Stripe Compliance / Risk Analyst Interview Questions

1.Tell me about a time you had to explain a compliance requirement — like KYC, AML, or sanctions screening — to a technical team building a product feature. How did you make sure they actually understood what mattered and why?

2.Tell me about a time a regulator, auditor, or senior stakeholder asked you a question about a compliance or risk matter where you genuinely didn't know the answer. What did you say in the moment, and how did you follow up?

3.Describe a risk assessment or compliance review where you had to make a judgment call between doing it perfectly and doing it fast enough to keep a business decision moving. What did you do, and what would you do differently?

4.Tell me about a time you wrote a compliance policy, risk memo, or regulatory guidance document that had to land with a non-compliance audience — maybe legal, product, or finance. How did you structure it, and how did you know it worked?

5.Walk me through a time you designed or significantly revised a compliance control or onboarding requirement that a developer or technical team had to implement. How did you balance what the regulation required with what was actually buildable?

6.Describe a situation where you were asked to do a thorough risk review — sanctions, credit, fraud, whatever — but the timeline or resources made that impossible. How did you scope it, and how did you defend what you left out?

7.Estimate how many Stripe merchants you'd expect to have active sanctions exposure at any given time. Walk me through your assumptions.

8.Your chargeback data shows that merchants in a specific Stripe Connect vertical — say, online ticketing platforms — have a dispute rate three times the network average. How do you decide whether this is a fraud problem, a product problem, or a customer service problem?

9.Stripe is expanding a product into a market where your transaction monitoring system wasn't built — you're covering it manually with a two-person team and 90-day transaction data. The team flags 40 accounts a week for review but has capacity to fully investigate only 15. How do you decide which 15 to work?

10.A Stripe Radar rule you inherited from a prior analyst is suppressing around 8,000 transactions a month in a specific merchant category. No one has reviewed the rule in 14 months. How do you figure out whether it's still doing the right thing?

11.You're building the risk appetite framework for Stripe Treasury's end-user segment — the customers of platforms that have embedded Treasury accounts. Regulators are asking you to define acceptable risk thresholds before the product scales. Where do you start, and what does a finished framework actually look like?

12.A Connect platform with $200M in annualized GMV is failing a periodic review — their sub-merchant onboarding documentation is materially out of compliance, but off-boarding them would likely trigger a wave of sub-merchant chargebacks and news coverage. How do you make this call?

13.Walk me through how you'd investigate a spike in Stripe Radar false positives — say, a 15% jump in legitimate transactions being blocked. Where do you start?

14.How do you perform a risk-tiering exercise on a new merchant segment — say, platforms using Stripe Connect to onboard sub-merchants in a high-risk vertical like crypto or firearms? What factors drive your tier assignment?

15.Stripe Billing handles recurring revenue for thousands of SaaS and subscription businesses. How would you design a monitoring program to catch billing-related fraud or compliance violations at scale — and what metrics would you track to know the program is actually working?

16.You're doing enhanced due diligence on a business applying through Stripe Atlas. It's a Delaware C-corp, clean incorporation docs, but the beneficial owner's source-of-funds documentation is inconsistent — the stated capital is $500K but their supporting bank statements show a balance of $12K. How do you work this?

17.Stripe Treasury lets platforms offer banking-as-a-service to their own customers. If a Treasury partner's end users start showing patterns consistent with structuring — say, a cluster of $9,800 transfers over 90 days — how do you conduct that investigation and what's your decision framework for filing?

18.A product team wants to expand Stripe Payments into a new market where the local AML regime is materially weaker than FATF standards and there's no national beneficial ownership registry. You've been asked to write a market entry risk assessment. How do you structure it and what would need to be true for you to recommend against entry?

19.A small merchant on Stripe Payments calls in upset — their account was flagged and payouts are on hold. You pull the file and see it's a legitimate-looking e-commerce business, but there's a chargeback rate nudging 1.8% over the last 30 days. How do you handle it?

20.You're reviewing a batch of new Connect platform applications and you notice several are structurally similar — same registered agent, overlapping director names, slightly different business names. None of them individually trip your automated flags. What do you do?

21.A sales team lead pushes back hard on a KYB requirement you added to the Connect onboarding flow — they say it's killing conversion for a high-value platform prospect and want an exception for 30 days while the prospect 'sorts out their docs.' How do you respond?

22.You're reviewing Stripe Radar model outputs and notice a specific merchant category — online pharmacies — has an unusually high block rate for transactions that are later manually approved. Your fraud team says the model is working as intended. What do you do with that information?

23.A law enforcement agency sends Stripe a grand jury subpoena for transaction records on five merchants, with a non-disclosure order prohibiting you from telling the merchants. Two of the five are currently in active remediation conversations with your team — you were supposed to meet with them this week. What do you do?

24.You discover that a compliance control your team has been relying on for 18 months — a third-party sanctions screening vendor — has been running on a stale watchlist that was last updated four months ago. During that window, Stripe onboarded approximately 3,000 new merchants. What do you do in the next 24 hours?

25.Tell me about a time a product or engineering team pushed back on a compliance requirement you owned. How did you get them to move without having any direct authority over them?

26.Walk me through a time you had to keep multiple stakeholders — say legal, product, and a business team — aligned on a compliance decision that kept evolving as new information came in. How did you manage the communication?

27.You're the compliance lead on a new Stripe product feature, and the launch is two weeks out. Legal says they need another week for their review. Product is telling you legal is being too slow and wants to know if compliance can sign off independently. How do you handle it?

28.Describe a time you had to present a compliance risk finding to a senior leader or executive who had a clear business interest in you reaching the opposite conclusion. How did you prepare, and how did the conversation go?

29.You're the compliance point of contact for a strategic Connect platform partner — a large marketplace — and their CEO emails your executive sponsor directly to complain that your due diligence process is too slow and threatening their launch. Your exec forwards it to you and says 'can you fix this.' What do you do?

30.You've been running a cross-functional working group — compliance, product, finance, and legal — to overhaul Stripe's risk appetite framework for a specific merchant vertical. Six weeks in, the group is stuck: product wants higher risk tolerance to capture market share, finance is worried about loss reserves, and legal is noncommittal. You have no authority to force a decision. How do you break the deadlock?