Executive Summary
- The hypothetical Hong Kong exchange should not launch one unrestricted global campaign. It can share substantiated source material, but each communication needs a lawful route. EU customers must receive services from the correctly authorised entity; UK promotions need a route under the financial-promotion restriction. (Financial Services and Markets Act 2000, s. 21; Regulation (EU) 2023/1114, arts. 59, 65–66.)
- The exchange retains responsibility for its campaign, while affiliates can incur their own liability. An AI supplier does not become the legal promoter merely by supplying software. Responsibility depends on who communicates, causes publication, provides the service or acts for the advertiser. (Financial Services and Markets Act 2000, s. 21(1), (13); Regulation (EU) 2023/1114, arts. 66, 73.)
- Centrally approved static country versions provide the recommended starting point. Human-approved AI variants can follow if the exact output, audience and destination are fixed before release. Approval of a prompt cannot establish the content of later generated ads. Uncontrolled publication and affiliate amendments should be excluded from this retail launch. (FCA Handbook, COBS 4.10; Regulation (EU) 2023/1114, arts. 66, 68.)
- A service advertisement and token-offer marketing require different checks. MiCA Article 66 governs a crypto-asset service provider's communications. Article 7 adds requirements for marketing relating to a token offer or admission to trading. Neither an EU authorisation nor a notified white paper constitutes regulatory approval of every advertisement. (Regulation (EU) 2023/1114, arts. 7–8, 66.)
- The Hong Kong operator should advertise its permitted services without promoting a particular token. The SFC's platform guidance prohibits advertisements for a specific virtual asset and requires overseas marketing to respect local restrictions. A group affiliate cannot cure a prohibited campaign by changing its label. (SFC, Guidelines for Virtual Asset Trading Platform Operators, paras. 9.3, 9.18.)
- Launch France and Germany through a French-established MiCA provider only after the relevant authorisation and German cross-border notification. Keep UK acquisition closed until a documented UK promotion route and compliant customer journey are ready. A functioning sign-up link must lead to the entity entitled to serve that customer. (Regulation (EU) 2023/1114, arts. 59, 61, 65; Financial Services and Markets Act 2000, s. 21; FCA Handbook, COBS 4.12A.)
- Stop any version that introduces an unsupported return, removes a material warning, contradicts the governing documents or defeats a country restriction. AI disclosures depend on the actual content and use. Ordinary advertising duties continue whether the copy originated with a person or a model. (FCA Handbook, COBS 4.2.1R; Regulation (EU) 2023/1114, arts. 7, 66; Regulation (EU) 2024/1689, art. 50.)
The product and publication methods
The product comprises order-book spot trading in the fictional Case Six Token and a hosted wallet. The operator controls customers' private keys. Customers receive no staking, lending, leverage, derivatives or promised yield. The token is transferable and fungible, has an identifiable issuer, and confers no equity, debt, profit-sharing or redemption rights. It has no value peg. The case treats it as a non-security cryptoasset, issued before 2026 and first admitted to EU trading in 2026. The required issuer documentation and separate Hong Kong retail-admission conditions must be satisfied before launch.
The proposed audience consists of adults resident in the UK, France or Germany. Retail customers are central to the analysis. A notice calling every visitor a professional investor would not change that audience. Nor would describing a sales page as education determine its legal classification. The words, presentation, intended recipients and linked transaction determine the applicable rules. (Financial Services and Markets Act 2000, s. 21; Regulation (EU) 2023/1114, arts. 3(1)(12), 4, 61.)
Three publication methods produce different control problems. Under method A, the exchange approves static country versions centrally before release. Under method B, AI generates alternatives, but a human reviewer approves each captured version before publication. Under method C, AI publishes automatically or an affiliate changes the copy after approval. The core claim, risk wording and commercial arrangement otherwise remain the same.
For the proposed EU launch, a French-established subsidiary would become the actual trading and custody provider. This is a recommended change to the offshore arrangement. The Hong Kong marketing team could supply factual material under controlled instructions, while the EU provider controls its own campaign and customer contracts. Merely inserting the subsidiary's name into an offshore onboarding page would not achieve that result. (Regulation (EU) 2023/1114, arts. 59(2), (5)–(6), 65, 73.)
Hong Kong obligations restrict the source campaign
The Hong Kong operator needs the permissions applicable to its home activity. The SFC regulates centralised virtual asset trading platforms under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. The case proceeds on the express premise that the operator holds the necessary home permissions. A home permission gives no exemption from UK or EU requirements. The SFC also expects overseas activities conducted for the operator to comply with the destination's rules. (SFC, Guidelines for Virtual Asset Trading Platform Operators, paras. 1.1–1.8, 3.7(g)(vii), 9.3.)
