On paper, a token labeled "utility" looks straightforward. In practice, the label means almost nothing to a regulator running a substance-over-form analysis. Mis-classifying a token can convert a product launch into an unregistered securities offering – with enforcement consequences that follow the issuer across borders. The legal question is not what you call the token; it is what rights the token confers, to whom, under what conditions, and in what jurisdiction.
A utility token legal opinion is a formal legal memorandum that applies the governing classification test in each relevant jurisdiction to the specific rights and mechanics of a proposed token, concluding whether the token falls within the regulated perimeter of securities law, e-money regulation, the asset-referenced token regime, or sits outside those boundaries as an unregulated instrument. This analysis draws on the MiCA regime administered by ESMA, the SEC and CFTC frameworks in the United States, the SFC licensing regime in Hong Kong, and the FINMA token taxonomy in Switzerland, among others. The page that follows maps the legal lines, the cross-border complications, and the decisions an issuer must make before a token goes live.
What Token Classification Actually Means – and Why Labels Fail
Token classification is a substance test, not a marketing exercise. Every major regulatory regime – MiCA in the EU, the securities law applied by the SEC in the United States, and the FINMA payment/utility/asset taxonomy in Switzerland – looks past the name on the whitepaper to the functional and economic reality of the instrument. If a token grants a holder a share in the issuer's profits, a governance right with economic value, or a reasonable expectation of return driven by the issuer's efforts, it behaves like a security regardless of what the documentation says.
In our practice, we encounter the same structural mistake repeatedly: an issuer drafts a whitepaper describing the token as a "access key" to a future platform, then simultaneously promises token holders that the proceeds will fund development and implies that early holders will benefit from scarcity. That combination triggers a securities analysis in most well-developed regimes.
The regulatory risk is not abstract. An issuer that sells tokens into a jurisdiction without meeting that jurisdiction's securities-offering requirements faces rescission claims from purchasers, civil enforcement, and – in the United States in particular – criminal referral. The practical consequence for a Web3 company can be an obligation to refund all proceeds plus interest, a figure that can reach material size even for a modest raise.
Classification also determines the disclosure burden. A token that is a security requires a prospectus or equivalent registration document in most jurisdictions. A token that qualifies as an asset-referenced token (ART) or e-money token (EMT) under MiCA requires an issuer authorisation and a whitepaper filed with the relevant national competent authority. A true utility token – one that grants only access rights to an already-functional platform, with no investment or profit expectation – may require neither, but the analysis to reach that conclusion must be documented and defensible.
How the Major Regimes Classify Tokens
Each flagship jurisdiction runs its own test, and the conclusions can diverge – which is precisely why a cross-border opinion is essential for any issuer with a multi-jurisdictional user base.
United States. The SEC applies the Howey test: an investment of money in a common enterprise with an expectation of profit derived from the efforts of others. The test is fact-intensive. A token pre-sold to fund platform development, with marketing emphasising price appreciation, will likely satisfy all four prongs. The CFTC asserts jurisdiction over tokens that qualify as commodities, and the overlap between the two agencies has created persistent ambiguity for tokens that do not clearly fall into either camp. FinCEN's separate money-transmission analysis runs concurrently. An issuer distributing tokens to US persons needs to address all three frameworks – and in many cases also state-level money-transmitter licensing requirements.
European Union. MiCA, supervised by ESMA and the national competent authorities, establishes three regulated token categories: ART, EMT, and "other crypto-assets". The utility token question under MiCA turns on whether the token is offered to the public in the EU and whether it falls outside the ART and EMT definitions. Tokens that are already admitted to trading or offered at scale require a whitepaper notified to the relevant national competent authority. Financial-instrument tokens – those that qualify as transferable securities – fall outside MiCA and into existing securities directives. MiCA's passporting mechanism means a token issuer authorised in one member state can operate across the EEA, making the choice of home-state regulator a structural decision with lasting consequences.
