Manchester City have refused to give Uefa any comment on allegations that they breached financial fair play regulations and misled the governing body because the club argues the claims were based on “hacked or stolen” emails.

The Uefa committee responsible for FFP wrote to City before Christmas inviting comment on allegations reported in the German magazine Der Spiegel that the club’s declarations in 2013-15 were “a web of lies”.

City responded that the allegations were based on “hacked or stolen” emails, and challenged Uefa to support stronger protection against hacking. No actual investigation of the club is understood to have begun; Uefa and its club financial control body (CFCB) are understood to be considering whether to launch one.

Der Spiegel based the allegations on a small number of emails it claimed had been leaked to it by an anonymous person based in Portugal, given the name John. Spiegel said that “John” denied the internal emails, from City, Uefa, Fifa and several other football clubs and organisations, were hacked, saying that he had good sources.

The magazine claimed most damagingly that short extracts from four internal emails showed that City’s sponsorships, by the Abu Dhabi airline Etihad and other state-owned companies, were in fact mostly paid by City’s owner, Sheikh Mansour bin Zayed al-Nahyan, a senior member of the Abu Dhabi ruling family. Etihad itself did deny in a public statement that the money came from Mansour, saying the airline’s “financial obligations … have always been … the sole liability and responsibility of Etihad Airways”, but City refused to engage with the substance of the allegations.

When the CFCB wrote inviting comment, City are understood to have replied with a similar stance to their public position since the allegations were published: a refusal to engage with the stories because the emails were hacked or stolen, and taken out of context. The letter from City is said by informed sources to have argued that as Uefa’s own internal emails were also published, it should support City and other clubs to strengthen European football’s cyber-security.

As City refused to comment but did not deny that the emails quoted were genuine, the CFCB and Uefa officials are now understood to be discussing internally how to proceed. Aleksander Ceferin, the Uefa president, and Yves Leterme, chairman of the CFCB investigatory chamber, have spoken publicly in general terms that the strongest sanction for a club found to be seriously in breach of the rules is expulsion from the Champions League.

A Uefa spokesman said there was no further update on Ceferin’s brief comment on the City issues last month, when he said: “We are assessing the situation. We have an independent body [the CFCB] working on it. Very soon you will have an answer on what will happen in this concrete case.”

City’s refusal to comment appears to be a determined policy in relation to perceived cyber-hacks. The club’s senior hierarchy, including the chairman, Khaldoon al-Mubarak, are also senior political figures in Abu Dhabi, which has been subject to previous hacking or email leaks. The response in those cases has also been not to comment on the substance of what was published.

City’s only statement since the allegations was: “We will not be providing any comment on out of context materials purportedly hacked or stolen from City Football Group and Manchester City personnel and associated people. The attempt to damage the club’s reputation is organised and clear.”

The financial information required for FFP is collected by national leagues, which are delegated responsibility for Uefa’s licensing system. If Uefa did embark on an investigation, which it is under pressure from La Liga and other clubs to do, the Premier League would have to ask City for further confidential information, potentially including internal emails. Leterme and Uefa officials are thought to be assessing whether the potential result of any investigation warrants such an escalation, which City are likely to oppose.

The CFCB did find City in breach of the permitted FFP losses in May 2014 and the club agreed to a range of sanctions, but it did not find that the Etihad sponsorship, now of the club’s shirt, stadium and new training “campus”, was overvalued. Owners can put money into clubs via sponsorships, as long as the price paid is considered fair market value.