The SFC's distinction between factual token information and token advertising changes the proposed creative. Paragraph 9.18 requires product-specific material to be factual, fair and balanced, and prohibits advertisements connected with a specific virtual asset. The recommended campaign therefore describes the exchange and wallet service. A token information page should explain the asset's features and risks without a featured-token sales pitch. A claim urging customers to buy Case Six Token for a return would fail this home review before translation. (SFC, Guidelines for Virtual Asset Trading Platform Operators, paras. 9.17–9.18, 9.25–9.26.)
These SFC guidelines carry supervisory consequences. Their breach alone does not create a standalone statutory offence, although the SFC can consider non-compliance in assessing fitness and properness. The group must assess whether a campaign is the licensed operator's activity, including conduct undertaken on its behalf. Allocating an EU campaign to a separate company does not remove duties attached to the Hong Kong operator's actual participation. (SFC, Guidelines for Virtual Asset Trading Platform Operators, paras. 1.5–1.8, 3.7.)
UK crypto financial promotions require a lawful communication route
A sales invitation to UK consumers to trade this token is a crypto financial promotion. Section 21 restricts invitations or inducements, communicated in the course of business, to engage in investment activity. The Financial Promotion Order brings qualifying cryptoassets within the controlled-investment categories. Case Six Token meets the assumed transferable and fungible characteristics and lacks the excluded security or electronic-money features. Its non-security status therefore does not remove the campaign from section 21. (Financial Services and Markets Act 2000, s. 21(1), (8); Financial Services and Markets Act 2000 (Financial Promotion) Order 2005, SI 2005/1529, Sch. 1, paras. 3–4, 26F.)
A landing page inviting trading, a video recommending purchase and an affiliate's sign-up post can each communicate an inducement. A commercial app-store description can do the same. A factual wallet-security explanation may fall outside the restriction if it contains no relevant invitation or inducement. The combined trading-and-wallet sales journey in this case is captured through the trading promotion; it should not be analysed as a standalone custody notice. (Financial Services and Markets Act 2000, s. 21; Financial Promotion Order 2005, Sch. 1, paras. 3–4, 6, 26F; FCA, FG24/1, Financial promotions on social media.)
There are four principal routes: communication by an authorised person; communication of content approved by an authorised person; the qualifying FCA anti-money-laundering registration exemption; or another applicable Financial Promotion Order exemption. The selected route must cover the actual communicator and communication. A payment-services or electronic-money authorisation alone does not make its holder an authorised person for section 21. (Financial Services and Markets Act 2000, s. 21(2); Financial Promotion Order 2005, art. 73ZA; FCA, Cryptoasset firms marketing to UK consumers, Communication routes.)
For this launch, the recommended UK route is approval by an appropriately permitted FCA-authorised firm. Its permission must cover approval of the relevant crypto promotions, unless a specific statutory approver exemption applies. Section 55NA restricts authorised firms' approval of other persons' promotions. The exchange's marketing director, local lawyer or AI reviewer cannot supply statutory approval merely by checking the copy. They can prepare and review it for the authorised firm. (Financial Services and Markets Act 2000, ss. 21(2)(b), 55NA; Financial Services and Markets Act 2000 (Exemptions from Financial Promotion General Requirement) Regulations 2023, SI 2023/966, reg. 3.)
The registration route needs particular care with affiliates. Article 73ZA can cover a non-real-time communication made on behalf of an FCA-registered person where that registered person prepared its content. It is not a general power to approve other businesses' promotions. An affiliate posting the prepared version may satisfy that condition. Adding a return claim or rewriting the inducement requires a fresh assessment; the exchange cannot assume its registration protects the altered post. Registration of another group company is also insufficient. (Financial Promotion Order 2005, art. 73ZA.)
The high-net-worth and self-certified sophisticated investor exemptions in Articles 48 and 50A do not cover this ordinary qualifying cryptoasset. Retail categorisation under the FCA rules is a separate requirement. For this mixed public audience, the exchange should use the documented approval route. UK service permissions and any required anti-money-laundering registration remain separate from approval of the advertising. (Financial Services and Markets Act 2000, s. 21; Financial Promotion Order 2005, arts. 48, 50A, 73ZA; FCA Handbook, COBS 4.12A.22R.)
UK approval must cover the customer journey
The UK version must be fair, clear and not misleading, with balanced benefits and risks. Approval covers the rendered communication: spoken words, captions, images, warnings, visible links and destination. The relevant approval legend must identify the approver and approval date. The rules permit a linked approver-reference disclosure where the digital format meets their conditions. A short video cannot rely on a warning that disappears in a crop or appears only after the viewer clicks. FCA social-media guidance explains these format requirements. (FCA Handbook, COBS 4.2.1R, 4.5.2R(1)–(1A), 4.5.2AR, 4.12A; FCA, FG24/1.)
The prescribed crypto risk warning and linked risk summary need the presentation required by COBS 4.12A. Website and app warnings must remain statically fixed at the top of the screen, including relevant linked pages. A shortened warning is available only within the rule's conditions for third-party character constraints. The publisher should assess the intended audience's language and use appropriate additional translations where English would not be understood. Translation must preserve the warning's force. (FCA Handbook, COBS 4.12A.10R–4.12A.11R, 4.12A.36R–4.12A.38R, 4.12A.41G.)
