What Legal Counsel for Token Issuers Actually Means
Token issuers face a compressed legal lifecycle that begins before a line of code is written. The central question – whether a token constitutes a security, an e-money instrument, or something else entirely – determines every subsequent decision: entity formation, jurisdiction selection, exchange listing eligibility, banking access, and the content of any public disclosure. Getting that classification wrong does not merely slow a launch. It converts a product release into an unregistered securities offering, with enforcement exposure that follows the founder across borders.
Legal counsel for token issuers spans the full arc from classification analysis and pre-launch structuring, through token offering documentation and regulatory filings, to post-launch compliance, exchange negotiations, and dispute resolution. At OBOLUS, we work through every stage of that arc with issuers, founding teams, and the funds backing them – advising on token classification, applicable securities law obligations, whitepaper obligations under applicable regimes, and the cross-border entity stacks that determine where risk actually sits.
This page maps the legal lifecycle for a token issuer: where each risk bites, which regimes govern it, and how the structure of counsel engagement shifts as a project moves from concept to market.
The Classification Problem: Why a Label Alone Is Not Enough
Token classification is determined by the substance of the rights a token confers, not by the name printed on the whitepaper. Calling a token a "utility token" does not make it one. Regulators in every major jurisdiction apply a substance-over-form analysis: what can the holder do with the token, what financial return – if any – is expected, and is that return dependent on the efforts of others?
Under MiCA (the EU's Markets in Crypto-Assets Regulation, enforced by ESMA and national competent authorities), the classification analysis is now codified. A token that qualifies as an asset-referenced token (ART) or an e-money token (EMT) draws a distinct issuer-authorisation requirement and reserve obligations. A token that falls outside those categories but is not a financial instrument under existing EU law sits in the "other crypto-assets" bucket and triggers the MiCA whitepaper regime. A token that is a financial instrument remains governed by existing EU securities law – and MiCA does not apply.
The Hong Kong SFC (Securities and Futures Commission) applies its own securities law test, with the consequence that a token representing a share in profits or a managed scheme will be treated as a collective investment scheme interest regardless of how it is marketed. Singapore's MAS (Monetary Authority of Singapore) takes a similar analytical approach under its Payment Services Act and existing securities statutes. In the United States, the SEC's application of the Howey test to tokens remains the operative standard at the federal level, while state money-transmitter rules may layer on independently.
In our cross-border practice, we see founders routinely surprised that a token structure acceptable in one jurisdiction becomes a securities product the moment it is offered to users in another. The classification analysis must be run against each relevant target market, not just the issuer's home jurisdiction.
A common assumption is that a utility label on a whitepaper settles the legal classification. It does not. Regulators read the token's mechanics, the economic rights it conveys, and – critically – the marketing materials that surrounded the offering. We assess classification against the substance of rights, not the label assigned to them.
If your team is assessing classification before the token design is finalised, the analysis is faster and the structural options are wider. The further a design progresses without legal input, the more constrained the remediation becomes. To map your token's classification exposure across relevant target markets, contact OBOLUS at info@oboluslaw.com.
Entity Structure and Jurisdiction Selection for Token Issuers
The entity that issues a token bears the legal relationship with holders – and that entity's jurisdiction of incorporation, its regulatory status, and its banking relationships together determine what the issuer can legally do and where enforcement risk concentrates.
Token issuers typically consider a layered structure: a foundation or non-profit entity for protocol-level activity in one jurisdiction, an operating company for commercial activities in a second, and potentially a regulated entity in a third where the token offering reaches a supervised market. The BVI and Cayman Islands remain common choices for the foundation or holding layer, offering established corporate law frameworks and familiarity among institutional counterparties. Both the BVI FSC (under the VASP Act 2022) and CIMA in the Cayman Islands now apply VASP registration and licensing requirements to entities providing qualifying virtual asset services, which must be factored into the structure.
For issuers targeting European distribution, the MiCA passporting mechanism is structurally significant. A CASP (Crypto-Asset Service Provider) authorisation obtained in one EU member state allows the issuer to passport services across the EU/EEA. Lithuania's Bank of Lithuania and Malta's MFSA have both been entry points for this route, each with distinct regulatory postures as the transition to MiCA CASP authorisation matures.
