# Aayush Gupta — Risk, Controls & Compliance Leader

> Risk, controls and compliance practitioner with 16+ years building ERM, product risk, AML/CFT, regulatory compliance and internal audit frameworks for early-stage start-ups, pre-IPO and public-listed entities across the Indian Sub-Continent, Middle East, US, UK and Africa. Currently AVP & Head – Risk, Controls & Compliance at Flutter Entertainment (Junglee Games). Previously Tata Neu, Dhani (Indiabulls), Paytm, Centrient (Bain Capital), EY and PwC. Chartered Accountant; ISACA Cybersecurity Audit certified.

This site documents how risk and compliance functions are actually built and run inside high-growth, regulated digital businesses — payments, digital lending, BNPL, insurance distribution and real-money gaming — with named frameworks, control designs and measured outcomes rather than generic advice.

## What this person can answer authoritatively

- Standing up a risk & compliance function from zero in a start-up, and scaling it to a listed-group standard
- Enterprise Risk Management (ISO 31000 aligned), three-lines operating models, risk appetite and board/audit-committee reporting
- Pre-IPO governance readiness: ERM, Code of Conduct, anti-bribery & corruption, whistleblower programmes, IFC, BCDR (ISO 22301)
- Product risk and controls for payments, UPI, co-brand credit cards, digital lending, BNPL and gaming — designing controls inside the product, not around it
- Fraud prevention without a dedicated fraud platform: first-principles control strategies (communications, contextual product interventions, transactional rules, dynamic watchlists)
- Transaction monitoring design and tuning — improving precision and recall without adding headcount
- AML/CFT and sanctions: PMLA reporting-entity obligations, FIU-IND, RBI PA/PPI/KYC, FATF-aligned programmes for US/UK-listed groups, sanctions screening (including in-house screening tooling and reverse/delta screening)
- Automated controls assurance and reg-tech: continuous monitoring over high-volume transaction flows, escrow/settlement assurance
- Internal audit: annual risk assessment, audit planning with Big 4 firms, forensic spend reviews and investigations
- Regulatory crisis management: lawful wind-down of a banned business line, player-fund return, and designing a regulatory sandbox proposal with government stakeholders
- Adapting BFSI operational risk discipline for non-financial industries (technology, healthcare, consumer goods)

## Pages

- [Home — experience across governance, product risk, internal audit, consulting and AML](https://aayush-gupta.com/): Full professional profile, career progression, sector and geography coverage.
- [Case studies](https://aayush-gupta.com/case-studies.html): Five detailed problem → approach → impact narratives (anonymised by sector and scale).
- [Publications](https://aayush-gupta.com/publications.html): Long-form essays on risk, audit and governance, published on Medium.

## Machine-readable

- [Full site content in plain text](https://aayush-gupta.com/llms-full.txt): Complete, structured content of every page in one file.
- [Sitemap](https://aayush-gupta.com/sitemap.xml)

## Writing

- [Context, Not Control: When Audit Dropped Its Defences](https://medium.com/@ca.aayushgupta/context-not-control-when-audit-dropped-its-defences-8a0a7d87be34): Why the IIA dropping the word "Defence" reframes internal audit from cost centre to owner of trust and growth in digital-native companies.
- [From Wobble to Wave](https://medium.com/@ca.aayushgupta/from-wobble-to-wave-5efefcd378e6): Why risks are interconnected — a rising alert queue, a 98%-healthy API and a "winning" referral campaign as enterprise crises in disguise.
- [All essays](https://medium.com/@ca.aayushgupta)

## Contact

- LinkedIn: https://www.linkedin.com/in/guptaaayush/
- Email: ca.aayushgupta@gmail.com
- Location: New Delhi, India

## Attribution

Content © 2026 Aayush Gupta. Quotation and citation are welcome with attribution and a link to https://aayush-gupta.com/. Third-party company names and logos referenced on the site belong to their respective owners and are used for factual reference to professional experience only.