This is our published view
The bench stands behind it
For your facts, in confidence, put the question to the firm.
The bench stands behind it
The position
The striking thing about VARA’s marketing rules is who they bind.
The striking thing about VARA’s marketing rules is who they bind. They are not a code for licensed firms alone. The Regulations on the Marketing of Virtual Assets and Related Activities 2024 apply to every entity, whether or not it is licensed by VARA and whether it sits inside the UAE or outside it, the moment its marketing is in or targeting the UAE (Regulations on the Marketing of Virtual Assets and Related Activities 2024, Rules I.B.1 and I.B.2, current as at 1 July 2026). An entity escapes only by falling outside on all three counts at once: not located in the Emirate, carrying on no VA activity there, and doing no marketing in or targeting the UAE (Rule I.B.5). Miss that exemption on any single limb and the rules apply in full.
The net is set wide on purpose. Marketing is defined as “any advertisement, invitation, inducement, solicitation, offer or promotion” (Rule I.A.1), and it catches that content across any medium: social posts, blogs, endorsements, videos, podcasts and live streams, banners and billboards, paid or earned media, branding and merchandise, the giving of a token by airdrop, and even educational articles, presentations and tutorials (Rule I.A.2). The form does not matter. If it promotes a virtual asset or a VA activity into the UAE, it is marketing.
Three requirements sit at the centre of the regime. First, a licensing gate: marketing of a VA activity may be carried out only by a VASP that VARA has licensed for that activity, or by someone acting on its behalf and with its approval (Rule I.B.3). Second, a conduct standard: all marketing must be fair, clear and not misleading, carry the prescribed risk warnings, and avoid manufacturing urgency, set out in the requirements of Part I.C and taken up in Section IV. Third, an outright prohibition: marketing a privacy coin, or any VA activity involving one, is strictly banned (Rule I.B.4).
Enforcement is not nominal. VARA may fine an entity up to AED 10,000,000 for each violation of the core requirements, at its sole discretion, with the figure doubled for a repeat within a year and a further charge accruing at one percent a month, compounding, on anything left unpaid (Schedule 1). The figures are maximums rather than fixed tariffs, and they sit on top of whatever any other authority may impose, a point Section VII takes up.
The regime layers on top of the rest of the framework rather than replacing any of it. The Marketing Regulations apply in addition to all Regulations, Rules and Directives, and where they conflict, the Regulations and Rules take precedence (Rule I.A.5). So a firm reads the marketing rules together with its activity rulebooks, not instead of them.
This article follows that shape. It sets out who is caught and what counts as marketing, the two hard prohibitions, the conduct standard, the exemptions and why they are narrower than they look, the duties that fall on platforms, app stores and event organisers, what non-compliance costs, and finally what is settled and what remains open.
The first question under these rules is not what you are marketing but whether you are caught at all, and the perimeter is drawn by reach rather than by residence. What matters is whether the marketing is “in or targeting the UAE”, not where the entity sits or whether it holds a licence (Regulations on the Marketing of Virtual Assets and Related Activities 2024, Rule I.B.1, current as at 1 July 2026). All marketing of or relating to a virtual asset or a VA activity in or targeting the UAE must comply, and no entity may carry on such marketing unless it complies at all times (Rules I.B.1 and I.B.2).
The way out is narrow, because it is conjunctive. An entity falls outside the rules only if it satisfies all three conditions together: it is not located in the Emirate, it conducts no VA activity in the Emirate, and it does no marketing of or relating to a virtual asset or VA activity in or targeting the UAE (Rule I.B.5). Fail any one and the rules bind in full. An offshore firm with no Dubai presence is therefore still caught the moment its marketing reaches into the UAE, because the third limb alone is enough to hold it in.
What “targeting the UAE” means is left open in the binding text and filled out in VARA’s Guidance, which is expressly non-binding and indicative only. The Guidance sets out a non-exhaustive list of factors VARA may weigh, and is explicit that no single one is necessary and none on its own decisive: pricing in dirhams, use of Emirati dialect or local slang, UAE or Dubai imagery, the use of UAE-based influencers, running communication channels aimed at UAE residents, or simply targeting the Gulf Cooperation Council as a whole, which VARA treats as including the UAE. VARA assesses the campaign as a whole rather than any single item within it. And it reads the reach widely in one particular way: it treats marketing that targets the UAE as, by default, also targeting Dubai, on the view that a campaign cannot credibly aim at the UAE while carving Dubai out unless it says so in every communication. For a firm, the safe working assumption is that anything pointed at the UAE market sits inside VARA’s marketing perimeter.
