Exchange Listing Legal Counsel: Where the Legal Lines Are Drawn

On paper, listing a token on a major exchange looks like a commercial milestone. In practice, it is one of the highest-stakes legal events in a digital-asset project's lifecycle. The exchange conducts its own classification review. Regulators in multiple jurisdictions are watching. And the label a team printed on its whitepaper two years ago may bear no relation to how a securities supervisor reads the instrument today. Token classification – the determination of whether a token constitutes a security, an e-money instrument, a commodity or an unregulated asset – is the question that decides which regime governs the listing, which disclosures are mandatory and who carries personal liability when the analysis goes wrong.

The legal lines around exchange listings are drawn by overlapping regimes: MiCA (the EU's Markets in Crypto-Assets Regulation, supervised by ESMA and national competent authorities) for tokens reaching European users; securities law frameworks administered by the SEC and CFTC in the United States; the SFC's VASP licensing regime in Hong Kong; MAS supervision under the Payment Services Act in Singapore; and VARA's activity-based rulebooks in Dubai. Each draws the line differently. A token that is a commodity derivative in one seat may be a transferable security in another. Counsel who advises a project through listing must map all of them simultaneously.

This analysis examines how those lines are drawn, what the cross-border divergence means for listing strategy, and where the legal risk concentrates when classification goes wrong.

Why Does an Exchange Listing Trigger Legal Analysis in the First Place?

A listing creates a public, liquid market for a token, and that act of creating liquidity is precisely what most securities regimes use to draw the regulatory perimeter. Before listing, a token may circulate in a small community of builders and early backers. After listing, it reaches retail investors in dozens of jurisdictions simultaneously, often within hours of the announcement. That change in accessibility is not commercially neutral – it is legally transformative.

Regulators have been explicit on this point across multiple jurisdictions. The SEC's longstanding guidance, built on the Howey analysis (the inquiry into whether an instrument is an investment contract), focuses on whether purchasers reasonably expect profits from the efforts of others. A centralized exchange listing – accompanied by public market pricing, secondary-market trading and the implied liquidity premium that investors actually pay for – strengthens the investment-return expectation argument considerably. In our cross-border practice, we see projects that passed an informal classification review at the seed stage face a materially different analysis the moment a Tier 1 exchange listing is announced, because the facts on the ground have changed.

The exchange itself has skin in this game. Regulated exchanges operating under the SFC in Hong Kong, MAS in Singapore or within the VARA regime in Dubai are obliged under their own licences to conduct token due diligence before onboarding. They will ask for a legal opinion. A weak opinion – one that simply recites the marketing label without working through the substantive rights analysis – will not satisfy a compliance team at a regulated venue. The project that cannot produce credible counsel often cannot complete the listing, irrespective of commercial readiness.

CTA #1: The classification analysis for a listing is almost never a one-jurisdiction exercise. Your token reaches users across multiple regulatory perimeters the moment it is listed. Map your options with OBOLUS before the exchange's legal team asks the first question.

Token Classification: What Does the Substantive Test Actually Examine?

Token classification turns on the substance of rights conferred, not on the label applied in a whitepaper or marketing document – and that distinction is the source of most listing-stage legal risk. Every major regulatory regime converges on this principle, even when the specific tests diverge.

Under MiCA, the classification gateway separates three primary categories: asset-referenced tokens (ARTs, which reference a basket of assets or currencies), e-money tokens (EMTs, which reference a single fiat currency), and all other crypto-assets. Tokens that qualify as financial instruments under the existing Markets in Financial Instruments Directive fall outside MiCA entirely and remain subject to securities regulation, which imposes a more demanding disclosure and authorisation regime. The classification analysis under MiCA therefore begins with a financial-instruments screen, proceeds to the ART/EMT test, and only then reaches the residual "other crypto-asset" category where MiCA's whitepaper obligations apply. Getting this sequence wrong – assuming MiCA applies when the token is actually a financial instrument – is a material error that can expose both the issuer and the listing venue to regulatory sanction.

In the United States, the SEC applies the investment-contract analysis across a broad spectrum of token structures. The core inquiry is economic: does the token holder rely on a common enterprise and the managerial efforts of others for a return? Governance rights, staking rewards, revenue-sharing mechanics and secondary-market price correlation to the project's development all feed the analysis. The CFTC, concurrently, asserts jurisdiction over tokens it classifies as commodities, creating a dual-regulator environment that adds complexity for any project with US user exposure.