A promotion can be a direct-offer financial promotion if it offers a controlled agreement, or invites an offer to enter one, and includes a specified response mechanism. A sign-up link must therefore be reviewed with the complete acquisition sequence. For a first-time customer, the relevant rules require a personalised risk warning and a 24-hour cooling-off stage before communication of the direct offer. Client categorisation and an appropriateness assessment must occur at their prescribed stages. A generic account-creation label cannot justify immediate investment access. (FCA Handbook, Glossary, direct-offer financial promotion; COBS 4.12A.15R, 4.12A.18R, 4.12A.20R–4.12A.22R, 4.12A.28R.)
The exchange should remove new-customer trading bonuses and consumer refer-a-friend rewards from the UK proposition. COBS 4.12A prohibits monetary and non-monetary incentives to invest in qualifying cryptoassets. Payment to a commercial affiliate for advertising is a different arrangement, but it neither authorises the affiliate's post nor permits a prohibited customer reward. The actual compensation and customer offer require separate review. (FCA Handbook, COBS 4.12A.7R–4.12A.9G; FCA, FG23/3.)
The approver must have the competence and expertise to assess the promotion and check continuing compliance. Its process must include recurring written attestations from the unauthorised person responsible for the promotion's overall content. A change that affects its approved meaning or operation must return for review. If a live promotion ceases to comply, the approver must withdraw approval and notify the relevant person as required. The exchange must then stop distribution across its own and affiliate channels and address applicable FCA reporting. (FCA Handbook, COBS 4.10.2R(1A)–(1C), 4.10.2R(2), 4.10.3G(6), 4.10.9AR; SUP 16.31.)
EU service permission does not approve the advertising
The French subsidiary needs authorisation for the services it actually supplies. Operating a multilateral order book and controlling customers' wallet keys engage separate MiCA services: operation of a trading platform and custody and administration. Dealing as principal against customers instead changes the permission analysis. Calling the business an exchange does not identify its authorised activities. (Regulation (EU) 2023/1114, arts. 3(1)(16)–(19), 59.)
An Article 63-authorised CASP must have the EU establishment and management required by Article 59. Before serving Germany, the French firm must complete the Article 65 cross-border procedure for the relevant services. It may start from receipt of the home authority's communication under Article 65(3) or, at the latest, on the fifteenth calendar day after submission under Article 65(4). Neither step approves the wording of a German advertisement. (Regulation (EU) 2023/1114, arts. 59(2), (6), 65.)
The October 2026 launch cannot rely on the former CASP transition. MiCA's maximum CASP transitional period ended on 1 July 2026. An offshore company cannot obtain the subsidiary's permission through a common logo, common shareholders or a redirect. The EU customer must contract with, trade through and receive custody from the entitled provider, within its actual service arrangements. (Regulation (EU) 2023/1114, arts. 59, 65, 143(3); ESMA, ESMA75-113276571-1710, 23 June 2026.)
Article 66 governs the CASP's information to clients and prospective clients. It requires marketing to be identified, fair, clear and not misleading. The CASP must warn clients about transaction risks and publish prominent information about costs and fees. Specified services also require access through hyperlinks to a MiCA white paper where one is required. A hosted-wallet ad must accurately explain custody and access; it must not suggest deposit protection or guaranteed recovery that the product does not provide. (Regulation (EU) 2023/1114, art. 66(1)–(4); European Commission, answer to ESMA_QA_2552, 18 February 2026.)
Token-offer marketing adds a separate publication sequence
Article 7 applies when a communication markets a token public offer or admission to trading. MiCA defines a public offer by the information supplied about the offer and asset, sufficient for a prospective holder to decide whether to purchase. A short promotional post can relate to an offer even if it omits those terms itself. The post, landing page, white paper and transaction path must be assessed together. A sign-up link is relevant evidence, although the link alone does not prove a public offer. (Regulation (EU) 2023/1114, arts. 3(1)(12), 7.)
The identifiable issuer and 2026 admission in this case make the ordinary Title II analysis relevant. Small-offer exemptions have precise limits; announcing intended admission can remove them. Tokens without an identifiable issuer present a different white-paper analysis. The Commission has explained that MiCA does not require a platform to create a Title II white paper for such a token merely because it admits it. Those distinctions prevent a service or token label from becoming an automatic answer. (Regulation (EU) 2023/1114, arts. 4–5, 143(2); European Commission, answer to ESMA_QA_2552, 18 February 2026.)
Where Article 7 applies, the communication must identify its marketing character, remain fair and clear, and match the required white paper. It must include the prescribed white-paper availability and contact information. Its prominent statutory statement must explain the absence of competent-authority review or approval and identify the responsible offeror, admission applicant or platform operator as required. The service provider should not insert the issuer's name mechanically where another role applies. (Regulation (EU) 2023/1114, art. 7(1).)