The definition of marketing is drawn just as widely, and by effect rather than by label. Marketing is any advertisement, invitation, inducement, solicitation, offer or promotion (Rule I.A.1), and it is caught whatever the medium it travels through (Rule I.A.2). Two inclusions catch firms that do not think of themselves as advertising at all. Giving a token away by airdrop is marketing, so a free distribution sits inside the regime rather than beside it. And educational content, the article, the presentation, the tutorial, is marketing too, which means the explainer and the how-to guide are not automatic safe harbours. The Guidance underlines the point, listing the factors VARA weighs in deciding whether something is marketing in the first place, among them the content, the audience, how it is made available, its relevance to a virtual asset or activity, and whether there is a commercial purpose behind it. The label a firm puts on a communication does not settle the question. Its purpose and effect do.
For completeness, the regime replaced the two Administrative Orders of 2022 that preceded it, with a ninety-day runway for marketing already approved under the old orders, a runway that has long since closed (Rules I.A.3 and I.A.4). The 2024 Regulations are now the whole of the marketing regime.
So the perimeter is set by reach, the definition by effect, and the exit by a test that must be passed on all three limbs at once. Having established who is caught, the next question is what the rules forbid outright. Two prohibitions are absolute, and Section III takes them in turn.
Most of the marketing regime shapes how you may market. Two rules are different in kind, because they decide whether you may market at all. One is conditional and one is absolute, and the difference between them matters.
The first is a licensing gate. Marketing of or relating to a VA activity may be carried out in only one of two ways: by a VASP that VARA has licensed for the activity the marketing relates to, or by someone acting on that VASP’s behalf and with its approval (Regulations on the Marketing of Virtual Assets and Related Activities 2024, Rule I.B.3, current as at 1 July 2026). There is no third route. An unlicensed party cannot promote a VA activity into the UAE on its own account. It can do so only as the approved agent of a firm licensed for that very activity, which is the mechanism through which distributors, affiliates and marketing agencies lawfully carry a licensed VASP’s message. The gate is drawn around the activity, and the words “or relating to” give it width, so a communication that stops short of naming the service can still be caught where it relates to the activity.
The gate bites on the marketing of a VA activity in particular. Marketing that concerns a virtual asset without relating to a VA activity is still inside the regime, and still bound by the conduct standard and the prohibitions, but the licence condition in I.B.3 is specifically about activity-marketing. For most firms the practical effect is the same, because promoting a token is usually bound up with promoting a service that deals in it, and the moment it is, the gate applies.
The second prohibition is absolute. The marketing of any privacy coin, and any VA activity involving one, is “strictly prohibited in the Emirate” (Rule I.B.4). This is not a gate that a licence opens. It is a flat ban that no licence, consent or exemption lifts. Where the licensing rule permits the activity on a condition, the privacy-coin rule removes it altogether, and it aligns with the wider prohibition on these assets that runs through the VARA framework. A firm cannot market its way around it, and being licensed does not help.
Both carry the regime’s heaviest penalty. A breach of the licensing gate is fined at up to AED 10,000,000 (Schedule 1). The privacy-coin ban is not given its own line in the fines table, but it is caught by the residual entry for any provision not separately listed, which carries the same ceiling of up to AED 10,000,000. So the two hardest rules in the regime also sit at the top of its penalty scale.
The distinction between them is the point. One rule permits the activity on a condition; the other forbids it outright. Everything in the next section assumes both are satisfied, because the conduct standard only reaches marketing that is allowed to happen in the first place. Section IV turns to that standard: how marketing must be done, once it is through the gate and clear of the ban.
Once marketing is through the licensing gate and clear of the privacy-coin ban, it is allowed, but it is heavily conditioned. The requirements in Part I.C reach the substance of what a promotion may say, how it must say it, and who carries the risk if it goes wrong. They divide into an overlay of other law, a core honesty standard with a floor of mandatory disclosures, a set of prohibitions on hype, extra rules for promoting a token, and duties of record-keeping and responsibility.
