When football meets crypto: sponsorship, investment and the AML risks clubs are still not measuring
The FCA's June 2026 warning to Premier League clubs addressed one crypto-linked risk in football: unauthorised firms buying legitimacy through sponsorship. It is the most visible risk, but it is not the only one. Crypto-denominated investment in club ownership, crypto-settled transfer payments, and the commercial arrangements sitting behind fan tokens and NFT schemes all carry AML exposure that most clubs have not yet formally assessed and the regulatory frameworks that will eventually govern all of it are already taking shape.
The sponsorship warning was the visible part of a bigger picture
Lagom's earlier coverage of the FCA's 3 June 2026 letter to Premier League clubs set out the immediate risk clearly: sponsorship arrangements with unauthorised crypto exchanges and trading platforms expose clubs to POCA criminal property risk, unauthorised financial promotion liability, and serious banking and reputational consequences. That warning was specific to one commercial relationship, the shirt sponsor or perimeter advertiser, and it was by design the most visible and most easily investigated crypto-football relationship in the game.
It was never the whole picture. Crypto now touches English football's finances in at least three other ways that carry genuine AML exposure and have received considerably less regulatory or advisory attention: crypto-denominated or crypto-linked investment in club ownership structures, transfer and agent payments settled wholly or partly in crypto-assets, and the commercial arrangements underpinning fan tokens and NFT schemes. Each sits within a different part of the regulatory perimeter, and each requires a different due diligence response.
The sponsorship warning addressed one crypto-linked risk. It was never the whole picture.
How AMLR actually treats crypto and the nuance clubs need to get right
EU Regulation 2024/1624, the AMLR, brings crypto-asset service providers, or CASPs, fully within the definition of obliged entities, treated broadly the same as banks and investment firms for AML purposes. This matters directly to football because it changes the risk profile of any crypto-related counterparty a club deals with, whether as a sponsor, an investor's payment channel, or a service provider facilitating a fan-facing crypto product.
The detail is more demanding than a general AML relationship. CASPs face a lower customer due diligence threshold than most other obliged entities -- EUR 1,000 rather than the general EUR 10,000 threshold that applies to most occasional transactions -- and are specifically required to identify and verify customer identity even where an individual transaction sits below that lower threshold. AMLR also imposes specific measures on CASPs around cross-border correspondent relationships and, critically, transactions involving self-hosted addresses -- wallets not held with a regulated custodian, where the ordinary chain of institutional due diligence simply does not exist. A club receiving crypto-denominated funds routed through a self-hosted wallet, whether from a sponsor, an investor, or a payment intermediary, is dealing with exactly the category of transaction the AMLR treats as elevated risk.
There is also a nuance clubs need to get right rather than assume: the AMLR's crypto-asset definition, drawn from the EU's Markets in Crypto-Assets Regulation, does not generally capture most NFTs, and unregulated NFT platforms are not automatically brought into scope as obliged entities. This is directly relevant to how a club should think about fan token and NFT commercial arrangements, addressed in detail below -- the regulatory position is genuinely more nuanced than a blanket assumption that "anything crypto-related is now regulated," and getting that distinction wrong in either direction is a real risk: understating it misses genuine exposure, overstating it wastes compliance resource on arrangements that fall outside the perimeter.
For English clubs specifically, this obligation lands later than it does for most other AMLR-obliged entities. While the main body of CASPs and financial obliged entities become subject to AMLR from 10 July 2027, football clubs and agents sit within a deferred category of obliged entities under the regulation, with the application date of 10 July 2029. That gap between 2027 and 2029 is not a reason for clubs to wait -- it is, as with the sponsorship due diligence framework covered in Lagom's earlier article, a preparation window that closes faster than most clubs assume.
Crypto-linked investment in club ownership: where the IFR's source of wealth test bites
The FCA warning addressed sponsorship. It said nothing directly about investment -- but the Independent Football Regulator's owner suitability framework is, in substance, the more consequential control point for crypto-linked money entering football, because it applies to the people acquiring genuine influence or control over a club, not merely those buying advertising space.
Under section 28 of the Football Governance Act 2025, a prospective owner must satisfy a source of wealth test before the IFR will make an affirmative suitability determination. The IFR must be satisfied that the applicant has sufficient financial resources and that it has no grounds to suspect that any part of the applicant's source of wealth is connected to serious criminal conduct -- a standard defined by reference to Schedule 1 of the Serious Crime Act 2007. This sits alongside the separate fitness test under section 26, addressing honesty, integrity and financial soundness more generally.