For issuers targeting Asian markets, Singapore and Hong Kong present distinct but complementary options. MAS licensing under the Payment Services Act and SFC authorisation under Hong Kong's VASP licensing regime each serve different activity profiles. In our practice, we regularly advise on how the choice between these hubs interacts with exchange listing requirements, banking access, and the domicile preferences of institutional lead investors.
The cross-border reality for most token issuers is that no single jurisdiction solves every problem. The entity layer that optimises for EU passporting may not optimise for Cayman-fund investment or US investor exclusions. Structure must be modelled against the issuer's actual user base, the exchanges on which the token will list, and the investors who will participate in any pre-launch sale.
What Does a Token Offering Require Legally?
A token offering – whether a private sale, a public launch, or a structured listing event – carries distinct legal requirements that vary by the classification of the token, the identity of the offerees, and the jurisdictions in which the offer is made or received.
Under MiCA, issuers of "other crypto-assets" (those not qualifying as ARTs or EMTs) must prepare and publish a crypto-asset whitepaper before offering to the public in the EU. The whitepaper must contain prescribed disclosures about the issuer, the token's rights and obligations, the underlying technology, and risk factors. ESMA has published guidance on the content standards applicable. Importantly, MiCA imposes liability on the issuer for material inaccuracies in the whitepaper – a provision that has direct implications for how technical claims, roadmap commitments, and tokenomics disclosures are drafted.
Where the token is classified as a security or financial instrument – which may occur in parallel across multiple jurisdictions even where MiCA applies in the EU – the offering triggers prospectus or offering-document requirements under local securities law. In the United States, the SEC's position means that tokens constituting investment contracts may only be offered pursuant to an available exemption from registration (Regulation D, Regulation S, or others), and the mechanics of those exemptions shape who may participate, on what terms, and with what subsequent resale restrictions.
Private sale structures – often called SAFTs (Simple Agreements for Future Tokens) – require careful drafting. The SAFT is a contract between the issuer and the investor; its enforceability, the investor's rights upon delivery of tokens, and its interaction with the token's final classification all require legal review specific to the governing law chosen and the investor's home jurisdiction.
Beyond the offering document itself, a token launch typically requires: AML/KYC procedures for participants in the sale (required under FATF Recommendation 15 and applicable VASP regulations), a legal opinion on token classification, exchange listing agreements reviewed for liability allocation and lock-up mechanics, and, where smart contracts govern distribution, a technical audit that interfaces with the legal disclosure.
The Travel Rule and Ongoing AML Obligations for Token Issuers
The Travel Rule – the obligation under FATF standards to pass originator and beneficiary data with a qualifying virtual asset transfer – imposes compliance infrastructure requirements on token issuers who also operate wallet services, staking platforms, or any transfer function. The rule applies to the VASP conducting the transfer, but the issuer who builds those functions into a token's smart-contract or platform architecture bears responsibility for ensuring the architecture supports compliance.
Under MiCA and the EU's Transfer of Funds Regulation (which now extends to crypto-assets), the data obligation applies above a threshold set by the applicable regime for each transfer. Operators we advise routinely underestimate the operational cost of implementing Travel Rule compliance across multiple VASP counterparties, particularly where the token trades on exchanges in jurisdictions with differing data-format standards.
For issuers who conduct a public sale, AML/KYC obligations attach at the point of accepting funds. The classification of the sale – whether conducted by the issuer directly or through a regulated intermediary – determines whose licence and whose AML programme governs the transaction. Structuring the sale through a regulated entity does not remove the issuer's own exposure if it remains the counterparty for proceeds.
FINMA in Switzerland has developed a pragmatic but detailed AML framework for token issuers, particularly relevant for issuers using Swiss foundations. The FCA's financial-promotion regime in the UK applies to communications inviting participation in a token offering where those communications are made to UK persons, and the FCA's cryptoasset registration requirement under the Money Laundering Regulations is a separate overlay for any entity providing qualifying cryptoasset activities to UK users.