Singapore's MAS distinguishes digital payment tokens (DPTs, regulated under the Payment Services Act for AML/CFT purposes but not as capital-markets products) from capital markets products (which include securities and units in a collective investment scheme, regulated under the Securities and Futures Act). The Hong Kong SFC applies a similarly bifurcated analysis, separating tokens that constitute "securities" under the Securities and Futures Ordinance from virtual assets that are regulated through the VASP licensing regime. In both hubs, a misclassification at the listing stage produces regulatory consequences for the exchange as well as the issuer.

What Do Exchanges Actually Require from Legal Counsel?

A regulated exchange's listing legal request is typically a written legal opinion addressing classification in each jurisdiction material to its licence and user base, confirming that the token is not an unregistered security in those seats and that the listing does not expose the exchange to regulatory breach. The opinion must be signed by qualified counsel and must engage the substantive rights – not restate the whitepaper.

We have seen exchanges in the VARA regime request opinions covering, at minimum, the UAE position and the EU position under MiCA, reflecting the cross-border composition of their user base. Exchanges licensed by the SFC in Hong Kong routinely request opinions covering the Securities and Futures Ordinance analysis, the MiCA analysis and the US position. The practical result is that a project targeting a multi-jurisdiction listing needs a coordinated set of opinions, produced under common instructions, that do not contradict each other on the underlying facts.

The common mistake at this stage is instructing separate local counsel in each jurisdiction without a coordinating lawyer who holds the whole fact pattern. Each local counsel produces an opinion based on the facts provided. If those facts are described inconsistently – if the token's governance rights are described differently in the US opinion than in the EU opinion – the exchange's compliance team will identify the discrepancy and suspend the review. In our practice, we function as coordinating counsel, ensuring that the factual record presented to each allied local opinion provider is consistent and complete.

A secondary requirement, increasingly common among regulated venues, is a Travel Rule compliance analysis – the Travel Rule being the obligation to pass originator and beneficiary data with a virtual-asset transfer, derived from FATF Recommendation 15. Exchanges operating under MAS, SFC or VARA supervision are expected to demonstrate Travel Rule compliance across their onboarded assets. This is not a listing condition in the same sense as a classification opinion, but it forms part of the overall AML posture that a regulated venue is obliged to maintain.

Whitepaper Obligations Under MiCA: What Must Be Disclosed?

Under MiCA, a crypto-asset whitepaper is a mandatory disclosure document for most public token offers and exchange admissions in the EU/EEA, carrying specific content requirements and issuer liability for misleading or inaccurate statements. This is not a marketing document – it is a regulated instrument.

The MiCA whitepaper obligation applies to offers of crypto-assets to the public and to admission to trading on a regulated trading platform within the EU/EEA. ESMA and the national competent authorities have published technical standards specifying the content, presentation and machine-readable format of compliant whitepapers. The issuer must notify the relevant NCA at least a defined period before publication – a timeline that projects frequently underestimate. Where a token qualifies as an ART or EMT, the whitepaper requirements are more demanding still, and an authorisation step is added before the offer can proceed.

The liability standard under MiCA is noteworthy. The issuer, its management body and, in some cases, the person seeking admission to trading bear civil liability to token holders for losses caused by a non-compliant or misleading whitepaper. That liability transfers to the listing context: if an exchange lists a token against a whitepaper that contains material inaccuracies, questions arise about the exchange's own due-diligence obligations. Regulators have made clear that "the issuer said so" is not a defence for a licensed trading platform.

Projects outside the EU that intend to list on an EU-licensed exchange face this obligation even if their home jurisdiction imposes no equivalent requirement. A token issued in Singapore or the BVI and listed on a MiCA-regulated venue must comply with MiCA's whitepaper rules for the EU/EEA tranche of the offer. This cross-border application is poorly understood and is one of the most frequent gaps we identify when reviewing pre-listing documentation.

How Does Cross-Border Divergence Affect Listing Strategy?

Cross-border divergence in token classification is not an abstract compliance concern – it produces concrete, binary outcomes at the listing stage: a token either clears the exchange's legal review or it does not. Projects that fail to map the divergence before engaging an exchange typically discover the conflict mid-review, under time pressure, when the commercial cost of a delayed or withdrawn listing is highest.

Consider the practical tension between the US and the EU. A token that the EU analysis places comfortably in the residual "other crypto-asset" category under MiCA – outside the financial-instruments perimeter – may still carry meaningful investment-contract exposure under US analysis, particularly where the token's value is closely correlated with the project team's continuing development efforts. The US position does not automatically invalidate the EU analysis. But it means the project must either restrict US-person access to the listing, obtain a formal no-action position, or accept the residual risk – and that decision must be made deliberately, with counsel, not by default.

A comparable tension arises between the Singapore and Hong Kong positions. Both regulators apply a substance-over-label test, but their precedent and supervisory practice diverge on specific token features – particularly staking mechanics, on-chain governance rights and token buy-back programmes. A token designed to satisfy the DPT threshold in Singapore may nonetheless require securities-product treatment under the SFC's analysis in Hong Kong, requiring a different listing vehicle or access restriction.

