Penelope Arellano

Senior Compliance, Risk & Control Professional with +10 years of experience in global financial institutions including Citi Banamex and American Express. Specialized in regulatory risk, audit management, process standardization and control testing across LATAM, US and Canada. Proven track record leading regulatory mapping, MCA programs, operational risk events (OREs) and cross-functional projects. Strong stakeholder management and audit liaison expertise at executive level.

Assistant Vice President Compliance Business Control, Senior Analyst - Citi Banamex

(2023-11 - 2026-03)

Business Unit: Credit and Customer Information

• Audit Expert (Control Liaison): Act as the primary point of contact for internal and external audits, ensuring effective coordination and timely delivery of audit requirements.
• Audit & Review Management: Coordinate audit requests, facilitate walkthroughs and stakeholder alignments, and provide comprehensive support throughout audit and review engagements.
• Regulatory Inventory Mapping Expert: Maintain and oversee regulatory inventory mapping activities to ensure alignment with applicable regulatory requirements.
• Regulatory Change Management: Monitor, assess, and support the implementation of regulatory changes impacting business processes and controls.
• Regulatory and Process Analysis: Analyze regulations and business processes to identify impacts, gaps, and opportunities for improvement while ensuring compliance.
• ICRM Process Mapping: Develop and maintain end-to-end process maps to enhance process transparency, governance, and operational efficiency.
• Procedure Governance and Analysis: Review and update procedures (920s), ensuring adherence to policies, accurate control documentation, and proper identification of Business Process Owners (BPOs).
• Records Management Champion: Lead records management activities to ensure compliance with retention requirements, documentation standards, and governance policies.
• SharePoint Administration and Documentation Management: Design and maintain SharePoint repositories to support efficient organization, accessibility, and management of audit and review documentation.
• Risk and Control Governance: Support the design, documentation, and maintenance of effective controls to strengthen compliance and operational risk management.
• Project Management: Led cross-functional projects focused on process optimization, risk management, regulatory compliance, and operational efficiency.
• Project Implementation: Successfully implemented strategic initiatives, including Monitoring Standardization, Internal Guidelines Documentation, and Process Improvement Programs.
• Standard Operating Procedures (SOP) Development: Designed and implemented standardized procedures to enhance consistency, governance, and operational effectiveness across teams.
• MCA Testing Program: Coordinated and executed the Manager's Control Assessment (MCA) Testing Program, ensuring adherence to control testing methodologies and quality standards.
• Operational Risk Event Management: Managed the identification, assessment, escalation, and remediation of Operational Risk Events (OREs) across Operations and Technology functions.
• Regional ORE Administration: Oversaw Operational Risk Event governance and administration for the LATAM region, ensuring accurate reporting, tracking, and regulatory compliance.
• Training & Development: Designed and delivered Operational Risk Event training sessions to more than 180 employees, strengthening risk awareness and control culture.
• Controls & Monitoring Analysis: Conducted comprehensive reviews of controls and monitoring activities to identify gaps, improve effectiveness, and mitigate operational risks.
• ARCM Quality Assurance: Performed monthly quality and compliance reviews of ARCM activities to ensure alignment with governance standards and risk management frameworks.
• ARCM Methodology Workshops: Facilitated bi-weekly workshops for Testers and Line Control Officers to reinforce methodology understanding, clarify requirements, and promote consistent execution practices.
• Monitoring Standardization Initiative: Led the assessment and standardization of monitoring processes performed by ICG Testers, improving execution quality, consistency, and governance oversight.
• Process Documentation & Governance: Developed and maintained internal guidelines and process documentation for Line Control Officers, streamlining onboarding, increasing productivity, and supporting continuous process improvement.

Risk Analyst & MCA Coordinator ICG Risk & Control - Citi Banamex - Operations & Technology

(2022-09 - 2023-11)