Crypto-linked wealth is not, in itself, a disqualifying factor under this test, the Act does not treat crypto assets as inherently suspect. What it does mean, in practice, is that a prospective owner whose financial resources are substantially or partly held in crypto-assets faces a source-of-wealth evidencing exercise that is genuinely more complex than one built on conventional banked funds. Demonstrating the legitimate origin of crypto holdings, particularly where assets have moved through multiple wallets, exchanges or jurisdictions before reaching a form the IFR can trace, requires a different category of evidence than a bank statement and a letter of reference -- and it is exactly the kind of source-of-wealth complexity that Transparency International UK's own submission to the IFR's consultation flagged as a specific area warranting close regulatory attention, alongside pooled investment vehicles more broadly.
For a club approached by a prospective investor whose funding is crypto-denominated, or routed through a corporate structure with crypto-asset exposure, the practical question is not whether the IFR will refuse the application outright. It is whether the prospective owner has assembled evidence capable of satisfying a source-of-wealth standard that was not designed with crypto-native wealth specifically in mind, and whether the club's own governance function has assessed that evidence critically before an application even reaches the IFR rather than discovering the gap only when the regulator does.
Why crypto-denominated transfer and agent payments deserve their own risk assessment
Transfer and agent fee payments settled wholly or partly in crypto-assets are not yet common in English football, but they are not theoretical either, and the direction of travel across global football\'s transfer market makes this a genuine near-term risk category rather than a speculative one.
The specific exposure is layered. A crypto-settled transfer payment routed through a CASP inherits that CASP\'s own AML obligations and the lower due diligence threshold described above -- but if any leg of the payment passes through a self-hosted wallet, the ordinary institutional verification chain breaks down at exactly the point in the transaction where source-of-funds and beneficial ownership questions matter most. Combined with the source-of-wealth exposure described above where the payment originates from an ownership-linked entity, and the existing AML typologies well documented in traditional transfer-fee laundering -- inflated fees, third-party ownership arrangements, payments to shell intermediaries -- a crypto-settled leg does not create a new typology so much as it strips away several of the traditional control points that would otherwise flag those typologies before completion.
Fan tokens, NFTs and the regulatory grey zone clubs need to navigate carefully
Fan tokens and NFT commercial arrangements are the area where clubs are most likely to either overreact or underreact, because the regulatory position genuinely depends on the specific structure of the product rather than on the fact that it involves crypto or blockchain technology at all.
As set out above, most NFTs fall outside the AMLR's crypto-asset definition, and an unregulated NFT platform is not automatically an obliged entity. A straightforward, genuinely one-off collectible NFT arrangement -- a single digital item tied to a specific moment or asset, not designed for fungible trading at scale -- sits in materially different regulatory territory to a fan token designed and marketed as a fungible, tradeable asset with market liquidity, price movement and exchange listing. The latter looks considerably closer to the kind of crypto-asset the regulation was built to capture, and a commercial partner operating that kind of scheme is far more likely to itself be, or need to be, a regulated CASP.
The practical implication is that a club evaluating a fan token or NFT commercial proposal needs to ask a structural question before any AML question: is what is actually being proposed a fungible, tradeable crypto-asset dressed in fan-engagement language, or a genuinely bespoke digital collectible that falls outside the regulatory perimeter as currently drawn? Getting that classification wrong in either direction has real consequences -- treating a genuine crypto-asset scheme as a harmless collectible misses the CASP-level due diligence the commercial partner should be subject to; treating a genuinely out-of-scope collectible arrangement as fully regulated wastes compliance effort that would be better directed at the sponsorship, investment and payment risks that are unambiguously live today.
What a genuinely proportionate response looks like
None of this is an argument that clubs should treat every crypto-adjacent commercial opportunity as inherently unsafe. Crypto sponsorship, crypto-linked investment and blockchain-based fan engagement products are not disappearing from football's commercial landscape, and a blanket refusal to engage with the category would simply cede a genuine commercial opportunity to clubs with weaker governance rather than stronger. The point is proportionate, risk-based assessment -- precisely the discipline the FCA's own sponsorship checklist, EU AML Regulation and the IFR's source-of-wealth framework are all separately converging on.
For sponsorship, the starting point remains the FCA authorisation and warning list checks set out in Lagom's earlier article -- but a genuinely crypto-specific sponsor also warrants a specific question about whether it is a regulated CASP or captured by the relevant national equivalent, and if not, why not.
For investment, any prospective owner or significant investor whose funding is materially crypto-denominated should be engaged early on the source-of-wealth evidencing challenge specifically, well before an IFR application is submitted, rather than treated as a standard financial-resources check with a crypto label attached.
