The 2029 countdown: a practical AMLR readiness roadmap for football clubs and agents

10 July 2029 sounds distant enough to ignore. It is not. Genuine AMLR readiness -- not a policy document that exists to satisfy an audit, but a compliance function that would actually survive a regulator's scrutiny -- realistically takes upwards of two years to build properly, from the first serious gap analysis to a tested, embedded, board-owned function. Treat 2029 as a deadline to start preparing for in 2027 or 2028, and the club or agency doing so is already working against a compressed, higher-risk timeline than the one available right now.

This article is brought to you by Lagom Sports Compliance -- the leading governance, risk, compliance and anti-financial crime consultancy built exclusively for professional football. We help clubs, agents and leagues navigate the IFR, UEFA licensing and EU AML obligations with proportionate, practitioner-led support.

Want to talk through what this means for your club?

Get in touch → Email us →

Why 'we have years' is the wrong starting assumption

Every article in this series has, in its own way, demonstrated the same underlying point: AMLR is not a single rule to implement, but a genuinely interconnected system of obligations -- a compliance officer structure that has to be correctly designed, not just staffed; a beneficial ownership framework that requires mapping genuinely complex ownership chains, not simply collecting a shareholder register; PEP screening that has to be embedded into onboarding as a live, working process; a cash-handling discipline that needs real operational controls, not a policy statement. None of these can be built credibly in the weeks before a deadline. Each one takes iteration, testing, and the kind of organisational embedding that only comes from genuinely operating a process, seeing where it breaks, and fixing it -- more than once, in most cases -- before a regulator ever looks at it.

The roadmap below works backwards from 10 July 2029 on that basis, treating readiness as something built in layers across roughly three years of genuine preparation, not a single project undertaken in the final year.

⚠

Treat 2029 as a deadline to start preparing for in 2028, and the club or agency doing so is already behind.

2026: Foundation year

Understand the framework and assess your own exposure honestly

Read the actual regulation, not just summaries. Work through AMLR's own structure -- the obliged-entity scope under Article 3, the Article 5 exemption mechanism, the compliance officer requirements under Articles 9 and 11 -- rather than relying solely on secondary commentary. This is the year to build genuine institutional understanding of what is actually coming.

Conduct an honest gap analysis against current practice. Map what your club or agency already does -- customer due diligence, ownership verification, cash handling, record keeping -- against what AMLR will require, and be honest about the size of the gap. Most organisations underestimate this in year one.

Check your Article 5 and national position now, not in 2028. If you are an EU club, establish whether your own member state is likely to exercise the Article 5 exemption discretion, and where your club's turnover and risk profile sit relative to any threshold your country applies. This is a genuinely useful early exercise precisely because it may narrow the scope of what you actually need to build.

For small agencies specifically: start the proportionality conversation early, not late. A sole practitioner or small agency does not need the same infrastructure as a large multi-client operation, but establishing what a genuinely proportionate response looks like for your specific size -- rather than either over-building or assuming exemption -- is far easier to work through calmly in 2026 than under deadline pressure in 2028.

2027: Build year

Design and begin implementing the core compliance infrastructure

Appoint and properly empower your compliance officer structure. This is the year to move beyond planning and actually appoint the Article 9 compliance officer and, where the entity's size and risk profile require separation, a distinct Article 11 Compliance Manager -- with genuine board-level appointment, sufficiently high hierarchical standing, and real independent access to the management body, not a title added to an existing role without structural change.

Build the beneficial ownership mapping capability. Develop the actual process for identifying beneficial owners through both the ownership-interest test and the control test, including for any multi-club, fund-based or otherwise layered ownership structures connected to your organisation. This is consistently the most time-consuming element to build properly, and 2027 is the year to have it genuinely operational, not merely designed.

Design PEP screening and cash-handling processes, and start running them. Build the actual screening workflow for politically exposed persons, family members and close associates, and the operational cash-handling controls needed to track linked transactions against Article 80's limit and the separate €3,000 due diligence trigger. Running these processes live, even ahead of the formal deadline, is how genuine problems get found before they matter.