• Project Management: Led cross-functional projects focused on process optimization, risk management, regulatory compliance, and operational efficiency.
• Project Implementation: Successfully implemented strategic initiatives, including Monitoring Standardization, Internal Guidelines Documentation, and Process Improvement Programs. Standard Operating Procedures (SOP) Development: Designed and implemented standardized procedures to enhance consistency, governance, and operational effectiveness across teams.
• MCA Testing Program: Coordinated and executed the Manager's Control Assessment (MCA) Testing Program, ensuring adherence to control testing methodologies and quality standards.
• Operational Risk Event Management: Managed the identification, assessment, escalation, and remediation of Operational Risk Events (OREs) across Operations and Technology functions.
• Regional ORE Administration: Oversaw Operational Risk Event governance and administration for the LATAM region, ensuring accurate reporting, tracking, and regulatory compliance.
• Training & Development: Designed and delivered Operational Risk Event training sessions to more than 180 employees, strengthening risk awareness and control culture.
• Controls & Monitoring Analysis: Conducted comprehensive reviews of controls and monitoring activities to identify gaps, improve effectiveness, and mitigate operational risks.
• ARCM Quality Assurance: Performed monthly quality and compliance reviews of ARCM activities to ensure alignment with governance standards and risk management frameworks.
• ARCM Methodology Workshops: Facilitated bi-weekly workshops for Testers and Line Control Officers to reinforce methodology understanding, clarify requirements, and promote consistent execution practices.
• Monitoring Standardization Initiative: Led the assessment and standardization of monitoring processes performed by ICG Testers, improving execution quality, consistency, and governance oversight.
• Process Documentation & Governance: Developed and maintained internal guidelines and process documentation for Line Control Officers, streamlining onboarding, increasing productivity, and supporting continuous process improvement.

Risk Analyst II & Project Management - American Express

(2019-02 - 2022-09)

• Sales Practices Program Management: Led the Sales Practices Program to identify, assess, and mitigate inappropriate conduct, deceptive sales practices, and customer treatment risks within the Corporate Client segment.
• Process Risk Self-Assessment (PRSA) Governance: Managed the PRSA methodology across multiple business units, including Product, Marketing, Global Dollar Card, Sales, and Corporate Client Acquisition functions.
• Risk Assessment Lifecycle Management: Led the annual creation, review, and update of Process Risk Self-Assessments (PRSAs) to ensure accurate risk identification and control effectiveness.
• Inherent Risk Identification and Evaluation: Conducted comprehensive risk assessments to identify inherent risks associated with business processes, products, and operational activities.
• Risk Mitigation and Control Design: Developed and implemented preventive and detective controls, including testing methodologies, to mitigate operational, compliance, and conduct risks.
• Control Testing Oversight: Ensured compliance with Quality Validation (Q Validation) requirements for control execution and testing activities.
• Process Mapping and Risk Analysis: Developed end-to-end process maps to identify key risks, control gaps, and improvement opportunities across critical business functions.
• Independent Compliance Testing Remediation: Coordinated monitoring activities and remediation efforts resulting from Independent Compliance Testing and Internal Audit reviews, ensuring timely resolution of identified issues.
• Complaint Monitoring Framework Implementation: Led the implementation of complaint monitoring and governance processes in accordance with AEMP71 policy requirements for Mexico and Argentina.
• Customer Complaint Analytics: Performed trend analysis and root-cause assessments of customer complaints across Mexico and Argentina to identify emerging risks and drive corrective actions.
• Operational Risk Event Management: Oversaw the identification, reporting, investigation, and remediation of Operational Risk Events across Mexico, Argentina, Global Dollar Card, Canada, and the United States.
• New Product Approval (NPA) Governance: Managed end-to-end New Product Approval processes, including applicability assessments under AEMP54 policy, risk evaluations, stakeholder coordination, and governance approvals for new product launches and product enhancements.
• Records Management Governance: Ensured compliance with the AEMP08 Global Records Management Policy across Mexico, Argentina, and Canada, supporting regulatory requirements and documentation governance standards.

Global Regulatory Policy Assurance Analyst - American Express

(2015 - 2019)

• Audits in the definition of new accounts, document review and process review.
• Policy implementation: Call Handling using the internal "Customer First" ideology for the corporate account market in conjunction with the operations area.
• Procedural Monitoring and Analytics - Quality and compliance review, call monitoring to identify areas of opportunity in agents and operations processes, reinforce knowledge and ensure they are in compliance with federal regulations and laws.
• Call monitoring: Monitoring of calls to operations teams, consumer accounts, corporate accounts, in markets such as: Mexico, Argentina, US, Spain, Global Dollar Card, for lending and charge accounts.
• Quality and Compliance Training.
• Organization of dynamics to reinforce processes.

Licenciada en Enfermería y Obstetricia - Nursing and Obstetrics - Universidad Nacional Autónoma de México

High School - Colegio de Ciencias y Humanidades plantel Sur (UNAM) (1994 - 1998)

Risk Management Certification - Risk Management - Universidad Intercontinental (2022-06 - 2022-12)