A token issuer preparing to launch across the European Union quickly discovers that the MiCA whitepaper (the disclosure document required under the Markets in Crypto-Assets Regulation) is not a compliance formality. It is the first piece of documentary evidence a regulator or a claimant's counsel will read when something goes wrong. The classification decision embedded in that document – security, asset-referenced token (ART), e-money token (EMT), or "other crypto-asset" – will be tested in enforcement proceedings, investor claims, and cross-border recovery actions for years after the token launches. Getting it right at the drafting stage is orders of magnitude less expensive than defending it afterward.
The MiCA whitepaper is both a disclosure instrument and a legal liability anchor. Under the MiCA regime, supervised by ESMA and national competent authorities (NCAs), the whitepaper must accurately describe the rights the token confers, the risks it carries, and the issuer's obligations. A document that labels a token "utility" when its economic substance resembles an investment instrument does not insulate the issuer – it creates additional exposure for misleading disclosure. In our practice, we see this tension at the intersection of token classification, securities law, and pre-emptive dispute management.
This analysis addresses the disputes angle: what the whitepaper review process looks like from a litigation-readiness perspective, where classification errors generate liability, how cross-border token offerings complicate the analysis, and what issuers can do before launch to reduce their exposure.
What MiCA Actually Requires From a Whitepaper
MiCA imposes mandatory whitepaper content requirements on issuers of crypto-assets that do not qualify as financial instruments under existing EU securities law. The whitepaper must describe the issuer, the project, the rights attached to the token, the technology, and the material risks. For ART and EMT issuers, additional authorisation is required from the relevant NCA before the whitepaper is published. For "other crypto-assets" – the broad residual category that covers most utility and governance tokens – the issuer notifies the NCA but is not, in most cases, required to obtain prior approval before publication.
The practical consequence is that errors in the "other" category can reach the market before any regulator has reviewed the document. ESMA has published guidance on the required content of MiCA whitepapers, and national competent authorities are developing their own supervisory expectations, but the primary gate is the issuer's own legal analysis. That analysis sits entirely at the issuer's risk. A whitepaper that mischaracterises the token's rights, overstates its stability, or omits material risks creates both a regulatory exposure and a private-law liability to purchasers who relied on the document.
In our cross-border practice, we regularly advise issuers whose user base spans the EU, the UK, and non-EU jurisdictions simultaneously. The MiCA whitepaper governs the EU offer. But the same document is read by investors in Singapore, the UAE, and the United States, each of which applies its own classification logic. A document crafted only for MiCA compliance may inadvertently misframe the instrument for a non-EU regulator – or for a claimant's expert in a later dispute.
Classification Is the Threshold Question – and the Primary Dispute Risk
Token classification is the single most consequential legal decision in a token offering, and it is the decision most frequently challenged in disputes. The logic under MiCA is sequential: if a token is a financial instrument under MiFID II, MiCA does not apply – the instrument falls into the existing securities regime supervised by ESMA and national securities regulators. If it is an EMT, MiCA's EMT chapter applies and the issuer requires authorisation as an electronic money institution or credit institution. If it is an ART, the ART authorisation track applies. Only if none of those categories fit does the "other crypto-assets" whitepaper regime apply.
The security / utility divide is not settled by a label. It is settled by an analysis of the rights the token confers in substance: does it carry profit expectations tied to the efforts of others? Does it represent a fractional interest in a revenue stream? Does its secondary-market price respond primarily to the issuer's performance? Regulators in the leading hubs – ESMA, the FCA, the SEC, MAS – each apply their own functional tests, but the direction of travel is consistent. The label on the whitepaper is the starting point of the analysis, not the conclusion.
A common assumption we encounter is that a well-drafted "utility" section in a whitepaper resolves the classification issue. It does not. When a regulatory investigation or investor claim is filed, the counter-party's expert will examine the token's actual economic function, the marketing materials, the pitch deck, the community communications, and the secondary-market price history. The whitepaper is one document in a larger evidential record. If the substance of those materials tells a different story from the whitepaper label, the issuer faces a more difficult position than if the document had been drafted honestly from the outset.
