Role purpose and statutory designationThe successful candidate will be appointed and registered with FIU-IND as tothemoon technologies pvt Ltd's Principal Officer under the PMLA and will act as the exchange's Money Laundering Reporting Officer (MLRO). The role is shaped by FIU-IND's AML & CFT Guidelines for Reporting Entities Providing Services Related to VDAs, updated on 8 January 2026, which set minimum requirements for the Principal Officer. Accordingly, the Principal Officer at tothemoon technologies pvt Ltd will:
• Be a management-level officer exclusively responsible for compliance with Chapter IV of the PMLA, and not actively involved in other business or operational activities of the company.
• Be engaged with tothemoon technologies pvt Ltd full-time and exclusively, with no concurrent engagement with any other entity.
• Be based in India.
• Have at least 3 years of experience in AML law, the PMLA framework and ML/TF risks (tothemoon technologies pvt Ltd's own hiring bar is higher; see requirements below).
• Take part in all high-level decisions that assess ML/TF/PF risk in products, services and delivery channels, with adequate staff and resources.
• Review AML/CFT functions and present them to the Board, preferably every quarter, plus a formal annual report to the Board. The Principal Officer role is distinct from the Designated Director, who holds overall responsibility for PMLA compliance at Board level. The Principal Officer works closely with the Designated Director but the two positions are held by different people. Sources: AZB & Partners summary of the FIU-IND 2026 VDA Guidelines (January 2026).

Key responsibilities
The role owns five areas: regulatory compliance, monitoring, customer due diligence, reporting and audit, and leading the compliance team. A. PMLA, FIU-IND and regulatory compliance
• Ensure full compliance with the PMLA, the PML (Maintenance of Records) Rules, 2005, and FIU-IND's AML/CFT/CPF guidelines for VDA service providers.
• Act as tothemoon technologies pvt Ltd's primary point of contact with FIU-IND for registration matters, FINGate/FINnet filings, notices, information requests and inspections.
• Own the AML/CFT/CPF Policy, KYC Policy, client risk classification framework and supporting SOPs, and obtain Board approval for them.
• Track regulatory changes from FIU-IND, the Ministry of Finance, CBDT, RBI, CERT-In and law enforcement advisories, and implement them within set timelines.
• Implement sanctions and asset-freezing obligations under UN Security Council lists, Section 51A of the UAPA and Section 12A of the WMD Act.
• Handle law enforcement requests, account freeze and unfreeze orders, and cybercrime referrals within required timelines.
• Support FIU-IND registration and renewal readiness, including live demonstrations of KYC, monitoring, blockchain analytics, Travel Rule and screening systems. B. AML/CFT and transaction monitoring
• Own the alert governance framework: rule design, thresholds, risk scoring,



alert disposition and documented reasons for both reporting and non-reporting decisions.
• Lead investigations into unusual activity such as structuring, layering, rapid in-out flows, mule accounts, P2P and OTC abuse, and third-party funding.
• Identify potential market abuse, including wash trading, spoofing, pump-and-dump schemes and coordinated trading across accounts.
• Oversee on-chain monitoring with tools such as Chainalysis, TRM Labs or Elliptic, so the origin and destination of VDAs can be traced.
• Manage wallet screening, unhosted wallet risk assessment and EDD, and block exposure to mixers, tumblers and anonymity-enhancing tokens.
• Run Travel Rule compliance so originator and beneficiary data is transmitted in real time, not after the fact.
• Conduct surprise checks and periodic reviews of alert queues and monitoring data to find gaps. C. KYC, customer due diligence and risk assessment
• Oversee KYC, CDD, EDD, beneficial ownership checks, PEP screening and adverse media screening for individual and corporate clients.
• Ensure onboarding controls meet current FIU-IND standards, including liveness-checked selfies, geo-location and IP capture, OTP verification of mobile and email, and penny-drop bank verification.
• Run the Board-approved client risk classification, reviewed at least every six months, with CDD refreshed half-yearly for high-risk clients and annually for others.
• Manage high-risk customer reviews, account restrictions, exits and escalations.
• Conduct the enterprise ML/TF/PF risk assessment at least once a year and before launching current products, tokens or delivery channels.
• Ensure records are kept for the periods required under the PMLA, with tamper-proof audit trails for verification events, timestamps and authentication logs. D. Regulatory reporting and audit
• Prepare and file Suspicious Transaction Reports (STRs) without undue delay and within prescribed timelines, with documented grounds for suspicion.
• File the monthly report to FIU-IND and any other reports prescribed under the PMLA and PML Rules, including cash transaction reports where applicable.
• Coordinate the annual independent audit of AML/CFT/CPF controls, the CERT-In empanelled cybersecurity audit, and internal and statutory audits as they relate to AML.
• Maintain investigation files, compliance documentation and audit trails that stand up to regulatory inspection.
• Track regulatory and audit observations through to closure with owners, deadlines and corrective action plans. E. Leadership and compliance operations
• Build and lead the KYC, AML, transaction monitoring and compliance operations teams, including hiring, training and performance management.