A required white paper must precede dissemination of the related marketing. Its notification normally occurs at least 20 working days before publication, with the classification explanation and intended host states. Marketing is notified to the competent authorities on request. Article 8(3) expressly prohibits requiring prior regulatory approval of these Title II white papers or related marketing. The internal release process must distinguish a completed notification from an approval of content. (Regulation (EU) 2023/1114, arts. 7(2), 8, 9.)
White-paper language follows Article 6(9): the relevant official language or a language customary in international finance, within its home and host-state conditions. That permission does not remove national consumer-language duties for advertisements. The authority in the state where Article 7 marketing is disseminated can assess compliance. The French authorisation therefore does not settle whether each German communication satisfies applicable content requirements. (Regulation (EU) 2023/1114, arts. 6(9), 7(3).)
France and Germany need distinct country checks
For the French country version, the French-established advertiser must address the French-language requirement for offering and presenting services and for advertising. Material conditions, fees and risk language need a coherent French presentation. An English white paper does not by itself meet that separate advertising obligation. Misleading statements and material omissions also remain prohibited under the Consumer Code. (Loi n° 94-665 du 4 août 1994, art. 2; Code de la consommation, arts. L121-2–L121-3.)
France adds a rule directly relevant to the sign-up link. Article L222-16-1 restricts electronic advertisements that invite a person, through response or contact forms, to seek information or establish a relationship concerning crypto-asset services. Its MiCA authorisation exception must apply to the advertiser. A campaign owned by the unlicensed Hong Kong parent cannot simply borrow the French subsidiary's status for that form. The proposed French CASP must be the actual advertiser and service provider. (Code de la consommation, art. L222-16-1, second paragraph.)
A France-established commercial influencer must satisfy the specific restrictions on promoting crypto services and tokens. Commercial intent must be disclosed clearly. Where AI creates faces or silhouettes, the French influencer law also requires the specified virtual-image disclosure or an equivalent adapted to the medium. This duty is separate from the EU AI Act's deepfake test. Articles 4 and 5 are subject to a country-of-origin qualification for influencers established in another EEA state, so the same French rule cannot be applied to every German influencer without that analysis. (Loi n° 2023-451 du 9 juin 2023, arts. 4, 5, 5-1, 5-2.)
For the French commercial-influence arrangement, Article 8(III) makes the advertiser, its representative where relevant, influencer and influencer agent where relevant jointly liable for third-party harm caused in performing their contract. This statutory allocation makes the contract and each participant's role material. A private indemnity cannot remove that liability to the injured third party. (Loi n° 2023-451 du 9 juin 2023, art. 8(III).)
For Germany, misleading advantages, concealed costs and unclear commercial purpose engage the Unfair Competition Act. A German affiliate must disclose its advertising relationship and comply with applicable provider and commercial-communication identification rules. A principal can face cessation and injunction claims for infringements by employees or agents under section 8(2). A contract calling the affiliate independent does not decide whether it acts as an agent. (Gesetz gegen den unlauteren Wettbewerb, §§ 5, 5a, 8(2); Digitale-Dienste-Gesetz, §§ 5–6.)
There is no single rule in those provisions that makes every crypto advertisement unlawful merely because it uses English. For a German retail audience, German copy and comprehensible terms are the recommended design because the meaning of warnings and costs determines whether the presentation misleads. The review must also respect the country-of-origin rules for a French online provider and mandatory consumer-contract protections. It must not treat every German digital-service requirement as automatically cumulative with French requirements. (Gesetz gegen den unlauteren Wettbewerb, §§ 5, 5a; Digitale-Dienste-Gesetz, § 3; Regulation (EC) No 593/2008, art. 6.)
Changed rights require a new product classification
Adding debt, equity or collective-investment rights changes the legal analysis. A token that qualifies as a financial instrument falls outside MiCA's relevant product scope. Investment-service marketing then needs the MiFID II requirements and applicable national implementation. A securities public offer or regulated-market admission can also engage the Prospectus Regulation, including its advertising rules. The UK qualifying-cryptoasset definition excludes investments already caught by the ordinary controlled-investment categories. The exchange must suspend the creative and classify the changed rights before choosing permissions and promotion rules. (Regulation (EU) 2023/1114, art. 2(4)(a); Directive 2014/65/EU, art. 24(3); Regulation (EU) 2017/1129, arts. 1, 22; Financial Promotion Order 2005, Sch. 1, para. 26F(3)(a).)
Leverage, derivatives, stabilisation or promised yield also require a fresh review. Approval cannot make a prohibited retail derivative campaign lawful. The UK rules restrict in-scope firms' marketing of cryptoasset derivatives to retail clients. The selected spot-token campaign should contain no feature or wording that implies a different investment. Its October 2026 UK analysis uses the present promotion rules; substantive commencement of the new UK crypto regime is scheduled for 25 October 2027. (FCA Handbook, COBS 22.6.1R, 22.6.5R; Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, SI 2026/102, regs. 1, 42.)
