On paper, a token sale looks like a straightforward commercial arrangement: a project offers tokens, buyers pay consideration, rights are defined in a document. In practice, a poorly drafted token sale agreement can convert a product launch into an unregistered securities offering – triggering regulatory enforcement, investor claims and, in the worst cases, personal liability for founders. The compliance burden is not an afterthought. It is the central design constraint.
A token sale agreement (the contract governing the issuance and sale of digital tokens to purchasers) must do three things simultaneously: reflect the economic substance of what is being sold, satisfy the disclosure obligations of every jurisdiction where buyers are located, and withstand classification scrutiny from regulators who care nothing for marketing labels. Getting all three right demands cross-border legal architecture, not boilerplate.
This analysis works through the key compliance pressure points – from token classification through whitepaper mechanics to cross-border enforceability – and identifies the structural choices that separate a defensible offering from one that invites challenge.
Why Token Classification Comes First
The single most consequential decision in drafting a token sale agreement is determining, with legal rigor, what the token actually is. Classification is not a branding exercise. It is a legal conclusion that determines which regulatory regime applies, which disclosures must be made, which exchanges can list the token, and whether the sale itself requires prior authorization.
The foundational principle – embedded in FATF guidance and reflected across the EU under MiCA, in the SEC's Howey-derived analysis, in MAS's Payment Services Act framework, and in the SFC's products-and-platforms approach – is that substance controls, not label. A token marketed as "utility" but conferring rights to profit participation, governance power over treasury, or a passive return on staking is not a utility token in any regulatory sense that matters.
The classification matrix is broadly threefold. A payment token functions as a medium of exchange with no rights attached to the issuer. A utility token gives access to a specific product or service, where the service is live or imminently so and the access right is the primary economic driver. A security token – or under MiCA, a token that qualifies as a financial instrument – confers investment rights: profit participation, governance over capital allocation, or a value tied to the performance of a managed enterprise.
The difficulty is that most real-world tokens are hybrid. A token that grants protocol governance votes, earns a proportion of fee revenue, and trades on secondary markets has characteristics of all three categories simultaneously. Each jurisdiction resolves that hybridity differently. In our cross-border practice, we have seen classification opinions that diverge materially between counsel in Dubai, London and New York for the same instrument – because the analytical tests genuinely differ. The agreement must be drafted to account for the most restrictive conclusion that applies to any jurisdiction where the issuer solicits or accepts purchasers.
The process-transparency point is critical here: classification analysis is documented before the agreement is drafted, not inserted post hoc. Regulators reviewing an enforcement matter will reconstruct the issuer's contemporaneous understanding of the token's legal character. A paper trail showing rigorous pre-issuance classification work is a meaningful mitigant. The absence of one is an aggravating factor.
For a scoped classification assessment before you commit to a sale structure, contact OBOLUS at info@oboluslaw.com. The classification drives every downstream drafting decision, and the analysis is most cost-efficient before the agreement is circulated. To Map your options, reach out now.
How Does MiCA Change the Drafting Calculus for EU-Facing Offerings?
MiCA – the Markets in Crypto-Assets Regulation, enforced by ESMA in coordination with national competent authorities – fundamentally restructured the token offering regime across the EU and EEA. Issuers of asset-referenced tokens (ARTs, tokens designed to maintain a stable value by referencing multiple assets) and e-money tokens (EMTs, referencing a single fiat currency) require authorization before public offer or admission to trading. For "other" crypto-assets – the category that covers most utility and governance tokens – a whitepaper must be notified to the relevant national competent authority, even though prior approval is not required for non-ART/EMT tokens.
The whitepaper obligation is not cosmetic. The required disclosures cover the rights and obligations attached to the token, the technical features of the underlying protocol, the use of proceeds, the risks specific to the issuer and the token, and the conflicts of interest that exist within the project. A whitepaper that omits material information – or whose content is inconsistent with the token sale agreement – creates a civil liability exposure that survives publication: purchasers who relied on an incomplete or misleading whitepaper can, under the MiCA framework, bring claims against the offeror.
The interaction between the whitepaper and the agreement is the most common drafting fault we observe. Teams treat them as separate documents produced by separate workstreams. The whitepaper describes the protocol; the agreement covers the commercial terms. In a regulatory investigation or a purchaser dispute, the two documents are read together. If the whitepaper represents that proceeds will fund protocol development and the agreement reserves broad discretion to deploy proceeds for other purposes, that inconsistency is not a minor drafting inelegance – it is a potential misrepresentation.