The first requirement points outward. All in-scope marketing must comply with every other applicable UAE and Emirate law, expressly including the law on advertising, data protection and consumer protection, together with any approvals a competent authority requires (Regulations on the Marketing of Virtual Assets and Related Activities 2024, Rule I.C.1, current as at 1 July 2026). The operative federal data-protection instrument here is the Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, in force since 2 January 2022, which governs how a firm may use personal data to target and deliver its marketing. One caution: that law’s Executive Regulations remain pending, so the detailed mechanics that will sit beneath it, including specific timelines, are not yet settled, and a firm should not build a process around a figure those regulations have not yet fixed. The advertising and consumer-protection instruments the rule also invokes are taken up in the companion article “Which federal laws stand behind a VARA licence?”.
The core standard is a single line doing a great deal of work: all marketing must be “fair, clear and not misleading” in both substance and presentation, and must be clearly identifiable as promotional (Rules I.C.2.a and I.C.2.b). VARA’s non-binding Guidance reads this by the overall impression on the audience, calling for plain language, a balanced picture that does not exaggerate returns or bury risk, and clarity about regulatory status, including that VARA’s approval of an issuance is not an endorsement of the asset. The standard is presentation-sensitive: what makes a long article fair will not be what makes a short video fair.
Beneath the standard sits a floor of statements the marketing may not contradict. It must not cut against a fixed set of truths: that a virtual asset can lose its value in part or in full and is highly volatile, may not be transferable and that some transfers are irreversible, can cost the holder everything with no financial protection, may be illiquid, is often recorded on a public ledger rather than being private, and can be the target of fraud, theft and manipulation (Rule I.C.2.c). The same rule forbids exploiting a consumer’s inexperience, and forbids letting small print contradict the headline message. This is a floor of candour the marketing has to stay consistent with, whatever else it says.
On top of the floor sit the prohibitions on hype. Marketing must not state or imply that an investment is safe, low risk or guaranteed, that investing is trivial or easy, or that past performance indicates future results, and it must not manufacture urgency or a fear of missing out through inaction (Rules I.C.2.d to I.C.2.h). The anti-urgency rule is the one most likely to catch ordinary promotional habits, because countdowns, limited-time framing and “don’t miss out” language are the native idiom of crypto marketing, and the rule bars them. Around these sit further controls: a firm may not promote acquiring a virtual asset on credit or other interest-bearing terms unless it is itself VARA-licensed to provide that facility (Rule I.C.2.i), targeting must present only appropriate assets to the audience reached (Rule I.C.2.j), paid third-party content must be disclosed as remunerated (Rule I.C.2.k), and any incentive must not distract from risk, must stay open long enough not to create urgency, and must first receive a compliance confirmation from VARA (Rule I.C.2.l).
Promoting a token, as opposed to a service, carries three further rules. The marketing may not include a call to buy or any message directing a purchase or sale (Rule I.C.3.a), it must carry a prominent disclaimer that the asset is volatile and can lose all its value with no financial protection (Rules I.C.3.b and I.C.3.c), and it may not send a virtual asset to anyone’s wallet without their prior consent or a clear expression of interest (Rule I.C.3.d). That last rule is why an airdrop is not a free pass: since giving a token away is itself marketing, an unsolicited airdrop breaches the consent rule, and the Guidance treats the consent required as including valid consent under data-protection law, which loops back to the Personal Data Protection Law.
Two final duties fix responsibility. Every marketer must keep a record of all its marketing, and of how it was distributed, for at least eight years, available to VARA on request (Rule I.C.4). And where marketing is run through an agency, responsibility runs both ways: the instructing firm remains responsible at all times for the agency’s compliance, and the agency is independently liable for its own breaches and must itself check that the instructing firm is permitted to market (Rule I.C.5). A firm cannot contract its way out of the rules by hiring someone else to break them, and an agency cannot shelter behind its client.
So the conduct standard forces candour, forbids hype, and pins responsibility on everyone in the chain. What it does not do is offer easy ways out. The exemptions that look like exits, for journalism, education and private messages, are narrower than they appear, and Section V takes them in turn.
Three things can take content outside the definition of marketing altogether: journalism, education, and purely personal communication. Each reads like an exit, and each is conditional, so the conditions are where the work is done. One category is expressly shut out of all of them: key opinion leaders. The thread running through the whole of Part I.D is that an exemption fails the moment the content’s real purpose is promotional, or the person behind it has an interest they have not disclosed.
