This blog post is part of a joint series by ANNERTON and GRUENGOLD LEGAL on “Professional Football and Anti-Money Laundering”, which we launched in December 2025 with an overview of “New compliance requirements for professional football clubs and football agents in the EU” (Part 1) and continued in February 2026 with a discussion of the addressees of the new compliance requirements for professional football clubs and football agents (Part 2).
Table of Contents
You are welcome to subscribe to our newsletter at [LINK] to ensure you do not miss any further information.
I. Introduction
With the new EU Anti-Money Laundering Regulation, professional football is for the first time systematically brought within the scope of European anti-money laundering and counter-terrorist financing. In the first two articles of this series, we outlined the regulatory framework and the scope of obliged entities. These include, in particular, professional football clubs, football agents and – depending on the structure – their holding companies.
For many stakeholders, this is new territory. At the same time, it is foreseeable that the new obligations will significantly impact existing processes – particularly in the areas of transfers, sponsorship, investors and intermediary structures.
In addition, the AML Regulation will be further specified through numerous technical standards, guidelines and other implementing measures issued by the EU Anti-Money Laundering Authority (AMLA). The legal framework is therefore in place. However, its practical application will become more precise over the coming months.
Against this background, the key question arises: What specific obligations result from the AML Regulation – and what do they mean in practice for clubs and football agents?
II. Key obligations under the AML Regulation
1. Risk assessment (Art. 10 AMLR)
Obliged entities must identify and assess the risks associated with their business activities in relation to money laundering, terrorist financing and breaches of targeted financial sanctions. This risk assessment must be documented, kept up to date and adjusted where necessary. It must also be made available to the competent supervisory authorities upon request.
The risk assessment is not merely a formal requirement. It is the foundation of the entire AML framework. It determines how internal processes are structured, where enhanced checks are required and which controls are appropriate. In particular, customer-related, geographical and transaction-related risk factors must be taken into account.
For practice, this means: professional football clubs and football agents must, for the first time, systematically identify their own risk areas. The focus will be on transfers, intermediary fees, sponsorship, investor relationships, payment channels and international structures. It is precisely in these areas that future risk analyses will concentrate. A structured approach is advisable: stocktaking, risk identification, risk assessment and derivation of specific mitigation measures. At the same time, it can be expected that AMLA will further specify the methodology and relevant risk factors.
2. Compliance function and governance (Art. 11 AMLR)
The AML Regulation requires a clear compliance structure. A member of the management body in its management function is responsible for compliance with AML requirements. In addition, an operational compliance function must be established to ensure the implementation of internal measures. This function must have sufficient authority, resources and access to information and must be integrated into reporting lines to senior management.
This point is of particular importance for clubs and football agents. Anti-money laundering thus becomes a genuine governance issue. It is not sufficient to assign responsibilities purely formally. Rather, roles, reporting lines and responsibilities must be designed in a robust and effective manner. In practice, this will—alongside the appointment of a Compliance Manager – typically lead to the designation of an AML Officer, who oversees operational implementation, receives internal reports, supports the risk assessment, coordinates training and acts as a contact point for authorities.
For practice, this means: many professional football clubs will have to break new organisational ground. Key questions arise at an early stage: who can adequately perform this function, whether sufficient in-house expertise exists and what level of resources is realistically required. A particular challenge will be to combine close proximity to senior management with an effective and independent control function.
3. Internal policies, procedures and controls (Art. 9 AMLR)
Obliged entities must, on the basis of their risk assessment, develop, document and implement internal policies, procedures and controls. These measures must be capable of managing the identified risks and ensuring compliance with AML obligations. They must be communicated within the organisation and, where appropriate, also to relevant third parties.
The AML Regulation therefore does not aim at general compliance statements, but at robust and operational processes. It requires documented procedures that are effectively applied in day-to-day business.
For clubs and agents, this means: transfers, sponsorship, investor onboarding and intermediary arrangements require clearly defined process steps. Who checks what, and when? Which documents must be obtained? When must issues be escalated? How is documentation maintained? In an environment characterised by high transaction dynamics, the organisation must be structured in such a way that AML checks remain effective even under time pressure. Future AMLA guidelines are likely to further specify these requirements.
4. Training and integrity requirements (Art. 9, Art. 13 AMLR)
The AML Regulation requires appropriate training measures for employees and, where relevant, for other persons involved in AML compliance. In addition, persons directly involved in implementing AML requirements must be assessed for their suitability and integrity.
This goes beyond a standard compliance element. In a sector such as professional football, which has so far been only lightly regulated, practical awareness is decisive in determining whether risks are identified early or overlooked.
For practice, this means: training will play a particularly important role in the initial years. It should not only cover general AML fundamentals but also typical risk scenarios in professional football – such as transfers, intermediary structures, sponsorship funds, investors and international payment flows. At the same time, it must be ensured that individuals entrusted with AML tasks possess the necessary expertise and integrity.
5. Customer due diligence obligations (Art. 19, 20 AMLR)
Customer due diligence measures must be applied, in particular, when establishing a business relationship, carrying out certain transactions and in cases of suspicion. These include, above all, the identification and verification of the customer, the identification and verification of the beneficial owner, the verification of representation arrangements and the collection of information on the business relationship or transaction. The extent of these measures is always risk-based.
This is one of the key practical focal points of the new regulation. In professional football, business partners and involved parties are often diverse: other clubs, sponsors, investors, agents, advisors and other intermediaries.
