AMLA Consultation Paper on Article 26(5) of Regulation (EU) 2024/1624: Draft Ongoing Monitoring Guidelines for Football Clubs and Agents
AMLA published its draft guidelines on ongoing monitoring of business relationships on 3 June 2026. Football clubs and agents are in scope. The consultation closes on 3 September 2026. Final guidelines are expected in Q4 2026. The window to understand what is coming, and to respond, is open now. Here is what the consultation paper actually requires, and why it matters for professional football.
The consultation paper few football clubs have read but every club is affected by
On 3 June 2026, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism, AMLA, published a consultation paper containing draft guidelines on the ongoing monitoring of business relationships under Article 26(5) of Regulation (EU) 2024/1624 (AMLR). The consultation closes on 3 September 2026. Final guidelines will be issued in Q4 2026.
Most football executives have not read it. That is understandable: the document runs to nearly 60 pages of regulatory drafting and is written for banks, law firms and crypto-asset service providers as much as for professional football clubs. But football clubs and football agents are obliged entities under the AMLR from 10 July 2029. These guidelines will govern how every in-scope club and agent is expected to monitor its business relationships and how regulators will assess whether it is doing so adequately.
If you are still working out what the AMLR requires of football at a foundational level, read our overview article EU AML 2024/1624: What professional football clubs need to know before 2029 first. This article assumes that baseline and goes deeper into what the ongoing monitoring framework means in practice.
The consultation closes 3 September 2026.
Final guidelines arrive Q4 2026.
Football clubs have a limited window to understand and respond followed by a longer window, closing July 2029, to implement.
What ongoing monitoring actually means and why it is more than transaction surveillance
The phrase 'ongoing monitoring' is familiar to anyone who has worked inside a regulated financial institution. For football clubs encountering it for the first time, it requires unpacking carefully. The AMLA draft guidelines make one point unmistakably clear from the outset: ongoing monitoring is not just about watching transactions. It is about maintaining a continuously accurate, risk-calibrated understanding of every counterparty in a business relationship and acting on it.
Article 26 of the AMLR requires obliged entities to do two distinct but related things. First, keep customer information (identity, beneficial ownership, source of funds, purpose of the business relationship) current and accurate throughout the life of that relationship. Second, monitor the transactions and activities carried out within the relationship to ensure they are consistent with what the club knows about the counterparty, and to detect anything unusual or suspicious.
For a football club, the 'customers' in scope are not season-ticket holders. They are the four counterparty categories specified in Article 3 of the AMLR: investors, sponsors, football agents and transfer counterparties. The ongoing monitoring obligation attaches to every business relationship with those parties, from the moment due diligence is first conducted at onboarding, through every subsequent interaction, until the relationship ends.
The two obligations under Article 26 AMLR
- Periodic reviews at risk-appropriate intervals: at least every five years for standard-risk counterparties, more frequently where risk is higher
- Event-driven reviews triggered by material changes in circumstances: new beneficial owner, change of jurisdiction, adverse media, anomalous transaction patterns
- Risk-based decisions on whether expired identity documents need to be re-collected: no automatic obligation, but a documented risk assessment is required
- A monitoring framework calibrated to the club's business-wide risk assessment: not a one-size-fits-all system
- Pre-transaction, real-time or post-transaction monitoring depending on the nature of the transaction and the club's access to information
- Manual, automated or semi-automated controls: the regulation mandates outcomes, not technology
- Clear governance, escalation paths and documented decision trails
Guideline 1: Keeping counterparty information current
The first of the two draft guidelines addresses a deceptively simple obligation: keep what you know about your counterparties accurate and up to date. In practice, for a football club, this requires something most clubs have never done before, implement a structured, risk-based programme of regular counterparty reviews.
Periodic reviews
The AMLR sets a maximum review interval of five years for standard-risk counterparties, with more frequent reviews required for those assessed as higher risk. The draft guidelines are clear that this is a ceiling, not a default: clubs must assess each counterparty's risk profile and determine whether more frequent review is appropriate. For an investor with a complex offshore ownership structure or a transfer counterparty in a high-risk jurisdiction, a five-year review cycle is unlikely to be adequate.
The depth of each review should also be proportionate to risk. For a long-standing sponsor with transparent domestic ownership, no new activity and a low-risk profile, the guidelines allow for a lighter-touch review — checking business registries, screening for politically exposed person status and adverse media, and confirming internally that nothing in the relationship has changed. For a new investor from a higher-risk jurisdiction with a multi-layered holding structure, the review needs to be substantively deeper.
Event-driven reviews
The second trigger for updating counterparty information is a material change in circumstances, what the guidelines call a 'trigger event'. The draft guidelines set out a non-exhaustive list of what may trigger an immediate review:
Changes in identity, legal status or ownership — including new beneficial owners, changes in nationality or residency, or restructuring of the counterparty's corporate structure.
