An NFT project can generate millions in primary sales before anyone on the founding team has considered where the issuer entity sits, what rights the token actually confers, or which securities regime is watching. That oversight is not a paperwork problem. It is the difference between a compliant digital-asset business and an unregistered securities offering. Mis-classifying a token – treating a label as a legal conclusion – can expose founders, platform operators and secondary-market facilitators to enforcement across multiple jurisdictions simultaneously. This page maps the structuring choices that matter, the legal regimes that apply and the cross-border pressure points that catch projects unprepared.
What Makes an NFT a Security – and Why the Label Does Not Decide It
Whether an NFT is a regulated instrument turns on the substance of the rights it confers, not the name on the whitepaper. The core analytical test – applied in varying forms by the SEC and CFTC in the United States, by ESMA under MiCA, and by the SFC in Hong Kong – asks whether the holder acquires an expectation of profit derived primarily from the efforts of others. A profile-picture collection sold as art carries a different analysis than a fractionalized NFT backed by a revenue-sharing pool, or an NFT that doubles as a governance token in a protocol treasury. Substance governs. A utility label on a whitepaper does not.
In our practice, the classification question rarely resolves cleanly in either direction at the outset. The more precise question is: which features of this token, in this context, on this platform, tip the analysis toward a regulated instrument? Three factors consistently drive the answer. First, the nature of the rights encoded in the smart contract – access, governance, income or a combination. Second, the economic reality of the secondary market and the messaging used to promote trading. Third, the structure of the issuing entity and who controls the protocol post-launch.
A common assumption is that once a project describes its tokens as utility tokens in the whitepaper, the legal classification is settled. It is not. Regulators in the US, EU and Hong Kong have each taken positions – sometimes informally through guidance, sometimes through enforcement – that the economic substance of a token's function controls its classification. A project that sells NFTs bundled with a profit share on platform revenue, or that actively promotes secondary-market appreciation as the investment thesis, invites analysis under securities law regardless of the label applied at mint.
For projects with users in the EU, MiCA introduces a parallel question: does the NFT fall within one of the regulated asset categories – an asset-referenced token (an ART, pegged to a basket of assets or currencies), an e-money token (an EMT, pegged to a single fiat currency), or a more general crypto-asset subject to a whitepaper notification regime? A one-of-a-kind digital artwork issued without a standardized set of rights likely falls outside MiCA's scope. A fractionalized NFT series with uniform rights and a secondary market begins to look like a crypto-asset within scope. ESMA has signaled that fractionalization and fungibility are relevant indicators.
The cross-border dimension compounds the risk. A project with a Cayman entity, US-based founders, an EU user base and a Singapore banking relationship faces potential analysis under four separate regimes simultaneously. The classification question must be answered for each jurisdiction where the token is marketed or accessible.
To pressure-test your token classification before you commit to a structure, contact OBOLUS at Map your options – the process above describes the standard analytical path, but your specific token mechanics, user base and entity structure change the analysis materially.
Entity Selection: Where Should the NFT Project Sit?
The choice of entity jurisdiction for an NFT project is not primarily a tax decision – it is a liability, enforcement and regulatory-access decision, and it has to be made before the mint. The founding entity anchors which regulator has primary jurisdiction, where enforcement can reach the founders personally, and which legal framework governs the smart-contract relationship with token holders.
Four broad profiles appear most often in cross-border NFT structuring.
The offshore holding company model – typically a Cayman or BVI entity – offers familiar fund-law mechanics, neutral tax treatment and limited liability. Under the BVI VASP Act 2022 and the Cayman VASP framework administered by CIMA, a project that facilitates secondary trading or provides custody services may nonetheless require registration. The offshore wrapper does not immunize a project from securities-law analysis in the jurisdictions where its tokens are offered or its users reside.
The EU-licensed model – using a MiCA CASP authorization in a member state such as Lithuania or Malta – provides passporting access across the EU and EEA and a clear regulatory home for projects that expect a substantial European user base. Lithuania's Bank of Lithuania has historically been a faster entry point; under MiCA the authorization pathway aligns to the CASP framework with ESMA oversight. Malta's MFSA administers the transitional process from the prior VFA regime. The cost of this model is the compliance infrastructure that comes with an EU authorization.
