Risk, Compliance and Data Protection Officer - OMIU

Role overview

Old Mutual is looking for a Risk, Compliance and Data Protection Officer to strengthen the effectiveness of the compliance function and help support business growth and strategic delivery. The position is based in Kampala, Central Region, Uganda and is focused on enterprise risk, regulatory compliance, financial crime controls, and data protection.

Enterprise risk management

• Drive rollout of the Enterprise Risk Management Framework across the organisation.
• Coordinate enterprise-wide risk and control self-assessments.
• Keep the corporate risk register current and ensure regular reviews.
• Track key risk indicators and highlight new or rising risks.
• Check observance of approved risk appetite statements and escalate exceptions.
• Coordinate incident reporting, root-cause analysis, and follow-up on corrective actions.
• Lead periodic risk assessments across departments.
• Support scenario analysis and stress-testing exercises where needed.
• Prepare monthly, quarterly, and annual risk reports for management committees and the Board Risk Committee.
• Review departmental risk registers and provide independent challenge.
• Support the Business Continuity Management Framework and its ongoing maintenance.
• Take part in business impact analysis and continuity testing.

Operational risk management

• Track operational exposures across underwriting, claims, finance, ICT, investments, and support areas.
• Monitor whether key controls are being implemented effectively.
• Record operational losses and near misses.
• Spot new operational risks linked to technology changes, outsourcing, and process redesign.
• Review the effectiveness of control actions.

Regulatory compliance

• Implement the Compliance Management Framework.
• Maintain the full inventory of regulations relevant to the company.
• Track adherence to the Insurance Act, IRA guidelines, AML legislation, tax rules, financial reporting rules, the Data Protection and Privacy Act, consumer protection requirements, and other applicable laws.
• Carry out compliance reviews in line with the approved monitoring plan.
• Document findings and recommend corrective measures.
• Follow up to ensure agreed actions are completed.
• Advise business units on regulatory matters.
• Monitor legal and regulatory changes and assess their impact.
• Coordinate regulatory submissions assigned to the role.
• Promote ethical behaviour and compliance awareness across the business.

Financial crime compliance

• Support the rollout of the AML/CFT/CPF programme.
• Assess the effectiveness of customer due diligence controls.
• Monitor sanctions screening and customer onboarding controls.
• Assist with preparation of AML-related regulatory returns.
• Track completion of AML action plans.
• Take part in reviews of suspicious activity.
• Deliver AML awareness sessions.
• Prepare AML dashboards and management reports.

Data protection and privacy

This role serves as the company’s designated Data Protection Officer.

• Implement the organisation’s Data Protection Framework.
• Ensure compliance with the Data Protection and Privacy Act, 2019 and related regulations.
• Maintain the personal data inventory.
• Coordinate data protection impact assessments.
• Keep records of processing activities up to date.
• Monitor compliance with privacy policies.
• Investigate data breaches and coordinate incident response.
• Work with the Personal Data Protection Office.
• Coordinate annual renewal of Data Controller/Data Processor registration.
• Coordinate submission of statutory returns.
• Deliver privacy awareness training.
• Track closure of privacy-related findings.
• Prepare periodic data privacy reports and dashboards.

New products, projects, and change risk

• Perform independent risk assessments for new insurance products.
• Review major projects and strategic initiatives.
• Assess regulatory implications before implementation.
• Recommend controls and actions prior to launch.
• Monitor emerging risks throughout project execution.

Risk governance

• Coordinate meetings of the Risk Management Committee.
• Prepare committee packs and minutes.
• Monitor implementation of committee resolutions.
• Support periodic reviews of risk policies.
• Assist with ORSA activities where relevant.
• Support combined assurance work with Internal Audit, External Audit, and regulators.

Risk culture and awareness

• Run risk and compliance awareness sessions.
• Encourage ownership of risk across teams.
• Support departmental risk champions.
• Develop awareness materials and newsletters.
• Help sustain a culture of integrity, accountability, and ethical conduct.

Reporting

• Prepare enterprise risk reports.
• Prepare compliance reports.
• Prepare risk appetite reports.
• Prepare operational risk reports.
• Prepare incident reports.
• Prepare AML reports.
• Prepare data protection reports.
• Prepare Board Risk Committee papers.
• Prepare regulatory compliance dashboards.

AML, compliance, and sanctions expectations

The role requires strict adherence to compliance, anti-money laundering, and sanctions policies, procedures, and process requirements across Old Mutual and its subsidiaries. The incumbent will handle customer due diligence, uphold KYC standards, carry out ongoing and enhanced due diligence, maintain data quality, and identify or escalate possible AML, sanctions, compliance breaches, and unusual activity to the Risk and Compliance Office.

Technical competencies

• Strong grasp of risk management, internal controls, corporate governance, and the financial services environment.
• Sound understanding of money laundering risks and regulatory expectations.
• Ability to anticipate, assess, and reduce risk by developing suitable risk management policies for the business unit.
• Excellent knowledge of accounting standards and relevant legislation.
• Good understanding of applicable regulatory requirements.
• Strong analytical, financial modelling, data-driven, and problem-solving capability.

Personal attributes

• High integrity and a fair, firm, and ethical approach.
• Strong interpersonal skills and the ability to lead or coordinate teams.
• Strategic, critical, and analytical thinking with practical problem-solving ability.
• Results-focused with strong operational awareness.
• Excellent communication and organisational skills.

Education and professional qualifications

A bachelor’s degree in Risk Management, Insurance, Finance, Business Administration, Law, Accounting, Economics, Statistics, Actuarial Science, Information Systems, or a related field is required. Professional qualifications or certifications in any of the following are valued: IRM, CRM, ACCA, CPA, ICA Certificate in AML, CAMS, Data Protection Certification, or ISO 31000 Risk Management training.

Experience

• 3 to 5 years of experience in Risk Management, Compliance, Internal Audit, Governance, or Data Protection.
• Experience in insurance or financial services is strongly preferred.
• Exposure to regulator engagement is required.
• Background in compliance reviews and enterprise risk assessments is important.
• Experience preparing board and management reports is needed.

Additional information

Closing date: 12 July 2026 at 23:59.

Old Mutual emphasises its belief in Africa’s opportunity and a diverse workforce.

The role is full-time and based onsite in Kampala, Central Region, Uganda.

The job title references OMIU.