Behavioural or transactional anomalies — unusual transaction patterns, unexplained changes in payment routing, activity inconsistent with the known purpose of the relationship.
Adverse findings — new adverse media, acquisition of PEP status by a beneficial owner, regulatory notices or intelligence from a financial intelligence unit.
Changes in financial situation or source of funds — significant shifts in financial standing, new products or services, or engagement with higher-risk jurisdictions.
For football clubs, the practical implications are significant. A mid-season investor acquiring additional equity in the club, a sponsor's parent company being acquired by a private equity vehicle with offshore connections, or a transfer counterparty emerging in adverse media in connection with a financial crime investigation, all of these are trigger events requiring prompt review and, where appropriate, enhanced due diligence.
Expired identity documents: a proportionate approach
One of the more immediately practical issues addressed in the guidelines is the treatment of expired identity documents collected at onboarding. The draft guidelines adopt a risk-based approach: expiry alone does not automatically require re-collection. Instead, clubs must assess whether re-collection is justified, having regard to the risk associated with the counterparty, how long the document has been expired, whether security features on the original document are materially outdated, and whether there are any doubts about the accuracy of the underlying identity information.
This is a deliberate choice by AMLA to avoid the administrative burden of blanket re-collection across entire counterparty populations. But it requires clubs to have a documented policy and decision trail. A club that cannot explain why it did not update an expired passport for a high-risk investor relationship has a compliance problem, regardless of whether re-collection was technically required.
Guideline 2: Building a transaction and activity monitoring framework
The second draft guideline is more technically demanding than the first, and the one most clubs will find hardest to translate from the regulatory text into operational reality. It sets out how clubs should design, operate and test a framework for monitoring the transactions and activities conducted within their business relationships.
The guidelines use the phrase 'transactions and activities' deliberately. This is AMLA signalling that, for non-financial obliged entities, including football clubs, monitoring cannot be confined to payment flows. It must also cover activities: the completion of a transfer, the execution of a sponsorship agreement, the disbursement of agent commissions, the receipt of investment funds. The framework needs to be designed with the actual structure of football transactions in mind, not imported wholesale from a retail banking context.
Manual, automated or semi-automated, the regulation does not dictate the technology
One of the most important principles in the draft guidelines is technological neutrality. AMLA does not require clubs to invest in automated monitoring platforms. A club whose counterparty base is limited, whose transactions are infrequent and whose risk profile is lower may operate an effective monitoring framework through well-designed manual processes and controls. What matters is that the framework works and is capable of detecting material deviations from expected behaviour without undue delay, that outputs are assessed by suitably qualified people, and that decisions are documented.
Clubs with more complex operations, such as those with active international transfer programmes, multiple investor relationships and significant cross-border commercial activity, will need to consider whether manual processes alone are adequate. For those clubs, automated or semi-automated tools may be necessary to process the volume and speed of activity. The guidelines are explicit that where such tools are used, clubs must be able to explain their functioning to regulators, demonstrate effective human oversight, and avoid the trap of treating an automated alert closure as a compliance decision rather than the beginning of one.
What the monitoring framework must cover
Irrespective of the tools used, the guidelines set out what an effective monitoring framework must be capable of doing:
Identifying transactions and activities that materially deviate from the expected behaviour profile of the counterparty. This would be the baseline established at onboarding and maintained through ongoing customer due diligence.
Detecting patterns that only become visible over time such as cumulative behaviour, linked transactions that individually appear unremarkable but collectively suggest structural risk, or shifting counterparty profiles that indicate changes in underlying risk.
Covering all products and services to enable a holistic view of each counterparty's behaviour across the relationship, not just isolated transactions.
Producing outputs that are assessed without undue delay, escalated to staff with appropriate expertise, and acted upon in a documented and traceable way.
Translated into the language of football: a transfer payment routed through an intermediary vehicle that was not disclosed at the time of the original CDD, an agent commission structured as a series of smaller payments through multiple entities, or a sponsorship contract with a third-party funder whose identity differs from the named sponsor. These are the kinds of patterns the monitoring framework is designed to catch.
Pre-transaction, real-time and post-transaction monitoring
The guidelines distinguish between three monitoring modes, and clubs will need to consider which applies to their operations.
Pre-transaction monitoring, assessing a transaction before it is executed, is applicable where the club has the ability to assess or intervene before funds move. In a transfer context, this includes reviewing the transaction documentation, ownership structure of the counterparty and payment routing before contracts are signed.
Real-time monitoring, assessing at the point of execution, is more relevant to financial institutions than to football clubs in most circumstances, but clubs that operate player-sale structures with deferred payments or instalment arrangements should consider whether there are control points at which monitoring can be applied during execution.