Switzerland. FINMA's three-category taxonomy – payment tokens, utility tokens, and asset tokens – is among the most clearly articulated in the world. Under FINMA guidance, a pure utility token that provides access to an application or service may sit outside the securities perimeter, but FINMA will treat hybrid tokens (utility rights combined with investment-like features) as asset tokens subject to securities regulation. Switzerland's clear taxonomy and FINMA's established engagement process make it a reference point for issuers seeking early regulatory certainty.
Hong Kong. The SFC applies a "look-through" analysis: if a token represents an interest in a collective investment scheme or a share, debenture, or equivalent, it is a security regardless of the label. The SFC's VASP licensing regime adds a layer for trading platforms. An issuer with Hong Kong retail distribution or a platform listing in Hong Kong must map its token against both the securities analysis and the VASP requirements.
Singapore. The Monetary Authority of Singapore applies the Securities and Futures Act analysis to determine whether a token is a capital markets product. Digital payment tokens – those that function purely as a medium of exchange – fall under the Payment Services Act rather than securities law, but tokens with investment features will be assessed under the capital-markets regime regardless of any utility framing.
The cross-border reality is this: a single token can be a utility instrument in Switzerland, an "other crypto-asset" under MiCA in the EU, and a security under Howey in the United States – simultaneously. An opinion addressing only one jurisdiction is not sufficient for a token distributed globally.
For a scoped multi-jurisdictional classification analysis, contact OBOLUS at info@oboluslaw.com. The process above describes the standard analytical path. Your facts – the token mechanics, the distribution plan, the jurisdiction of your entity and your users – change the analysis materially. Map your options.
What Does a Utility Token Legal Opinion Actually Cover?
A well-structured utility token legal opinion is more than a conclusion. It is a documented analytical record that the issuer can show to a regulator, an exchange, or a court to demonstrate that the classification decision was reached through a principled, good-faith process. The content and structure of the opinion matter as much as the conclusion.
The opinion begins with a precise description of the token: the rights it confers (access, governance, economic, or some combination), the technical mechanism by which those rights operate, the conditions under which the token is issued or sold, and the intended use of proceeds. This fact-gathering stage is often where issuers discover that their documentation is inconsistent – the whitepaper says one thing, the smart contract does another, and the marketing deck implies a third.
The analysis then applies each relevant jurisdiction's test to that factual matrix. For the US analysis, the opinion will walk through each Howey prong in turn, identifying the specific features of the token that support or undermine each element. For the EU analysis, the opinion will map the token against the MiCA category definitions and, if applicable, the financial-instruments analysis under the existing securities directives. For Switzerland, the opinion will apply the FINMA taxonomy. The conclusion in each jurisdiction is stated explicitly, with a confidence assessment.
The opinion also identifies structuring recommendations. If the token has features that create classification risk, the opinion will describe the structural changes – to the rights conferred, the vesting schedule, the marketing restrictions, or the distribution mechanism – that would move the instrument toward a defensible utility position. This is the most commercially valuable part of the document.
Finally, the opinion addresses the ongoing compliance posture: what the issuer must not do after issuance to avoid converting a utility token into a security through conduct. Secondary-market promotion, buyback programs, and issuer profit-sharing arrangements have all been cited by regulators as post-issuance conduct that retroactively colours the initial classification.
Does the Whitepaper Obligation Apply – and What Must It Say?
Under MiCA, a person offering crypto-assets to the public in the EU must publish a whitepaper that has been notified to the relevant national competent authority, unless a specific exemption applies. The whitepaper requirement is separate from – and in addition to – the classification analysis: even a token that is not an ART or EMT will require a whitepaper if it is publicly offered at scale in the EU.
MiCA provides exemptions that are relevant to utility token issuers. Tokens offered exclusively to qualified investors, tokens offered to fewer than a defined number of persons per member state, tokens with a total consideration below the applicable threshold across the EU, and tokens that are offered free of charge are among the categories that may fall outside the public-offer trigger. Each exemption has conditions that must be met in full – partial reliance is not available.