If a prior application stalled, a public sale was structured without full AML coverage, or an exchange delisted a token citing compliance concerns, the structural reason is usually identifiable. To pressure-test your compliance architecture or restructure a sale programme, write to OBOLUS at info@oboluslaw.com.
Decision Matrix: Which Legal Path Fits Your Token Profile?
The right legal path for a token issuer depends on the combination of token type, target market, and stage of the project. The following profiles describe how the analysis typically maps.
Profile A – Protocol token targeting EU retail distribution. The issuer needs a classification opinion first. If the token falls outside the ART/EMT categories and is not a financial instrument, MiCA's "other crypto-assets" whitepaper regime applies. A CASP authorisation in an EU member state with passporting capability – or reliance on an authorised intermediary – determines whether the issuer itself needs a licence. Timeline to a compliant public EU launch is likely a matter of months, depending on the member state chosen and whether prior regulatory engagement is required. Key risk: a post-launch reclassification as a financial instrument by a national competent authority.
Profile B – Security token or tokenised asset targeting institutional investors. Securities law in each target jurisdiction governs. A private placement using available exemptions (Regulation D for US investors, equivalent exemptions in the EU, UK, and Singapore) is the typical route. The offering document must comply with the most restrictive applicable regime. Timeline is driven by documentation, legal opinion production, and investor KYC – typically several months from instruction to close. Key risk: a broader distribution than the exemptions permit, including secondary market sales.
Profile C – Protocol token with US investor exclusion and Asian primary market. The issuer structures around an offshore foundation (BVI or Cayman), with a Regulation S framework for the initial distribution and an exchange listing on a platform holding SFC or MAS authorisation. US person restrictions must be technically enforced, not merely disclaimed. Key risk: US persons acquiring tokens through secondary markets and the issuer being deemed to have facilitated an unregistered US distribution.
Profile D – Airdrop or token-distribution event to existing community. Airdrops raise classification issues in their own right – distributing a token that is a security without registration or an available exemption is an offering, regardless of the absence of payment by the recipient. We have seen regulators in multiple jurisdictions take enforcement action against airdrop programmes on this basis. Structure, eligibility criteria, and jurisdictional exclusions matter.
Exchange Listings and Secondary Market Access
Exchange listing is a distinct legal event, not merely a commercial milestone. The listing agreement between the issuer and the exchange allocates liability for token-related claims, sets lock-up periods for founding team allocations, governs delistment rights, and in some cases requires issuer representations about the token's regulatory status that have legal consequences if inaccurate.
In Hong Kong, the SFC's VASP licensing regime for virtual-asset trading platforms (VATPs) now requires licensed exchanges to conduct due diligence on tokens listed for retail trading. An issuer seeking a Hong Kong retail listing must be prepared to engage with that due diligence process, which includes legal-opinion-level analysis of the token's classification and issuer compliance posture. In our practice, we regularly advise issuers preparing that documentation package for exchange review.
In Singapore, MAS-regulated exchanges apply their own listing criteria, which interact with the Payment Services Act's digital payment token licensing framework. A token that triggers securities law treatment under Singaporean law cannot be listed on a DPT-only licensed exchange without separate regulatory authorisation.
The VARA regime in Dubai has introduced exchange-licence categories that are activity-specific. An issuer targeting the Dubai market through a VARA-licensed exchange must understand which of VARA's rulebook provisions apply to the exchange's listing process and what those provisions require of the issuer in terms of disclosure and ongoing reporting.
A micro-matter from recent practice: in the latter part of last year, a token issuer preparing for a dual listing in two Asia-Pacific markets discovered that its existing entity structure – a Cayman foundation with a BVI operating subsidiary – did not satisfy the compliance representation requirements of either exchange's listing agreement. We restructured the entity layer, obtained an updated classification opinion, and coordinated the documentation with allied counsel in the relevant jurisdiction. The listing proceeded on a revised timeline without requiring changes to the token's underlying smart-contract architecture.