Post-transaction monitoring, reviewing after the event, will be the primary mode for most clubs in most situations. The obligation here is to ensure that reviews are conducted without undue delay, and that the outputs of those reviews feed back into the counterparty's ongoing risk profile.
Monitoring obligations under AMLR Article 26: what they mean for a football club
| Monitoring obligation | What it means for a football club |
|---|---|
| Periodic review — Guideline 1 Guideline 1 | Structured review of investors, sponsors, agents and transfer counterparties at risk-appropriate intervals. Documented assessment of what information needs updating and why. |
| Event-driven review — Guideline 1 Guideline 1 | Prompt review when material changes occur: new beneficial owners, adverse media, anomalous transactions, changes in financial profile. |
| Transaction monitoring — Guideline 2 Guideline 2 | Framework to detect unusual or suspicious transactions within existing business relationships. Covers transfers, sponsorship payments, agent commissions, investment receipts. |
| Activity monitoring — Guideline 2 Guideline 2 | Monitoring of non-transactional activities within the relationship. Relevant for football given the complexity of structures around deals. |
| Monitoring outputs — Guideline 2 Guideline 2 | Alerts or findings must be assessed without undue delay, escalated appropriately, and resolved with a documented rationale. |
| Internal controls — Guideline 2 Guideline 2 | The framework must be regularly tested and recalibrated. Governance must be clear. Responsibility for AML decisions must be formally assigned. |
Proportionality is not a free pass for smaller clubs
The draft guidelines are explicit on proportionality in a way that is directly relevant to football.
The principle applies to the design, calibration and intensity of monitoring measures, not to whether those measures are required at all. A League One club with a modest transfer programme, domestic ownership and limited agent relationships does not need the monitoring architecture of a Champions League participant. But it does need something: documented, risk-assessed, and capable of withstanding scrutiny.
Proportionality should not be understood as implying lower or weaker standards for smaller obliged entities. The guidelines state this explicitly. What proportionality requires is a proper assessment of actual risk, with controls calibrated to match. A smaller club that has never conducted a business-wide risk assessment, the foundational exercise that the guidelines presuppose throughout, cannot demonstrate that its monitoring approach is proportionate. It can only demonstrate that it has no monitoring approach.
The practical implication for clubs at every level of the professional pyramid is the same: start with the risk assessment, understand what the actual risks are, and build controls that address them. The football club that has done that work is in a defensible position, regardless of size. The football club that has not is exposed, regardless of how limited its apparent risk profile might seem from the outside.
The consultation process and why football should engage
This is a consultation paper, not final rules. The guidelines published on 3 June 2026 are draft guidelines, open for comment until 3 September 2026. AMLA will consider responses before issuing final guidelines in Q4 2026, which will then apply when the AMLR comes into force for football in July 2029.
Football clubs and agents have a genuine opportunity here to shape how these guidelines are calibrated for the non-financial sector. AMLA has been explicit that it actively sought non-financial sector input during the drafting process and that it will consider developing tailored communication materials, factsheets and explainers, to support smaller obliged entities. Clubs and agents that engage with the consultation, flag the specific challenges of football's transaction structures, and propose workable alternative framings will be contributing to a regulatory outcome that is better calibrated for the industry.
Those that do not engage will receive guidelines calibrated primarily for financial institutions, applied to football without adaptation. The consultation window is three months. It will not reopen.
What clubs and agents should be doing right now
The AMLA consultation paper is not a call to action for 2028. It is a detailed preview of the supervisory standards your club will be assessed against in 2029. The earlier you understand those standards, the more time you have to build towards them.
For clubs that have not yet begun AML readiness work, the immediate priorities are:
Conduct a business-wide risk assessment. Every provision in the guidelines, on review frequency, monitoring intensity, proportionality, presupposes that the club has an accurate, documented understanding of its own ML/TF risk profile. Without it, nothing that follows is possible.
Map your counterparty relationships against the Article 3 transaction categories. Identify your investors, sponsors, agents and transfer counterparties. Understand the beneficial ownership structures. Flag the higher-risk relationships.
Assess your current monitoring capability honestly. Do you have a process for periodic counterparty review? For event-driven review? For monitoring transactions within ongoing relationships? If not, you have a gap that needs to be closed before July 2029.
Engage with the consultation if you can. Even a short, focused submission on the specific challenges the guidelines create for football club compliance will be read and considered by AMLA.
Lagom Sports Compliance is a specialist AML and financial-crime advisory firm built specifically for professional football. The name is deliberate: lagom is Swedish for 'not too much, not too little, just right', a direct expression of the regulation's own proportionality principle.
Start with the free compliance checker to see if and how the regulations affect you. It maps your club's current position against EU AML 2024/1624 requirements in minutes.