For large clubs and multi-client agencies specifically: begin group-wide policy alignment now. If your organisation operates across multiple entities, jurisdictions or a multi-club structure, 2027 is the year to begin the more complex work of aligning group-wide policies and information-sharing arrangements -- work that takes considerably longer for a complex organisation than the equivalent exercise for a single-site operation.

2028: Test and refine year

Stress-test what you have built, and fix what does not hold up

Run genuine internal audits against every article covered in this series. Test the compliance officer function, the beneficial ownership mapping, the PEP screening process and the cash-handling controls against realistic scenarios, not just a paper walkthrough. This is the year equivalent to the scenario testing discipline covered in Lagom's operational resilience series -- a plan that has never been tested against a realistic scenario is a hypothesis, not a capability.

Address every gap the testing surfaces, and re-test. 2028 should include at least one full cycle of finding a genuine weakness, fixing it, and confirming the fix actually works -- not a single pass-through that assumes everything built in 2027 functions as intended.

Confirm your national supervisory position and any late-breaking divergence. By 2028, national supervisors, AMLA's technical standards, and each member state's specific implementation choices -- including Article 5 exemption decisions -- should be considerably clearer than they are today. Revisit the national-position work started in 2026 and confirm it still holds.

For every size of organisation: this is the year proportionality gets tested, not assumed. Whether a combined compliance officer/Compliance Manager structure genuinely holds up for a small agency, or whether a large club's group-wide policies actually function across every entity, is a question that needs a real answer by the end of 2028 -- not an assumption carried forward from 2026 without being checked.

2029: Live year

Operate the function for real, from 10 July onward

Treat 10 July 2029 as the day obligations begin, not the day preparation should start. By this point, every element covered in this series -- compliance officer structure, beneficial ownership mapping, PEP screening, cash-handling controls, and awareness of the UK/EU asymmetry for any cross-border relationships -- should already be a functioning, tested part of how the organisation operates, not a project still under construction.

Maintain, monitor and update, rather than treating this as a finished project. AMLR compliance is an ongoing operational discipline, not a one-off implementation. Ownership structures change, PEP status changes, and AMLA's own technical standards and guidance will continue to evolve after the application date -- the function built in 2026 to 2028 needs genuine ongoing ownership from 2029 onward, not a project team that disbands once the deadline passes.

Watch for the divergence this series has flagged throughout. National supervisory practice, Article 5 exemption decisions, and the UK's own regulatory position may all continue to shift in the months around and after the application date. A club or agency that stops monitoring the regulatory landscape the day the deadline passes is likely to fall behind exactly the kind of divergence this cluster has repeatedly identified as a genuine risk.

For every organisation: the two-year build should mean 2029 feels routine, not urgent. The entire purpose of the roadmap above is that, by the time 10 July 2029 actually arrives, going live should be a formality confirming work already done -- not the moment the real work begins.

Why this genuinely cannot be compressed into a single year

Every element of AMLR compliance covered across this series shares a common feature: none of it is a document you can write once and file away. A compliance officer structure needs to actually function, with real independent access to the board, before anyone can confidently say it satisfies Article 9. Beneficial ownership mapping needs to be tested against real, complex ownership structures, not assumed accurate the first time it is documented. PEP screening needs to run against real onboarding activity to reveal where the process breaks. None of these are things a club or agency can credibly claim to have achieved in the final quarter before a deadline.

The clubs and agencies that reach 10 July 2029 with genuine, defensible compliance functions will, in almost every case, be the ones that started building in earnest by 2027 at the latest -- giving themselves the 2028 testing year this roadmap treats as essential, rather than skipping straight from planning to going live. Two years is not a cautious estimate. It is closer to the minimum realistic timeline for building something that would actually survive scrutiny.

Lagom Sports Compliance commentary

This roadmap draws together the detail covered across this series: AMLA and its role in shaping national supervision, the Article 9 compliance officer requirement, beneficial ownership under Chapter IV, PEP screening under Articles 42 to 46, the Article 80 cash payment limit, and the specific gap between AMLR and current UK law for any club or agency with cross-border exposure. Each of those articles addresses one piece of the roadmap above in full detail. 

