The manual is the first document a supervisor asks for, and the one that most often reveals that the system does not exist. A correct text downloaded from another sector is spotted on first reading. This page explains which chapters a club’s manual must have, which bodies it creates, who approves it and how it is kept alive season after season.
A review of your manual
We reply within 24 h
The manual is not a legal document that is drafted once and filed away: it is the internal rulebook that says how decisions are made at the club when an alert comes up. If the team that negotiates does not recognize it as a description of its own work, the manual is not doing its job, however well drafted it is.
The manual is the internal document that sets out the policies, procedures and bodies through which the club meets its anti-money laundering obligations.
It is approved by the management body, applied in day-to-day operations and reviewed periodically. It is also the first piece of evidence produced in an inspection.
The manual is not written in a vacuum: it is calibrated on the club’s risk self-assessment. That analysis determines which controls are needed and how intensive they must be.
Drafting the manual before you have the risk analysis means writing blind, and that is the order in which it is done most of the time.
This is the structure we propose for a professional football club. It is not a bank’s structure adapted: it is built on the transactions a club actually carries out—signings, commissions, sponsorships, shareholdings and ticketing—and on who decides them within the organization.
| Chapter | What it must cover |
|---|---|
| 1 · Scope and responsibilities | Who within the club is bound by the manual, which areas are affected and who is accountable for applying it. |
| 2 · Risk analysis | Summary of the self-assessment: risks identified by transaction, counterparty, channel and jurisdiction, and how controls are calibrated on it. |
| 3 · Acceptance policy | Which counterparties are accepted, which require enhanced approval and which are not accepted, and who can authorize an exception. |
| 4 · Due diligence | What is checked for each counterparty, with what documentation and at what point, with the three levels of intensity and the cases that trigger each one. |
| 5 · Beneficial ownership | How the ownership chain is traced, which sources are used and what happens when it cannot be completed. |
| 6 · Signings and transfers | A specific procedure for the highest-risk transaction, including agents, commissions and deferred payments. |
| 7 · Sponsorships and shareholders | Checks required before signing a sponsorship agreement or letting a new investor into the share capital. |
| 8 · Cash and ticketing | Limits, identification above a threshold and traceability of payment methods in ticket and season-ticket sales. |
| 9 · Detection and reporting | How an alert is generated, who analyzes it, how quickly, who decides and how the outcome is documented, including the duty to refrain from executing transactions. |
| 10 · Record keeping | What is filed, in what format, for how long, who can access it and how it is retrieved. |
| 11 · Control bodies | Composition and functions of the internal control body, appointment of the representative and reporting lines to the board. |
| 12 · Training | Annual plan, target audience by role, content, assessment and record of the training delivered. |
| 13 · Review and audit | How often the manual is reviewed, triggers for an early review and the arrangements for the external review. |
Structure proposed on the basis of the obligations in Regulation (EU) 2024/1624 as applied to a club’s operations. The minimum required content must be checked against the articles of the Regulation and the Spanish implementing law.
Drafting the document is the quick part. What makes it work is the groundwork of understanding how the club makes decisions and the follow-up work of getting the team to use it.
The analysis comes before the manual: what risks this club faces by type of transaction, counterparty, channel and jurisdiction. Without that diagnosis, the manual has nothing on which to calibrate the intensity of its controls.
A document built on interviews with the people who really make decisions at the club: sporting management, the legal team, administration and the board. The result describes the organization that exists, not a generic template.
Design of a control structure proportionate to the club’s size, formal appointment of the representative before the authority and definition of reporting lines.
The procedures that sit under the manual and that the team uses every day, with their file templates and decision criteria.
A manual that no one has read protects no one. We train each role in the part that concerns it and leave documented evidence of who received what and when.
Review of the manual every season, updates when relevant changes occur and an independent external review of how the system really works.
A mid-sized club does not need a heavy structure, but it does need a clear one. What a supervisor checks is not how many people there are, but that each function is assigned, known and working.
| Body or function | Its responsibilities | What is checked |
|---|---|---|
| Management body | Approve the manual and the risk self-assessment, and be accountable for the effectiveness of the system. | Dated approval minutes, and a record showing that it receives regular information on how the system is working. |
| Internal control body | Analyze alerts, decide on reports and propose improvements to the system. | A defined composition, meetings with minutes and documented decisions, not just its formal existence. |
| Representative before the authority | Act as the formal point of contact and be responsible for reporting suspicious transactions. | Formal appointment, notification to the supervisor and real availability. |
| Sporting management | Apply the procedure in transfer dealings and escalate any alerts it detects. | Documented training and a record showing that alerts are escalated and not resolved informally. |
| Legal team and administration | Carry out the checks, keep the files and verify payments. | Complete, retrievable files that include the analysis, not just the contracts. |
| External review | Independently check that the system works as the manual says. | A report with a defined scope and documented follow-up of its recommendations. |
Indicative allocation. Combining functions is possible at small clubs, but it must be justified in writing and respect any incompatibilities arising from the law.
