Token legal classification is not a branding exercise. A founder who labels a token "utility" without legal analysis risks converting a product launch into an unregistered securities offering – a regulatory event that triggers enforcement, mandatory disclosure obligations and, in some jurisdictions, personal liability for officers. The applicable test is substance over label: what rights does the token actually confer, and on whom, and in what economic relationship? That question is resolved by reference to the relevant regime – the MiCA (Markets in Crypto-Assets Regulation) taxonomy in the European Union, the securities law frameworks administered by the SEC and CFTC in the United States, and the activity-based licensing regimes operated by VARA, the FSRA and the SFC in the Gulf and Asia Pacific hubs. Classification drives structure, and structure determines every downstream decision: the licence type, the whitepaper obligations, the tax treatment, the banking relationship, and the ongoing compliance stack. This analysis works through the classification matrix from first principles and identifies where structuring choices genuinely move the answer.
Why token classification determines the structuring outcome
Classification is the threshold question because every subsequent regulatory obligation depends on how the token is characterised. A token that satisfies the conditions of a security under the applicable regime requires a registered offering or an available exemption, mandatory disclosure, and in most cases a licensed intermediary at the point of sale. The same token – identical code, identical economics – structured differently at issuance may fall outside the securities perimeter and attract a lighter or different regulatory touch. The structuring angle is precisely that delta: the decisions available before launch that change where the token lands in the classification matrix.
The fundamental principle – substance over label – is shared across the major regulatory regimes. Under MiCA, ESMA and the relevant national competent authorities assess token rights by reference to defined categories: asset-referenced tokens (ARTs), which stabilise value by reference to a basket of assets; e-money tokens (EMTs), referenced to a single fiat currency; and all other crypto-assets subject to MiCA's lighter third-category regime. Crucially, MiCA explicitly carves out tokens that qualify as financial instruments under the existing EU financial instruments directive – those tokens remain subject to the securities regime rather than MiCA. The carve-out means that getting to MiCA compliance first requires confirming you are not already inside the securities perimeter.
In the United States, the Howey test – an investment of money in a common enterprise with an expectation of profits from the efforts of others – remains the primary analytical tool applied by the SEC. The CFTC's concurrent jurisdiction over commodity tokens and the interplay between the two agencies adds a further dimension that an issuer structuring for US participants cannot ignore. Neither agency defers to a whitepaper label.
The structuring angle opens here: the rights embedded in a token at the protocol level, the economic relationship between issuer and holder, and the sequence of events in a launch all feed into the classification analysis. Decisions made in the design phase are not reversible once the token is live.
The four classification axes every issuer must map
Token classification turns on four analytical axes, each of which can be addressed in the structuring phase. Understanding each axis is essential before any whitepaper is drafted or any token is sold.
Axis 1 – Rights conferred. Does the token give the holder a claim on revenues, profits, or the residual value of an enterprise? Does it carry governance rights that are economically equivalent to an equity interest? Does it represent a debt claim or a redemption right against the issuer? Affirmative answers to any of these questions push the token toward the securities end of the spectrum in most regimes. Pure consumption rights – a voucher for network services with no secondary-market expectation – pull in the opposite direction, but only if the consumption use-case is genuine and functional at the time of issuance.
Axis 2 – The economic relationship. Is the issuer a counterparty with ongoing obligations to holders, or is the issuer merely a protocol deployer with no continuing relationship? Courts and regulators in multiple jurisdictions have focused on whether the issuer retains influence over the token's value – through development activity, marketing, or treasury management. The more the issuer's ongoing efforts drive the return, the stronger the securities case. Genuine decentralisation – a state most projects do not reach at launch – can reduce this nexus, but the claim must be substantiated technically and legally.
Axis 3 – The sale mechanics and investor profile. A sale to sophisticated institutional investors under a private placement exemption carries different regulatory consequences than a public sale to retail participants. The sequence matters too: a SAFT (Simple Agreement for Future Tokens) structure, for example, treats the initial sale as a securities transaction while the token itself is intended to be functional and non-security on delivery. Whether that two-step approach insulates the delivered token from securities characterisation remains actively litigated in the United States and is unresolved in several other jurisdictions.
Axis 4 – Geographic reach of the offering. Every token launch that is not technically geofenced from the outset reaches participants in multiple jurisdictions simultaneously. The classification analysis must be run in each material jurisdiction – not just the issuer's home – because securities laws apply by reference to where the investor is located, not only where the issuer sits. An issuer incorporated in a favourable jurisdiction but selling to EU retail participants is inside the MiCA regime regardless of its domicile.
