Zatlas is the payments automation platform for hospitality. We help large hotel chains in Latin America — and increasingly in Europe and the United States — turn every reservation from Booking.com, Expedia and other platforms into collected revenue, with far less manual work. We are hiring our first Head of Legal to own the legal and regulatory foundation this cross-border business runs on.

Why this role, and why now

Zatlas sits at the intersection of software and money movement. We collect on behalf of hotels, work with acquirers and card networks, move funds across borders, and hold guest and property data in several jurisdictions. Each of those facts carries a regulatory question, and those questions now need a single owner rather than a series of one-off engagements with outside firms.

The near‑term centre of gravity is Mexico: the characterization of what Zatlas is, from a regulatory and tax standpoint, and what that implies for the licences or exemptions we rely on. But it cannot be answered for Mexico alone — our entities span Mexico, Brazil, the US and Europe, and our expansion path points globally. As the first lawyer here you will draft, negotiate and decide rather than supervise, and design the function itself: how we use external counsel, what we standardise, and what the company simply should not do.

What You Will Own

- Regulation — the priority
- Mexico: lead the regulatory characterization of our activity — whether we need to be a regulated entity, how our collection and closed‑loop flows are treated, and the position we take with the SAT and, where relevant, the CNBV and Banxico. Own the analysis, the conclusion and the plan that follows.
- Brazil: payment‑institution rules, PIX and card‑scheme requirements,



consumer protection and LGPD, and the implications for our local entity.
- United States: money transmission and payment‑facilitator questions as we take on US hotel clients, plus obligations attached to our US holding structure.
- Europe: the licensing and structuring path for a European entity — PSD2/PSD3 and e‑money perimeter, GDPR, DAC7.
- Maintain a live regulatory map across the four regions: what applies, what we rely on, what is coming, and what would force a change in how we operate — turned into clear recommendations with the trade‑offs named, not memos that end in "it depends".
- Commercial contracting
- Hotel chain agreements — above all the master services and collection terms governing how we handle clients' money — plus partnerships and distribution with booking platforms and channel partners.
- Payments and infrastructure contracts — acquiring, PSPs, fraud tooling, card‑network programmes. Term, data sharing, liability allocation and chargeback economics are where the value sits.
- Build the playbook: templates, fallback positions, an approval matrix and standard vendor/SaaS/DPA terms, so routine deals stop consuming senior time.
- Corporate, financing and structure
- Financing rounds end to end — SAFEs and priced rounds, data room, diligence, closing — and a clean cap table.
- Employee equity: plan documents, grant mechanics,



board approvals, and the cross‑border tax and securities treatment of grants.
- Inter‑company structuring across our Mexican, Brazilian, US and future European entities — with our tax and transfer pricing advisors — so legal form matches economic substance. Plus governance: board and shareholder mechanics, powers of attorney, corporate books.
- Data, privacy and compliance
- Privacy programme across the LFPDPPP, LGPD, GDPR and applicable US state regimes — notices, records, transfer mechanisms, vendor terms.
- AML/KYC and sanctions obligations, in proportion to how we are actually characterised in each market, plus information security and PCI‑adjacent contractual obligations — working with engineering, not around it.
- The customer‑facing surface: terms and conditions, privacy notices, and the risk positions embedded in them.
- People, external counsel and legal spend
- Employment and contractor arrangements in Mexico and Brazil — including the payroll‑versus‑independent‑provider distinction and the risk it carries in each — plus offer letters, confidentiality and IP assignment.
- Select and manage firms in each market, scope engagements tightly, decide what stays in-house, and own a legal budget you can explain.

Who We Are Looking For

MUST HAVE

- 8+ years of practice, with meaningful in‑house time at a technology, payments or financial services company. Firm pedigree is welcome; judgment shaped inside a business is what we are buying.
- Deep Mexican regulatory fluency. The Ley Fintech perimeter, how the CNBV, Banxico, Condusef and the SAT actually behave, and where the real grey areas are. Qualified in Mexico or with equiv

📌 Head of Legal (México)
🏢 Zatlas
📍 México