The First Hires Playbook
Who to hire first, and in what order, for founders launching a regulated crypto, fintech or iGaming business and for teams entering a new market.
Two paths: launching from scratch, or expanding into a new country. Role order, what to look for, interview questions and a planning worksheet. Regulatory points are referenced to official sources.
Recruitment for fintech, crypto and iGaming · hirexel.comBefore you start
Four rules for your first hires
Whether you are launching a regulated business or opening a new market, the first hires are not only a team. They are part of the licence file, and they shape the documents, the banking and the launch date.
Hire the people the regulator assesses before you draft
Many regulators approve the people in key roles, not only the firm. The MFSA, for example, assesses competence, reputation, conflicts of interest and independence of mind, and time commitment[7]. The FCA expects firms to show how they satisfied themselves that a candidate is fit and proper before applying[5]. If a key person is missing or weak, the application slows down.Plan where people will live before you name them
Some regimes set location rules. MiCA requires a crypto-asset service provider to have its place of effective management in the EU and at least one director resident in the EU[1]. In Dubai, VARA requires two Responsible Individuals who are full-time employees, fit and proper, and resident in the UAE or UAE passport holders[10].Hire for the stage you are in
At launch you need people who open doors: regulators, banks, payment providers, partners. At scale you need people who run processes: operations, payments risk, retention. The same title can mean two different profiles.Start early
Senior compliance candidates often have long notice periods, and regulator approval sits on the critical path when a role must be approved before the firm is licensed. A late search pushes back the submission.
How to read the role tables
Each section lists roles in a typical order for a launch. Your order depends on your licence, your market and who you already have. Smaller firms often combine roles; check that the regulator accepts each combination.The First Hires Playbook · Hirexel2
Two paths
Launching from scratch or entering a new market?
The first hires depend on what already exists. Find your path, then use the sector tables that follow.
Path 1: launching a new business
Nothing exists yet: no framework, no providers, no team. The regulator assesses the people named in the application.
- First: the people in the licence file. Under MiCA, the management body is assessed for good repute, knowledge, skills and experience[2]; the head of compliance writes or owns the documents the regulator reads[5].
- Then: the people who open banks and payment providers. Without providers that accept the business, there are no payments to operate.
- Watch the clock: under MiCA the authority checks that an application is complete within 25 working days, and weak or missing information on key people can stop the clock[3].
Path 2: entering a new market
You have a product, a team and perhaps a licence elsewhere. The new market adds local rules, local providers and local people.
- First: a country manager with a local network at regulators, banks, payment providers and partners. Hire before the launch plan is fixed.
- Check local presence rules: MiCA requires effective management in the EU and at least one EU-resident director[1]; VARA requires two Responsible Individuals who are full-time and UAE-resident or UAE passport holders[10].
- Decide the set-up early: local entity, employer of record or contractor. An employer of record may not be accepted for roles the regulator expects the firm's own employees to hold. Take local legal and tax advice before the offer.
- Expect new providers: each new market can need new local payment methods and providers, so PSP relationship work returns with every expansion.
| Question | Launching a new business | Entering a new market |
|---|---|---|
| First hire | Key people for the licence file | Country manager with a local network |
| Biggest risk | An incomplete or generic application | Local rules on residence and key people discovered late |
| Payments | Find providers that accept the business | Add local payment methods and providers |
| Employment | Usually the new licensed entity | Local entity, employer of record or contractor |
The First Hires Playbook · Hirexel3
Crypto and Web3
First hires for a crypto firm applying for a licence
Example regimes: MiCA in the EU, VARA in Dubai, FCA registration in the UK.
| Role | Why it comes first | What to look for | |
|---|---|---|---|
| 1 | Management body and an EU-resident director (MiCA) | Assessed for good repute, knowledge, skills and experience under MiCA Article 68(1)[2]; effective management must be in the EU[1]. Under Article 63 a competent authority must refuse authorisation if the management body does not meet the criteria[3]. | Experience running a regulated financial business; real decisions taken in the EU |
| 2 | Head of Compliance | Writes or owns the policies, procedures and risk assessment the regulator reads. The FCA expects an AML framework tailored to the business, not generic or off-the-shelf[5]. | A successful application for a similar business; direct regulator contact; built a framework from scratch |
| 3 | MLRO | Owns the AML framework, the travel rule and suspicious transaction reporting. In the EU the travel rule applies under Regulation (EU) 2023/1113 from 30 December 2024[12]. | Crypto-specific AML experience, not only bank AML; wallet screening and blockchain analytics |
| 4 | Risk management | Anyone professionally arranging or executing crypto transactions must have arrangements to prevent and detect market abuse under MiCA Article 92[4]. | Crypto or trading risk experience |
| 5 | IT and information security | DORA has applied to MiCA-authorised CASPs since 17 January 2025[11]. | Security and resilience experience in a regulated firm |
| 6 | Head of Operations | Turns rules on client assets (MiCA Art. 70), complaints (Art. 71) and outsourcing (Art. 73) into daily procedures[2]. | Regulated operations experience; writes procedures; works well with compliance |
| 7 | Country manager | Opens doors at regulators, banks and payment providers in a new market. | Local network; launch experience; works without a team |
| 8 | Business development | Wins clients and partners once you know what you may offer and how you may market it, before and after the licence. | Deals they can explain; knowledge of the marketing rules in your markets |
Dubai (VARA) specifics
VARA requires two Responsible Individuals per VASP: full-time, fit and proper, resident in the UAE or UAE passport holders, approved during licensing[10]. VARA's Compliance Officer must have at least five years of relevant compliance experience, be resident in the UAE or hold a UAE passport, be a full-time employee and report directly to the board[9].The First Hires Playbook · Hirexel4
Fintech
First hires for a payments firm, EMI or neobank
In payments, the regulator, the banks and your clients all judge you by the same people: compliance, AML, risk and operations.
