Compliance Manager

Established in 1996, Banca Popolare dell'Emilia Romagna (Europe) International SA, which became in 2018 BPER Bank Luxembourg SA, is a fully licensed bank and a wholly-owned subsidiary of BPER Banca Spa (Italy), one of the most prominent banking groups in Italy. BPER Bank Luxembourg SA offers a range of banking investment and broader wealth management and corporate services in Luxembourg as well as treasury management, securities trading, risk management and administrative services. Based in Luxembourg city centre, BPER Bank currently has around forty employees. For our Compliance Department we are hiring a Compliance Manager who will also be appointed as Data Protection Officer (DPO) CDI (w/m/x) Position overview Reporting to the Chief Compliance Officer (CCO) for Compliance management activities, the Compliance Manager coordinates the second-line Compliance function and supports the Bank’s regulatory compliance framework. The position also includes the formal appointment as Data Protection Officer (DPO), exercising the statutory DPO tasks independently, without receiving instructions regarding those tasks and with direct access to the Bank’s highest management level, in accordance with Articles 38 and 39 of the GDPR. The combined role is subject to an assessment and ongoing management of potential conflicts of interest. Major duties & responsabilities
· Coordinate the day-to-day execution of the Compliance function’s activities, establish priorities, monitor deliverables and support the CCO in supervising the work performed by Compliance team members.
· Develop, implement and maintain the risk-based Compliance Monitoring Programme (CMP), including control planning, testing, documentation of findings, reporting and follow-up of remediation actions.
· Monitor Luxembourg and EU regulatory developments (including CSSF requirements, EBA and ESMA guidelines, MiFID II / investor protection and other applicable banking regulations); assess impacts, perform gap analyses and coordinate implementation plans.
· Provide independent second-line advice and challenge to business and support functions on regulatory matters, new products, investment services, client protection, conflicts of interest and conduct risks.
· Oversee the review and continuous improvement of Compliance policies, procedures, controls, governance arrangements and related documentation.
· Support oversight of AML/CFT, sanctions and related financial crime compliance activities, in coordination with the CCO/MLRO and relevant control owners, according to the Bank’s allocation of responsibilities.
· Assess incidents, control deficiencies and potential regulatory breaches; recommend proportionate corrective measures, assign follow-up actions and monitor their effective and timely closure.
· Prepare and review clear, accurate Compliance reports, risk assessments and management information for the Authorised Management, Board of Directors, relevant committees and supervisory authorities.
· Act as a key contact for internal and external auditors, the CSSF and other relevant supervisory stakeholders; coordinate information requests, inspections and related remediation plans under the CCO’s oversight.
· Coordinate Compliance contributions to cross-functional initiatives, including IT and operational change projects, new regulatory requirements and product or process changes.
· Liaise with BPER Group Compliance and other Group functions to promote consistent methodologies, reporting and implementation of Group standards, while taking account of Luxembourg requirements.
· Promote a strong compliance culture through training, practical guidance and effective communication with the first line of defence.
· Carry out other Compliance activities delegated by the CCO, consistent with the position’s responsibilities.
· Act as the Bank’s designated DPO and independently inform and advise the Bank and its employees on their obligations under the GDPR and applicable Luxembourg data protection law.
· Monitor compliance with data protection requirements and internal privacy policies, including appropriate awareness activities, training and proportionate oversight of privacy controls.
· Advise on Data Protection Impact Assessments (DPIAs), monitor their performance and provide guidance on privacy by design, data protection risk assessments and legitimate interest assessments where relevant.
· Advise and coordinate with accountable departments on personal data breaches, data subject rights requests, records of processing activities, retention, processor arrangements and international data transfers, without assuming ownership of operational processing decisions.
· Cooperate with and act as the contact point for the Luxembourg National Commission for Data Protection (CNPD), including consultations and supervisory enquiries.
· Report independently on material data protection risks and DPO activities to the Bank’s highest management level; maintain appropriate safeguards for DPO independence, resources, confidentiality and avoidance of conflicts of interest. Other activities and responsibilities, in addition to those mentioned above, may be entrusted with the function holder. Profile
· University degree (preferably a Master’s degree) in law, economics, finance or a related field.
· At least 6–8 years of relevant experience in a Compliance function within the banking or financial services sector, preferably in Luxembourg, including experience coordinating activities, controls or projects.
· Solid knowledge of the Luxembourg regulatory environment and the CSSF supervisory framework; strong familiarity with investment services / MiFID II and broader banking compliance obligations.
· Proven experience in risk-based Compliance monitoring, regulatory gap analyses, policy development, regulatory reporting and remediation follow-up.
· Experience interacting with senior management, auditors, regulators and Group functions; prior people-management experience is an advantage.
· Sound knowledge of the GDPR and Luxembourg data protection law, with practical experience in privacy governance, DPIAs, personal data breach handling and supervisory interactions.
· Previous experience as DPO or in an equivalent privacy advisory role, ideally within a regulated financial institution, is strongly preferred.
· Ability to perform the DPO function independently and impartially; the allocation of responsibilities must not involve determining the purposes and means of the Bank’s personal data processing. Technical, behavioral and language skills
· Strong analytical judgement, sound risk awareness and the ability to translate regulatory requirements into workable controls and business actions.
· Excellent organisational, coordination and prioritisation skills, with the ability to manage concurrent deadlines and take ownership of deliverables.
· Credibility, independence, integrity, discretion and a high standard of confidentiality.
· Clear written and oral communication, stakeholder management and the ability to constructively challenge at different levels of seniority.
· Collaborative leadership, attention to detail, autonomy and a pragmatic, solution-oriented approach.
· Professional command of English is a must as well as conversational command of Italian.
· Professional command of French is considered a strong advantage.

We offer
· A permanent, full-time role in a Luxembourg-regulated banking institution.
· Employment conditions and benefits in line with the Luxembourg banking sector collective agreement (including supplementary pension scheme and supplementary health insurance, as applicable).
· A role with broad exposure to regulatory topics, management and cross-functional projects.
· Start date: as soon as possible. Equal opportunities & data protection BPER Bank Luxembourg S.
A. is committed to equal opportunities in employment. Applications will be considered without discrimination on the grounds protected by applicable law. Personal data submitted in connection with an application will be processed for recruitment purposes in accordance with applicable data protection requirements and the Bank’s recruitment privacy information.