Every one of the 116 clubs in England's top five divisions needs an IFR operating licence from the start of the 2027/28 season. The application form is common. So are the four Mandatory Licence Conditions that follow. What is not uniform is the amount of evidence, reporting intensity and governance machinery the IFR may reasonably expect from each club. The regulator's published documents repeatedly anchor that judgement in size, resources, complexity, circumstances and risk. League position matters, but it is not the whole test. Understanding that distinction is the difference between preparing sensibly and either under-preparing or building a compliance structure the club does not need.

AMLR's beneficial ownership rules were written for a world of reasonably traceable ownership chains -- a company with identifiable shareholders, a controlling individual, a documented structure. Modern football club ownership is, with increasing frequency, none of those things. Multi-club groups, layered fund vehicles and nominee arrangements are becoming the norm at exactly the moment the rule requires them to become transparent. And buried in the same regulation is a football-specific exemption most clubs have not read closely enough -- one that will not apply uniformly, and that is likely to produce genuinely different outcomes from one EU member state to the next.

Ask most people in football compliance what AMLR requires on personnel, and the answer comes back as some version of "a compliance officer and an MLRO." It is a reasonable shorthand, and it is not quite what the Regulation actually says. AMLR does not use the term MLRO anywhere in its own text. Getting this precisely right -- what Article 9 actually requires, what role sits alongside it, and what genuinely counts as "designated" rather than a title on a business card -- is the difference between a compliance structure that would survive scrutiny and one that only looks right on paper.

Football agents sit within AMLR's obliged-entity population from 10 July 2029, named directly and specifically in the Regulation's own text. What that means in practice differs meaningfully from what it means for a club -- agents operate a genuinely different business model, with a different relationship to the money that moves through their work, and different practical questions about who the customer actually is, how much compliance infrastructure is proportionate, and where the real financial crime risk in agent commission structures actually sits. This is the full, dedicated treatment.

Compliance advisers, one independent firm has already observed, are increasingly describing the IFR's Owners, Directors and Senior Executives regime as football's own version of the Senior Managers and Certification Regime -- the framework that transformed how UK financial services firms recruit, promote, monitor and exit senior staff. That comparison is instructive, not just clever. Financial services HR teams spent years learning, often the hard way, that a personnel-level regulatory regime cannot sit solely with legal or compliance. Football HR teams are now in exactly that position, and most have not yet had the equivalent conversation.

10 July 2029 sounds distant enough to ignore. It is not. Genuine AMLR readiness -- not a policy document that exists to satisfy an audit, but a compliance function that would actually survive a regulator's scrutiny -- realistically takes upwards of two years to build properly, from the first serious gap analysis to a tested, embedded, board-owned function. Treat 2029 as a deadline to start preparing for in 2027 or 2028, and the club or agency doing so is already working against a compressed, higher-risk timeline than the one available right now.

I write and talk to club C-suite about the Independent Football Regulator for a living. Lagom Sports Compliance advises clubs on it, we draft the guidance and sit across the table from boards trying to work out what a mandatory condition actually requires of them in practice. But every so often it is worth stepping back from the advisory language and asking a more honest question: if I actually sat in the chief executive's chair at a regulated club right now, what would genuinely keep me up at night? Not the version of the IFR that reads cleanly in a briefing note. The version that lands on my desk, my inbox, my own personal record with the Regulator, and the people I am responsible for.

Most discussion of the Independent Football Regulator's discretionary licence conditions treats them as a club-by-club matter: the IFR identifies a concern at an individual club and attaches a condition to that club's licence. What almost no commentary has addressed is that, for financial discretionary conditions specifically, the Act gives competition organisers -- the Premier League, the EFL -- a genuine opportunity to step in and offer a commitment as an alternative to the proposed club-level condition or variation. This is a governance lever competition organisers should be thinking about proactively, not a mechanism clubs discover only once a condition has already landed on their own licence.

Over the past decade, football has evolved into one of the world's most sophisticated commercial industries. Multi-million-euro player transfers. Cross-border ownership structures. International sponsorship agreements. Increasingly global agency networks. Together, these have transformed the sport into a complex financial ecosystem.

With that evolution comes opportunity. It also brings risk.

