On paper, labelling a token "utility" looks like a straightforward product decision. In practice, regulators from the U.S. Securities and Exchange Commission to ESMA and the SFC in Hong Kong test classification against the substance of the rights the token confers – not the language a whitepaper uses. A token issuer that gets this wrong does not merely face a compliance comment; it faces the prospect of its entire distribution being recharacterised as an unregistered securities offering, with civil enforcement, investor rescission rights and, in some jurisdictions, criminal exposure following close behind.
A utility token legal opinion (a formal written analysis of how applicable law classifies a given token and what obligations that classification triggers) is the instrument that separates a defensible launch from an improvised one. This analysis maps the classification question across the major regulatory regimes, identifies the axes on which reasonable expert views diverge, and offers a decision framework for issuers building across borders.
The sections below move from the classification principles common to every regime, through the specific tests applied in the EU, the United States, the UAE, Singapore, Hong Kong and Switzerland, to the practical questions every issuer must answer before committing capital to a launch.
Why Classification Is the First Legal Question Any Token Issuer Must Answer
Token classification drives every downstream obligation: whether a whitepaper is required, whether the distribution channel needs a broker-dealer or CASP licence, whether AML/KYC applies from day one, and how the token is taxed in the hands of the holder. Get it right at the start and the compliance path is manageable. Get it wrong and retrofitting a securities regime onto a live network is, at best, expensive and, at worst, impossible.
The FATF Recommendations – specifically the guidance on virtual assets and virtual asset service providers – establish that substance governs classification, not self-description. That principle is replicated, with local variation, in every major regime this analysis covers. A token that promises profit participation, voting rights over a treasury, or a share of revenue is treated as a security or similar instrument regardless of what the issuer calls it. A token that delivers access to a defined service and nothing more sits in a different category – but the line between the two is not drawn by marketing copy.
In our cross-border practice, we regularly advise issuers who arrive with a draft whitepaper that uses utility language throughout but whose token economics include staking rewards calculated as a percentage of protocol revenue, secondary-market liquidity commitments, or governance rights that effectively function as equity. Each of those features shifts the classification analysis. The opinion must engage with each of them.
A common assumption is that a utility label on a whitepaper settles the legal classification. It does not. The label is one data point. The rights conferred, the reasonable investor's expectations at the time of sale, the manner of distribution, and the degree to which the token's value depends on a third party's managerial efforts are the operative factors. Every credible legal opinion assesses against those factors, not against the marketing name.
For a scoped assessment of your token's classification exposure across the jurisdictions where you intend to sell or list, contact OBOLUS at info@oboluslaw.com.
The EU MiCA Classification Grid: Three Buckets and What Falls Outside Them
Under MiCA, every crypto-asset distributed in the EU/EEA falls into one of three regulated categories – an asset-referenced token (ART), an e-money token (EMT), or the residual "other crypto-assets" category – or it is excluded from MiCA's scope entirely because it qualifies as a financial instrument under MiFID II, in which case the full securities regime applies instead.
The "other crypto-assets" bucket is where most utility tokens land, and landing there is not permission-free. An issuer distributing tokens in that category to the public must publish a whitepaper notified to the relevant national competent authority (NCA) and comply with ESMA's disclosure standards. The whitepaper must describe the rights and obligations attached to the token, the technology, the use of proceeds, and the risks. A token that grants access to a software platform, with no profit-sharing or redemption right against the issuer, can be structured to sit here.
The difficult cases are hybrid tokens. A token that starts life as a pure access credential but whose smart contract includes a staking mechanism paying variable returns, or a governance module that confers economic rights, may satisfy the MiFID II definition of a transferable security. If it does, MiCA does not apply; the CASP authorisation path does not resolve the problem. The issuer needs a prospectus or an applicable exemption under the EU prospectus regime, and a distribution network limited to appropriately licenced firms.
The passporting advantage of MiCA – a CASP authorised in one member state distributing to the full EU/EEA single market – only materialises if the token itself clears the MiCA threshold. An opinion that does not address the MiFID II fallback is incomplete for any issuer targeting European retail or professional investors.
The U.S. Howey Analysis: Why It Still Dominates Cross-Border Token Opinions
The Howey test – applied by the SEC to determine whether an instrument is an investment contract and therefore a security – remains the most influential single analytical tool in utility token legal opinions globally, not because it governs every jurisdiction but because the U.S. market, U.S. institutional investors, and U.S.-accessible exchanges create unavoidable exposure for almost every issuer.