The journalistic exemption is for genuine journalism, not for promotion in the shape of reporting. Content published by an entity acting as a journalist is not marketing, but only if it meets five conditions at once: the entity is appropriately licensed by the relevant authorities and stays compliant; the overall purpose of the content, taken as a whole and including any promotional material in it, is not marketing; it carries a prominent disclaimer of the author’s interest, and that of close family, in any asset, activity or VASP it covers; it discloses any paid arrangement under the rule met in Section IV; and, if it refers to buying a virtual asset at any point, it carries the volatility and total-loss disclaimer (Regulations on the Marketing of Virtual Assets and Related Activities 2024, Rule I.D.1, current as at 1 July 2026). VARA’s non-binding Guidance narrows the gate further, treating a journalist as media personnel licensed or accredited by the UAE’s Media Regulatory Office, and saying plainly that influencers are not journalists.
The educational exemption runs in parallel, and is narrower than it feels. Educational content is not marketing, provided its overall purpose is not marketing, it carries the interest disclaimer, it discloses any paid arrangement, and it carries the volatility disclaimer where it references a purchase (Rule I.D.2). The decisive limit sits in the Guidance, which is non-binding but pointed: content that is sponsored or paid for does not qualify as educational at all. A paid explainer is therefore not education under the exemption. It is marketing, and it must meet the full conduct standard.
Both exemptions turn on the same hinge, the overall purpose of the content taken as a whole. VARA reads the whole item, including any promotional material, merchandise or giveaways attached to it, and asks what it is really for (Guidance, non-binding). A firm cannot take a promotional message, wrap an article or a lesson around it, and claim the wrapper’s exemption. The promotion inside is weighed as part of the whole.
The personal-communications exemption is real but small, and VARA controls its edges. Purely personal or private communications are not marketing, but VARA keeps sole and absolute discretion to decide when a communication is not purely personal or private (Rule I.D.3). The Guidance, again non-binding, draws the line tightly: purely personal or private covers only friends, family and colleagues, and anything reaching fifty or more people in aggregate is not personal or private, while even a smaller group may still be marketing. A message pushed to a large channel or chat group is not saved by being sent from a personal account.
Then there is the category the exemptions do not reach. Key opinion leaders do not qualify for either the journalistic or the educational exemption and “must comply with these Marketing Regulations in full” (Rule I.D.4). The influencer post is always marketing, whatever its tone, and it carries the whole conduct standard with it: the paid-promotion disclosure, the risk warnings, and the ban on any call to buy. For a sector that runs heavily on influencer promotion, this is the exemption section’s sharpest edge, because the content that most often looks like commentary is treated as advertising.
So the exemptions protect genuine journalism, genuine education, and genuinely private conversation, and very little else. The moment content is paid for, promotional in purpose, broadcast widely, or produced by an influencer, it falls back inside the regime in full. Having covered who is caught, what is forbidden, how compliant marketing must be done, and what is exempt, the next question is who else in the distribution chain carries a duty. Section VI turns to platforms, app stores and events.
The marketing rules do not stop with the marketer. Part I.E and Part I.F recruit the infrastructure the marketing travels through, the broadcaster, the search engine, the app store, the conference hall, and give each its own duties. For businesses that are not virtual-asset firms at all, this is the part of the regime that reaches them.
Anyone who carries the marketing carries a duty. Every entity that facilitates in-scope marketing, expressly including traditional and digital broadcasters, publishers, search engines, social media and other internet platforms, must take “all commercially reasonable steps” to ensure the marketing it facilitates complies with all applicable law, including these Regulations (Regulations on the Marketing of Virtual Assets and Related Activities 2024, Rule I.E.1, current as at 1 July 2026). The standard is diligence rather than strict liability, a reading the rule’s own words support: the platform must take the steps a commercially reasonable operator would take, not guarantee the outcome. But the diligence must be real and provable, because the platform must keep records of that due diligence for eight years and produce them to VARA on request (Rule I.E.2). A platform that ran no checks has nothing to produce, and the record-keeping rule is how that failure surfaces.
App stores carry a sharper, gatekeeping version of the duty. An operator of an app store or download platform must ensure that any application searchable and downloadable in the Emirate which facilitates a VA activity is either owned or controlled by a VASP licensed by VARA for that activity, or otherwise approved by VARA (Rule I.E.3), and must implement all necessary technology to achieve that, expressly including geo-blocking and location-based filtering (Rule I.E.4). The consequence runs against the store, not only the developer: if an unlicensed exchange’s app can be found and installed in Dubai, the store’s own compliance is engaged. Availability in the Emirate is the store’s problem to engineer away.