The most common finding in any inspection, in any sector, is the same: a manual approved years ago that nobody has touched since, while the organization has changed completely. At a club, where the management team and the ownership change frequently, that gap opens up even faster.
A deficient manual is not an isolated documentation problem: it is the warning sign that leads the supervisor to look at everything else more closely.
Template manual: a text that talks about customers, branches or financial products at a football club is spotted on the first page. From then on, the whole file is read on the presumption that the system exists on paper and not in reality.
Contradiction with day-to-day practice: the manual says that transactions above a certain amount require approval from the control body, and the files show that it was never requested. That contradiction is more serious than not having the procedure in writing.
Approval without a date or minutes: a manual with no record of who approved it and when does not prove that the management body has taken responsibility for the system, which is precisely what the law requires.
An excellent manual that nobody has read protects no one. Without a training record by role, the presumption is that the document has not been rolled out.
A manual approved and never reviewed despite changes in ownership, management or operations is the most common finding and the hardest to justify.
A control body set up on paper but with no meetings or minutes is, for inspection purposes, the same as a body that does not exist.
We prepare the risk self-assessment, draft the manual based on how your club really makes decisions and leave the procedures, templates and training ready to use.
REGULATORY CONTROL CENTER · MANUAL AND INTERNAL SYSTEM
Proportionality allows a small club to have a light system, but not to be missing any piece. This panel shows what depth is appropriate for each size.
Indicative benchmark for prioritizing the work and sizing the project team.
They all produce the same result: an impeccable document and an organization that does not apply it.
It is the most common sequencing mistake. Without a self-assessment there is no basis for deciding which controls are needed or how intensive they should be, and the manual ends up disproportionate in some areas and insufficient in others.
A club does not have customers: it has counterparties. It does not have branches: it has a sporting management team that negotiates. A manual that does not use the club’s vocabulary or processes will not be used by anyone at the club.
The manual has to describe how transactions are actually approved. That is not in any organization chart: you find it out by asking sporting management, administration and the board.
A procedure without a person with authority to stop a signing is just a formality. You have to state who that person is, what information they base the decision on and how quickly they must respond.
A manual with no approval minutes, no date and no record showing that the board receives regular information does not prove that the management body has taken responsibility for the system.
Ownership changes, sporting management changes, operations change, and the manual still describes the club as it was three seasons ago. It is the most common finding of all.
Three principles that separate a working manual from a document for the archive.
If sporting management reads the manual and does not recognize the way they work, the manual describes a different organization. That is the most useful test: give it to the people who negotiate and see whether it sounds familiar.
Listing checks is not enough: you have to say what happens with the result. Who assesses, who authorizes, who can stop the transaction and how quickly they must do so.
A manual needs someone responsible for maintaining it and a review schedule, plus a list of events that require an earlier update: a change of ownership, management, operations or legislation.
If you would like us to review or draft your club’s manual, see our AML services or request a free consultation.
Parts of the system that should not be confused with one another, because each one responds to a different obligation.
A document approved by the management body that sets out the club’s anti-money laundering policies, procedures and bodies.
A prior document that identifies and assesses the risks specific to the activity, and on which the intensity of all controls is calibrated.
Criteria that determine which counterparties are accepted, which require enhanced approval and which are rejected.
The body that analyzes alerts, decides on reports and proposes improvements to the system. With meetings and minutes.
The person formally appointed as responsible for reporting suspicious transactions and for the relationship with the supervisor.
A circumstance detected in a transaction that requires it to be analyzed before going ahead. It does not imply suspicion: it implies checking.
The obligation not to carry out the transaction where there is suspicion, except in specific cases set out in the law. The manual must say who decides.
Documentation proving that the procedure was applied: files, minutes, training records and signed decisions.
Checking that the manual still describes the real organization, at a defined frequency and with triggers for an earlier review.
It is the internal rulebook that sets out the policies, procedures and bodies through which the club meets its anti-money laundering obligations. It is approved by the management body, applied in day-to-day operations and reviewed periodically.
It is also the first document requested in an inspection, and the one that most often reveals that the system exists on paper and not in reality.
We propose thirteen: scope and responsibilities, risk analysis, acceptance policy, due diligence, beneficial ownership, signings and transfers, sponsorships and shareholders, cash and ticketing, detection and reporting, record keeping, control bodies, training, and review.
What matters is not the numbering but that no obligation is left without an assigned procedure and that every procedure ends in a decision.
As a structural reference, yes. As a document to adapt with find-and-replace, no. A club has no customers or branches: it has counterparties, a sporting management team that negotiates and operations concentrated in two transfer windows a year.
