Legal Compliance Manager

A. Legal Advisory & Leadership (Internal Legal Function)

• Act as the Bank’s principal internal legal advisor, delivering timely and practical legal advice on corporate, regulatory, privacy, consumer, banking, contracts and governance matters.
• Lead and maintain the Legal Risk Management Framework, including legal risk identification, contract governance, legal risk assessments and legal incident management.
• Partner with business units on reviews of new products, digital initiatives, contracts, third-party arrangements, technology solutions and outsourcing arrangements.
• Oversee internal and external dispute resolution including oversight of AFCA matters.
• Support governance frameworks including conflicts of interest, delegations, document execution, and powers of attorney (as required).
• Manage relationships with external legal service providers and the internal legal budget.
• Monitor and interpret changes to legislation, case law, industry standards and codes re Bank impact.
• Act as spokesperson or regulatory point of contact on legal matters where appropriate and as agreed with CRO and Head of Risk & Compliance.

B. Compliance Framework & Governance

• Own and maintain the Compliance Management Framework, ensuring alignment with APRA, ASIC, OAIC and industry standards. Work with Risk & Compliance team members with respect to AUSTRAC requirements as required.
• Maintain the obligations register / obligations library, ensuring obligations are accurately interpreted, mapped to controls, assigned to Line 1 owners and kept current.
• Oversee compliance monitoring, thematic reviews, compliance assurance and Line 1 control attestation processes, assisting with driving clear accountability for compliance obligations within Line 1.
• Ensure the Bank complies with all relevant obligations, including:
• • APRA Prudential Standards (CPS 220, CPS 230, CPS 234, CPS 510, CPS 520)
  • ASIC Act, Corporations Act, RG 78, DDO, consumer protection requirements
  • Privacy Act and APPs
  • Customer Owned Banking Code of Practice
• Promote a strong compliance culture and uplift in regulatory understanding across Line 1.

C. Regulatory Change, Horizon Scanning & Emerging Regulation

• Lead horizon scanning for legislative, regulatory, prudential and industry changes, including upcoming reforms and regulatory expectations.
• Maintain the Regulatory Change Register capturing impacts, interpretation, responsible owners, implementation milestones and deadlines, ensuring the Bank is prepared for and compliant with major regulatory developments including Privacy Act reforms, Scam Prevention Framework and AML/CTF enhancements. Work closely with Risk & Compliance team members accordingly.
• Conduct regulatory impact assessments and partner with Line 1 to implement required changes sustainably and on time.
• Provide concise, forward-looking insights to ELT, Risk Committee and Board on emerging legal, compliance, privacy, industry and prudential risks.

D. Compliance Incidents & Regulatory Breach Oversight

• Own and oversee the Bank’s Legal, Compliance, Privacy and Regulatory Incident Management Frameworks, working closely with the Operational Risk Manager.
• Provide Line 2 oversight of regulatory and compliance incidents, legal incidents, privacy incidents, including reportable situations, ensuring Line 1 owns investigation, remediation and controls.
• Ensure timely and accurate notifications to regulators including:
• • ASIC Reportable Situations (RG 78)
  • APRA breach notifications (including CPS 220/230/234)
  • OAIC Notifiable Data Breach (NDB) notifications
• Work with Operational Risk Manager in 2nd line oversight role regarding quality of root cause analysis and ensure appropriate customer remedial actions for compliance related and breach incidents.
• Maintain the Breach Register and ensure accurate and insightful reporting to ELT, Risk Committee, Audit Committee and the Board.

E. Oversight & Challenge (Line 2)

• Challenge as appropriate Line 1 compliance assessments, breach investigations, control effectiveness assessments and proposed remediation plans.
• Review the quality and completeness of Line 1 compliance controls, operationalisation of legal requirements and adherence to policies.
• Oversee compliance attestations, Line 1 obligations self-assessments and thematic reviews.
• Work with Line 1 to ensure appropriate escalation of legal, compliance and regulatory risks in accordance with governance expectations.

F. Policy Management & Governance

• Assist the CRO and Head of Risk & Compliance with continuous improvement of the Bank’s policy governance framework, ensuring policies and standards are current, aligned, consistent and accessible.
• Ensure policies reflect regulatory, prudential and legal changes and drive consistent policy governance across the Bank. Support Line 1 policy owners with interpretation and implementation advice.

G. Regulatory Engagement & Reporting

• Act as primary or delegated regulator contact for legal, compliance, and privacy matters as required.
• Maintain a central Regulatory Engagement Register, including all regulatory interactions, notices, requests, reviews and commitments.
• Coordinate high-quality responses to regulatory notices, inquiries, data requests, reviews and consultations.
• Prepare clear and concise reports for ELT, Risk Committee, Audit Committee and the Board covering:
• • compliance incidents and breaches
  • legal risks and disputes
  • emerging regulatory risks
  • compliance maturity and trends
  • regulatory change status

H. Training, Capability & Culture Uplift

• Develop and deliver training on legal obligations, compliance risk, privacy, breach reporting and governance requirements.
• Assist with uplifting Line 1 capability and understanding of their legal and compliance responsibilities.
• Promote a strong culture of ethical conduct, transparency and regulatory accountability.

I. Leadership, People & Strategy

• Manage and develop the role holder’s direct report while collaborating and assisting with team development within the broader Risk & Compliance function.
• Contribute to strategic initiatives and Bank-wide projects, providing proactive legal / compliance insights.
• Support the CRO and Head of Risk & Compliance in strategic planning and maturity uplift of the overall Risk & Compliance function.
• Represent the Bank in industry forums, working groups and external stakeholder engagements.

Risk Management

Community First requires you to:

• Understand and adhere to Community First’s operational risk, business continuity, and incident management policies and procedures, incorporating APRA CPS 230 requirements.
• Actively identify, assess, mitigate, and report operational risks, incidents, errors, or concerns through designated internal reporting channels, in alignment with the Community First’s risk management framework and operational risk management policy.
• Seek assistance or clarification whenever in doubt about a risk or when a new or increased risk is identified and escalate these matters to your direct manager or other reporting channels as appropriate.
• Participate annually in risk management workshops to identify and assess key risks, determine their likelihood, and ensure appropriate mitigants and controls are in place.
• Collaborate effectively with external service providers and partners, ensuring that third-party risks are managed in accordance with Community First’s policies and regulatory requirements.
• Know and comply with Board and Management policies, including but not limited to consumer and business lending, as well as all regulatory requirements. Review all policies and regulatory requirements annually and remain up to date on changes. Managers must ensure their teams are aware of and understand these policies and changes.
• Participate in ongoing training, development activities, and practice drills to maintain competence in risk management, compliance, and business continuity practices, including successful completion of annual risk and compliance training arranged by Talent Management.
• Foster a strong risk culture by promoting accountability, transparency, and continuous improvement, and by championing risk awareness across the organisation.
• Understand that failure to follow documented policies and procedures, or to act in a manner inconsistent with Community First’s values and expectations, may result in performance management