Events are where the regime makes its one deliberate opening. As a limited exemption from the licensing gate, an entity not licensed by VARA may market at a physical event held in the Emirate, but only inside six conditions holding together: it carries out no VA activity in the Emirate unless licensed; it does not permit any UAE resident to sign up or onboard as a client at the event; all its marketing meets the full conduct standard of Part I.C; everything carries a prominent disclaimer that it is not licensed or regulated by VARA and cannot conduct VA activities in or from Dubai; it is properly licensed everywhere it does offer its products; and its marketing consists only of its name, its logo, a reference to its types of activities or its fees, and explanatory or educational information, which may include live demonstrations (Rule I.F.1). The last condition is a ceiling on content, not a colour: the booth may say who the firm is, what it does and how its product works, and nothing more. The line the exemption will not cross is onboarding, and it is the line most easily crossed in practice, because a sign-up at the booth is precisely what the rule forbids. VARA’s non-binding Guidance adds texture: speaking on a panel is fine where the content stays informative and makes no recommendation about any product or asset, and a promotional giveaway may count as a non-monetary incentive, which drags in the incentive rules met in Section IV, including VARA’s prior confirmation.
The event organiser is made a gatekeeper of that opening. Whoever organises, hosts, promotes or manages an event where in-scope marketing may occur must ensure attendees are suitable and qualified for the event’s subject matter, keep a list of every attendee with full name, age, country of residence and the information used to validate them, obtain a signed undertaking from every exhibitor that it will not carry out VA activities in or from the Emirate without a licence, and be able to demonstrate all of this to VARA on request (Rules I.F.2.a to d). Behind those duties sits a kill switch: if VARA gives notice, the organiser must suspend or cancel the event and announce that immediately to the public, stating non-compliance with the rule as the reason in the body of the announcement itself (Rule I.F.2.e). The sanction is not only the cancellation. It is the forced public statement of why.
The regime also looks outward. An entity in the Emirate marketing into another jurisdiction must comply with that jurisdiction’s laws in addition to these Regulations, and VARA may cooperate with the relevant foreign authorities, including by exercising its enforcement powers under Part IX of the Regulations, in respect of a breach (Rules I.G.1 and I.G.2). A Dubai licence is not a passport for outbound marketing; the firm answers to the destination’s rules, and VARA has given itself the hook to act on a foreign breach at home.
So the chain of responsibility runs from the marketer through the platform and the app store to the event floor, and each link carries duties it must be able to prove it discharged. What remains is what failure costs. Section VII turns to the fines.
The numbers in this regime are ceilings, not prices. VARA has “sole and absolute discretion” to issue fines and to set their amounts (Regulations on the Marketing of Virtual Assets and Related Activities 2024, Schedule 1, paragraph 1, current as at 1 July 2026), and every figure in the fines table is expressed as an amount up to which VARA may go, per violation, assessed against the factors in Regulation IX.C of the Virtual Assets and Related Activities Regulations 2023 (Schedule 1, paragraph 2). Two consequences follow immediately. A first offence is not entitled to the bottom of the range, and a single campaign can produce several violations, each carrying its own fine.
The machinery behind the numbers is not the marketing instrument’s own. Part II applies the whole of Part IX of the Regulations, the framework’s general supervision, examination and enforcement regime, to the Marketing Regulations (Rule II.A.1), with fines imposed in accordance with Schedule 1 or as VARA otherwise publishes (Rule II.A.2). So the investigative and enforcement powers that reach a licensed VASP reach an unlicensed marketer too, and the fines VARA imposes sit on top of, not instead of, anything another authority or a court may separately impose (Schedule 1, paragraph 2).
The table itself is tiered, and the tiers say what the regime cares about. At the ceiling of AED 10,000,000 per violation sit the substantive breaches: the licensing gate for activity-marketing, the general conduct requirements, the additional token-marketing rules, a platform’s facilitation duty, both sides of the events regime, outbound marketing from the Emirate, failure to comply with a remedial or enforcement action, and any provision not separately listed (Schedule 1, rows 1 to 3, 7, 10 to 14). At AED 2,000,000 sit the chain-of-responsibility breaches: a marketing agency’s duties, the conditions of the journalistic and educational exemptions, and the app-store rules (rows 4 to 6 and 9). One row sits alone at AED 500,000: a platform’s failure to keep its due-diligence records (row 8).