Territorial reach follows publication and access evidence
A Hong Kong origin does not keep a communication outside UK law. Section 21(3) asks whether it is capable of having an effect in the UK. English alone is weak evidence of exclusive UK direction because it has many audiences. UK-specific wording, sterling references, paid UK delivery, local affiliates and a usable UK acquisition journey strengthen the connection. Actual investment is not required before the promotion restriction can apply. (Financial Services and Markets Act 2000, s. 21(3); Financial Promotion Order 2005, art. 12; FCA, FG24/1.)
Article 12 provides an exemption for communications received outside the UK or directed only outside it, subject to its terms. For the relevant overseas-sender deeming route, the systems must prevent excluded UK recipients from engaging in the promoted investment activity with the specified persons. The communication must also avoid reference or direct access from the sender's UK-directed promotion. Other circumstances can inform the direction assessment. A disclaimer and an unchecked country dropdown do not establish effective exclusion. (Financial Promotion Order 2005, art. 12(1), (3)(b)–(c), (4)(c)–(d).)
In the EU, the offshore provider's Article 61 exception depends on the client's exclusive initiative. Solicitation through a person acting on its behalf, or through a closely linked entity, defeats that basis. ESMA's guidance treats local-language promotion, search optimisation, social accounts, applications and affiliates as relevant evidence. A statement that every account was opened on the customer's initiative cannot reverse the acquisition facts. (Regulation (EU) 2023/1114, art. 61; ESMA, Guidelines on reverse solicitation under MiCA, ESMA35-1872330276-2030, paras. 11–28.)
Paid advertisements make the chosen market comparatively easy to identify through campaign settings and delivery reports. Organic posts need a different factual assessment. A compensated affiliate targeting French followers is soliciting through its channel even without paid distribution. A genuinely unsolicited, unpaid comment by an unrelated user is different. Mere incidental global availability does not conclusively settle the EU solicitation question. The operator's precautions and response to known reach matter. (Regulation (EU) 2023/1114, art. 61; ESMA, Guidelines on reverse solicitation under MiCA, paras. 11–17 and Annex.)
Authorities assess an accessible global website together with the operator's market-selection and access controls. App-store availability, local screenshots, search results, redirects and working account links can contradict a claimed exclusion. The recommended design removes excluded-country store availability and acquisition pages, blocks ineligible onboarding and tests direct, mobile and affiliate routes. It must also handle detectable location inconsistencies and attempts to bypass restrictions. IP location can be inaccurate; a VPN can disguise it. Multiple controls and investigation of exceptions provide stronger evidence than one location signal. (Financial Promotion Order 2005, art. 12; ESMA, Guidelines on reverse solicitation under MiCA, para. 16; SFC, Guidelines for Virtual Asset Trading Platform Operators, para. 9.3.)
Keep dated audience settings, country exclusions, placement and referral reports, page captures, redirect maps, store settings and test results. Record the contracting entity, accepted residence and reasons for blocked acquisition. Minimise personal data in that evidence. These records support a factual account of exclusion; they cannot prove that no person ever saw a screenshot. Continued conversions from a supposedly excluded market require an immediate investigation and stop decision.
Each publisher needs a named owner and stop authority
The exchange owns the source claim and the channels it controls. It may also cause an affiliate's promotion through instructions, payment and distribution arrangements. The affiliate remains responsible for its own commercial communication. Internal approval does not transfer those functions to the reviewer. Personal liability of individual staff depends on the applicable legal conditions; it does not follow automatically from appearing in an approval log. (Financial Services and Markets Act 2000, ss. 21, 25; Regulation (EU) 2023/1114, arts. 66, 68, 73.)
For the proposed EU service, the French CASP's management owns campaign compliance. Its compliance lead approves internal release after French and German legal and language checks. MiCA contains no general counterpart to the UK's external statutory advertising approver. Where an operational function is outsourced, Article 73 preserves the CASP's responsibility and requires suitable controls. An affiliate that places tokens, transmits orders or gives individual recommendations may itself cross a crypto-service boundary. A marketing-only contract cannot determine the classification of those acts. (Regulation (EU) 2023/1114, arts. 3(1)(22)–(24), 59, 66, 68, 73.)
For the website and app, the relevant operating entity owns the content; engineering controls publication and the acquisition switch. The local marketing lead selects the permitted audience, subject to compliance approval. For paid social, the operating entity should own the advertising account and retain administrator access, including when an agency operates it. Its media buyer can implement only the recorded placements and country settings. App-store copy requires the same release record as the landing page.
For an affiliate account, the affiliate owns publication and must disclose its commercial relationship. The contract should forbid independent claims, live improvisation, unapproved translations and sub-affiliates. It should require immediate removal, audit access and preservation of delivery evidence. The exchange must separately control the referral link and acquisition destination. If the affiliate refuses removal, the exchange can disable that route and seek platform removal while escalating the breach. Lost takedown access is itself a reason to suspend the channel.