| Role | Why it comes first | What to look for | |
|---|---|---|---|
| 1 | Key function holders and senior managers | Under the UK Senior Managers Regime, roles such as compliance oversight (SMF16) and money laundering reporting (SMF17) need approval[6]. The FCA requires regulatory references going back 6 years for senior management function applicants[6]. | Competence for your business, clean reputation, no conflicts, enough time for the role[7] |
| 2 | Compliance Officer | Builds the compliance framework and answers the regulator's questions on it. | Experience in a similar regulated business; licence application experience |
| 3 | MLRO | Owns AML and suspicious activity reporting. In the UK, money laundering reporting is a senior management function (SMF17) that needs approval[6]. | Decisions they owned personally; experience in the same type of business |
| 4 | Fraud and payments risk | Fraud losses and chargebacks hit margins, partner relationships and client trust from the first live payments. | Rules they built, losses they reduced, how they worked with AML |
| 5 | Head of Operations | Runs onboarding, payments, reconciliations, complaints and vendors under the rules compliance sets. | Regulated operations; written procedures; incident examples |
| 6 | Sales and partnerships | Merchants, partners and distribution once the product and licence position are clear. | A pipeline they built themselves; high-risk sector experience if relevant |
Screen against the regulator's criteria before the first interview
- Match experience to the role and to your business, not only the title.
- Ask about investigations, proceedings, dismissals and findings early.
- List every other appointment and the time each takes.
- Check residence and full-time conditions for the role.
- Take the references a regulator would take.
The First Hires Playbook · Hirexel5
iGaming
First non-tech hires for an iGaming operator
An operator needs approved key people to get licensed, payment providers to take deposits, and commercial people to bring and keep players.
| Role | Why it comes first | What to look for | |
|---|---|---|---|
| 1 | Key functions (e.g. Malta) | The MGA treats compliance, AML/CFT, legal affairs and technology, among others, as key functions that need prior approval and a key function certificate[8]. | Gaming-specific regulatory experience; a record that passes fit and proper |
| 2 | MLRO | The MGA interviews applicant MLROs together with the FIAU[8]. | Hands-on AML in gaming; suspicious activity decisions they owned |
| 3 | Head of payments / PSP relationships | Without providers that accept the business, there are no payments to operate. Gambling is treated as higher risk by many providers and banks. | A PSP network of their own; high-risk merchant experience; local payment methods |
| 4 | CRM and retention | Incentive rules differ by market. From 19 January 2026 the Gambling Commission capped wagering requirements at 10 times and banned mixing product types in one incentive[14]. | Campaigns measured against a control group; knowledge of incentive rules |
| 5 | Affiliate manager | In Great Britain, licensees are responsible for the actions of third parties they work with, including affiliates[13]. | Partner network; compliance controls on affiliate marketing |
| 6 | VIP and account management | In Great Britain, high value customer scheme rules require affordability, harm and source of funds checks before enrolment and on an ongoing basis[15]. | A portfolio they managed and results they can explain; safer gambling knowledge |
| 7 | Payment operations and fraud | Once volumes grow: approval rates, withdrawals, reconciliations, chargebacks. | Numbers they can explain; work with AML and safer gambling |
Market rules shape the job
In Great Britain, gambling with credit cards has been banned since 14 April 2020, including through e-wallets funded by credit cards[16]. Ask every payments and CRM candidate how they applied rules like this in the markets they know.The First Hires Playbook · Hirexel6
Interview questions
Questions that separate doers from describers
Strong answers name documents, systems, people and decisions. Weak answers repeat general principles.
Director (MiCA)
"Which decisions will you take personally in the EU, and how will you show the regulator that effective management is here?"
Head of Compliance
"Walk me through the last application you worked on. Which documents did you write yourself, and what did the regulator ask about them?"
MLRO (crypto)
"How would you meet the travel rule for transfers to a service provider that does not support it?"
Risk
"What would market abuse monitoring look like in our first year, and who would review the alerts?"