The residual row is where the table does quiet work. Any provision not specifically listed carries the full ceiling of AED 10,000,000 (row 13), and two obligations of real weight fall to it. The privacy-coin ban has no dedicated row, so a breach of it is caught by the residual at the regime’s maximum, a conclusion that follows from what the table lists and omits. And the marketer’s own eight-year record-keeping duty is likewise unlisted, so it too falls to the residual, which produces an asymmetry worth noticing: the platform that fails to keep records faces a cap of AED 500,000, while the marketer that fails to keep its own faces up to AED 10,000,000. The reading rests on the table’s structure rather than a stated rule, but the structure is unambiguous.
Two rows then multiply whatever the table produces. A repeat violation within one year of the original doubles the applicable fine (row 15). And an unpaid fine grows: a further fine accrues at one percent per month, rounded up to the nearest full month, compounding, until both the original and the further fine are paid in full (row 16), with VARA additionally free to pursue recovery through further enforcement action or referral to law enforcement and the courts (Schedule 1, paragraph 4). Non-payment is not a standoff a firm can win; it is a meter running.
One final feature keeps the whole schedule provisional. VARA may amend the grounds or the amounts, or add new categories of fine, by amending the Regulations or simply by Directive, at any time (Schedule 1, paragraph 3). The tariff a firm reads today is the tariff until VARA publishes otherwise, which is one more reason the date on this analysis matters. What that leaves settled, and what it leaves open, is where this article closes. Section VIII draws the line.
Most of this regime is settled, and settled broadly. The perimeter is fixed by reach, with a three-limb conjunctive exit that offshore status alone does not satisfy (Section II). The definition catches promotion by its effect, airdrops and educational content included (Section II). The two hard rules stand at the centre, a licensing gate for activity-marketing and an absolute privacy-coin ban (Section III). The conduct standard binds everything that passes them: candour that may not be contradicted, hype that may not be manufactured, records kept for eight years, and responsibility that runs both ways between a firm and its agency (Section IV). The exemptions are real but conditional, and closed entirely to key opinion leaders (Section V). The chain duties reach platforms, app stores, events and their organisers (Section VI). And the cost of failure is a tiered schedule of discretionary ceilings reaching AED 10,000,000 per violation, doubling on repetition and compounding on non-payment (Section VII).
What remains open is not a gap in the rules but a reservation of discretion, and the reservation sits at exactly the points where firms most want certainty. The binding text does not define when marketing targets the UAE; the factors live in Guidance that is expressly non-binding. The fifty-person line for private communications, the rule that sponsored content is not educational, and the reading of a journalist as accredited media personnel are all Guidance too, while the binding text keeps VARA’s sole and absolute discretion over what counts as purely personal, leaves key opinion leaders to be defined by competent authorities from time to time, sets every fine at VARA’s sole and absolute discretion, and allows the fines schedule itself to be amended by Directive at any time. The structure is settled. The edges are deliberately kept in VARA’s hands, and a firm planning near an edge is planning inside VARA’s discretion rather than inside a published line.
One boundary of this article is a hand-off. The conduct standard obliges all in-scope marketing to comply with federal law on advertising, data protection and consumer protection, without naming the instruments. The data-protection instrument was identified in Section IV as the Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, verified in force with its Executive Regulations still pending. The advertising and consumer-protection instruments, and the wider federal layer that stands behind the VARA framework, including the federal AML legislation, are the subject of the companion article “Which federal laws stand behind a VARA licence?”, where each instrument is identified and verified against the federal register in its own right.
This analysis rests on the Regulations on the Marketing of Virtual Assets and Related Activities 2024 in their original version, effective 1 October 2024, read together with VARA’s accompanying Guidance, which is indicative and non-binding. Each is live. A new version of the Marketing Regulations, any Directive touching the fines schedule, which can move the tariff without a new version of the instrument, an update to the Guidance, or the issue of the Personal Data Protection Law’s Executive Regulations would each be a reason to read this analysis again against the source.
For your facts, in confidence, put the question to the firm.
The bench stands behind it