The AI vendor ordinarily supplies a tool. If it also chooses audiences, changes claims or publishes content, its communication and data roles require review. A platform's decision to accept an advertisement supplies no statutory approval. The campaign owner must know who can edit, publish, target and stop every asset. A reviewer who can see only the script cannot approve an unseen rendered video or a changing destination. (Financial Services and Markets Act 2000, s. 21(13); Financial Promotion Order 2005, arts. 18(5), 18A; Regulation (EU) 2023/1114, arts. 66, 73.)
The five failure tests apply to all publication methods
An invented claim that Case Six Token delivers a guaranteed 12% annual return is incompatible with the defined no-yield product. Static approval under method A does not make that statement accurate. Method B must reject it before release. Under method C, publication creates an immediate live incident and may fall outside the UK approval's scope. A loss warning elsewhere cannot reconcile a guaranteed-return promise with the actual rights. Withdraw the claim, examine its source and search every language version for the same meaning. (FCA Handbook, COBS 4.2.1R, 4.5.2R; Regulation (EU) 2023/1114, arts. 7, 66; Code de la consommation, art. L121-2; Gesetz gegen den unlauteren Wettbewerb, § 5.)
An omitted risk warning can result from translation, subtitle cropping or platform formatting. Method A needs review of each placement, despite the centrally approved words. Method B needs the same rendered-output check. Method C must stop the affected creative and related formats that share the defect. The UK prescribed warning must satisfy its rules. EU service communications require fair risk presentation, while Article 7's additional prescribed statement applies where the token-marketing classification is met. The two regimes do not prescribe one interchangeable global warning. (FCA Handbook, COBS 4.12A.10R–4.12A.11R, 4.12A.36R–4.12A.38R, 4.12A.40R–4.12A.42R; Regulation (EU) 2023/1114, arts. 7, 66.)
A claim of instant, unrestricted withdrawal fails if the wallet terms permit withdrawal suspensions. A token claim also fails the Article 7 consistency requirement where the required white paper states otherwise. The reviewer must resolve the conflict with product and legal owners, then correct the relevant source and dependent variants. A translator cannot select the more attractive document. If a significant new factor or material error triggers MiCA Article 12, the responsible entity must follow its modification and notification sequence. Article 12(2) requires notification at least seven working days before publication of the modified material. Harmful marketing should remain suspended while that process runs. (FCA Handbook, COBS 4.2.1R; Regulation (EU) 2023/1114, arts. 7(1)(c), 12, 66.)
Incorrect targeting can make accurate copy unlawful for its actual audience. A static French asset sent to UK users still needs a UK route and applicable presentation. A human-approved German variant does not authorise an affiliate to acquire customers in another state. Under every method, stop the placement and determine whether its referral destinations and related campaigns share the targeting fault. Direct UK reach and continued EU solicitation undermine claims of exclusion or exclusive client initiative. (Financial Services and Markets Act 2000, s. 21; Financial Promotion Order 2005, art. 12; Regulation (EU) 2023/1114, arts. 59, 61, 65.)
A link that permits full onboarding exposes the difference between copy approval and operational control. For an excluded market, disable the acquisition path immediately. For the UK launch, check whether the journey communicates a direct offer and whether the relevant retail stages occur in order. For France and Germany, verify the provider's identity and permissions throughout the transaction. The same tests apply when an approved page redirects later or an affiliate substitutes its own link. Method B provides no protection if the approved output points to an uncontrolled flow. (FCA Handbook, COBS 4.12A.15R, 4.12A.18R, 4.12A.20R–4.12A.22R, 4.12A.28R; Regulation (EU) 2023/1114, arts. 59, 61, 65–66; Code de la consommation, art. L222-16-1.)
A release record must connect the claim to the published asset
Start with a claim register approved by the product owner. Each claim should identify its evidence, governing terms, relevant white-paper passage, permitted qualifications and review trigger. Fees require the actual schedule and calculation assumptions. Custody claims require the wallet contract and operational evidence. Performance assertions require an appropriate basis and presentation; the selected no-yield launch should omit forecasts and return promises. An affiliate's preferred wording is not substantiation. (FCA Handbook, COBS 4.2.1R, 4.5.2R; FCA, FG23/3, paras. 2.71–2.74; Regulation (EU) 2023/1114, arts. 7, 66.)
Next, legal review fixes the product classification, advertiser, service provider, audience and communication route. The French CASP records its service permissions and German notification. The UK approver confirms its own permitted scope and the content to be approved. Hong Kong compliance clears the source operator's participation. Country reviewers then check consumer law, language, advertising identification and any influencer conditions. These are separate decisions, even when coordinated in one system.