A quality of earnings report tells a buyer whether the numbers are real. A legal due diligence report tells a buyer whether the contracts hold up and the litigation history is disclosed. Neither tells a buyer whether the target club would survive an IFR owner suitability determination, whether its governance evidence would satisfy the corporate governance condition, whether its ownership structure creates a beneficial ownership problem under AMLR, or whether its squad cost ratio is quietly heading toward a UEFA significant breach. That gap, not a rounding error in an existing workstream but a missing one, is what this article addresses.

A plan that has never been tested against a realistic adverse scenario is a hypothesis, not a capability. That is the principle at the heart of the fourth and final discipline in the operational resilience framework, and it is the one that most decisively separates genuine resilience from a document sitting in a drawer. Football has already experienced the exact category of disruption this article describes -- more than once, and more recently than most boards realise.

August is a two-session month for us, and both sessions land at a genuinely useful moment in the IFR's own timeline. The final licensing rules have been published, the application window is now weeks away, and the governance standard the Regulator expects is no longer a future obligation to plan around -- it is a present one clubs are being actively assessed against. Below is what we are running this month, why each session earns its place on a busy calendar, and an early look at what September has in store.

A new EU authority with direct power to supervise, investigate and sanction is being built in Frankfurt right now, and football clubs and agents across Europe will almost certainly never appear on its own supervisory books. That is not a reassurance to skip past. It is the single most important thing to understand about the Anti-Money Laundering Authority, because the way this body actually reaches football is more indirect, more structural, and ultimately more consequential than a simple direct-regulator relationship would be.

Football regulation is not being built from a blank page. Almost every mechanism now appearing in the IFR's licensing framework and the EU's approach to football-specific AML has a direct precedent somewhere in financial services regulation over the past fifteen years. That is not a coincidence -- it is the natural result of governments and regulators reaching for tools that have already been tested elsewhere, rather than inventing football-specific ones from scratch. Reading that precedent carefully lets us make some genuinely informed predictions about where football regulation goes next. These are our own views, not confirmed policy, and we have graded our confidence in each one accordingly.

Identifying important business services, setting tolerances for their disruption, and mapping who delivers them are three disciplines a club can complete largely through its own effort. The fourth is harder, because it requires the club to hold a third party to a standard the club does not control. Financial services firms have a specific regulatory framework for exactly this problem. Football clubs, for the most part, do not -- and it shows.

Schedule 9 of the Football Governance Act 2025 gives the Independent Football Regulator the power to require a club to appoint a specialist, nominated by the IFR itself, to help bring an unresolved compliance failure to an end. It is easy to mistake this for a version of the advisory support clubs already engage voluntarily. It is not. The distinction between choosing your own adviser and having one nominated for you by your regulator is the entire point of this article and the most useful thing any club can take from it is exactly what it looks like to never need one.

A single Premier League matchday can involve well over a thousand people who are not employed by the club at all. Stewarding, catering, cleaning, ticketing technology and much of the infrastructure that makes a fixture happen sits with a small number of specialist operators serving much of the league at once. Mapping exposes exactly how concentrated that dependency really is -- and most clubs, when they do this exercise properly for the first time, are surprised by what they find.

Section 65 of the Football Governance Act 2025 is the Independent Football Regulator's most fundamental information-gathering power, and it is also the one most likely to arrive at a club without any warning that an investigation is under way. Unlike the expert reporter power under section 66, which involves the IFR commissioning an independent third party, section 65 is the IFR's own direct power to require any person to hand over, generate or even collect information it does not currently hold. Understanding exactly what a notice under this section can require, and what happens if a club gets its response wrong, matters to every regulated club, not only those already facing a live enquiry.

The same rigour FIFA brings to protecting a match result should extend to protecting the money that flows through the game.

The FCA's June 2026 warning to Premier League clubs addressed one crypto-linked risk in football: unauthorised firms buying legitimacy through sponsorship. It is the most visible risk, but it is not the only one. Crypto-denominated investment in club ownership, crypto-settled transfer payments, and the commercial arrangements sitting behind fan tokens and NFT schemes all carry AML exposure that most clubs have not yet formally assessed and the regulatory frameworks that will eventually govern all of it are already taking shape.