• Present AML/CFT reviews to the Board, preferably quarterly, and an annual report on programme effectiveness, STR summaries, policy changes and FIU-IND advisories.
• Build compliance dashboards and MIS on alert volumes, ageing, STRs, high-risk clients, screening hits and audit actions.
• Run AML/CFT training for all staff at onboarding and at least yearly, with role-specific training for operations, support and tech.
• Embed compliance controls across spot trading, futures and derivatives, OTC, INR and crypto deposits and withdrawals, token listings and any new VDA services.
• Work with technology, operations, finance, legal and business teams so new features are reviewed for ML/TF risk before launch. Candidate requirementsCandidates must meet every mandatory requirement; preferred qualifications strengthen an application but are not required. Mandatory
• Minimum 5–7 years of relevant, hands-on AML/CFT and PMLA compliance experience in a regulated financial institution.
• Practical experience in transaction monitoring, STR investigations, KYC/CDD/EDD, and sanctions and PEP screening.
• Direct experience of FIU-IND reporting, including drafting and filing STRs on FINnet/FINGate.
• Sound working knowledge of the PMLA, PML Rules, FIU-IND guidelines for VDA service providers, UAPA and WMD Act sanctions obligations, and FATF standards.
• Experience handling regulatory inspections, audits or law enforcement requests.
• Experience leading or supervising a KYC, AML or compliance team.
• Graduate degree in law, commerce, finance or a related field.
• Based in India and able to work full-time and exclusively for tothemoon technologies pvt Ltd, with no concurrent engagement elsewhere.
• Clean regulatory and professional record, with no adverse findings related to financial crime. Preferred
• Prior Principal Officer, Deputy PO or MLRO experience at a VDA exchange, bank, NBFC, payment aggregator or stockbroker.
• Hands-on use of blockchain analytics tools such as Chainalysis, TRM Labs or Elliptic.
• Working knowledge of Travel Rule solutions, unhosted wallet controls and crypto-specific typologies.
• Experience with market surveillance for trading platforms, including derivatives.
• Certifications such as CAMS, CAMS-FCI, CCAS, ICA diplomas or IIBF AML/KYC certification.
• Professional qualification such as LLB, CA, CS or MBA.
• Experience building compliance programmes, SOPs and MIS from scratch in a fast-growing company.
• Familiarity with global VASP regimes such as the UAE (VARA), EU (MiCA) or FATF peer guidance. Core competencies
• Sound, independent judgement and the integrity to escalate or decline business on compliance grounds.
• Clear written communication for regulators, the Board and investigation files.
• Analytical skill with transaction and on-chain data; comfort with SQL or Excel-based analysis is an advantage.
• Ability to work with engineering and product teams to turn regulations into system controls.

📌 Senior Compliance Manager (Lucknow)
🏢 Amrevx
📍 Lucknow