Approved translations should use a controlled glossary for return, risk, ownership, custody, access and fees. A competent reader of each language must compare the meaning against the source evidence. Templates should lock mandatory wording, qualifications, provider identity and permitted destinations. The model can propose text within those constraints, but it cannot determine that its own output complies. Check unsupported numbers, invented endorsements, altered certainty, missing negatives and misleading visual or spoken content.
Capture the complete release object: text, images, audio, subtitles, thumbnail, warning, language, destination, publisher, audience settings and expiry. Give it a unique version identifier and content hash. Link it to the prompt, template, model configuration, source evidence, reviewer and approval decision. These identifiers are recommended controls for proving what was reviewed. They do not replace the substantive assessment. A screening tool can assist triage; Atlas by Licentium describes that role. Its output is not the UK statutory approval or the EU provider's release decision.
Method A publishes only the recorded static asset. Method B adds a queue in which each complete generated output waits for the same review and release. Publishing staff must deploy the captured version and verify the live result. A change to a claim, warning, language, audience, provider or destination returns for review. A purely technical adjustment can follow a documented pre-authorised process only if it preserves the approved meaning, presentation and route. Method C's unrestricted generation and post-approval edits should remain disabled.
Affiliate onboarding comes after those controls work on owned channels. Contracts should state the approved entity and audience, compensation, exact assets, advertising disclosure, permitted links and withdrawal obligations. Monitor live placements against the approved version. Search for prohibited return language and unapproved domains; sample rendered mobile pages and videos in each language. Require the affiliate to supply its own targeting and publication records. An indemnity may allocate financial loss between parties, but it cannot prevent a regulator or consumer from applying the law to the responsible actor.
Retention needs a jurisdiction-specific schedule. UK rules generally require three years for these ordinary promotion and approval records, with five years for specified investor and alternative-risk-summary records. MiCA requires relevant CASP records for five years, extendable to seven at the competent authority's timely request. The Hong Kong operator should retain evidence of compliance with the SFC's platform guidelines for at least seven years. The group can adopt a justified common archive for non-personal campaign material, while keeping personal logs only as long as their purposes require. Public white-paper and modification histories have separate MiCA publication duties. (FCA Handbook, COBS 4.11.1R, 4.11.5R–4.11.8R; Regulation (EU) 2023/1114, arts. 9, 12, 68(9); Regulation (EU) 2016/679, art. 5(1)(e); SFC, Guidelines for Virtual Asset Trading Platform Operators, para. 14.7(m).)
MiCA's binding recordkeeping standards also require each non-oral marketing communication issued by the CASP or on its behalf to be retained. Records must be accessible, reconstructable and protected against manipulation, with amendments and previous content visible. (Commission Delegated Regulation (EU) 2025/1140, art. 2, Annex, section 1.)
AI and data duties depend on what the campaign does
Using AI to rewrite approved service copy creates no universal visible-label duty under the AI Act. The exchange ordinarily deploys the vendor's system; developing or commissioning a system under its own name can change that role. Article 50 distinguishes direct AI interaction, provider marking of synthetic outputs, deepfake disclosure and specified public-interest text. Hong Kong deployment can fall within the Act where the output is used in the EU. Providers and deployers within the Act's scope must also take measures supporting the development of AI literacy among staff and others operating or using AI on their behalf, tailored to their technical knowledge, experience, education and training, the use context and the people affected. Article 4 does not require a guaranteed individual level of literacy. (Regulation (EU) 2024/1689, arts. 2(1)(c), 3(3)–(4), 4(1), 50, as amended by Regulation (EU) 2026/1744.)
A video that falsely makes an existing person appear to endorse the exchange can meet the deepfake definition and require disclosure. The human-review exception for public-interest text does not exempt that video. For generated text published to inform the public on matters of public interest, the exception requires human review or editorial control and a natural or legal person with editorial responsibility. Ordinary promotional copy must first meet the actual purpose test. French influencer disclosure for generated faces or silhouettes requires its own assessment. (Regulation (EU) 2024/1689, arts. 3(60), 50(4)–(6); Loi n° 2023-451 du 9 juin 2023, art. 5.)
Provider duties for machine-readable marking remain distinct from labels visible to viewers. Article 50(2) excludes standard assistive editing and operations that do not substantially alter the deployer's input or its semantics. The limited transition gives providers of relevant systems placed on the market before 2 August 2026 until 2 December 2026 to comply with that paragraph. It does not defer the deployer's Article 50(4) obligations. The campaign must establish the actual system and role before relying on that transition, and preserve applicable marking through its publishing process. (Regulation (EU) 2024/1689, arts. 50(2), 111(4), 113, as amended by Regulation (EU) 2026/1744.)