Post-Launch Compliance and Dispute Readiness
The legal work for a token issuer does not end at launch. Post-launch obligations include ongoing whitepaper update requirements under MiCA where material information changes, periodic regulatory reporting under applicable VASP regimes, AML/KYC maintenance for any issuer-operated platform, and monitoring of secondary-market activity that might indicate a market-manipulation or front-running exposure.
Token issuers are also regular defendants and claimants in disputes. Founders dispute equity and token allocations. Early investors assert rights under SAFTs where delivery has been delayed or the delivered token diverges from what was described. Exchanges bring claims against issuers for reputational damage following a token's collapse or delisting event. Smart-contract exploits raise questions about whether the issuer bears legal responsibility to affected holders – a question that turns on the governing law of the token relationship and the representations made in the whitepaper.
On the recovery side, token issuers who suffer misappropriation of treasury assets – whether through an insider exploit, an exchange insolvency, or an external hack – need to act within hours. The recovery tools available – disclosure orders from courts in England and Wales, injunctions in Hong Kong, proprietary remedies in Singapore, and stablecoin freezes with Tether (USDT) or Circle (USDC) acting on law-enforcement or court-order basis – are time-sensitive. We have seen treasury balances become unrecoverable because the decision to engage dispute counsel was delayed by days.
Regulators in the leading hubs increasingly expect token issuers to have documented incident-response procedures, including a clear internal protocol for engaging legal counsel when an exploit or misappropriation is detected. That protocol is part of a mature compliance posture and can itself reduce enforcement exposure where a regulator investigates the response to an incident.
Related at OBOLUS
- Token Offerings & Securities Practice – Full-scope legal counsel on token classification, offering structures, and securities law compliance across jurisdictions.
- Exchange Listing Legal Counsel in Hong Kong – SFC VATP listing requirements, classification opinions, and dual-listing documentation for the Hong Kong market.
- NFT Project Legal Structuring in South Africa – Regulatory analysis and entity structuring for NFT issuers and digital-collectibles platforms in South Africa.
FAQ
Is my token a security?
The answer depends on the economic rights the token confers and the jurisdiction in which it is offered. Most regulators apply a substance-over-form test: if the token conveys an expectation of financial return derived from the efforts of others, it is likely treated as a security or financial instrument regardless of its label. The analysis must be run across every jurisdiction in which you intend to offer or distribute the token, because the same token can be a security in one market and not in another. Legal classification analysis – reviewed against each target market's applicable regime – is the only reliable answer.
Do I need a MiCA whitepaper?
If you are offering a crypto-asset to the public in the European Union, and that asset is not classified as an ART, an EMT, or a financial instrument under existing EU law, MiCA's whitepaper requirement applies. The whitepaper must meet prescribed content standards set by ESMA and must be published before the public offer begins. Specific exemptions exist – for example, for offers to fewer than a defined number of persons or below a defined consideration threshold – but those exemptions carry their own conditions. Where the token is a financial instrument, MiCA does not apply and existing EU securities law governs instead.
How should an airdrop be structured legally?
An airdrop is a distribution of tokens, and if those tokens are classified as securities in any jurisdiction included in the distribution, the airdrop may constitute an unregistered securities offering even where no payment is received. Legally sound airdrop structures typically include a classification analysis of the token in each target jurisdiction, a defined eligibility-and-exclusion process that removes recipients from jurisdictions where distribution would be impermissible, documented AML/KYC procedures where required, and legal review of the smart-contract distribution mechanics to confirm they are consistent with the intended restrictions.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise token issuers, exchanges, custodians, and funds on the full legal lifecycle of a token – from classification and pre-launch structuring to offering documentation, post-launch compliance, and dispute resolution – across more than 70 licensing jurisdictions and 25 dispute and recovery forums. Digital assets are the entirety of our practice. We assess classification against the substance of rights, not the marketing label, and we act only for business clients. To discuss your token project, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Roman Levitt, Technology & DeFi Counsel – advising token issuers and protocol teams on classification analysis, offering structures, and the cross-border legal architecture of on-chain products.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.