A manual that does not use the club’s vocabulary or processes will not be used by anyone at the club, and that is exactly what is spotted on first reading.
The analysis, always. The risk self-assessment determines which controls are needed and how intensive they must be; the manual develops them. Doing it the other way round produces a document that is disproportionate in some areas and insufficient in others.
It is the most common sequencing mistake we find when reviewing systems.
The club’s management body. And there must be a record of it: dated minutes, and evidence that the board receives regular information on how the system is working.
Without that record, there is no proof that the management body has taken responsibility for the system, which is the responsibility the law assigns to it.
The principle is proportionality: the structure can be very light, but no function can be missing. There must be an internal control body (even a small one), a representative appointed before the authority and someone with the authority to stop a transaction.
Functions can be combined, but this must be justified in writing and must respect the incompatibilities.
At least once a season, and also whenever something happens that makes it outdated: a change of ownership, a change in sporting management, a significant change in operations or a change in the law.
A manual approved and never reviewed is the most common finding in any inspection, in any sector.
An independent comparison between what the manual says and what the club does is the only reliable way to detect the gap before the supervisor does. For clubs without internal audit resources, an external review is also the most efficient route.
The scope must be defined and the follow-up of the recommendations documented.
Whoever can spot an alert, and that is not the legal department: it is the sporting management team that negotiates the signing, whoever signs the sponsorship and whoever deals with intermediaries.
Training must be tailored to each role and leave retrievable evidence of who received it, when and with what content.
Professional football clubs are obliged entities from July 10, 2029. By that date the system has to be set up and running, not under construction.
Bear this in mind: a manual written in 2029 goes into its first inspection with no track record of application to show. We explain the scope and the timeline on our page on AML for football clubs.
Everything stated on this page comes from the EU legislative package or from official Spanish documents still in the legislative process.
Entry for the EU anti-money laundering regulation in the Spanish Official State Gazette (BOE), with access to the PDF of the original publication. It is the regulation that brings football into the scope of obliged entities.
boe.es · DOUE-L-2024-80912 BOEMechanisms that Member States must put in place: supervision, registers and cooperation. This is the piece Spain has to transpose.
boe.es · DOUE-L-2024-80913 BOEEstablishes the EU Anti-Money Laundering Authority, with which the Spanish supervisor will coordinate.
boe.es · DOUE-L-2024-80910 Ministry of EconomyOfficial page of the public hearing and information procedure for the Spanish reform that creates the ANIFI and brings in the new obliged entities. Submissions until September 30, 2026.
portal.mineco.gob.es · public consultation La MoncloaOfficial summary of the agreement approving, at first reading, the draft bill for the comprehensive reform of the AML framework.
lamoncloa.gob.es · Council of Ministers BOEConsolidated text of the Spanish law still in force, which the reform now in progress is set to replace.
boe.es · BOE-A-2010-6737Regulatory content ages quickly, and an outdated guide wastes the time of anyone who follows it. That is why we publish who maintains it and how.
Tell us whether you already have a manual, when it was approved and who applies it, and we will tell you what needs to be redone and what can be kept.
When a supervisor walks into any obliged entity, the first thing it asks for is the manual. Not because the document is the most important part of the system, but because it is the one that most quickly reveals whether the system exists. A text that talks about customers, branches and financial products inside a football club is identified on the first page, and from then on everything else is read on the presumption that compliance is a mere formality.
The most widespread mistake is not in what the manual says, but in when it is written. The manual is calibrated on the risk self-assessment: it is that analysis that determines which controls are needed and how intensive they must be. Drafting the document first and doing the analysis afterwards—which is the real order in most projects—produces a manual that is disproportionate in areas that do not need it and insufficient precisely where the club’s risk is concentrated.
The temptation to start from a bank’s manual is understandable, and it ends badly. A club does not have customers: it has counterparties, and very few of them. It does not have a branch network: it has a sporting management team that negotiates. It does not operate continuously: it concentrates most of its high-risk transactions in two transfer windows a year, under calendar pressure that no bank manual contemplates. The vocabulary and the processes have to be the club’s own, or nobody at the club will use them.
A useful manual does not just list checks: it says what happens with the result. Who assesses the alert, who authorizes going ahead, who has the authority to stop a signing and how quickly they must respond. That part—the least eye-catching and the most often omitted—is what turns a procedure into a control mechanism. Without a person who can say no, the manual describes a formality.
When the inspection comes, the manual will only be the starting point. What will be checked is whether what it says matches what the files show: whether the transactions that, according to the manual, required the control body’s approval actually got it; whether the training the manual provides for was delivered and recorded; whether the body the manual creates met and took minutes. A contradiction between the document and the evidence is more serious than the absence of the document, because it proves that the system was written down and not applied.
Key legislation, linked to the official text:
Legislation and links reviewed in .