The MiCA passporting mechanic adds a further layer: an issuer authorised in one EU member state may offer tokens across the EEA. The jurisdiction of first authorization therefore shapes not only the immediate regulatory burden but the issuer's operating footprint for years. That choice – Lithuania versus Malta versus another NCA – is a strategic decision with significant long-term consequences, and it belongs in the pre-drafting structure, not the post-issuance review.
What Does the Agreement Itself Need to Say?
A token sale agreement that can survive regulatory scrutiny and purchaser litigation contains, at minimum, six operational pillars: a precise definition of the token and the rights it confers; a classification-consistent description of the sale as either a regulated or an unregulated offering in each relevant jurisdiction; disclosure of material risks specific to this issuer and this token; use-of-proceeds provisions that are consistent with the whitepaper; a purchaser eligibility mechanism that gives effect to any applicable geographic restrictions and investor qualification requirements; and a dispute resolution clause that specifies the governing law and forum with real thought given to enforceability.
The purchaser eligibility mechanism deserves particular attention. A US-person exclusion written only as a representation by the purchaser – without a technical access gate, a KYC check, or a contractual covenant against resale – is not, in practice, an effective exclusion. The SEC and CFTC have in the past treated issuers as having sold into the United States when they accepted wire transfers from US-linked accounts, regardless of what the agreement stated. The agreement needs to be backed by a compliance infrastructure that makes the eligibility representation meaningful: wallet screening, IP-based access controls, KYC at onboarding.
Governing-law selection is another site of recurrent error. Issuers frequently choose a jurisdiction with a light regulatory touch, without considering whether a court in that jurisdiction would actually be accessible to a purchaser in a dispute, whether judgments from that court would be recognized elsewhere, or whether the chosen law would be displaced by mandatory consumer-protection or securities-law provisions in the purchaser's jurisdiction. The DIFC Courts, the courts of England and Wales, and Singapore's courts all offer sophisticated crypto-asset jurisprudence and strong enforcement networks. That matters when a dispute becomes live.
Cross-Border Risk: Where Does the Compliance Burden Actually Land?
A token sale agreement is signed once. The compliance burden it attracts is determined by where tokens are sold, where the issuer is domiciled, where the proceeds are received, and – sometimes determinatively – where the token trades after issuance. An issuer sitting in Dubai under the VARA regime, selling tokens to purchasers in Singapore, the EU, and the United Kingdom, faces four concurrent regulatory frameworks, each with different disclosure, authorization, and AML obligations.
The cross-border reality is that no single agreement template resolves this. The base agreement defines the economics and the core rights. A series of jurisdiction-specific schedules addresses the mandatory disclosures, the applicable exemptions, and the purchaser restrictions that apply in each relevant market. The EU purchaser schedule follows the MiCA whitepaper standard. The UK purchaser schedule must account for the FCA's financial promotion rules, which apply to crypto marketing directed at UK persons regardless of the issuer's location. A US schedule – if US persons are excluded – must document the exclusion mechanism in a way that is credible to a reviewing court.
In Singapore, the MAS DPT licensing framework applies to service providers rather than to issuers directly, but the substance of the token determines whether its distribution engages the Securities and Futures Act, which operates independently. In Hong Kong, the SFC's VATP regime governs trading platforms, but the classification of the token as a "security" or a "virtual asset" determines the regulatory lane for the offering itself.
The FATF Travel Rule – the obligation to pass originator and beneficiary data with a virtual asset transfer – applies at the transfer layer, not the offering layer, but its practical effects reach into the agreement: if the issuer processes transfers in-house or through an affiliated platform, the compliance architecture for those transfers is part of the offering's total compliance footprint.
The Utility Label: An Objection That Carries Real Risk
A common assumption in the market is that labelling a token as "utility" in the whitepaper and the sale agreement settles its legal classification. It does not. Regulators in every major jurisdiction have stated this explicitly, and enforcement actions have confirmed it repeatedly.
Classification is a functional analysis, not a documentary one. The questions regulators ask are: does the purchaser have a reasonable expectation of profit? Does that expectation derive primarily from the efforts of the issuer or a third party? Is the token's value tied to the performance of the enterprise rather than to a use-right in a specific, existing product? A token that answers "yes" to those questions is treated as a security in the United States, a financial instrument under MiCA's gateway test, and a regulated product under multiple other frameworks – whatever the label says.