How Whitepaper Errors Become Disputes
Misclassification or materially incomplete disclosure in a MiCA whitepaper generates liability along several distinct vectors, each with its own procedural path and forum. Understanding those vectors before launch shapes both the drafting strategy and the corporate structure.
The first vector is regulatory enforcement. An NCA that concludes a token was misclassified – that it was effectively an ART or an EMT but was published under the "other" regime without the required authorisation – can issue a prohibition notice, require the issuer to remediate or withdraw the whitepaper, and impose administrative penalties. The severity varies by member state and by the degree of harm caused, but public enforcement action is damaging independently of any financial penalty because it triggers reputational consequences across the EU's passporting area.
The second vector is civil liability to investors. MiCA includes explicit civil liability provisions for whitepapers. An investor who suffers a loss as a result of information in the whitepaper that was incomplete, unfair, or not clearly presented may seek compensation from the issuer and, in some circumstances, from persons who authorised the whitepaper. This is a statutory private right of action that does not require the investor to prove fraud – negligent or reckless misstatement is sufficient. In our cross-border practice, we regularly advise on the interaction between MiCA civil liability and the parallel securities-law claims that investors in non-EU jurisdictions may assert under their own domestic regimes.
The third vector is cross-border regulatory divergence. A token that passes MiCA classification analysis as "other" may still require registration, disclosure, or exemption in the UK under FCA rules, in Singapore under the MAS Payment Services Act regime, or in the US under SEC guidance. An issuer that has published a whitepaper optimised for MiCA may find that the same document creates problems in those jurisdictions – either because the characterisation differs, or because the document itself becomes evidence in a foreign enforcement proceeding.
In a recent matter, a token issuer had published a whitepaper under the "other" MiCA category and had begun distribution to EU and non-EU users simultaneously. When a regulatory inquiry opened in a separate jurisdiction, the whitepaper's characterisation of the token's governance rights became the central point of factual dispute. The analysis we conducted identified two sections of the document where the description of those rights, read against the contemporaneous community communications, created an inconsistency that the regulator was able to exploit. Early intervention allowed the issuer to provide a consistent and accurate factual account before the investigation progressed to a formal proceeding.
What Does the Cross-Border Reality Change About Whitepaper Strategy?
The cross-border dimension of a token offering does not disappear because MiCA has harmonised the EU position. It intensifies. A single whitepaper published in English reaches investors across dozens of legal regimes simultaneously. Each regime applies its own classification test, its own disclosure standard, and its own enforcement posture.
For an issuer whose token will circulate in the EU, the UK, and the Gulf, the practical approach is to draft the whitepaper against the most demanding applicable standard and to document explicitly where it satisfies each regime's requirements. This is not the same as drafting three separate documents. It is a single document with a disciplined internal architecture that addresses each regime's key analytical questions: the nature of rights, the basis for valuation, the use of proceeds, and the governance structure.
VARA in Dubai and the FSRA in ADGM each publish their own token classification guidance, and neither maps precisely onto MiCA's categories. An issuer who has resolved classification under MiCA may still need a separate analysis for the UAE market. Similarly, MAS in Singapore applies a securities-law test that is distinct from MiCA's financial-instruments analysis. The result is that the whitepaper must be drafted knowing that it will be read by multiple regulators applying different tests, and that any inconsistency between sections – or between the whitepaper and the broader marketing record – will surface in the jurisdiction that is most aggressive in enforcement.
For issuers working with legal counsel in their home jurisdiction, the risk is that counsel optimises for the local regime without sufficient visibility into the cross-border record. We have seen this produce whitepapers that are technically compliant under MiCA but that create material exposure in the UK or Singapore markets because the document does not address those regimes' additional requirements. The solution is a coordinated review that encompasses the full distribution footprint from the start.
Securities Law and the Functional Test: Where the Disputes Actually Turn
The deepest disputes over token classification involve the application of securities law in jurisdictions that have not adopted MiCA's categorical structure. The United States remains the highest-risk environment for this analysis, given the scope of SEC jurisdiction and the broad reach of the investment-contract test. But the UK's FCA has also taken an increasingly functional approach, and several non-EU hubs are moving toward securities-style regulation for tokens that carry profit expectations.