For clubs ready to begin formal preparation, the our Readiness Assessment delivers a fixed-scope diagnostic: an enterprise risk assessment, football-specific risk mapping and a prioritised remediation roadmap. The fee is credited in full against any subsequent framework implementation.
Full framework design is available as well. Clubs requiring a fully outsourced AML function can review our Outsourcing and Resourcing support.
Frequently asked questions: AMLA's Article 26(5) consultation and football
-
An AMLA consultation paper is a formal regulatory document published by the Authority for Anti-Money Laundering and Countering the Financing of Terrorism — the EU body established under Regulation (EU) 2024/1620 to lead the fight against financial crime across the Union. Consultation papers set out AMLA's draft guidelines or technical standards on a specific aspect of AML/CFT compliance, invite feedback from obliged entities, supervisors and other stakeholders, and then incorporate that feedback before issuing final rules.
They matter for two reasons. First, they are a preview of binding expectations. The draft guidelines in a consultation paper will, subject to revision, become the standards against which regulators assess whether clubs and agents are compliant. Reading the consultation paper now is reading the exam paper before the exam is set. Second, they are one of the few points in the regulatory process at which affected parties, including football clubs and agents, can influence how the rules are shaped. AMLA has made clear that it actively sought non-financial sector input during the drafting of the Article 26(5) guidelines and will consider further feedback submitted before the 3 September 2026 deadline. A club that engages with that process has a voice. A club that waits for the final rules has none.
-
Yes. The AMLA consultation paper, published 3 June 2026, contains draft guidelines on how obliged entities should conduct ongoing monitoring of business relationships under Article 26(5) of Regulation (EU) 2024/1624. Football clubs and football agents are obliged entities under the AMLR from 10 July 2029. These guidelines will determine the supervisory standards against which clubs and agents are assessed. Understanding them is not optional for any club that is serious about compliance readiness.
-
Ongoing monitoring under the AMLR involves two obligations: keeping the information you hold on counterparties accurate and up to date throughout the life of a business relationship, and monitoring the transactions and activities within that relationship to detect anything unusual or suspicious. For football clubs, this applies to relationships with investors, sponsors, football agents and transfer counterparties, the four Article 3 transaction categories that bring clubs into scope. It is a continuous obligation, not a one-time exercise at onboarding.
-
Guideline 1 requires clubs to conduct periodic reviews of counterparty information at risk-appropriate intervals, at least every five years, more frequently for higher-risk relationships, and event-driven reviews whenever material changes in circumstances occur. Events that trigger a review include changes in beneficial ownership, adverse media, anomalous transaction patterns, and changes in financial profile or source of funds. The depth of each review should be proportionate to the counterparty's risk level. Clubs must also have a documented policy on whether and when to re-collect expired identity documents.
-
Guideline 2 requires clubs to design and operate a monitoring framework capable of detecting unusual or suspicious transactions and activities within their business relationships. The framework must be based on the club's business-wide risk assessment and cover all relevant counterparty relationships. It may be manual, automated or semi-automated depending on the club's size, complexity and risk profile. It must produce outputs that are assessed without undue delay, escalated appropriately, and resolved with documented rationale. It must be regularly tested and recalibrated.
-
Yes. Football agents are obliged entities under Article 3(n) of the AMLR with no size or turnover-based exemption. The AMLA ongoing monitoring guidelines apply equally to agents. Every agent providing intermediary services for a fee must conduct ongoing monitoring of their business relationships with clubs, players and counterparties from 10 July 2029. A solo agent representing a small number of players carries the same formal obligations as a large multi-national agency, though the intensity of controls should reflect actual risk.
-
The consultation on the draft guidelines closes on 3 September 2026. AMLA has indicated it will issue final guidelines in Q4 2026. Those final guidelines will take effect for football clubs and agents when the AMLR applies to them, 10 July 2029. Clubs and agents that wish to submit responses to the consultation should do so through AMLA's consultation platform before the 3 September 2026 deadline.
-
Proportionality under the draft guidelines means calibrating the intensity of monitoring to the club's actual risk profile, not exempting lower-risk clubs from the obligation entirely. A smaller club with domestic ownership, limited transfer activity and well-established sponsors may operate a proportionate monitoring framework through structured manual processes: periodic reviews, documented event-driven reviews and post-transaction checks on the club's material deals. What proportionality requires is a documented, risk-assessed basis for the approach chosen. A club that has not conducted a business-wide risk assessment cannot demonstrate proportionality — it can only demonstrate the absence of a framework.
-
Lagom Sports Compliance builds football-native AML frameworks calibrated to the actual risk profile of each club, including the ongoing monitoring systems and governance structures the AMLR requires. The starting point is the free compliance checker. For clubs ready to begin formal preparation, the Lagom Sports Compliance Readiness Assessment provides a complete diagnostic and remediation roadmap, credited in full against subsequent implementation.