The agreement compounds the problem when it contains provisions that contradict the utility narrative. Lock-up periods calibrated to token price performance, profit-sharing on secondary-market trading fees, governance rights over treasury management, and issuer buy-back provisions are all features of investment products. Including them in an agreement titled "Utility Token Sale Terms" does not make the offering compliant – it creates a document that a regulator can use to prove that the issuer knew what the token was and mischaracterised it anyway.
In our practice, we assess classification against the substance of the rights conferred, not the marketing label. That assessment is documented, jurisdiction-specific, and reflected consistently in the agreement and whitepaper. Where the analysis identifies securities-law exposure, the structure is adjusted – whether through a registered offering, an applicable exemption, or a redesign of the token's economic features – rather than papered over with a utility disclaimer.
If a prior offering has already closed and the classification position is now being questioned, a remediation review can identify the structural reasons and, in some cases, the route back. Contact OBOLUS at info@oboluslaw.com or Map your options to discuss the position confidentially.
AML, KYC, and the Travel Rule: How Do They Interact With the Sale Agreement?
AML and KYC obligations are not peripheral to a token sale – they are embedded in its legal structure from the first investor contact. Under FATF Recommendation 15, issuers and their intermediaries that qualify as virtual asset service providers (VASPs) are subject to AML/CFT obligations including customer due diligence, transaction monitoring, and suspicious activity reporting. Whether the issuer itself qualifies as a VASP under the laws of its domicile – and whether the sale is a "virtual asset transfer" or a regulated service – depends on the jurisdiction, but the question must be answered before the agreement is drafted.
The agreement's purchaser eligibility mechanism is the primary vehicle for the KYC obligation. The structure that works in practice is: the agreement requires each purchaser to complete KYC verification before tokens are delivered; delivery is conditional on satisfactory completion; and the agreement contains a warranty by the purchaser as to source of funds, PEP status, and the absence of sanctions exposure. This creates a contractual record of the issuer's compliance effort – relevant both to regulatory review and to any post-issuance civil claim.
The Travel Rule – the obligation to transmit originator and beneficiary data with a virtual asset transfer, applying in the EU under MiCA and in most FATF-aligned jurisdictions – applies to transfers above a de minimis threshold that varies by jurisdiction. For a token sale, the relevant moment is token delivery: if the issuer delivers tokens via a transfer on a blockchain and falls within a regulated category, the Travel Rule data obligation attaches to that delivery. The agreement and the compliance architecture for the sale must be designed with this in mind, particularly where the issuer is serving purchasers across multiple jurisdictions with different Travel Rule implementations.
What Does a Defensible Sale Structure Look Like? A Decision Matrix
The right structure depends on the token's classification, the issuer's jurisdiction, and the target purchaser base. The following profiles illustrate the principal decision branches.
Profile A: Pure utility token, issuer in an EU member state, offering to EU/EEA purchasers only. Classification as a non-ART, non-EMT crypto-asset allows a MiCA whitepaper notification path without prior authorization. The agreement must be consistent with the whitepaper, include a purchaser-restriction schedule excluding US persons, and comply with the national CDA (consumer data and AML) requirements of the member state. Timeline from first classification opinion to whitepaper notification is typically a matter of weeks for a well-prepared team; the authorization clock does not run on non-ART/EMT tokens. Key risk: the classification is contested post-offering on the basis that governance rights confer financial-instrument characteristics.
Profile B: Governance-plus-revenue token, issuer domiciled in Dubai (VARA), offering globally with US exclusion. VARA's activity-based licence framework requires an assessment of whether the issuance and ongoing management of the token constitutes a regulated activity. The agreement must include a VARA-compliant structure, jurisdiction-specific purchaser schedules for EU (MiCA), UK (FCA financial-promotion rules), Singapore (MAS DPT screening) and other target markets. The US exclusion must be technically enforced, not merely represented. Timeline is longer and capital requirements are material; allied counsel in each target jurisdiction are engaged in parallel. Key risk: secondary-market trading on an unlicensed venue in a restricted jurisdiction retroactively implicating the original offering.
Profile C: Token with clear security characteristics, issuer seeking to offer to accredited investors. The agreement is structured as a private placement. An exemption from registration – under applicable securities law in the relevant jurisdiction – is relied upon; the agreement documents the issuer's basis for relying on the exemption and the purchaser's qualification. Resale restrictions are written into the agreement and technically enforced via transfer controls on the token contract. Timeline is longer and the compliance cost is higher, but the legal position is substantially more defensible than a utility mislabelling. Key risk: the exemption conditions are breached post-issuance by a purchaser resale into a non-exempt market.
In each profile, the agreement and the compliance architecture are designed together, not sequentially. The agreement embeds the compliance obligations; the compliance infrastructure makes the agreement's representations accurate.