For transfer and agent payments, any proposal involving a crypto-settled leg -- even a partial one -- should trigger enhanced source-of-funds scrutiny specifically at the point where the payment touches a self-hosted wallet, since that is precisely where conventional verification breaks down.
For fan tokens and NFTs, the structural classification question above should come before, not after, any commercial sign-off -- because it determines which regulatory framework, if any, actually applies.
For the immediate, live risk this article builds on -- the FCA's specific sponsorship warning, the authorisation and warning list checks it expects, and the POCA and financial promotion exposure it identified -- see Lagom's earlier coverage: Football sponsorship due diligence: how clubs can avoid regulatory, legal and reputational risk.
Crypto risk in football is not one question. It is at least four, and most clubs have only assessed one of them.
Assessing crypto-linked sponsorship, investment, payment and commercial arrangements properly does not always require a full engagement -- sometimes it is a specific, contained question that needs an experienced practitioner's eye before a deal, an investor introduction or a commercial proposal is signed off. Lagom Sports Compliance offers ad hoc hourly support for exactly this kind of situation: a single booked session to work through a specific crypto-linked proposal, or a fixed number of hours each month at a discounted rate for clubs that expect to need this kind of input on a recurring basis. If your club has a crypto-related sponsorship, investment approach, payment structure or fan engagement proposal in front of it right now, get in touch to talk through what that looks like.
Frequently asked questions: crypto and AML risk in football
-
Yes. AMLR brings crypto-asset service providers (CASPs) fully within the definition of obliged entities, treating them broadly the same as banks and investment firms for AML purposes. CASPs face a lower customer due diligence threshold than most obliged entities -- EUR 1,000 rather than the general EUR 10,000 threshold -- and must identify and verify customer identity even for transactions below that lower threshold. AMLR also imposes specific measures on CASPs relating to cross-border correspondent relationships and transactions involving self-hosted addresses, which are treated as higher risk given the absence of an institutional custodian.
-
The main population of AMLR-obliged entities, including CASPs, becomes subject to the regulation from 10 July 2027. Football clubs and agents sit within a deferred category of obliged entities under AMLR, with an application date of 10 July 2029. This later date does not mean clubs should wait to prepare -- building the underlying due diligence capability now, while the deadline still feels distant, is considerably easier than building it under time pressure closer to 2029.
-
It depends on the specific structure of the product, not simply on whether it uses blockchain technology. Most NFTs fall outside AMLR's crypto-asset definition, which is drawn from the EU's Markets in Crypto-Assets Regulation, and unregulated NFT platforms are not automatically brought into scope as obliged entities. A fungible, tradeable fan token designed with market liquidity and exchange listing sits in materially different regulatory territory to a genuinely bespoke, one-off digital collectible. Clubs evaluating a fan token or NFT commercial proposal should assess this structural classification question before applying an AML risk framework, since it determines which rules, if any, actually apply.
-
Crypto-denominated wealth is not automatically disqualifying under the Independent Football Regulator's owner suitability framework. Under section 28 of the Football Governance Act 2025, a prospective owner must satisfy a source of wealth test, demonstrating sufficient financial resources with no part connected to serious criminal conduct. In practice, a prospective owner whose wealth is substantially crypto-denominated faces a more complex evidencing exercise than one relying on conventional banked funds, particularly where assets have moved through multiple wallets, exchanges or jurisdictions. Clubs approached by such an investor should engage on the source-of-wealth evidencing challenge specifically and early, well before any IFR application is submitted.
-
A self-hosted wallet is one not held with a regulated custodian or exchange, meaning the ordinary chain of institutional due diligence and verification that exists for funds moving through a bank or a regulated crypto-asset service provider does not apply. AMLR specifically requires obliged entities, including CASPs, to apply risk-mitigation measures to transactions involving self-hosted addresses. For a football club, any transaction -- a sponsorship payment, an investment, or a transfer or agent fee -- with a leg that touches a self-hosted wallet should be treated as carrying elevated source-of-funds risk, precisely because that is the point in the payment chain where conventional verification breaks down.
-
Item descriptionThe FCA's June 2026 warning addressed one specific relationship: sponsorship deals with unauthorised crypto exchanges and trading platforms, which carry POCA criminal property risk and unauthorised financial promotion liability. That is the most visible crypto-linked risk in football, but it is not the only one. Crypto-denominated investment in club ownership is governed separately by the IFR's source of wealth test; crypto-settled transfer and agent payments carry their own source-of-funds exposure, particularly where self-hosted wallets are involved; and fan token and NFT commercial arrangements sit in a regulatory grey zone that depends on the specific structure of the product. A club that has only assessed its sponsorship relationships has addressed one of at least four distinct crypto-linked risk categories.