What MiCA changes for EU issuers and EU-adjacent token sales
MiCA introduces a harmonised EU-wide classification and disclosure regime that replaces the patchwork of national rules and creates a single whitepaper obligation for most token issuers targeting EU participants. For structuring purposes, MiCA's most important feature is the clarity it offers on the non-security side of the line – and the explicit carve-out for tokens that cross into the securities category.
Under MiCA, an issuer of crypto-assets other than ARTs or EMTs must publish a whitepaper (the document providing prescribed disclosure about the token, the issuer and the project) and notify the relevant national competent authority before any public offer in the EU. The obligation attaches to the public offer, not to the issuer's jurisdiction of incorporation. A Cayman-incorporated issuer offering tokens to French retail investors is not exempt from the whitepaper requirement simply because Cayman law does not impose one.
ESMA and the national competent authorities that administer MiCA have authority to investigate whether a token that is presented as falling outside the securities carve-out actually does so. A whitepaper that misdescribes the token's rights is not a shield; it is evidence in an enforcement proceeding. The structuring discipline under MiCA is to ensure that the rights documented in the whitepaper accurately reflect the rights coded into the token – and that both are consistent with the regime under which the issuer is operating.
For ART issuers, the authorisation threshold is higher: MFSA in Malta, the Bank of Lithuania and the other NCAs with established crypto practices are handling CASP authorisations under MiCA. An ART issuer needs authorisation as a credit institution or as an issuer approved under MiCA's specific ART chapter, with reserve composition and redemption obligations that go significantly beyond a standard whitepaper filing. EMT issuers face a similar requirement, with alignment to the e-money regime. Structuring an instrument that would otherwise qualify as an ART or EMT as a "standard" crypto-asset to avoid those obligations is a classification error with enforcement consequences.
The cross-border angle is acute: MiCA passporting allows a CASP authorised in one EU member state to operate across the entire EU/EEA, which means the choice of NCA for the primary authorisation carries strategic weight for any issuer planning EU-wide distribution. Lithuania's established VASP infrastructure and Malta's MFSA both have track records with digital-asset applicants, and the relative processing pace and supervisory culture of each NCA is a material input to the jurisdiction selection.
To discuss how MiCA applies to your planned token offering – and which NCA presents the most efficient path to authorisation – contact OBOLUS at info@oboluslaw.com.
U.S. securities law: the Howey analysis and its limits for token issuers
No token issuer with U.S. participants can avoid the Howey analysis, and no structuring choice eliminates it entirely. The test – an investment of money, in a common enterprise, with an expectation of profits derived from the efforts of others – is fact-intensive and applied by the SEC to the economic reality of each offering, not to its formal documentation.
Several structuring choices are consistently relevant. First, the functionality of the network at the time of sale: a token sold when the network is not yet operational is far more likely to satisfy the Howey test because buyers have no present consumption use for the token and must rely on the issuer's continued development efforts to generate any return. Second, the degree to which the issuer has made public representations linking the token's value to the issuer's own work – development roadmaps, ecosystem grants, marketing campaigns – all strengthen the "efforts of others" prong. Third, the profile of the initial sale: an institutional placement under Rule 144A or Regulation D is not a public offering in the U.S. securities law sense, but it does not make the token a non-security; it makes it a privately placed security.
The CFTC asserts jurisdiction over tokens that qualify as commodities rather than securities, and where a token lacks a contractual relationship with an issuer and trades on a spot basis, the CFTC's regulatory space has historically been broader. That jurisdictional line is actively contested and has been the subject of significant regulatory policy activity. Issuers structuring for the U.S. market must account for both agencies' analytical frameworks – and the interaction with FinCEN's money-services business requirements and NYDFS's BitLicense regime for any business with New York nexus.
In our practice, the most common mistake is an issuer that correctly identifies Howey as the relevant test but then structures around a single prong without considering the holistic application. A token with strong consumption utility but issued through a centralized presale, to retail participants, by a team that publicly discusses expected price appreciation, will often still satisfy Howey notwithstanding the utility features. The SEC's analysis focuses on the totality of the economic relationship at the time of sale, not the eventual state of the network.
The Gulf and Asia-Pacific classification regimes: activity-based analysis
VARA in Dubai, the FSRA in Abu Dhabi's ADGM, and the SFC in Hong Kong each apply activity-based regulatory models that are structurally distinct from both the MiCA taxonomy and the U.S. securities analysis. Understanding this distinction matters for issuers selecting a domicile or planning a multi-hub launch.
