Rui Pinto is a convicted extortionist living in a safehouse. If he says there's more on Manchester City, the smart money says there's more on Manchester City.
Start with what's true. An independent commission reportedly found City guilty on 114 of the 115 charges the Premier League brought over breaches of its financial rules. As of Friday, the ruling hadn't been made public, no sanction had been set, and City are expected to appeal. The full written judgment might not land until late 2026 or into 2027. It's a guilty finding, and it's a long way from over.
Now the man. Pinto is the Portuguese behind Football Leaks, the site that surfaced in September 2015 under the pseudonym "John." A self-taught computer enthusiast and former history student, he was named after his 2019 arrest. His documents fed journalists, journalists fed regulators, and the material Der Spiegel published in 2018 helped set UEFA and the Premier League digging. He's been a protected witness in Portugal since 2020, handing over hard drives in exchange for protection. In September 2023 he was convicted of attempted extortion against the agency Doyen Sports, along with illegal access to data and breach of correspondence, and given a four-year suspended sentence. A French case later added a six-month suspended sentence. He's no clean-hands hero, and anyone selling him as one is selling you something.
A whistleblower's credibility rests on whether the material holds up once serious people pull it apart. Pinto's has. It stood up at UEFA and fed the process that reportedly ended with a 114-of-115 finding. Years of independent scrutiny landed in the same place.
So when Pinto says at a Marbella conference in June 2024 that he handed five hard drives to French and German authorities with "millions of documents, including more on City," and when his legal team says there's "a massive file of Manchester City-related documents that has yet to be released," the honest reaction, if you're City, is dread.
The case against him is real: he was convicted of trying to shake down a football agency, and there's something odd about a protected witness making public noise about what he's holding. Fine. But a man's rap sheet doesn't reach back in time and clean up someone else's books. Whether Pinto is a good person doesn't matter. What matters is whether City did what the paperwork says they did, and a commission reportedly decided they did, 114 times over.
Responsibility here sits with the ownership and executives who built and signed off on the financial arrangements now being litigated. They spent a decade constructing the structure that's being taken apart charge by charge. When you build something like that, you don't get to pick who finds it or how unsavory they are.
And if the finding survives the appeal everyone treats as a certainty, the punishment can't be a fine City would file under petty cash. A club found guilty on that scale, in a systematic, years-long pattern, needs sanctions that actually cost something: points, titles, a penalty that means it never happens again.
The verdict and the sanction are still pending. But the direction of travel is obvious, pushed along by a hacker with an inconvenient habit of being right. City have more to answer for now than they did before Pinto opened his mouth.