The key question in a securities-law dispute is not what the whitepaper says. It is whether the token's economic substance – at the time of the offering and in the secondary market – satisfies the relevant functional test in the forum where the claim is brought. A whitepaper that describes a "governance token with no profit expectation" is not dispositive if the token was priced in the primary offering on the basis of anticipated protocol revenue, if the issuer's marketing materials emphasised returns, or if the secondary market price correlated closely with the issuer's business performance.
In a cross-border token offering, the issuer must therefore consider: where will disputes most likely be litigated or arbitrated? England and Wales is a leading common-law forum for crypto-asset claims; the DIFC Courts in Dubai have demonstrated sophisticated handling of digital-asset disputes; Singapore and Hong Kong are active forums as well. Each forum applies its own conflict-of-laws analysis to determine which substantive law governs the classification question. The whitepaper's choice of governing law and jurisdiction is relevant, but it is not necessarily determinative in a regulatory enforcement context, and sophisticated claimants will look for the forum that maximises their prospects of success.
The CFAAR network – the Crypto Fraud and Asset Recovery forum launched in London in September 2021 – has developed significant cross-border coordination capacity, and practitioners in that network routinely work across the multiple forums where token disputes are litigated. The implication for issuers is that a dispute over a whitepaper misclassification can quickly become a multi-forum proceeding, with coordinated claims in the EU, England, and one or more offshore hubs.
Decision Matrix: Which Issuer Profile Faces Which Risk?
Not every issuer faces the same whitepaper risk profile. The primary variables are the token's economic function, the distribution geography, the issuer's corporate location, and the nature of the secondary market. A structured view helps clarify where the disputes angle is most acute.
A governance token issued by a protocol with significant protocol revenue and a large secondary market in the US, EU, and Asia faces the highest compound risk. The token's economic function is likely to attract securities-law scrutiny in the US regardless of the MiCA classification. The distribution geography ensures that any enforcement action in one hub will create pressure in others. The whitepaper must be drafted to withstand the most demanding of the applicable tests, and the issuer's legal opinion on classification must be documented and current at the time of each material distribution event.
A utility token issued by a platform that provides a defined service – access to software, computing capacity, or a specific digital good – and that restricts distribution to non-US, non-UK jurisdictions faces a more contained risk profile under MiCA. The classification analysis is more straightforward, and the whitepaper's primary function is accurate disclosure of the platform's service and risks, rather than securities-law defence. The disputes angle here is primarily regulatory: is the disclosure complete and fair? Is the technology description accurate? Are the risk factors proportionate?
An ART or stablecoin issuer faces a different set of risks entirely. MiCA imposes authorisation requirements, reserve composition and redemption obligations, and disclosure standards that are more demanding than the "other" category. The disputes that arise for ART issuers tend to involve the adequacy of reserves, the accuracy of reserve disclosures, and – in a stress scenario – the issuer's compliance with the mandatory redemption obligation. We regularly advise on the pre-launch structuring of reserve arrangements and the drafting of reserve disclosure sections in ART whitepapers, precisely because the adequacy of those arrangements will be the central factual issue in any post-launch claim.
An EMT issuer – essentially an electronic money institution that issues tokens denominated in a fiat currency – faces the narrowest whitepaper risk profile in terms of classification, but the highest regulatory compliance burden. The authorisation requirement under MiCA's EMT chapter means that the whitepaper is reviewed by the NCA before publication. The disputes angle for EMT issuers tends to arise in the operational phase: does the token's circulation remain within the limits imposed by the MiCA regime? Are the redemption mechanisms functioning as described?
What Does a Proper Pre-Launch Whitepaper Review Cover?
A pre-launch whitepaper review conducted with the disputes angle in mind is materially different from a compliance review that asks only whether the document satisfies MiCA's mandatory content requirements. The litigation-readiness review asks a different set of questions: is this document consistent with every other material communication about this token? Will the classification analysis hold up under a functional test in the relevant foreign jurisdictions? Are the risk factors specific enough to be meaningful, or are they generic boilerplate that will not provide a meaningful defence in a civil liability claim?