Under the VARA regime, the regulatory perimeter is drawn around the activity undertaken rather than the token type alone. An issuer that manages a token's issuance and primary distribution within Dubai requires a licence for the relevant activity – advisory, exchange, management or a combination. VARA's rulebooks specify detailed conduct and disclosure requirements applicable to virtual asset activities, and the Dubai Mainland scope of VARA's authority means it operates separately from the DIFC, which has its own financial services framework. An operator structuring a dual-entity structure with a Dubai Mainland issuance vehicle and a DIFC-based fund must account for both regimes.
The FSRA within the ADGM applies a "recognised virtual assets" concept that determines which tokens may be dealt in by FSRA-regulated entities. The list of recognised assets reflects a substance-over-form assessment by the regulator, and the classification of a novel token for FSRA purposes requires a regulatory dialogue that should be initiated early in the structuring process, not after the token is deployed.
The SFC in Hong Kong operates a VASP licensing regime for virtual-asset trading platforms, with the classification question turning on whether the token constitutes a "security" under Hong Kong law – which applies a test functionally similar to the rights-based analysis used in the UK and Commonwealth jurisdictions. For token issuers contemplating a Hong Kong listing or distribution channel, the SFC's position on the specific token's classification is a precondition to any compliant launch. The SFC's VATP framework imposes additional requirements on the types of tokens that may be listed on licensed platforms, which means the classification decision made by the issuer upstream affects the platform's own compliance obligations downstream.
For an operator sitting between the Gulf and Asia-Pacific hubs, the classification analysis must run in parallel across both jurisdictions. We regularly advise issuers that a structure optimised for VARA compliance requires a separate classification opinion for SFC purposes, because the two regulatory frameworks approach the same token from different analytical starting points.
The decision matrix: which structure fits which issuer profile
Token structuring is not one-size-fits-all. The correct structure depends on the issuer's business model, the intended token rights, the geographic profile of anticipated holders, and the regulatory environment in the primary distribution jurisdiction. The following matrix is illustrative of the main profiles we encounter in practice.
Profile A – Infrastructure protocol issuing a native transaction token. This profile presents the strongest case for a non-security characterisation, provided the network is functional at launch, the token's primary use is transaction fee payment or resource allocation, and the issuer has not made representations linking token value to the issuer's own future development work. The applicable regime in the EU is MiCA's third-category regime, triggering a whitepaper obligation but not CASP authorisation for the token itself. In the US, the Howey analysis turns heavily on the timing of sale relative to network functionality. Structure recommendation: delay the public sale until the network is operational; avoid issuer-controlled secondary-market activity; publish a whitepaper that accurately documents the consumption mechanics.
Profile B – Platform issuing a governance and revenue-sharing token. Revenue-sharing rights almost invariably satisfy the profit-expectation prong of Howey and their equivalents in the EU, Gulf and Asian regimes. This profile is a near-certain security in most major jurisdictions. Structure recommendation: the offering must be structured as a private placement to accredited or professional investors under applicable exemptions; retail distribution requires authorisation or must be excluded; CASP authorisation under MiCA for the EU dimension; and SEC-registered offering or registered exemption for any US participants. The governance rights can remain but the economic rights require the securities overlay.
Profile C – Stablecoin issuer pegged to a single fiat currency. An EMT under MiCA, requiring authorisation at issuer level with ongoing reserve and redemption obligations under MiCA's EMT chapter. In the US, a stablecoin issued to consumers may attract both securities and money-transmission analysis depending on reserve structure and redeemability. Structure recommendation: authorise as an EMT issuer in at least one EU/EEA jurisdiction before any EU distribution; obtain the relevant payment institution licence for the US; ensure reserve composition is documented and auditable from day one. The FSRA and VARA have their own stablecoin-specific requirements that must be layered in for Gulf distribution.
Profile D – Early-stage project raising through a SAFT. The SAFT treats the initial investment as a securities transaction, sold to accredited investors under Regulation D in the US context. The theory is that the token delivered at a later stage – when the network is functional – is not itself a security because the investment component has already been transacted. That theory is not settled law, and in our practice we advise clients that the SAFT structure reduces but does not eliminate securities risk on the delivered token. The EU, Gulf and Asia-Pacific equivalents of this structure require separate analysis in each jurisdiction. Structure recommendation: the SAFT is a legitimate institutional-raise tool; build in the classification opinion for the delivered token as a condition to delivery; do not represent to SAFT investors that the delivered token will be freely tradeable without first confirming the classification in each distribution jurisdiction.
