On paper, structuring a security token offering looks like a documentation exercise. In practice, the token's legal classification – assessed by substance, not label – determines which regulatory regime applies, which investors may participate, and whether the issuer faces enforcement rather than a launch. A security token offering (an STO: the public or private sale of a blockchain-native instrument that carries the legal character of a security) sits at the intersection of capital-markets law, digital-asset regulation, and cross-border private placement rules simultaneously. The jurisdiction where the issuer is domiciled, the jurisdiction where investors are located, and the jurisdiction where the token is listed may each apply independent and conflicting rules. Getting the structure wrong at the outset converts a product launch into an unregistered securities offering – with the enforcement consequences that follow.
This analysis maps the principal regulatory regimes for STOs across the major hubs, contrasts the classification tests applied in each, and identifies the structural decisions that determine whether a cross-border offering is legally sound. It is written for the general counsel or founder who already understands the technology and needs the legal architecture.
Why Token Classification Determines Everything
Token classification is not a branding decision; it is the legal question that sets every downstream obligation. The classification test in each major regime asks what rights the instrument actually confers on the holder – not what the issuer chooses to call it. A token that entitles the holder to a share of profits, a governance vote over a protocol treasury, or a debt repayment stream will be characterized as a security in virtually every major jurisdiction, regardless of the word "utility" printed in the whitepaper. Regulators and courts apply a substance-over-form analysis, and that analysis has tightened materially as enforcement activity has increased across the leading hubs.
The practical consequence is that the classification question cannot be deferred. Issuers who rely on a utility label without a documented legal analysis face the risk that a regulator – or, in a recovery context, a court – later characterizes the instrument as a security, voiding the offering, triggering civil liability to investors, and potentially exposing founders to criminal sanction. In our practice, the most costly structural errors we see are those introduced before counsel was engaged, when the token's economic architecture was already fixed.
The four principal classification categories across the major regimes are: payment tokens, utility tokens, security tokens (asset tokens), and e-money tokens. Under MiCA, the European Union's Markets in Crypto-Assets Regulation, the distinction between asset-referenced tokens (ARTs), e-money tokens (EMTs), and "other" crypto-assets carries significant regulatory weight, with STOs governed primarily by existing EU securities law (MiFID II / Prospectus Regulation) rather than MiCA itself for instruments that qualify as financial instruments.
The cross-border dimension compounds the problem. An issuer may apply FINMA's three-category token taxonomy correctly under Swiss law and still face SEC scrutiny if US persons participate in the offering. Classification is not a once-and-done determination; it must be assessed jurisdiction by jurisdiction against the actual investor universe.
A critical early-stage decision: whether to conduct a private placement under applicable exemptions or a public offering subject to full prospectus or registration requirements. That choice shapes the entire structural architecture – from the offering document to the transfer restrictions encoded on the token itself.
For a scoped classification analysis and jurisdictional mapping, contact OBOLUS at info@oboluslaw.com. The process above describes the standard analytical path. Your token's specific economic rights, the investor geography, and the intended secondary market each alter the analysis materially.
The US Position: The Howey Test and Regulation D
In the United States, a token is a security if it satisfies the Howey test – an investment of money in a common enterprise with an expectation of profit derived from the efforts of others – and the SEC has applied that test aggressively to token offerings since 2017. The structural consequence for a US-facing STO is that either the offering must be registered with the SEC (an onerous and rarely used path for early-stage issuers) or it must qualify for a registration exemption. The principal exemptions used in practice are Regulation D (private placement to accredited investors, Rule 506(b) or 506(c)), Regulation S (offerings to non-US persons outside the US), and Regulation A+ (a lighter-form public offering up to a stated annual cap). The CFTC retains concurrent jurisdiction over tokens that function as commodities – a classification that applies to a meaningful portion of the market.
