From Football Leaks to Manchester City's 115 Charges: Which Transfer-Window Numbers Are Actually Reliable

The most repeated number of a transfer window is often not a deal record but a communications product. In September 2026, when Gareth Bale joined Real Madrid, leaked documents later suggested the publicly stated fee sat above an internally projected figure designed to protect Cristiano Ronaldo's £80m world-record status. Another leaked file claimed a clause in Roberto Firmino's Liverpool contract barred a sale to Arsenal. In this part of the calendar our feeds fill with fees, release clauses and medical updates, and much of that origin traces back to a single document cache.

The man behind that cache now lives under witness protection and reportedly wears a bulletproof vest. He has been convicted by a national court. So the question has two layers: how reliable are the documents, and where does the legal architecture we use to judge clubs place them as evidence?

Context before code is my rule. In 2026, as a junior rules producer at The Anfield Wrap, I learned to match the tape before matching the mood. For Sadio Mané's 37th-minute red card at Manchester City I counted 11 camera angles and worked through IFAB Law 12 to separate reckless from serious foul play. In 2026 I logged 14 VAR stoppages in Russia and wrote a 2,500-word protocol explainer. In 2026 I checked Law 10 and goal-line technology protocol on the ghost goal at Villa Park. Years of watching matches and reconciling documents is the same habit: what did the referee see, and what should he have been able to see?

Rui Pinto is Portuguese and self-taught. Between 2026 and 2026, under the Football Leaks banner, roughly 18.6 million documents — 3.4 terabytes — surfaced through Der Spiegel and the European Investigative Collaborations network. The Luanda Files of 2026 and the Malta Files followed, syndicated across more than 37 outlets. He was arrested in Budapest in January 2026. One small correction worth logging, because it shows how carefully sources check themselves: Budapest sits on the Danube, not the Vltava — the Vltava is in Prague. When a timeline gets its geography wrong, the legal conclusion drifts too.

The rulebook here is not one book. UEFA's Financial Fair Play, the Premier League's Profit and Sustainability Rules — a £105m three-year loss threshold — FIFA's Regulations on the Status and Transfer of Players, Articles 18bis and 18ter, and Portuguese criminal law. FIFA banned third-party ownership in 2026, and the Doyen Sports case sits directly on that border.

| Date | Event | Legal layer | Reliability | |---|---|---|---| | 2026–2026 | Football Leaks document releases | Journalism/criminal | Documents exist; source verification limited | | November 2026 | Der Spiegel on Manchester City | Journalism | Medium; linked to Portuguese prosecution | | January 2026 | Pinto arrested in Budapest | Criminal process | Verifiable | | July 2026 | CAS overturns UEFA's two-year ban; €10m fine | Judicial ruling | Verifiable (reduced from €30m) | | February 2026 | Premier League files 115 charges | League rules | Verifiable | | September 2026 | Guilty verdict; four-year suspended sentence | Criminal | Reported; I have not seen the primary judgment |

The biggest inaccuracy in circulation is a conflation. Manchester City's 115 charges came from the Premier League in February 2026. Der Spiegel's 2026 disclosures fed UEFA's separate case, which collapsed at CAS in July 2026. The claim that City have been found guilty of 114 of Der Spiegel's 115 documented charges merges two processes and arrives without a panel, a date or a document. As of February 2026 no final Premier League commission ruling has been published. Strictly stated: that claim is unverified allegation, not finding.

I rewound the tape until the law stopped blinking. Here the tape is the paperwork. The first layer is market opacity. The Bale valuation, the Firmino clause, the Doyen third-party model all point to one fact: transfer prices are sometimes political decisions rather than market prices, which is precisely why a window's quoted fee cannot be treated as a valuation.

The second layer is procedural separation. FFP, PSR and criminal law run on different standards of proof. A Premier League commission works on the balance of probabilities; a Portuguese criminal court requires near-certainty. That asymmetry explains why the personal case concluded while the club-level case hangs: the law is not failing, it is behaving as designed.

The third layer is sanction precedent. Everton were docked ten points, reduced to six on appeal; Nottingham Forest lost four. Sanctions are real, but they are forward-looking instruments. Retroactive trophy stripping is a different tool, and it is not simply available because supporters demand it.

The offside line is a legal fiction drawn in grass. In the same way, the £105m PSR threshold is a legal fiction drawn in accounts. The line is real, but it is human-made, and so is the panel that draws it.

The fourth layer is my own confidence labelling. The Der Spiegel documents and the 2026 charge sheet are verifiable. Pinto's conviction and protection status are reported consistently but thinly sourced. The suggestion that FIFA president Gianni Infantino helped City and PSG avoid FFP is an allegation. The claim that Pinto's lawyer holds five more hard disks is a forecast, not evidence. Mixing those three registers turns analysis into advocacy.

Anticipatory risk dashboard | Rating: high

| Risk | Level | Basis | Note | |---|---|---|---| | Pinto's personal safety | Very high | Reported, consistent | Witness protection, daily threats | | City's sporting sanction | High | Precedent-based inference | Points deduction/fine plausible, uncertain | | Regulator credibility | High | Precedent-based | Oversight depended on the man then prosecuted | | Chilling effect on leaks | Medium | Speculative | Whistleblower protection vacuum | | Further disclosures | Medium | Speculative | The five hard-disk claim |

The most certain risk is not on the pitch but to a person: personal safety is the best-evidenced risk item here. The largest but least certain risk concerns City's sporting future, because it depends on an unpublished ruling.

The contrarian reading: the Robin Hood versus extortionist binary is false. Media place Pinto at one pole or the other. Legally, both can be partly true — the same person can expose systemic opacity and seek personal leverage from it. Where an attempted extortion charge against Doyen Sports and its former chief executive sits on the record, public-interest motive cannot whitewash everything. The reverse also holds: the regulatory system that came to depend on an outsider's documents, and then prosecuted him, exposes a fragility larger than one club's case.

The comparison to match management is uncomfortable but accurate. When a player retaliates and the referee books only the retaliation, the explanation is simple: I can only punish what I can see on the tape. Football governance works the same way. The reaction — the leak, the unauthorised access — is punishable; the cause frequently stalls at the allegation stage. The long-term consequence is fewer leaks and weaker independent oversight.

Takeaway: watch three signals. First, the Premier League panel's ruling — any outcome reshapes how clubs draft clauses and price regulatory risk. Second, whether the claimed hard disks ever surface, which would convert an archive story into a live one. Third, whether European-level whistleblower protection emerges; it is the quietest decision with the longest shadow.

If football's regulators want to be honest, the first question belongs to them, not the supporters: does punishment change behaviour, or merely demonstrate that someone was punished?