For practice, this means: KYC becomes standard. Professional football clubs and football agents must be able to reliably determine who they are dealing with and who ultimately owns or controls a structure (beneficial ownership). This is particularly challenging in multi-layered corporate structures, cross-border scenarios or where advisors and intermediaries become involved at a late stage. Standardised KYC questionnaires and—where feasible—pre-KYC for frequently relevant counterparties are therefore advisable.
6. Understanding the purpose of transactions and source of funds (Art. 25 AMLR)
Obliged entities must understand the purpose and intended nature of a business relationship or transaction. Where necessary, additional information must be obtained, in particular regarding the economic background, the volume of the transaction and the source and destination of the funds involved. The business activity or occupation of the customer may also be relevant.
This obligation is central because it goes beyond mere identification. It is not sufficient to collect names, register extracts and identification documents – the transaction must be plausible in substance.
For practice, this means: particularly in complex contractual arrangements, unusual payment flows or internationally layered structures, clubs and agents must take a closer look. Where the economic purpose is not immediately apparent, additional information must be obtained and assessed in a comprehensible manner. Standardised questionnaires regarding source of funds, rationale and payment logic can help stabilise operational processes without unnecessarily slowing them down.
7. Sanctions and PEP screening (Art. 20, Art. 42 AMLR)
Obliged entities must verify whether business partners or beneficial owners are subject to targeted financial sanctions. They must also determine whether a person is a politically exposed person (PEP), or a family member or close associate of such a person. In such cases, additional requirements apply.
These checks are not merely ancillary to KYC obligations but form an independent component of an effective AML framework. The Regulation’s increased focus on preventing sanctions breaches further enhances their practical relevance.
For practice, this means: professional football clubs and football agents require robust screening processes. Manual checks will generally not be sufficient in international contexts. In addition, matches must be assessed, documented and, where necessary, escalated. A clearly defined escalation process is therefore advisable, including responsibilities for review, documentation and approval.
8. Enhanced due diligence in higher-risk cases (Art. 34 et seq. AMLR)
Where a higher risk is identified, enhanced due diligence measures must be applied. This is particularly the case for complex or unusually structured transactions, transactions without an apparent economic or lawful purpose or other high-risk scenarios. In such cases, additional information must be obtained and more in-depth checks must be carried out. In PEP cases, senior management involvement is also required.
While the Regulation sets the framework, the real challenge lies in its practical application.
For practice, this means: clubs and agents must define when a transaction is to be considered unusual or higher risk according to their own criteria. Without clear benchmarks, uncertainty arises. Internal thresholds and case categories are therefore advisable – for example, for unusual payment structures, atypical contractual arrangements or high transaction values. A list of accepted supporting documents for verifying the source of funds is also recommended.
9. Suspicious transaction reporting (Art. 69, 71 AMLR)
Obliged entities must promptly submit a suspicious transaction report where they know, suspect or have reasonable grounds to suspect that funds are the proceeds of criminal activity or are related to terrorist financing. Additional information must be provided upon request. Following submission of the report, the transaction must generally not be carried out until authorisation is granted or the statutory deadline has expired.
This aspect is often underestimated in practice. Certainty is not required – a reasonable suspicion is sufficient.
For practice, this means: clubs and agents need clear internal reporting and escalation procedures. Employees must know when to raise concerns internally and who decides on further action. A simple but clear escalation model – distinguishing between non-suspicious, reviewable and reportable cases – can be helpful. The ability to respond quickly to information requests must also be organisationally ensured.
10. Internal control and independent review (Art. 9, Art. 11 AML Regulation)
The AML Regulation requires not only the implementation of measures but also their review. The adequacy and effectiveness of internal policies, procedures and controls must be regularly assessed. Depending on the organisation’s structure, this can be done internally or by external qualified third parties.
This makes it clear that AML compliance is not a one-off project but a continuous organisational task.
For practice, this means: professional football clubs and football agents must determine which controls are necessary and appropriate in their specific context. The starting point is their own risk assessment. Particularly relevant are controls in KYC processes, beneficial ownership verification, source of funds checks and the handling of suspicious cases. Where no independent internal review function exists, external solutions may be considered.
III. Conclusion
The AML Regulation represents a fundamental shift for professional football. Professional football clubs and football agents are, for the first time, comprehensively integrated into the European AML framework.
The new obligations are clearly structured. Their implementation, however, is not. It is not about isolated measures, but about the consistent establishment of a robust overall system comprising risk assessment, governance, KYC, control processes and reporting lines within the relevant group of obliged entities (see Part 2 of this series for further details).
Even at this stage, three key priorities are evident:
1. a robust risk assessment,
2. an effective compliance organisation, and
3. practical due diligence and review processes in particularly sensitive areas such as transfers, sponsorship, investors and intermediary relationships.
For professional football clubs and football agents, this is regulatory new ground. For that reason, the transitional period until 10 July 2029 should not be seen as a postponement, but as an implementation window.
We are happy to support you in systematically reviewing your processes, responsibilities and risk areas and in developing a robust target operating model for AML compliance. Please feel free to contact us.
For practical insights:
Register free of charge for the webinar “Anti-Money Laundering in Football – Future obligations for professional football clubs and intermediaries” via the following link: Microsoft Virtual Events Powered by Teams
When? Thursday, 23 April 2026, 2 p.m.–3 p.m.
