I help scaleups and enterprises build and launch products in regulated markets around the world. Not by ignoring the constraints regulation imposes, but by understanding them deeply enough to innovate within them.
I work with companies expanding into new markets and established companies launching new products in fintech, regtech, InfoSec, and trust & safety. I'm not a lawyer. I'm a product person who knows how to build inside regulated environments because I've done it myself.
Let's Talk
Most consultants have either worked at a big company or built a startup. I've done both, and both in regulated industries.
At Google, I spent 11 years building and scaling Trust & Safety products used by billions. I know what innovation looks like when the constraints are enormous and every decision is scrutinised.
Then I built compensIT from nothing: a regulated fintech operating where finance, data, and regulation meet. I took it from an idea to an acquisition by Experian.
I know what trips up scaleups entering regulated markets: the wrong assumptions, the product architecture decisions that create problems later, the operational gaps that burn through runway before you've found traction.
I know what kills innovation inside established companies: the organisational friction, the process bloat, the slow death of new ideas inside a company optimised for risk avoidance.
I know what a successful exit looks like from the inside: what acquirers look at, how operational maturity affects valuation, and what makes a regulated product investable.
I don't give advice based on frameworks I read. I give advice based on things I've built, scaled, and sold, inside the same constraints you're operating in.
I work with companies where trust and regulation shape every product decision, wherever they operate. If your product doesn't live in one of these spaces, I'm not the right person, and I'm fine with that.
Companies that have real revenue, real teams, and a real need to innovate inside regulatory constraints.
You've built a successful product at home and you're ready to expand internationally. What worked in your first market won't automatically work in the next one, because the regulatory environment shapes everything. I help you adapt and launch without losing a year learning the hard way.
You have customers and revenue. Now you're launching a new product or business line in fintech, regtech, InfoSec, or trust & safety. Your team can ship features, but innovating where the constraints shape every decision is a different skill. I bridge that gap.
Your innovation lab has ideas but has shipped zero products. The gap between an interesting concept and a thing you can actually launch in your market is too wide. I close it, with an approach built by someone who understands the constraints your industry imposes.
Innovation in regulated tech isn't a harder version of regular innovation. It's a different discipline, and every pillar accounts for the environment you're actually operating in.
Finding problems worth solving within the world you actually operate in.
Customer research, market analysis, opportunity identification. In regulated markets, the constraints shape which problems are worth pursuing. I help you run discovery that accounts for the regulatory environment from the start, so you don't invest in directions that won't work in your market.
Deciding what to build, with eyes open about the environment.
Product vision, positioning, business model, market entry. In regulated markets, strategy means understanding how the environment shapes your options: which markets to enter first, how to structure your offering, where the constraints create defensibility because competitors face the same barriers.
Building trust through the experience, not despite the constraints.
User experience, service design, prototyping. Regulated products have consent flows, verification steps, and disclosure requirements. The best products turn these into trust signals: experiences that make users feel safe, not frustrated. I design with the constraints as part of the experience.
Engineering that understands the environment it's shipping into.
Technical architecture, development, deployment. In regulated environments, engineering decisions have consequences beyond performance. Data handling, security, and audit capabilities all matter differently. I help your team build with an understanding of these constraints from day one.
Learning fast when the usual shortcuts aren't available.
Prototyping, MVP, experimentation, pilot programmes. In regulated industries, the standard shortcuts aren't always available. I help you find ways to validate quickly within the constraints: sandbox programmes, controlled pilots, staged rollouts, and creative testing approaches.
Growing without the operations falling apart under complexity.
Growth strategy, operational scaling, team structure, metrics, fundraising readiness. In regulated markets, scaling adds layers of complexity: new jurisdictions, growing compliance workloads, sophisticated reporting. I build the systems that let you grow without chaos.
Every engagement is fully remote and async first, wherever you are in the world. I don't fly in for workshops. I don't sit in your office. This is by design.
Coaching and advisory for founders, CPOs, and executive teams. Strategic direction, product decisions, innovation methodology. Regular sessions, individually or with the whole leadership team, plus async support. I challenge your thinking and sharpen your decisions.
A scoped assessment of your product, operations, strategy, and innovation readiness, evaluated against my framework. I deliver a written report: what's working, what's broken, and what to do about it, prioritised by impact. You execute. Two to four weeks, fixed deliverable, no ongoing obligation. Often the starting point that leads to coaching.
Remote workshops and structured programmes that transfer my methodology to your people. Product discovery in constrained environments, innovation sprints adapted for regulated markets, operational excellence. I train your team, then step back. You keep the capability.
Every engagement is built around asynchronous communication, which means I can work with teams in any timezone. This isn't a compromise. It's a deliberate choice because it produces better outcomes.
Async means your team isn't pulled into status meetings that should have been a document. My analysis is written, structured, and reviewable, not lost in a conversation nobody recorded.
The best strategic thinking doesn't happen live. It happens when someone has the space to read, reflect, and respond thoughtfully. That's what async gives you: depth instead of speed, clarity instead of volume.
I use live sessions when they genuinely add value: coaching conversations, workshops, decision making moments. But the default is written, the default is async, and the default is that everyone's time is respected.
Trained and certified across these, but none of them is religion. I use what works, adapted for regulated industries where constraints, speed, and quality all have to coexist.
I'm not a lawyer and I don't do legal analysis. But I've built products inside regulated environments and I understand how those constraints shape product decisions. That experience means I don't waste your time on approaches that ignore your reality.
In regulated industries, a bad assumption discovered in month six costs ten times more than one challenged in week two. My process puts the hard questions first.
Most meetings exist because someone didn't write things down. I default to written communication: structured, searchable, reviewable. When we meet, it's because a live conversation will produce something a document can't.
If your product thesis doesn't hold up under scrutiny, I'll say so. If the data says your approach won't work in this market, I'll show you. You're paying for signal, not comfort.
Every engagement transfers knowledge and capability to your team. When I leave, you should be stronger, not wondering how to function without me.
I turn down work outside my expertise or my values. I won't take your money to learn on your project.
I've built products, led teams, and shipped inside these industries. I understand the constraints because I've operated within them.
Payments, banking APIs, BaaS. Built compensIT from zero to an acquisition by Experian, working with major card networks, SEPA, and payment operations across borders.
Compliance automation, regulatory reporting, KYC/AML tooling. I understand what regulators expect because I've built products that had to meet those expectations.
Security products, identity and access, fraud and abuse prevention, threat response. CISSP and Security+ certified, with over a decade protecting platforms used by billions of people.
Content moderation, fraud prevention, abuse detection, policy enforcement. 11 years building T&S at Google across Search, Gmail, AdWords, and Shopping.
Selected organisations from my background and ecosystem.
Who is Paolo Petrolini? Paolo Petrolini is a product coach and advisor for regulated industries worldwide, with deep roots in fintech, regtech, InfoSec, and trust & safety.
11 years at Google building and leading Trust & Safety teams, from Search Quality to running Google's T&S organisation in Switzerland. Then I founded compensIT, a regulated fintech that Experian acquired in 2025.
Now I help scaleups and enterprises innovate inside regulated markets, wherever they are. Remotely, async first, and with the honesty that comes from having done this myself.
If you're a scaleup entering a new market, or an established company launching a new product in fintech, regtech, InfoSec, or trust & safety, let's have a conversation. Wherever you are in the world.