If your profile does not fit neatly into one of these categories – most real projects do not – a structured legal analysis of the specific token economics is the first step before any decision is made. Write to us at info@oboluslaw.com to scope an assessment.
The utility label myth: the objection we hear most
A common assumption among founders is that attaching a "utility token" label to a whitepaper, and restricting token rights to platform access or service consumption on the face of the document, resolves the classification question in the issuer's favour. It does not. Regulators in every major jurisdiction have moved firmly to a substance-over-label standard, and the analysis looks through the whitepaper to the economic reality of what the token does.
The utility label argument fails most often for two reasons. First, the token's secondary-market behaviour: a token sold at a price that is transparently disconnected from its consumption value – because the network is not yet built – is purchased for investment return, not for utility, regardless of how the whitepaper describes it. Second, the issuer's own conduct: public statements by founders projecting token price appreciation, ecosystem development plans tied explicitly to token value, and treasury management strategies that buyback tokens from the market all provide evidence that the economic relationship between issuer and holder is investment-based, not consumption-based.
We have seen this issue arise repeatedly in projects that received informal external comfort that a "utility" label would suffice. That comfort is not a legal opinion and it does not transfer risk. The classification analysis must be conducted by counsel reviewing the full set of token rights, the offering mechanics, the issuer's public communications and the anticipated holder profile in each relevant jurisdiction – not by reference to what the whitepaper calls the token.
The practical fix is not simply to restructure the label. It is to restructure the rights. If a token genuinely needs to carry profit expectations to attract investors at the fundraising stage, the securities path – properly structured – is the right path. Attempting to dress a security as a utility token does not reduce regulatory risk; it amplifies it by adding the possibility of a fraud or misrepresentation claim alongside the underlying securities violation.
Airdrop and secondary distribution: structuring the post-launch phase
The classification analysis does not end at the primary token sale. Airdrops, liquidity mining programs, staking reward distributions and secondary-market listings each raise distinct classification and compliance questions that must be anticipated in the structuring phase.
An airdrop – a distribution of tokens to wallet addresses without direct monetary consideration – is often assumed to be outside the securities offering perimeter because no investment is made. That assumption is incomplete. Where an airdrop is conditional on prior investment activity, on holding another token with an expectation of value appreciation, or on completing tasks that generate value for the issuer, a regulator may characterise the condition as equivalent to consideration for the token received. The classification of the airdropped token follows the same substance-over-form analysis as a sold token: if the token confers investment-type rights, the airdrop is a distribution of a security regardless of the absence of direct monetary payment.
Under MiCA, airdropped tokens are not automatically exempt from whitepaper requirements. The relevant exemption applies to tokens offered free of charge without any consideration or equivalent obligation, and the scope of "free of charge" is interpreted narrowly. An airdrop that requires wallet activity, social media engagement or referral generation as a condition is unlikely to qualify as a genuinely consideration-free distribution.
Secondary-market listings raise a different but related concern. A token that was not a security at primary issuance can become subject to secondary-market regulation under MiCA or national securities laws if the circumstances of trading change – for example, if the token acquires profit-distribution features through a governance vote after launch. We advise clients to build ongoing classification monitoring into their token governance documentation, so that material changes to token rights trigger a fresh legal assessment before the change is implemented.
From a tax structuring perspective, which sits at the centre of Lydia Brennan's practice at OBOLUS, the airdrop mechanics also determine the tax event: in most jurisdictions, a token received in an airdrop with no consideration attached triggers a different tax characterisation than one received through a mining, staking or work-for-token arrangement. The classification decision and the tax position must be developed in parallel, not sequentially.
Micro-matter: reclassification ahead of a Gulf distribution
In a recent structuring matter, a token issuer that had conducted an early-stage institutional raise under a private placement regime approached OBOLUS ahead of a planned public distribution campaign targeting participants in the Gulf and Asia-Pacific regions. The token had been structured with governance rights and a protocol revenue-sharing mechanism that had been appropriate for the institutional placement but that, on a fresh classification analysis, would have been characterised as a security under the VARA regime and would have raised comparable concerns under the FSRA framework. We identified the classification exposure before the distribution campaign launched, restructured the revenue-sharing mechanics to remove the issuer-obligation element and documented the functional consumption rights that supported a non-security characterisation under both regimes. The issuer proceeded with its campaign with a compliant whitepaper and the appropriate VARA activity registration, avoiding what would otherwise have been an unregistered securities distribution in two of the Gulf's principal regulatory jurisdictions.