The test asks whether there is an investment of money in a common enterprise with an expectation of profit derived from the efforts of others. No single factor is determinative, and the SEC applies the test to the economic reality of the offer, not its form. Tokens sold before a network is functional – where the buyer necessarily relies on the issuer's development effort to generate value – carry the highest Howey risk. Tokens sold after a fully decentralised, operational network exists, to users who buy them to consume a service, carry materially lower risk, though the analysis is never mechanical.
The CFTC and FinCEN each have a parallel interest: the CFTC's jurisdiction over commodity derivatives can overlay a token that clears Howey, and FinCEN's money-services-business rules apply to certain token distribution models regardless of securities status. A credible U.S.-facing opinion addresses all three agencies' frameworks, not just the SEC's.
For issuers who conclude they must exclude U.S. persons entirely, the opinion must also address what structural controls – geofencing, KYC at wallet level, exchange contractual restrictions – are legally sufficient to support that exclusion, and how robust those controls must be to provide a meaningful legal defence.
VARA and ADGM: Where UAE Classification Diverges From the European Model
The UAE operates two distinct regimes for token issuers, and the classification outcome can differ materially between them. In mainland Dubai, VARA governs under its activity-based rulebooks; in Abu Dhabi's financial free zone, the FSRA within ADGM applies its own virtual asset framework.
VARA's approach to token classification centres on whether the virtual asset constitutes a "regulated activity" under the applicable VARA rulebook. VARA's investment token category captures tokens with equity-like or debt-like features; utility tokens that deliver platform access without investment characteristics are treated differently and may not require VARA authorisation for the issuer, though a VARA-licenced distribution partner may still be required for public distribution in Dubai.
The FSRA in ADGM applies a "recognised virtual assets" concept: the FSRA maintains a list of virtual assets it considers acceptable for regulated firms to deal in. An issuer seeking ADGM-based distribution of a utility token needs to understand whether its token can achieve recognition status and what that means for the distribution architecture. ADGM is a common-law jurisdiction, which makes its courts attractive for disputes – but classification decisions made under ADGM rules do not automatically translate to the VARA environment on the mainland.
In a recent structuring matter, an issuer building a token-gated loyalty programme sought to distribute to users across both the UAE mainland and the ADGM free zone. We mapped the VARA rulebook tests and the FSRA's recognised-asset criteria in parallel; the token design required a modification to the staking mechanic to remain outside the VARA investment-token category, and a separate distribution entity was established within ADGM to satisfy the FSRA's requirements for the free-zone user base. Both tracks resolved without requiring a securities-type authorisation, though the timeline extended beyond the issuer's initial plan.
Singapore and Hong Kong: Parallel Paths With Diverging Risk Profiles
Singapore and Hong Kong each offer licenced exchange access and institutional capital, but their classification tests for utility tokens run on different rails. Getting the analysis right for both – which many cross-border issuers attempt – requires treating them as independent exercises, not as a single "Asia strategy."
Under the MAS Payment Services Act, a digital payment token (DPT) is distinguished from a capital markets product. A utility token that functions as a medium of exchange or a store of value within a closed ecosystem may fall under the DPT definition, attracting MAS registration obligations for any firm that deals in or facilitates transactions in it. A token that grants access rights only – with no exchange or transfer functionality independent of the platform – may sit outside the DPT definition entirely, though MAS has signalled increasing scrutiny of claims of functional restriction.
The SFC in Hong Kong applies a securities analysis to tokens that carry investment features. Under the SFC's VATP licensing regime, a virtual-asset trading platform may only list tokens that the SFC has assessed as acceptable for retail trading. A token that clears the utility classification in Singapore does not automatically clear it in Hong Kong. The SFC's assessment factors include the degree to which the token's value depends on an issuer's ongoing efforts – a criterion that maps closely to the Howey "efforts of others" prong.
The practical implication for a dual-listing strategy: the legal opinion must be prepared in a form that is credible to both the MAS-supervised exchange and the SFC-approved platform, and the token's smart contract features must survive both tests. We have seen issuers receive a Singapore exchange opinion and then discover, at the Hong Kong listing stage, that a staking feature that was tolerated in the Singapore analysis is a disqualifying characteristic under the SFC's review criteria.
If your listing strategy spans Singapore and Hong Kong, the classification work must address both frameworks explicitly – not as a footnote to a primary-jurisdiction analysis but as equal-weight legal exercises. To map that analysis for your specific token architecture, write to OBOLUS at info@oboluslaw.com.
Switzerland: FINMA's Three-Token Taxonomy and When It Still Matters
FINMA's payment, utility, and asset token taxonomy – established in FINMA guidance and applied through Switzerland's financial market infrastructure and AML frameworks – remains one of the most clearly articulated classification systems available to issuers, even as MiCA and VARA have drawn practitioner attention to other hubs.