The review process we apply starts with the full marketing record – the whitepaper draft, the pitch deck, the community communications, and any prior versions of the document. Inconsistencies between those materials are identified and resolved before publication. A classification opinion is prepared against the applicable tests in each jurisdiction where the token will be distributed – MiCA for the EU, the FCA regime for the UK, MAS for Singapore, and so on. Where the classification is genuinely uncertain, the opinion documents that uncertainty and the analysis on which the issuer's position rests, so that the contemporaneous record reflects a good-faith, reasoned determination rather than an unsupported assertion.
The risk-factor section receives particular attention. Generic risk disclosures provide limited protection in a civil liability claim. A risk factor that accurately identifies a specific operational, regulatory, or market risk – and describes the potential consequence and the issuer's mitigation approach – is substantially more defensible than a boilerplate statement that "the regulatory environment is uncertain." In practice, the difference between a well-drafted risk section and a poor one can determine whether a civil liability claim is viable at all, because a claimant must establish that the risk was not adequately disclosed.
The governing law and jurisdiction clause also merits careful analysis. The clause operates between the issuer and the token holder in a contractual dispute, but it does not bind a regulator and may not be effective in a securities-law claim. The choice of forum should reflect the actual distribution geography and the issuer's ability to contest a claim in the chosen forum, not simply the most favourable law available.
For issuers seeking to structure a pre-launch review as a single coordinated mandate – covering classification, cross-border distribution analysis, and whitepaper drafting – the process typically proceeds in three phases: a classification workshop in which the token's economic function is analysed against each applicable test; a document review phase in which the whitepaper draft is aligned with the classification analysis and the full marketing record; and a distribution analysis phase in which the geographic scope of the offering is mapped against the applicable regulatory requirements in each target jurisdiction.
The process above describes the standard path. Your facts – the token structure, the distribution geography, the corporate entity, the banking – change the analysis materially.
For a scoped whitepaper review and classification analysis, contact OBOLUS at info@oboluslaw.com. We can typically scope and begin a whitepaper review mandate within a matter of days of instruction. To map your options first, visit our contact page.
Airdrop Structuring and the Whitepaper: A Specific Disputes Trigger
Airdrops – distributions of tokens to existing wallet holders or community participants at no direct monetary cost – present a concentrated version of the whitepaper disputes risk. The token's classification at the point of airdrop determines whether the distribution is a securities offering, a promotional distribution of a utility instrument, or a taxable event triggering disclosure obligations. The whitepaper's description of the airdrop mechanism and the rights attached to the distributed tokens is the primary documentary basis for that determination.
A poorly structured airdrop – one that distributes tokens to a broad geographic base without regard to the local regulatory treatment of the instrument – can create enforcement exposure in multiple jurisdictions simultaneously. The MiCA regime applies to public offers in the EU; the FCA's financial-promotion rules apply to token marketing in the UK; and most major jurisdictions have some form of securities-law analysis that applies to token distributions. An issuer that treats an airdrop as outside the regulatory perimeter because "no money changes hands" is applying an incorrect analysis in most of the leading hubs.
The whitepaper's treatment of the airdrop should be drafted in parallel with a distribution analysis that maps the proposed recipient geography against the applicable regulatory requirements. Where an airdrop is limited to non-US, non-UK, and non-EU addresses, the MiCA whitepaper regime may not be triggered. Where the airdrop reaches EU users, the whitepaper obligations apply in full. The document should describe the airdrop mechanism, the eligibility criteria, and the rights attached to the distributed tokens with sufficient specificity to support the issuer's classification position.
A Common Assumption: "If It Is Not a Security, MiCA Compliance Is Straightforward"
A common assumption among issuers who have confirmed that their token is not a financial instrument is that MiCA compliance is therefore straightforward – the "other" regime is lighter-touch, the whitepaper is notified rather than approved, and the principal risk has been managed. This assumption understates the exposure significantly.