Cross-border classification: the multi-hub reality
Every token launched on a public blockchain is, from the moment of deployment, accessible in every jurisdiction where the internet is accessible. This is the central cross-border tension in token classification: the issuer's chosen domicile determines which regulator has primary supervisory authority, but it does not determine the regulatory exposure in the jurisdictions where holders are located.
Operators we advise routinely underestimate the jurisdictional footprint of a token launch. A project domiciled in a jurisdiction with a light-touch classification regime – the BVI, the Cayman Islands, or a jurisdiction outside MiCA's reach – is not insulated from EU enforcement action if EU residents hold the token in material numbers. ESMA and the NCAs have asserted authority over token issuers that have no EU establishment but whose tokens are publicly traded and held by EU retail investors. The MiCA whitepaper obligation and the carve-out analysis for financial instruments both apply on this extraterritorial basis.
The same logic applies in the Gulf: VARA's regulatory perimeter covers virtual asset activities conducted in or from Dubai regardless of the issuer's corporate seat, and the FSRA in the ADGM takes a similar position. An issuer that structures its token through a BVI vehicle but conducts its distribution activity – marketing, community management, exchange listings – from Dubai is inside VARA's jurisdiction on an activity basis.
The practical implication for structuring is that the entity through which the token is issued and the entity through which distribution activity is conducted may need to be different, with a clear legal separation between the two functions and a defensible basis for the classification in each relevant jurisdiction. In our cross-border practice, the multi-entity structure is often the correct answer – but only if each entity's function is substantively distinct and the cross-entity arrangements are documented at arm's length.
Allied counsel in the relevant jurisdiction are engaged where local law opinions are required as part of a multi-hub classification exercise. The analysis is coordinated centrally through OBOLUS to ensure consistency across the matrix.
Related practices at OBOLUS
Related at OBOLUS
- Token Offerings & Securities – end-to-end legal structuring for compliant token launches across major jurisdictions
- Security Token Offering Structuring in the Bahamas – jurisdiction-specific analysis for STO structures through the Bahamas regulatory regime
- Alternative Investment Funds for Crypto: A Legal Guide – how AIF structures interact with token issuance, custody and investor obligations
If the classification question on your token is unresolved, now is the right moment to address it. The process above maps the standard analytical path. The specific rights embedded in your token, the geographic profile of your holders, and the regulatory environment in your primary distribution jurisdictions will shape the outcome in ways that a general analysis cannot predict. Write to us at info@oboluslaw.com or message via t.me/oboluslaw to scope a classification opinion.
FAQ
Is my token a security?
The answer depends on the rights the token confers, the economic relationship between issuer and holder, the mechanics of the offering, and the jurisdiction where holders are located. No label in a whitepaper determines this. In the EU, MiCA's financial instruments carve-out and ESMA's guidance provide the analytical frame; in the US, the SEC applies the Howey test to the economic reality of the offering. A formal classification opinion, reviewed against each material jurisdiction, is the only reliable basis for a compliant launch.
Do I need a MiCA whitepaper?
If your token is not an ART, an EMT, or a token that qualifies as a financial instrument under existing EU law, and you are making a public offer to EU participants, a MiCA whitepaper obligation applies. The obligation attaches to the offer, not to the issuer's domicile. ART and EMT issuers face additional authorisation requirements beyond the whitepaper. Tokens offered free of charge without any equivalent obligation may be exempt, but the scope of that exemption is narrow and requires legal confirmation before relying on it.
How should an airdrop be structured legally?
An airdrop must be assessed for classification risk on the same substance-over-form basis as a primary sale. If the distributed token carries investment-type rights, the absence of direct monetary consideration does not convert it into a non-security distribution. Conditions attached to airdrop participation – wallet activity, task completion, referral generation – may constitute equivalent consideration for MiCA and securities law purposes. The tax treatment of received tokens also varies by jurisdiction and by the mechanics of the distribution, and the legal and tax analysis should be conducted together before any airdrop program is launched.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess token classification against the substance of rights, not the marketing label, and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. To discuss your situation, contact info@oboluslaw.com.
By Lydia Brennan, Tax & Structuring Analyst – specialising in the intersection of token classification, cross-border tax treatment and structuring for digital-asset issuers across EU, Gulf and Asia-Pacific regulatory regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.