State-level money-transmitter licensing requirements and the NYDFS BitLicense may apply in parallel to any secondary-market or exchange activity touching New York. The US regulatory environment for STOs is therefore a federal-plus-state stack, and the analysis does not resolve to a single clearance. Operators we advise with US investor exposure routinely structure simultaneous US and non-US tranches, each governed by its own legal and offering-document regime, with hard wallet-level transfer restrictions blocking cross-tranche secondary transfers.
A further US-specific consideration is whether the token will be listed on a secondary market. A token that is initially structured as a security may still trade on a registered alternative trading system (ATS) or a national securities exchange, but the issuer must have established the structural conditions for that secondary market at the time of the initial offering – including the correct restrictive legends, lock-up periods, and resale registration or exemption planning. Retrofitting those conditions after launch is expensive and sometimes impossible.
How Does MiCA Treat Security Tokens?
MiCA does not govern tokens that qualify as financial instruments under existing EU law – those remain subject to MiFID II, the Prospectus Regulation, and national transpositions. The practical effect is that a well-structured EU STO sits outside the MiCA regime and inside the capital-markets regime, with all the obligations that entails: prospectus approval (or an applicable exemption), authorized intermediaries, investor categorization under MiFID II, and – for retail-facing offerings – a 10-business-day investor right of withdrawal.
This creates a two-track analysis for any EU-facing token issuer. First: does the token qualify as a financial instrument? If yes, MiCA is disapplied and the full capital-markets stack applies. If no, MiCA's whitepaper and CASP-authorization requirements govern. The line between a utility token and a financial instrument is not always obvious in practice, and national competent authorities within the EU have taken divergent positions. ESMA has published guidance on the classification question, but the final determination rests with the NCA of the member state where the issuer is authorized.
Passporting under MiCA is available for CASP authorizations but does not extend to financial-instrument offerings, which remain subject to the Prospectus Regulation's own passporting framework. A Malta-authorized CASP may passport exchange services across the EU; a Malta-authorized securities offering requires a separate prospectus passport. The MFSA administers both tracks, but they are distinct regulatory processes with distinct timelines.
Lithuania has historically been a preferred EU entry point for digital-asset operators because of relatively efficient supervision under the Bank of Lithuania. Under MiCA, that advantage migrates to the CASP authorization process; for STO structures that engage the capital-markets track, the relevant Lithuanian NCA review applies its own resourcing and timeline.
The DIFC and ADGM Routes for Gulf-Region STOs
For issuers targeting the Gulf Cooperation Council investor base or building from the UAE, two distinct legal environments are available within the same country: mainland Dubai under VARA and the financial free zones of DIFC and ADGM. Each applies its own securities and digital-asset law.
VARA governs virtual-asset activities on the Dubai mainland and operates an activity-based licensing model. A token that VARA classifies as a virtual asset – rather than a security under UAE federal securities law – may be issued and traded under the applicable VARA rulebook. Whether a given STO falls within VARA's perimeter or within the UAE Securities and Commodities Authority's jurisdiction is a classification question answered by the substance of the instrument, not by the issuer's choice of venue.
ADGM, administered by the FSRA, operates under an English common-law framework and has developed a recognized virtual assets regime with specific categories for investment-character digital assets. The FSRA applies a classification analysis broadly analogous to the MiFID II financial-instrument test. For issuers seeking a common-law-governed offering document, ADGM offers a structurally familiar environment with direct access to DIFC Courts – the leading dispute-resolution forum for digital-asset matters in the region.
In a recent cross-border STO structuring matter, a Gulf-based issuer proposed to list a real-estate-backed digital instrument to GCC and European investors simultaneously. The structure required separate classification analyses under FSRA and ESMA guidance, a VARA notification assessment, and a Regulation S determination for any US-connected investors. We coordinated the multi-track analysis and identified the single jurisdiction – ADGM – where the primary authorization could be obtained with the widest secondary passporting potential. The cross-border offering document was then structured to comply with both the FSRA's investment-instrument requirements and the EU Prospectus Regulation's disclosure standards for cross-border placements.