The decision matrix for a multi-jurisdiction listing typically resolves into four operator profiles:

Profile A – Global Tier 1 listing, unrestricted access: requires classification opinions in the US, EU/EEA, Hong Kong and Singapore as a minimum; coordinated whitepaper under MiCA; access restrictions for sanctioned jurisdictions; timeline measured in months, not weeks.

Profile B – EU-primary listing, US persons excluded: MiCA whitepaper is the governing document; US-person exclusion implemented at the exchange level; Hong Kong/Singapore opinions optional depending on exchange licensing; timeline shorter but compliance infrastructure at the exchange must be verified.

Profile C – VARA or ADGM-primary listing, regional scope: VARA or FSRA classification opinion primary; MiCA analysis required if EU users are in scope; US-person exclusion standard; timeline governed by the exchange's own onboarding cycle under its VARA or FSRA licence.

Profile D – Offshore listing, compliance-minimalist approach: carries the highest residual risk; regulators in major jurisdictions assert extraterritorial reach where users are located in-jurisdiction regardless of where the exchange is incorporated; this profile is not a safe harbour – it is an unquantified risk position.

CTA #2: If a prior listing application stalled at the legal-review stage, the structural reason is almost always identifiable. A second read of the classification analysis and the opinion package can surface the gap and map the route forward. Reach the OBOLUS token offerings desk for a scoped review.

Where Does Liability Concentrate When Classification Goes Wrong?

When a token is misclassified and the error is discovered post-listing, liability distributes across multiple parties – and the distribution depends on who made which representations to whom and in which jurisdiction. Understanding this distribution before listing is the clearest argument for investing in classification counsel early.

The issuer carries primary liability in most regimes. An unregistered public offering of a security is a strict-liability violation in the United States under the applicable federal securities statutes; registration defects are not cured by the issuer's good-faith belief in a utility label. Under MiCA, the management body of the issuer carries personal civil liability for whitepaper misstatements. In Singapore and Hong Kong, an offer of securities without a prospectus or applicable exemption exposes the offeror to criminal and civil sanction.

The exchange carries secondary liability in regulated jurisdictions. An exchange licensed under MiCA, MAS, SFC or VARA has made undertakings to its regulator about the adequacy of its token due diligence. Listing a security without proper classification exposes the exchange to licence sanction – which is why regulated exchanges are, increasingly, more conservative in their legal-review requirements than the applicable law strictly demands. We regularly advise token issuers who are surprised by the depth and specificity of exchange legal requests; the answer is almost always that the exchange is protecting its licence, not making an idiosyncratic demand.

Founders and management team members may carry personal liability where the applicable regime imposes individual accountability for regulated-activity violations. In the UK, the FCA's financial-promotion rules impose obligations that can result in personal action against individuals who approve non-compliant promotions. In the US, the SEC has pursued individual enforcement actions in the digital-asset space.

The micro-matter that illustrates this most clearly arose in a recent matter we handled: a token issuer in a common-law seat had completed a listing on a regulated exchange in a Gulf hub on the basis of a single-jurisdiction legal opinion. Following the listing, the exchange received regulatory correspondence from a European NCA asserting that the token's revenue-sharing mechanics brought it within the financial-instruments perimeter under the applicable pre-MiCA national legislation. The exchange suspended trading within days. We were instructed to produce a supplemental EU-law analysis, coordinate with allied counsel in the relevant European jurisdiction, and support the issuer in a dialogue with the NCA. The matter resolved without formal enforcement, but the commercial cost – lost trading volume, reputational impact and the cost of the subsequent legal process – was materially higher than a complete pre-listing opinion would have been. The analysis took weeks; the listing review had taken months.

Does a "Utility" Label on the Whitepaper Settle the Classification?

A utility label on a whitepaper does not settle the legal classification of a token – it is marketing language, not a legal determination, and every major regulator has said so explicitly. This is one of the most persistent misconceptions we encounter in pre-listing instructions.

The legal analysis is conducted by reference to the actual rights the token confers, not the name the issuer assigns to it. A token described as a "utility token" that gives holders a right to a share of platform revenue, that appreciates in value as the project grows, and that was sold to early investors on the basis of projected returns, will be analysed as a potential investment contract under the US framework and as a potential financial instrument under MiCA – regardless of the whitepaper label. The label may be relevant as evidence of the parties' intent, but intent is not determinative in most regimes.

