EU) is yours to do – as are operational decisions on live matters.

My job is to make sure those people are properly appointed, working from current procedures, and backed by a lawyer who knows their business. That is the difference between advising from the outside and actually running compliance.

• > You have the licence and now everything has to work. During the application, documents were enough. From the day of authorisation, the regulator looks at whether the business actually runs that way.
• > You are growing faster than your procedures. New product, new market, new people – and the policies are still last year's.
• > Your compliance person has left. The knowledge went with them, and hiring for that role takes months.
• > An inspection has been announced, or a request for information has arrived. You need someone to establish the facts and prepare the response before you answer on your own.
• > You are entering a new EU market. Passporting (article 65 MiCA, article 28 PSD2) is not a formality – it means a new supervisor and new expectations of your procedures.

You do not need a compliance team to start. You only need to know that the current setup will not survive the first inspection.

What I learn about your business stays with your business. As an attorney-at-law I am bound by professional secrecy – indefinitely, and enforceable through professional liability. It is a statutory duty of the profession, not a clause in a contract. Consultants and advisory firms are not held to that standard.

Compliance does not run separately for each regulation. Inside one business, the same procedures have to satisfy several regimes at once – and that is usually harder than any of them taken alone.

Most of my work is under MiCA: CASP licensing, token classification, white papers, passporting. This is the core of the practice and where the experience runs deepest – licensing proceedings I have run, not advice given from a distance.

The second area is payment services: payment and e-money institutions, small payment institutions, safeguarding, proceedings before KNF (the Polish financial supervisor).

Alongside that, AML and the Travel Rule – in practice the most common source of inspection findings, whatever the sector. DORA – ICT risk management, the register of provider contracts, resilience testing; I have run an implementation of this with a client. And the AI Act, where the clients are mainly deployers: businesses that buy and use AI rather than build it. Role classification, obligations towards the provider, human oversight, information duties – a different set of requirements from the ones usually discussed in the context of model developers.

These are all EU regulations. They apply the same way in Warsaw, Tallinn and Nicosia – what differs is the procedure before the regulator, not the substance of the requirements.

1. 01 A call – 30 minutes, no charge. You tell me what your business does, where you are in the process, and what is keeping you up. I tell you what follows from that and the range this kind of work falls into. You leave with a sense of the cost, even if you decide not to work together.
2. 02 Scope and engagement letter. You get a written proposal: what I do, by when, for how much. No hourly rates on Review and Implementation – you know the figure up front.
3. 03 Start. We agree one point of contact on your side and a schedule. First conversations with your teams usually within two weeks of signing.

You do not have to start with the Review. If you already know what needs doing, we go straight to Implementation.

Review and Implementation – fixed fee. Set after our call, once I know the size of your organisation and how many regimes are in play. I do not bill by the hour and I do not add hours after the fact. The Review fee is credited against Implementation.

Ongoing counsel – monthly retainer. Scope is agreed at the outset and written into the engagement letter. Day-to-day matters sit inside the retainer, without pricing each one separately. Larger projects outside the agreed scope – a licence application, entry into a new market – are quoted separately, always before the work starts.

I give you the range on the first call. Before you spend time reading a proposal, you know whether you are in the right bracket.