2029 will arrive on schedule. Whether your club or agency is genuinely ready for it depends on what happens between now and then.

Lagom Sports Compliance is the leading specialist governance, risk, compliance and anti-financial crime consultancy built exclusively for professional football, globally. We help clubs and agents, in the EU and UK, build genuine, tested AMLR readiness on a realistic timeline -- not a compressed scramble in the final year. If your club or agency wants to understand where it genuinely sits on this roadmap today, get in touch.

Start with our free compliance checker. It maps your club's current position against EU AML 2024/1624 requirements in minutes and gives you an immediate read on your exposure. No obligation. No cost. 

For clubs ready to begin formal preparation, the Lagom Sports Compliance EU AML 2024/1624 Readiness Assessment delivers a fixed-scope diagnostic for a fixed fee: an enterprise risk assessment, football-specific risk mapping, sanctions exposure review and a prioritised remediation roadmap. The fee is credited in full against any subsequent framework implementation.

Clubs requiring full framework design can explore our AML Framework Development support, and those seeking a fully outsourced AML function can review what we can provided through outsourcing and resourcing. Football agents will find dedicated compliance guidance at lagomsportscompliance.com/aml-compliance-for-football-agents.

This article is brought to you by Lagom Sports Compliance -- the leading governance, risk, compliance and anti-financial crime consultancy built exclusively for professional football. We help clubs, agents and leagues navigate the IFR, UEFA licensing and EU AML obligations with proportionate, practitioner-led support.

Want to talk through what this means for your club?

Get in touch → Email us →

Frequently asked questions: the AMLR readiness timeline for football

• When do football clubs and agents need to comply with AMLR?

  Football clubs and agents fall within AMLR's deferred obliged-entity category, with the Regulation applying to them from 10 July 2029, later than the general obliged-entity population, which is subject to AMLR from 10 July 2027. While 2029 may feel distant, genuine readiness -- a compliance officer structure, beneficial ownership mapping, PEP screening and cash-handling controls that would actually survive regulatory scrutiny -- realistically takes upwards of two years to build properly.

• How long does it actually take to prepare for AMLR compliance?

  Realistically, upwards of two years for a genuinely tested, operational compliance function, rather than a policy document produced shortly before the deadline. This reflects the nature of the obligations themselves: a compliance officer structure needs to actually function with genuine board access before it satisfies Article 9; beneficial ownership mapping needs to be tested against real ownership structures; PEP screening needs to run against real onboarding activity to reveal where it breaks. None of these can be credibly built and tested in the months immediately before 10 July 2029.

• What should a football club or agency do first to prepare for AMLR?

  The foundation year should focus on building genuine institutional understanding of AMLR's actual requirements, conducting an honest gap analysis against current practice, and, for EU clubs, establishing the club's likely position under Article 5's exemption mechanism and their national supervisor's expected approach. Small agencies should also use this early period to think through what a genuinely proportionate compliance structure looks like for their own size, rather than either over-building unnecessary infrastructure or assuming exemption without checking.

• Does a small agency need the same AMLR preparation timeline as a large club?

  The overall timeline principle -- that genuine readiness takes roughly two years to build properly -- applies broadly, but the scale of what needs to be built differs significantly by size. A small agency's roadmap is likely to focus on a combined, proportionate compliance officer and Compliance Manager structure and simpler ownership and screening processes, while a large club or multi-client agency needs to budget additional time for group-wide policy alignment across multiple entities or jurisdictions. Both still benefit from the same foundation, build and test sequence, just at different scales of complexity.

• What happens if a club or agency starts AMLR preparation late, close to 2029?

  A club or agency beginning serious preparation only in 2028 is working against a significantly compressed timeline, with limited or no opportunity for the genuine testing and refinement phase this roadmap treats as essential. This increases the risk of reaching the 10 July 2029 application date with a compliance function that looks complete on paper but has not been tested against real operational scenarios, which is precisely the kind of gap regulatory scrutiny is designed to expose.