Head of Operations
"A large client's withdrawal is held by an analytics alert and the client calls every hour. What do you do, who do you involve and what do you tell the client?"
Country manager
"Name three people at banks or payment providers in this market you would call in your first month, and what you would ask each of them."
Head of payments (iGaming)
"Your main card acquirer gives you 30 days' notice. Walk me through the next 30 days."
Payments (iGaming)
"How would you choose payment methods for a new market you have not worked in before?"
Red flags in any first hire
- A network that belongs to the previous employer, not to the candidate.
- Only established-market experience: ran a large business, never built one.
- Generic language about regulation that does not apply to your product.
- A CV that will not survive a fit and proper review: unexplained gaps, short roles at firms that lost licences, too many other appointments.
The First Hires Playbook · Hirexel7
Worksheet
Work backwards from your launch or market entry date
Fill in one row per role. Start with the roles the regulator approves, then the roles that open banks and payment providers.
| Role | Regulator approval? | Location rule? | Must start by | Search starts | Owner |
|---|---|---|---|---|---|
Before each offer, check
- Does the regulator need to approve this person, and how long does approval take?
- Does the role have residence, full-time or experience conditions?
- Is the entity and employment set-up decided: local entity, employer of record or contractor?
- Have you documented your own fit and proper assessment of the candidate?
- What is the candidate's notice period, and does it fit the plan?
Book a free 30-minute first hires plan call
A Hirexel recruiter goes through this worksheet with you: which roles to open first, where the candidates are, and what your regulator will check. No obligation.Hirexel recruits management, compliance, AML, payments, operations and commercial roles for fintech, crypto, blockchain and iGaming companies, and screens candidates against the regulator's criteria before you meet them. If a candidate we place doesn't work out in the first 90 days, we fill the role again free of charge.
Book on WhatsApp: +971 56 842 8813 · hirexel.com
The First Hires Playbook · Hirexel8
Sources
Official sources
This playbook is general information, not legal advice. Check the current rules of your regulator before you hire.
- ESMA, MiCA interactive single rulebook, Article 59 (Authorisation): https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-59-authorisation
- ESMA, MiCA interactive single rulebook, Articles 68, 70, 71 and 73: https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica
- ESMA, MiCA interactive single rulebook, Article 63 (Assessment of the application): https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-63-assessment-application
- ESMA, MiCA interactive single rulebook, Article 92 (Prevention and detection of market abuse): https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-92-prevention-and-detection-market
- FCA, Cryptoassets: what we expect to see in your application for registration: https://www.fca.org.uk/firms/cryptoassets/application-registration
- FCA, Senior Managers Regime: https://www.fca.org.uk/firms/senior-managers-and-certification-regime/senior-managers-regime
- MFSA, Guidelines to the Personal Questionnaire: https://www.mfsa.mt/wp-content/uploads/2019/02/MFSA_PQ_Guidelines_FINAL.pdf
- Malta Gaming Authority, Key Functions: https://www.mga.org.mt/licensee-hub/key-function/
- VARA, Compliance and Risk Management Rulebook (19 May 2025): https://rulebooks.vara.ae/sites/default/files/en_net_file_store/VARA_EN_123_VER20250519.pdf
- VARA, Company Rulebook: https://rulebooks.vara.ae/entiresection/122
- Regulation (EU) 2022/2554 (DORA): https://eur-lex.europa.eu/eli/reg/2022/2554/oj
- EBA, Travel rule guidance under Regulation (EU) 2023/1113: https://www.eba.europa.eu/publications-and-media/press-releases/eba-issues-travel-rule-guidance-tackle-money-laundering-and-terrorist-financing-transfers-funds-and
- Gambling Commission, Licensees' responsibilities for third parties: https://www.gamblingcommission.gov.uk/licensees-and-businesses/page/licensees-responsibilities-for-third-parties
- Gambling Commission, Gambling promotions to be safer and simpler: https://www.gamblingcommission.gov.uk/news/article/gambling-promotions-to-be-safer-and-simpler
- Gambling Commission, New rules to stamp out irresponsible "VIP customer" practices: https://www.gamblingcommission.gov.uk/news/article/gambling-commission-new-rules-to-stamp-out-irresponsible-vip-customer
- Gambling Commission, Gambling on credit cards to be banned from April 2020: https://www.gamblingcommission.gov.uk/news/article/gambling-on-credit-cards-to-be-banned-from-april-2020
The First Hires Playbook · Hirexel · hirexel.com9
Recruitment for fintech, crypto, blockchain and iGaming companies: commercial, account management, marketing, compliance, payments, operations and executive roles.
Send us the job descriptionSiliconSea LP (SL036312), 5 South Charlotte Street, Edinburgh, doing business as Hirexel HR Agency.
Proxima Eight FZE LLC, Business Centre, Sharjah Publishing City Free Zone, United Arab Emirates. Hirexel is a recruitment brand by Proxima Eight.
© 2026 Hirexel