The content requirements for a compliant MiCA whitepaper are detailed. The document must describe the issuer, the project, the rights and obligations attached to the token, the technology, the risks, the use of proceeds, and the principal adverse impacts. It must include a liability statement. It must be updated if materially inaccurate. The liability regime for a defective whitepaper runs to the issuer and, in some circumstances, to the offeror and the person seeking admission to trading.
Outside the EU, analogous disclosure obligations exist. The US requires a registration statement or an available exemption. The SFC in Hong Kong expects disclosure proportionate to the nature of the instrument. FINMA in Switzerland does not mandate a prescribed whitepaper format, but expects that investors receive adequate information proportionate to the token's risk profile.
In our practice, we have found that issuers who treat the whitepaper as a marketing document rather than a legal instrument consistently underestimate their disclosure obligations. A whitepaper that is accurate, complete, and consistent with the smart contract is a defence. A whitepaper that overpromises or omits material risks is a liability document.
How Should an Airdrop Be Structured to Minimize Legal Risk?
An airdrop – the gratuitous distribution of tokens to wallet addresses or registered participants – sits at the intersection of securities law, tax law, and AML/CFT regulation, and the legal treatment varies significantly across jurisdictions. The classification of the airdrop as a "free" distribution does not, by itself, resolve the legal questions.
The securities-law analysis for an airdrop turns on whether recipients have provided consideration, directly or indirectly. A pure airdrop to random wallet addresses, with no prior registration, no community membership condition, and no expectation of reciprocal action, has the strongest argument for falling outside the "investment of money" prong of the Howey test in the United States. A "conditional airdrop" – where recipients must follow social media accounts, refer others, or hold a minimum balance of another token – introduces a consideration argument that weakens the utility position. Regulatory guidance on this point differs across jurisdictions, and the analysis should be conducted before the distribution design is finalised.
The tax treatment of airdropped tokens is a distinct question. Most jurisdictions that have addressed the issue treat received tokens as taxable at the point of receipt, at the fair market value on the receipt date. This creates a cost basis for future disposals but also an immediate income-recognition event for recipients – a consequence that issuers marketing the airdrop as "free" rarely communicate clearly. For the issuer, the airdrop may represent a deductible cost or a non-deductible distribution depending on the jurisdiction's treatment of the instrument.
AML/CFT obligations apply to the distributor if the airdrop functions as part of a commercial distribution mechanism. Where the distributor is a VASP (virtual asset service provider) – licensed under MiCA, the MAS Payment Services Act, or the applicable VASP provisions in other jurisdictions – the distribution of tokens may trigger know-your-customer and transaction-monitoring obligations even in a nominally gratuitous context.
Structuring an airdrop legally requires decisions on at least three axes: the eligibility conditions (to manage the consideration question), the jurisdictions of excluded recipients (to manage the securities-law perimeter), and the tax disclosure to recipients (to manage issuer reputational and regulatory risk). A legal opinion addressing all three dimensions before the distribution is announced is substantially less expensive than the remediation required after a regulator identifies a deficiency.
If your airdrop or token distribution is under design, write to OBOLUS at info@oboluslaw.com before the mechanics are finalised. A prior application that stalled or a prior distribution that attracted regulatory attention can be re-examined to identify the structural issue and the route forward. Map your options.
The Cross-Border Token Distribution Problem
A token does not stay in the jurisdiction where it was issued. Within hours of a public sale or airdrop, tokens are held by wallet addresses in dozens of countries, traded on platforms in multiple regulatory zones, and subject to the laws of every jurisdiction into which they were sold. The issuer's legal exposure is not limited to its home jurisdiction.
The United States is the most consequential jurisdiction to manage. The SEC has asserted jurisdiction over token distributions that targeted US persons, regardless of where the issuer was incorporated. Regulation S provides an exemption for offshore transactions not directed at US persons, but the conditions are technical and must be satisfied in fact, not just in form. Blocking US IP addresses at the point of sale is a start, but it is not sufficient if US persons are nonetheless solicited through social media, Discord, or other channels.