Consumer law independently prohibits misleading commercial presentation. In the UK, the current general regime is Part 4 of the Digital Markets, Competition and Consumers Act 2024. Concealed commercial intent, false approval claims and fabricated customer reviews can engage its prohibitions. An AI-generated testimonial should not be presented as a real customer's experience. Similar accuracy and commercial-identification duties apply to the French and German campaign. An AI label cannot cure a fabricated endorsement. (Digital Markets, Competition and Consumers Act 2024, ss. 225–227, Sch. 20, paras. 4, 12–13, 25; Code de la consommation, arts. L121-2–L121-3; Gesetz gegen den unlauteren Wettbewerb, §§ 5, 5a.)
The initial model prompts should contain approved product material without customer data. The campaign still processes personal data through identifiable location, account and access records. Each purpose needs an appropriate legal basis, clear information, limited retention and access controls. The actual decisions about purposes and means determine whether the CASP, parent, affiliate or ad platform is a controller or joint controller. A vendor is a processor only for processing on documented instructions. Common ownership does not settle those roles. (Regulation (EU) 2016/679, arts. 2–6, 13, 26, 28; UK GDPR, arts. 3–6, 13, 28.)
Access by a separate Hong Kong parent or overseas vendor to the EU provider's personal data requires a transfer assessment and applicable Chapter V safeguards. An employee of the same controller working abroad does not automatically create that separate-recipient transfer. UK transfers require their own analysis under the amended UK provisions. The group should map actual recipients and locations before enabling remote access or sending data to a model. (Regulation (EU) 2016/679, arts. 44–46; EDPB, Guidelines 05/2021, version 2, paras. 9–12 and Examples 8, 11; UK GDPR, arts. 44A, 45A, 46.)
Launch without behavioural retargeting, customer-list uploads or optional advertising pixels. If those features are added, complete the relevant national cookie, electronic-marketing and profiling checks first. In the UK, advertising storage or access does not become consent-free merely because the advertisement is contextual. AI use alone does not establish an EU duty to conduct a data-protection impact assessment or invoke the automated-decision rules. High-risk processing or solely automated decisions with legal or similarly significant effects need their respective assessments. (Privacy and Electronic Communications Regulations 2003, SI 2003/2426, reg. 6, Sch. A1; Regulation (EU) 2016/679, arts. 21–22, 35.)
Launch and withdrawal decisions must remain enforceable
Launch method A first: French and German service pages, fixed short videos and owned social posts for adult residents. The French subsidiary must hold the correct MiCA permissions and complete the German procedure. Clear the Hong Kong operator's involvement, required token documentation, country language and consumer checks before publication. Keep token purchase claims out of the source campaign. Start with owned channels; add paid placements and contracted affiliates only after their targeting, rendered formats and removal controls pass the same process.
Keep UK acquisition closed until the selected FCA-authorised approver covers the final UK communications and their actual distribution. Confirm any separate permissions required by the UK service model. Test the warnings, first-time retail stages and investment links before enabling conversion. Use one shared production system with separate country releases, named owners and revocable access. Method B can follow when it demonstrably preserves those controls for every output. No approval should authorise unrestricted future model generations.
Give compliance authority to order immediate suspension and engineering authority to execute it without waiting for a commercial meeting. Stop on an unsupported return, lost warning, unresolved source conflict, wrong country, changed provider, expired approval or permission, bypassed onboarding gate, unauthorised affiliate edit or inability to remove an asset. Quarantine all variants affected by the same source, template or redirect. Preserve the original evidence, identify exposed customers, assess corrections and complaints, and record the decision to resume.
The UK approver must follow its withdrawal and reporting obligations. Current SUP 16.31 includes qualifying seven-day approval notifications during the relevant initial period or for direct-offer promotions, and reporting of concerns-driven amendments or withdrawals. MiCA's Article 12 notification sequence applies where the Article 12(1) modification trigger is met; Article 94 gives authorities powers to suspend or prohibit relevant marketing and services. These are specific legal processes. They should run alongside the immediate operational stop. (FCA Handbook, COBS 4.10, SUP 16.31.5R–16.31.7R; Regulation (EU) 2023/1114, arts. 12, 94.)
The strongest adverse case is continued acquisition through supposedly independent affiliates after the firm claims to have excluded a market. Payment records, local scripts, dynamic pages, referral commissions and completed onboarding can show the continuing arrangement. UK law reaches causing a communication; MiCA expressly addresses solicitation on behalf of the offshore firm and by closely linked entities. Disclaimers do not displace those facts. (Financial Services and Markets Act 2000, s. 21(13); Regulation (EU) 2023/1114, art. 61.)
That conduct can expose the actual communicators to the UK section 21 offence where its conditions are met, and can affect resulting agreements under section 30. EU authorities can use MiCA's enforcement powers and applicable national remedies. White-paper liability under Article 15 has its own information, loss and causation conditions; it is not automatic liability for every advertisement or trading loss. The campaign should resume only after the responsible provider and, for the selected UK route, its lawful approver accept a corrected, testable release. (Financial Services and Markets Act 2000, ss. 25, 30; Regulation (EU) 2023/1114, arts. 15, 94, 111; Gesetz gegen den unlauteren Wettbewerb, § 8.)