Under FINMA's taxonomy, a utility token is one that grants access to a digital application or service and is only intended for that purpose at the time of issue. If the token also has an investment or payment function, FINMA treats it as a hybrid and applies the more demanding regulatory classification. The critical temporal element is that the utility function must be present and operational at the time the token is issued: a token sold before the platform is live, as a right to access future functionality, sits in a legally different position than a token distributed after the platform is operational.
Switzerland also offers a fintech licence route and, for token issuers with banking-adjacent functionality, the option of pursuing a banking licence or a self-regulatory organisation (SRO) affiliation under the applicable AML provisions. A FINMA-based utility token opinion therefore covers not only classification but also the AML/CFT obligations that attach once a token is in distribution, which vary depending on whether the issuer is running a Swiss legal entity or using Switzerland primarily as a holding jurisdiction.
Decision Matrix: Which Opinion Architecture Fits Which Issuer Profile
The form and scope of a utility token legal opinion should follow the issuer's actual risk profile, not a generic template. An opinion designed for a single-jurisdiction private sale to professional investors is structurally different from one supporting a global retail-facing token generation event.
Profile A: Early-stage issuer, pre-functional network, targeting EU professional investors only. The primary opinion covers MiCA classification and the MiFID II fallback; it addresses whether a whitepaper notification to the relevant NCA is required and confirms the applicable investor restrictions. The Howey analysis is included as a protective annex because EU professional investors increasingly include U.S.-connected entities. Timeline for this work is typically a matter of weeks once the token design and documentation are complete.
Profile B: Growth-stage issuer, live network, dual-listing on Singapore and Hong Kong exchanges. The opinion architecture requires a primary MAS analysis for the Singapore listing, a separate SFC assessment for the Hong Kong platform, and a reconciliation section that identifies any token features which satisfy one regime but create exposure in the other. This is a heavier exercise; the timeline extends accordingly, and the token design itself may require modification before the opinion can be issued without a disqualifying caveat.
Profile C: Global consumer-facing token generation event with UAE structuring. The opinion stack covers VARA classification for the mainland Dubai entity, FSRA analysis for any ADGM distribution vehicle, an EU MiCA/MiFID II analysis for the European distribution channel, and a U.S. exclusion opinion that addresses the adequacy of the issuer's investor restriction controls. Allied counsel in the relevant jurisdiction supports local-law elements where a specific NCA or VARA filing is required.
In each profile, the opinion is only as reliable as the token design it analyses. A design that changes post-opinion – new staking features, governance upgrades, secondary-market liquidity mechanisms – requires the opinion to be updated. Treating the opinion as a one-time clearance document, rather than as a living compliance instrument, is the most common structural mistake we see in this area.
Cross-Border Interaction: How Tax Treatment and Banking Posture Depend on Classification
Token classification is not only a securities-law question. It propagates directly into tax treatment and the issuer's ability to maintain banking relationships, both of which have immediate practical consequences for the economics of a launch.
In most jurisdictions, the tax treatment of proceeds from a token distribution turns on what the token is: proceeds from a security issuance are treated differently from proceeds from the sale of a software access licence. Equally, the VAT or GST position of token transfers – whether the transfer of a utility token in exchange for access to a platform constitutes a taxable supply of services – varies materially by jurisdiction. An issuer that structures its entity in, say, a UAE free zone to achieve a particular tax outcome for the proceeds must confirm that the classification supporting that tax treatment is consistent with the classification opinion given to exchanges and investors in other jurisdictions. Inconsistency between the tax filing position and the securities analysis is a regulatory risk in itself.
Banking access is the other pressure point. Banks in the major financial centres apply their own internal classification logic to token issuers seeking accounts. A bank that concludes your token is a security, regardless of what your legal opinion says, may decline to open an account or close an existing one on that basis. The opinion therefore needs to be written in a form that a compliance officer at a correspondent bank can read, understand, and rely on – not as a purely technical legal exercise aimed at a regulator. We regularly advise on the preparation of classification summaries adapted for banking due-diligence purposes, which are distinct in form from the full legal opinion but draw on the same analysis.
What a Credible Utility Token Legal Opinion Must Contain
A credible utility token legal opinion is not a short-form letter confirming that your counsel has reviewed the whitepaper and considers the token to be utility in nature. It is a structured analytical document that any regulator, exchange listing committee, or institutional investor can read, follow, and rely on as independent professional work product.
At minimum, a credible opinion addresses: the specific rights conferred by the token (with reference to the smart contract, the whitepaper, and any side agreements between issuer and initial holders); the applicable legal tests in each jurisdiction covered (named regime, named regulator, no article-number shortcuts); the issuer's analysis of how each feature of the token maps to those tests; the conclusion on classification in each jurisdiction; the obligations that flow from that classification (whitepaper, registration, investor restrictions, AML/KYC); and the assumptions on which the opinion relies, with a clear statement that a change in the token design or distribution method would require the opinion to be revisited.