The EU creates a different challenge. MiCA's reach extends to any offer of crypto-assets to persons located in the EU, regardless of where the issuer is established. An issuer incorporated in Singapore that distributes tokens to EU residents without a compliant whitepaper and the required notification is operating outside the MiCA perimeter. The consequence is not merely a fine; it can include a prohibition on further distribution in the EU and a liability claim from EU-based purchasers.
For issuers based in the UAE, the VARA regime governs virtual asset activities conducted in mainland Dubai. An issuer licensed under VARA has a clear framework for distribution within that perimeter, but VARA authorisation does not resolve the EU or US analysis. Similarly, an ADGM-regulated issuer has clarity within the FSRA framework but faces the same cross-border issues for any distribution outside Abu Dhabi.
The practical solution is a jurisdiction matrix: a structured assessment that maps the issuer's entity location, the marketing channels, the anticipated user geography, and the token mechanics against each relevant regime. The matrix identifies the jurisdictions where the issuer is clearly outside the regulated perimeter, the jurisdictions where it is clearly inside, and the jurisdictions where the answer is fact-dependent and requires a specific opinion. This is the document that drives the distribution design.
In a recent matter, an issuer had completed a private sale and was preparing a public distribution across Europe and Southeast Asia. A pre-launch jurisdiction matrix identified that the proposed distribution structure would have triggered the MiCA whitepaper obligation and the MAS capital-markets analysis simultaneously. The issuer restructured the distribution timing and eligibility conditions before launch, avoiding both obligations through legitimate structural planning. The analysis took a matter of weeks; the remediation, had the launches proceeded as planned, would have taken considerably longer.
A Common Assumption: The Utility Label Settles the Question
The most persistent misconception in token structuring is that a "utility" label on the whitepaper resolves the classification question. It does not. Every regulator that has addressed this question – the SEC in its guidance and enforcement activity, ESMA in its MiCA implementation materials, FINMA in its token taxonomy, and the SFC in its circulars – has made clear that the economic substance of the token governs, not the name the issuer assigns to it.
The source of the misconception is understandable. In an earlier period of digital-asset markets, "utility token" was used as a shorthand for instruments that were neither securities nor e-money, and some early regulatory guidance appeared to confirm that functional-access tokens were outside the regulated perimeter. That guidance has been substantially overtaken by subsequent regulatory development. MiCA now establishes detailed criteria for "other crypto-assets" that go well beyond a simple utility claim. The SEC's enforcement record includes multiple actions against issuers who characterised their tokens as utility instruments.
The correct approach is a documented substance analysis conducted before the token is designed, not after it is sold. The analysis examines: what rights the token actually confers; whether those rights are available at the time of sale or contingent on future development; whether the marketing emphasises investment returns; whether the token is priced in a manner that implies scarcity-driven value appreciation; and whether the issuer retains a material portion of the supply in a way that aligns its interests with token-price appreciation. Each of these factors has been cited by regulators in classification determinations.
We assess classification against the substance of rights, not the marketing label. That assessment must be documented, jurisdiction-specific, and updated if the token's rights or the applicable regulatory regime changes materially after the initial opinion is issued.
Decision Matrix: Which Profile Requires Which Opinion
Not every issuer needs the same analysis. The depth and geographic scope of the opinion should match the issuer's distribution plan, funding structure, and regulatory exposure.
Profile A – Pre-launch startup, single-jurisdiction distribution, no public sale. An issuer distributing tokens only to institutional or accredited investors in a single jurisdiction, with no public offer, typically requires a focused domestic-law opinion addressing the applicable securities and e-money tests. The timeline is relatively short. The key risk is that the distribution conditions are not maintained in practice – a secondary sale to retail investors, or a social media campaign that expands the effective audience, can convert a private placement into a public offer.