Singapore and Hong Kong: The Asia-Pacific Comparison
Singapore and Hong Kong represent the two principal Asia-Pacific options for STO structuring, and their regulatory approaches, while convergent in some respects, differ in ways that matter to the choice of domicile.
In Singapore, the Monetary Authority of Singapore (MAS) governs tokens through the Securities and Futures Act for instruments that constitute capital-markets products and through the Payment Services Act for digital payment tokens. A Singapore STO must first determine whether the token is a capital-markets product – if it is, a full MAS prospectus or an applicable exemption (private placement to accredited investors, for instance) governs the offering. MAS has published a digital-token checklist and a series of guidance papers that operators in our cross-border practice use as a reference framework, though the checklist is guidance only and not a safe harbor. Operators we advise structuring Singapore STOs routinely seek a formal classification opinion before any investor-facing documentation is finalized.
Hong Kong's SFC operates a VASP licensing regime for virtual-asset trading platforms and applies the same "look-through" analysis to token classification that applies to traditional securities. A token that constitutes a "collective investment scheme" or a "structured product" under Hong Kong law triggers the full prospectus and SFC authorization requirements. The SFC has been explicit that a token's label is irrelevant to its legal character. Hong Kong is also the forum where the first "tokenised" injunction in the Asia-Pacific region was granted in HCA 2417/2024, signaling that the courts there will apply mainstream civil remedies to digital-asset disputes involving securities-character tokens.
The strategic difference between Singapore and Hong Kong for an STO issuer is less about which regime is more permissive and more about investor geography and secondary-market access. Singapore's financial ecosystem connects more directly to Southeast Asian and institutional investor flows; Hong Kong connects more directly to Greater China capital. Both require substantive local presence and ongoing supervisory engagement – neither is a paper-domicile option.
To map the licence, banking, and investor-access stack for an Asia-Pacific STO, write to info@oboluslaw.com. If a prior application stalled or a classification determination has already been challenged, a second-read analysis can identify the structural reason and the route forward.
Switzerland: The Token Taxonomy and FINMA Guidance
FINMA's three-category taxonomy – payment tokens, utility tokens, and asset tokens – remains one of the most analytically rigorous classification frameworks available. An asset token under FINMA guidance is one that "represents assets such as participations in real physical underlyings, companies, or earnings streams, or an entitlement to dividends or interest payments." That definition captures most instruments that would also satisfy the Howey test, and FINMA has made clear that asset tokens are treated as securities for all Swiss regulatory purposes.
Switzerland's appeal as an STO jurisdiction stems from several structural features: a well-developed DLT-specific legal framework (the Swiss DLT Act introduced uncertificated register securities that can be issued natively on a blockchain), a FINMA no-action letter / guidance-request process that allows issuers to obtain regulatory clarity before launch, and a legal tradition that has absorbed digital-asset innovation with more speed than most civil-law jurisdictions.
The Swiss DLT Act allows the creation of register value rights – legal instruments held and transferred on a distributed ledger with full Swiss civil-law effect, eliminating the need to issue a traditional certificated security alongside the token. This is a meaningful structural advantage for issuers who want the token itself to carry legal title to the underlying right, rather than having the token represent a claim on a separately held instrument.
FINMA's guidance process is not a registration system in the US sense – it does not grant a license or a prospectus approval. For public offering purposes, a Swiss STO still requires either a Swiss prospectus approved by a recognized review body or reliance on a private-placement exemption. The Finanzdienstleistungsgesetz (FinSA) governs prospectus requirements and investor protection obligations. For issuers building a cross-border offering that includes Swiss investors or that uses Swiss legal infrastructure, the interaction between FINMA token guidance, FinSA prospectus rules, and the DLT Act needs to be mapped in full before the offering structure is finalized.
The BVI and Cayman Islands: Offshore Structuring for STOs
The British Virgin Islands and the Cayman Islands remain the dominant offshore domiciles for STO issuers, largely because of their flexibility for issuer-entity structuring rather than because of any distinctive token-offering regulatory framework. BVI FSC and CIMA each administer VASP regimes that apply to service providers – exchanges, custodians, brokers – rather than to token issuers per se, which means the offshore domicile question is often more about the issuer's corporate structure and the governing law of the token terms than about obtaining a local licence.