Regulators have made this explicit. ESMA has issued guidance noting that the label attached to a crypto-asset does not determine its regulatory classification. The SEC has consistently taken the position that economic substance governs. The SFC in Hong Kong has published detailed guidance on how to conduct the substance analysis for tokens that claim to be utility instruments but carry investment-return characteristics.

The practical implication for a token issuer approaching a listing is straightforward: the legal opinion must work through the substantive rights analysis in each applicable jurisdiction and arrive at a classification conclusion that can be defended to a regulator. An opinion that simply affirms the whitepaper label is not legal counsel – it is a liability risk in written form. We assess classification against the substance of rights, not the marketing label. That is the standard a regulated exchange and a competent regulator will apply, and it is the standard any serious pre-listing analysis must meet.

How Should an Airdrop Be Structured to Manage Legal Exposure?

An airdrop – the gratuitous distribution of tokens to wallet addresses, typically for community-building or marketing purposes – is not legally neutral, and treating it as such is one of the most common structural errors we see in pre-listing project reviews. The legal analysis of an airdrop turns on several factors: whether consideration is exchanged, whether recipients form a definable class, whether the airdrop is conditional on any action, and which jurisdictions' residents receive the distribution.

Under MiCA, an offer of crypto-assets to the public at no charge – a true gratuitous airdrop with no conditions and no consideration – is explicitly carved out from the whitepaper publication obligation. ESMA's technical standards and MiCA's recitals confirm this exemption. However, the exemption is narrowly construed. An airdrop that requires recipients to engage in promotional activity (retweeting, referring, completing tasks) introduces a consideration element that regulators are increasingly willing to characterise as a conditional offer rather than a gratuitous distribution – pulling the airdrop back within the whitepaper regime.

In the United States, even a gratuitous token distribution can raise issues if it is used as a mechanism for bootstrapping a secondary market before a planned listing. The SEC's analysis focuses on whether the airdrop creates an expectation of profit tied to the team's efforts. A large-scale airdrop to hundreds of thousands of wallet addresses, followed by a listing announcement, fits a pattern that regulators have treated as a structured distribution designed to circumvent registration requirements.

The structural elements of a legally defensible airdrop include: clear documentation of the basis for distribution; recipient eligibility criteria that do not inadvertently create a securities-offer characterisation; jurisdictional restrictions implemented at the wallet or protocol level; and a documented analysis of the treatment in each material jurisdiction before distribution. Where the airdrop precedes a listing, the airdrop documentation forms part of the listing file and will be reviewed by the exchange's legal team alongside the classification opinion.

Related at OBOLUS

• Token Offerings & Securities for Digital-Asset Businesses – the full scope of our token issuance and securities analysis practice
• Token Legal Classification in Liechtenstein – how the Liechtenstein token-law framework approaches classification and what it means for cross-border issuers
• DAO Legal Wrapper Under Heightened Scrutiny – the governance and liability analysis for token-issuing DAOs facing regulatory pressure

FAQ

Is my token a security?

Whether a token is a security depends on the substance of the rights it confers and the jurisdiction asking the question. The US applies the investment-contract analysis; the EU applies the MiCA financial-instruments screen; Singapore and Hong Kong each apply their own capital-markets-product tests. No single label resolves the question. A defensible answer requires a written analysis in each jurisdiction material to your offer, conducted by qualified counsel who examines the actual mechanics of the token – not the whitepaper description.

Do I need a MiCA whitepaper?

If you are offering a crypto-asset to the public in the EU/EEA or seeking admission to trading on an EU-regulated platform, a MiCA whitepaper is required in most cases. Exemptions apply to purely gratuitous distributions, small-scale offers below a defined threshold and offers to qualified investors only. If the token classifies as an asset-referenced token or an e-money token, prior ESMA or NCA authorisation is required, not merely a whitepaper notification. A MiCA compliance review should be conducted before the listing process with a regulated EU venue begins.

How should an airdrop be structured legally?

A legally defensible airdrop requires documented distribution criteria, a jurisdictional restrictions analysis, and a determination of whether the distribution is truly gratuitous or carries implicit consideration. Under MiCA, a genuinely unconditional airdrop is exempt from the whitepaper obligation; a task-based or referral-conditional airdrop may not be. In the US, even a gratuitous distribution can raise regulatory concern if it precedes a listing and creates secondary-market price expectations. Instruction of counsel before the airdrop structure is finalised – not after – is the standard we recommend.

OBOLUS is an independent digital-asset law boutique acting exclusively for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice. We assess token classification against the substance of rights, not the marketing label – the standard that regulated exchanges and competent regulators apply. To discuss your listing or classification matter, contact info@oboluslaw.com.

By Glen Sorensen, Disputes & Recovery Analyst – specialist in cross-border token enforcement, exchange listing due diligence and post-listing regulatory dispute matters.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.