Profile B – Public token launch, multi-jurisdiction user base, EU and US exposure. This profile requires a multi-jurisdictional opinion addressing, at minimum, the MiCA classification and whitepaper analysis, the US Howey and FinCEN analysis, and the FINMA taxonomy if Switzerland is in scope. The timeline is longer and the output is more extensive. The key risk is the US nexus: if US persons can access the distribution, the SEC analysis is not optional regardless of where the issuer is incorporated.
Profile C – DeFi protocol, token used for governance and fee-sharing. Governance tokens with fee-sharing or value-accrual mechanisms present the most difficult classification questions. The combination of governance rights and economic participation has been characterised as a security by multiple regulators. An opinion for this profile must address not only the initial distribution but the ongoing operation of the protocol – including any changes to the fee model, the governance structure, or the token's buyback or burn mechanics. The key risk is that post-launch protocol changes convert an initially defensible utility position into a securities-law issue without the issuer recognising the trigger.
Profile D – Token re-launch or re-structuring after a prior regulatory query. An issuer that has received a regulatory inquiry, a no-action request, or a warning letter faces a different analysis. The prior regulatory communication is itself a material fact. The opinion must address not only the current token structure but the issuer's response to the prior contact and the adequacy of any remediation steps taken. This is a higher-complexity engagement with a timeline that depends heavily on the prior regulatory record.
Related at OBOLUS
Related at OBOLUS
- Token Offerings & Securities for Digital-Asset Businesses – Full-service counsel on structuring, classification and compliant token launches worldwide.
- Security Token Offering Structuring in South Africa – Jurisdiction-specific analysis of STO structuring under South Africa's evolving digital-asset regime.
- Cross-Chain Bridge Legal Risk for Regulated Entities – How cross-chain mechanics interact with licensing and liability obligations for regulated businesses.
FAQ
Is my token a security?
Whether your token is a security depends on its economic substance, not its label. The principal test in the United States is the Howey analysis: an investment of money in a common enterprise with an expectation of profit from others' efforts. Under MiCA in the EU, tokens that qualify as financial instruments fall outside the MiCA perimeter and into existing securities directives. FINMA in Switzerland applies its own three-category taxonomy. A cross-border token offering requires a jurisdiction-by-jurisdiction analysis of the rights actually conferred, the distribution mechanism, and the marketing. Classification conclusions differ across regimes, and a utility finding in one jurisdiction does not guarantee the same result elsewhere.
Do I need a MiCA whitepaper?
Under MiCA, a person publicly offering crypto-assets to persons in the EU must publish and notify a whitepaper to the relevant national competent authority, unless a specific exemption applies. Exemptions include offers to qualified investors only, offers below the applicable consideration threshold across the EU, and free distributions meeting defined conditions. Each exemption has precise requirements. A token that is not an ART or EMT but is offered publicly at scale in the EU will typically require a whitepaper. Tokens that qualify as financial instruments are governed by existing securities directives rather than MiCA and require different documentation.
How should an airdrop be structured legally?
Legal airdrop structuring requires decisions on three dimensions: eligibility conditions (to manage the securities-law consideration argument), jurisdictional exclusions (to keep the distribution outside the US securities perimeter and other regulated zones), and tax disclosure to recipients (to address income-recognition obligations at the point of receipt). Conditional airdrops – where recipients must perform tasks or hold other tokens – are more likely to attract a securities analysis than purely gratuitous distributions. AML/CFT obligations may apply if the distributor is a licensed VASP. Structuring decisions should be documented in a legal opinion before the distribution is announced.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses – not retail claimants or individual investors. We assess classification against the substance of rights, not the marketing label, and we regularly advise issuers navigating multi-jurisdictional distribution questions where a single-jurisdiction opinion is not sufficient. To discuss your token structure, contact info@oboluslaw.com or message us via t.me/oboluslaw.
By Lydia Brennan, Tax & Structuring Analyst – specialising in token classification, cross-border structuring for digital-asset issuers, and the intersection of securities and tax law in multi-jurisdiction token offerings.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.