The BVI's VASP Act 2022 introduced a registration regime for virtual-asset service providers operating from or within the BVI. A BVI-incorporated STO issuer conducting its primary offering activities outside the BVI may fall outside the VASP Act's scope, but that analysis requires a careful fact-specific review – particularly given that BVI courts apply English common-law principles and the enforcement and recovery implications of that legal heritage are significant.
Cayman structures are typically used for the fund or SPV layer that holds the rights underlying the token rather than for the token issuer itself. A Cayman exempted limited partnership or LLC acting as the vehicle that holds the real estate, the revenue stream, or the equity stake that the token represents provides a familiar legal wrapper for institutional investors while the token layer is issued from a jurisdiction with a more accommodating STO framework. The interaction between Cayman's regulated-fund requirements (administered by CIMA) and the token layer's securities classification in the investors' home jurisdictions must be mapped explicitly – the Cayman structure does not insulate the offering from overseas investor-protection law.
Decision Matrix: Which Structure for Which Issuer Profile
No single jurisdiction is optimal for every STO. The right structure depends on the issuer's operational footprint, the investor universe, the nature of the underlying right, and the intended secondary market. The following profiles illustrate the principal decision branches.
Profile A – EU-domiciled issuer, EU retail and institutional investors, secondary listing on an EU venue. This issuer is firmly within the EU capital-markets stack. The token will be classified as a financial instrument. The offering requires a Prospectus Regulation-compliant document, approved by the relevant national competent authority. Malta (MFSA) and Lithuania (Bank of Lithuania) offer familiar supervisory environments for digital-asset issuers; both are MiCA-transition hubs. The CASP authorization for any exchange services and the prospectus process are distinct tracks that must run in parallel. Timeline: the prospectus review process is measured in months; allow for NCA resourcing and back-and-forth. Key risk: cross-jurisdictional NCA divergence on classification.
Profile B – Issuer with no EU nexus, targeting institutional investors in Singapore, the GCC, and Switzerland. This issuer can work across MAS's capital-markets product framework (Singapore), FSRA's recognized virtual-assets regime (ADGM), and FINMA's asset-token guidance (Switzerland). A private placement structure relying on accredited-investor exemptions in each jurisdiction is typically achievable without a full public prospectus, significantly reducing the regulatory burden and timeline. Key structural decisions: governing law of the token terms, the choice of primary authorization jurisdiction (ADGM has common-law enforceability advantages), and hard transfer restrictions preventing participation by US persons or EU retail investors. Timeline: typically more compressed than the public-offering track.
Profile C – US-facing issuer, primarily institutional. Regulation D Rule 506(c) (general solicitation to verified accredited investors) combined with Regulation S for non-US persons is the standard architecture. The issuer needs a legal opinion on the Howey analysis, SEC counsel to review the offering materials, and – if a secondary market is planned – an ATS partner or a broker-dealer intermediary. CFTC analysis is required if any token in the structure has commodity characteristics. Timeline varies; the SEC's no-action process is not available for most STOs. Key risk: the breadth of the US "security" definition and the jurisdictional reach of US securities law over non-US issuers who "direct" offerings into the US.
Profile D – Hybrid (real-world asset tokenization, global investor base). This is the most structurally complex profile. The issuer typically needs a primary authorization in one leading hub (ADGM or Singapore), Regulation S and Regulation D tranches for non-US and US investors respectively, a Swiss DLT Act register value right for investors who want title-on-chain, and VARA or MFSA notification depending on secondary-market venues. Offshore BVI or Cayman SPV layers are common for the underlying asset-holding structure. The multi-tranche offering document must be consistent across all applicable regimes while satisfying each jurisdiction's specific disclosure requirements. Operators we advise on this profile allocate significant lead time to the structural design phase before any investor-facing work begins.