A Micro-Matter: Structuring Around a Post-Issuance Enforcement Trigger
In a recent matter, a token issuer approached us after receiving a regulatory inquiry from a national competent authority questioning the classification of tokens issued under what the issuer had characterised as a utility offering. The inquiry followed secondary-market price appreciation and the launch of a staking programme that generated a passive return for token holders. We conducted a classification review of the token, the agreement, and the whitepaper as a package, mapping each right conferred by the token against the classification tests of the relevant jurisdictions. The review identified that the staking programme, introduced after the initial sale, had materially altered the token's economic character in a way not reflected in the original whitepaper or agreement. We advised on a remediation approach – including a supplementary disclosure document, amendments to the staking programme's economic structure, and revised agreement terms for subsequent token sales – that addressed the regulatory concern while preserving the programme's commercial substance. The matter concluded without formal enforcement action.
Practical Checklist: Before You Circulate a Token Sale Agreement
Before a token sale agreement is sent to a single prospective purchaser, the following questions need documented answers.
First: has a jurisdiction-specific classification opinion been obtained, covering every jurisdiction where the issuer will actively solicit purchasers? Classification in the issuer's home jurisdiction is necessary but not sufficient.
Second: is the agreement internally consistent with the whitepaper? Every right described in the agreement should be reflected in the whitepaper, and every use-of-proceeds statement in the whitepaper should be mirrored in the agreement. Inconsistencies create liability.
Third: does the purchaser eligibility mechanism actually exclude the categories of purchaser that the issuer intends to exclude? A contractual representation without technical enforcement is not an effective gate.
Fourth: has the KYC and AML compliance architecture been designed and tested before the first sale closes? The compliance infrastructure is not something to build after the offering is live.
Fifth: has governing-law and dispute-resolution strategy been reviewed by counsel with actual experience of enforcing crypto-asset claims in the chosen forum? An arbitration clause in a jurisdiction with no track record in crypto disputes is not neutral – it is a risk.
Sixth: if the offering is EU-facing, has the whitepaper been reviewed against the MiCA required-content checklist by counsel who regularly advise under that regime? A whitepaper that fails the MiCA standard creates civil liability from the moment of publication.
Seventh: are post-issuance changes to the token – staking programmes, governance mechanisms, fee-sharing arrangements – being reviewed for their classification impact before they go live? The classification of a token is not fixed at issuance. Changes to its economic features can alter its regulatory character.
Related at OBOLUS
- Token Offerings & Securities – OBOLUS Practice Group – full-service counsel on token issuance, classification and securities compliance across jurisdictions
- Airdrop Legal Structuring in Canada – jurisdiction-specific analysis of airdrop classification and compliance under Canadian law
- Oracle and Data Feed Liability in Nigeria – analysis of on-chain data infrastructure liability in an emerging digital-asset market
FAQ
Is my token a security?
Whether a token is a security depends on the rights it confers and the jurisdiction of the analysis, not on what it is called. The core question – present in US law, under MiCA, and across most flagship regimes – is whether purchasers have a reasonable expectation of profit derived from the efforts of others. Governance rights, revenue participation, and passive staking returns all pull toward a security classification. The analysis must be done jurisdiction by jurisdiction, before the agreement is drafted.
Do I need a MiCA whitepaper?
If you are offering crypto-assets to the public in the EU or EEA and your tokens are not ARTs or EMTs, a whitepaper notified to the relevant national competent authority under MiCA is required before the offer opens. For ARTs and EMTs, prior authorization – not mere notification – applies. The whitepaper must contain prescribed disclosures and be consistent with your sale agreement; civil liability attaches to misleading or incomplete content.
How should an airdrop be structured legally?
An airdrop – a gratuitous distribution of tokens – does not eliminate classification risk. If airdropped tokens are materially identical to tokens sold in a prior or concurrent offering, regulators may treat recipients as having received consideration of equivalent economic value. The distribution mechanism, the eligibility criteria, the number of recipients, and the jurisdictions of distribution all affect the analysis. A well-structured airdrop documents the absence of consideration, restricts distribution in securities-sensitive jurisdictions, and is reviewed against the classification position of the underlying token.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess token classification against the substance of rights conferred – not the marketing label – and we advise across the full lifecycle of a token offering, from pre-issuance structure through post-issuance regulatory response. To discuss your token sale, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in cross-border token offering disputes, post-issuance enforcement response, and the intersection of smart-contract mechanics and contractual liability.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.