The assumptions section is particularly important. An opinion that silently assumes the platform will be fully operational at the time of the token distribution, or that sales will be limited to non-U.S. persons, or that no secondary market will develop in a particular jurisdiction, is carrying unacknowledged risks. Those assumptions should be explicit – and the issuer should have controls in place to ensure they remain valid throughout the distribution period.
If a prior opinion stalled at the listing-application stage, or an exchange raised concerns that the existing opinion did not address, a second-read engagement can surface the structural gap and identify whether a supplemental analysis or a design modification resolves it. To discuss that kind of review, message us via t.me/oboluslaw.
Self-Assessment: Six Questions Before You Commission a Token Legal Opinion
Before engaging counsel for a utility token legal opinion, an issuer who can answer these six questions clearly will compress the time and cost of the work substantially – and will surface the design risks that need to be resolved before, not during, the opinion process.
First: is the platform functional at the time the token is distributed? If not, the "future functionality" risk is live in every jurisdiction covered by this analysis, and the opinion will need to address it directly rather than assume it away.
Second: does the token carry any right to a share of revenue, a staking return calculated as a percentage of treasury assets, or a buyback commitment from the issuer? Any of these features shifts the classification analysis toward the investment instrument end of the spectrum in most regimes.
Third: does the token carry governance rights that confer meaningful economic control – for example, voting on token burns, treasury deployments, or fee structures? Governance rights that affect value distribution are treated as investment characteristics in several regimes, including under the SFC's assessment framework in Hong Kong.
Fourth: what is the issuer's proposed distribution method, and who are the likely first and secondary holders? An opinion based on a private placement to professional investors cannot be relied on for a public token generation event.
Fifth: which jurisdictions are in scope – for initial distribution, for exchange listing, and for the issuer's banking and holding structure? The answer to this question determines how many parallel analyses the opinion must contain.
Sixth: is there a prior opinion, and if so, does the current token design match the design the prior opinion analysed? Token designs evolve. Opinions that do not track the evolution are a liability, not an asset.
Related at OBOLUS
- Token Offerings and Securities Practice – full-scope legal counsel for token issuers from design through distribution
- Exchange Listing Legal Counsel Under Heightened Scrutiny – preparing the opinion and documentation package exchanges actually require
- Fiat On/Off-Ramp Banking: A Cross-Jurisdiction Comparison – how token classification affects banking access for issuers and exchanges
FAQ
Is my token a security?
Whether a token is a security depends on the rights it confers and the legal test applied by the relevant regulator – not on the label in the whitepaper. In the United States, the Howey test examines whether buyers invest money in a common enterprise with an expectation of profit from the efforts of others. Under MiCA, the MiFID II definition of a transferable security applies as the threshold question. In Singapore, Hong Kong, Switzerland, and the UAE, each regime applies its own classification criteria. No single answer covers all jurisdictions; a cross-border opinion is required for any issuer distributing across multiple markets.
Do I need a MiCA whitepaper?
An issuer publicly distributing tokens in the EU/EEA that fall within MiCA's "other crypto-assets" category must publish a whitepaper that meets ESMA's disclosure standards and notify the relevant national competent authority before distribution. Tokens that qualify as financial instruments under MiFID II fall outside MiCA and into the EU prospectus and securities regime instead. Certain small-scale offers and distributions to professional investors only may qualify for an exemption, but those exemptions are defined conditions, not a default. The first step is confirming which MiCA bucket – or which alternative regime – applies to your specific token design.
How should an airdrop be structured legally?
An airdrop is not inherently exempt from securities or AML regulation. If recipients provide consideration – even indirect consideration such as completing tasks, holding other tokens, or providing data – some regulators will treat the airdrop as a distribution of securities or a taxable event. A legally defensible airdrop structure documents the eligibility criteria, the absence of a profit expectation on the recipient's part, the issuer's KYC/AML controls where applicable, and the jurisdictions where recipients are excluded or capped. The classification of the underlying token governs which regulatory obligations attach; the airdrop mechanism does not change that underlying classification.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess token classification against the substance of rights, not the marketing label – the analysis that exchanges, regulators and institutional investors actually rely on. We advise crypto exchanges, custodians, token issuers and funds across more than seventy licensing jurisdictions. To discuss your situation, contact info@oboluslaw.com.
By Lydia Brennan, Tax & Structuring Analyst – specialising in cross-border token classification, proceeds treatment and the tax implications of token distribution structures across the EU, UAE, Singapore and common-law jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.