The "other" category under MiCA still imposes substantive disclosure requirements, civil liability for the whitepaper's accuracy, and marketing rules that restrict the use of free-call options and similar promotional mechanisms. The NCA notification process is not an approval, which means there is no regulatory imprimatur on the document. An issuer that relies on notification as a form of validation has misread the regime. If the whitepaper contains incomplete or misleading information, the civil liability provisions apply regardless of whether the NCA reviewed the document before publication.
Furthermore, the "not a security" analysis is jurisdiction-specific. A token that is not a financial instrument under MiFID II – and therefore does not attract the securities regime – may still be a regulated instrument in the UK, a payment token in Switzerland subject to FINMA's registration requirements, or a digital payment token under MAS's Payment Services Act in Singapore. The MiCA whitepaper provides no safe harbour in those jurisdictions. Issuers that have completed the MiCA classification analysis and stopped there have addressed one layer of the problem. The cross-border layer remains.
We assess classification against the substance of rights – not the marketing label. A utility label on a whitepaper does not resolve the legal classification in any jurisdiction that applies a functional test, and the major enforcement jurisdictions do. The classification opinion that accompanies a whitepaper review should address the full distribution geography, document the analysis, and be updated whenever the token's economic function or the applicable regulatory guidance changes materially.
If a prior whitepaper review stalled or produced an opinion that left cross-border risks unresolved, a second review can surface the structural gaps and the route to a defensible position.
To pressure-test your whitepaper classification before distribution, message us via t.me/oboluslaw or write to info@oboluslaw.com. A scoped second review is often completed in less time than the first. For mapping your options, contact us here.
Related Practices at OBOLUS
Related at OBOLUS
- Token Offerings & Securities – structuring compliant token launches across EU and non-EU regimes
- Airdrop Legal Structuring in Georgia – jurisdiction-specific analysis for airdrop classification and distribution
- AIF for Digital Assets Under Heightened Scrutiny – alternative investment fund structuring for digital-asset portfolios facing regulatory pressure
FAQ
Is my token a security?
Token classification depends on the rights the instrument confers in substance, not the label applied to it in a whitepaper or marketing document. The applicable test varies by jurisdiction: MiCA uses the MiFID II financial-instrument definition for the EU; the FCA applies its own functional analysis in the UK; MAS applies the Securities and Futures Act test in Singapore; the SEC applies the investment-contract test in the US. An instrument that passes the classification analysis in one jurisdiction may fail it in another. A multi-jurisdiction classification opinion, documented before distribution, is the appropriate basis for a defensible position.
Do I need a MiCA whitepaper?
Under the MiCA regime, any public offer of crypto-assets to EU users – other than tokens that qualify as financial instruments, e-money, or certain exempted instruments – requires a whitepaper that meets the mandatory content requirements supervised by ESMA and the relevant national competent authority. ART and EMT issuers require prior NCA authorisation before publication. Issuers of "other" crypto-assets must notify the NCA but are not, in most cases, required to obtain prior approval. The whitepaper obligation applies to the geographic scope of the offer, not the location of the issuer. An issuer outside the EU that distributes tokens to EU users is within scope.
How should an airdrop be structured legally?
Airdrop structuring requires a classification analysis of the distributed token in each jurisdiction where recipients are located, a distribution analysis mapping the proposed recipient geography against the applicable regulatory requirements, and a whitepaper that describes the airdrop mechanism and the rights attached to the tokens with sufficient specificity to support the classification position. Restricting distribution to non-regulated jurisdictions or non-qualifying recipients may reduce regulatory exposure, but the eligibility criteria must be technically enforceable and consistently applied. Tax treatment of received tokens varies by jurisdiction and should be assessed alongside the regulatory analysis.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking, and compliance that sit around them. Digital assets are the whole of our practice. We structure licensing, banking, and tax as one mandate rather than three disconnected workstreams – which means the whitepaper classification decision is made with the corporate structure, the banking relationship, and the cross-border distribution strategy already in view. We assess classification against the substance of rights, not the marketing label. To discuss your token offering, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in MiCA token classification, cross-border whitepaper analysis, and pre-launch regulatory risk assessment for token issuers.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.