Common Structural Mistakes in Cross-Border STOs
The most consequential mistakes in cross-border STO structuring are made in the design phase, before counsel is fully engaged.
The first and most common error is treating the utility label as a classification safe harbor. A common assumption is that calling a token "utility" in the whitepaper insulates the issuer from securities regulation. It does not. Regulators across every major jurisdiction apply a functional test. The label in the document is irrelevant; the rights encoded in the token – profit participation, governance over a treasury, revenue share, debt repayment – are determinative. We assess classification against the substance of rights, not the marketing label, and we do so before any investor communication is drafted.
The second common error is designing the token's economic rights without considering how those rights will be characterized in each investor's home jurisdiction. A token that clears the classification bar in Singapore may be a security in Germany, a collective investment scheme unit in Hong Kong, and a commodity in the US. Multi-jurisdiction classification matrices must be built before the token architecture is fixed.
The third error is failing to encode transfer restrictions at the smart-contract level. Offering-document restrictions that are not mirrored in the token's on-chain transfer logic are legally ambiguous and practically unenforceable in secondary markets. The technical implementation of transfer restrictions – including jurisdiction-based blocklists, investor-accreditation verification hooks, and lock-up period enforcement – must be designed in parallel with the legal structure, not retrofitted afterward.
The fourth error is inadequate attention to the secondary market. An STO that creates a liquid secondary market inadvertently – by listing on a DEX or by allowing OTC transfers without controls – may create ongoing registration obligations in jurisdictions the issuer did not intend to engage. Secondary-market design is part of the primary offering structure, not a separate question.
Related at OBOLUS
- Token Offerings & Securities practice – full-service advisory for digital-asset capital markets across all major hubs.
- Token legal classification: the compliance burden in practice – how classification decisions drive ongoing compliance obligations across jurisdictions.
- DeFi protocol legal structuring – legal counsel for digital-asset firms operating at the intersection of DeFi and tokenized securities.
To pressure-test your STO structure before you commit to a jurisdiction or begin investor conversations, message us via t.me/oboluslaw. If a prior application stalled or a classification determination has been challenged, a second-read analysis can surface the structural reason and the route forward.
FAQ
Is my token a security?
Whether a token is a security depends on the rights it actually confers on the holder – not on how it is labeled. Across the major jurisdictions, regulators apply a functional test: if the token entitles the holder to profit participation, revenue share, governance over a treasury, or debt repayment, it will typically be characterized as a security. Classification must be assessed jurisdiction by jurisdiction against the actual investor universe and the token's encoded rights. A documented legal analysis, produced before investor communications begin, is the standard professional baseline.
Do I need a MiCA whitepaper?
Under MiCA, a whitepaper is required for tokens that fall within the regulation's scope – broadly, crypto-assets that are not financial instruments, e-money, or central-bank-issued tokens. If your token qualifies as a financial instrument under EU law, MiCA's whitepaper obligation is disapplied and you are instead subject to the EU Prospectus Regulation and MiFID II. The threshold question is therefore whether your token is a financial instrument, which requires a classification analysis before the offering document type is determined.
How should an airdrop be structured legally?
An airdrop's legal treatment depends on the token being distributed and the conditions attached to receipt. A gratuitous distribution of a token that has security characteristics does not avoid securities regulation simply because no payment is required – regulators in the US, EU, and Singapore have each addressed this point. The issuer must assess whether the airdrop constitutes an offer of securities, whether disclosure obligations apply, and whether recipients' jurisdictions impose investor-protection requirements. Conditional airdrops – where recipients must perform a task – raise additional consumer-law and promotional-regulation considerations in several major markets.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking, and compliance that sit around them. Digital assets are the whole of our practice. We assess classification against the substance of rights, not the marketing label – the question that determines every other obligation in an STO. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when recovery is needed. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specializing in multi-jurisdiction token classification, STO regulatory architecture, and CASP/VASP authorization across the EU, UAE, and Asia-Pacific hubs.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.