The ADGM or VARA model – in Abu Dhabi or Dubai respectively – suits projects targeting Middle Eastern institutional and retail markets. VARA's activity-based licence structure is explicit about which functions require a licence; the Dubai model excludes the DIFC, which has its own FSRA regime under ADGM. Both regimes have moved quickly and operators we advise report that the regulatory engagement process is substantively manageable for well-prepared projects.
The foundation model – a Swiss or Singapore foundation paired with a Cayman or BVI operating entity – is common for DAO-adjacent projects. FINMA applies a payments / utility / asset token taxonomy that can provide a workable path for certain NFT issuances, but the foundation does not by itself resolve securities-law exposure in jurisdictions where token holders reside.
The decision matrix in practice looks like this. A project with primarily EU users and a desire for regulatory certainty fits the EU-licensed model. A project focused on institutional counterparties in the Gulf fits VARA or ADGM. A project with global retail reach and a DAO governance layer more often uses the offshore plus foundation structure, accepting that each relevant jurisdiction must be separately analyzed. A project with material US-person exposure must address the SEC and FinCEN position directly, regardless of where the entity sits.
Smart Contract Legal Architecture: What Does the Code Actually Promise?
The smart contract governing an NFT is, in functional terms, a contract between the project and every holder – and the legal analysis of what it promises begins with what the code does, not what the terms of service say. A terms-of-service document that disclaims all investment characteristics while the smart contract distributes protocol revenue to holders will not resolve the classification question in the project's favor. The code governs economic reality; the marketing governs how regulators read intent.
In our cross-border practice, we regularly advise projects on four structuring questions embedded in the smart-contract layer. First, the royalty mechanism: does the contract encode a royalty that flows to the project treasury, to a DAO, or to original holders? Each path creates a different relationship with income-tax regimes and a different signal to securities analysts. Second, the governance right: does holding the NFT confer any vote on protocol parameters, treasury deployment or future issuance? Governance rights, even if framed as community participation, can push a token toward the securities boundary under certain analyses. Third, the upgrade pathway: who can modify the contract after deployment, and does that party's continued involvement satisfy the "efforts of others" element of a securities test? Fourth, the interoperability with DeFi protocols: can the NFT be deposited as collateral, wrapped or fractionalized? Each new financial primitive layered onto a base NFT reopens the classification question.
The Travel Rule (the obligation, under FATF Recommendation 15, to pass originator and beneficiary data with a virtual-asset transfer) is generally not triggered by peer-to-peer NFT transfers between self-custodied wallets, but becomes relevant the moment a licensed VASP – an exchange, a custodian, a marketplace operating as a regulated entity – facilitates the transfer. Projects integrating with licensed marketplaces need to account for this upstream.
A practical structuring discipline we apply in early-stage NFT mandates is what we call a rights-isolation analysis: mapping every economic right, governance right and access right encoded in the contract, then stress-testing each against the securities framework of the three or four jurisdictions where the project will have the most exposure. Rights that are not commercially essential and that create regulatory risk are removed from the contract before deployment. Removal after deployment is far more disruptive – and in some cases practically impossible without a migration.
How Does DAO Structure Interact with NFT Legal Liability?
A DAO – a decentralized autonomous organization – that issues NFTs with governance rights creates a layered liability question: who is responsible for the protocol's actions when the protocol is governed by token holders? The answer varies sharply by jurisdiction and by the legal form, if any, that the DAO has adopted.
An unincorporated DAO with no legal wrapper is, in most common-law jurisdictions, a general partnership by default. That means every active token-holding participant may be personally exposed to the liabilities of the enterprise. This is not a theoretical risk. Several enforcement actions in the United States have named DAO token holders as respondents on the theory that they collectively operated an unregistered exchange or investment scheme.
The available legal wrappers each address part of the problem. A Marshall Islands DAO LLC provides legal personality and limited liability, recognized in a handful of jurisdictions but not universally. A Cayman foundation company – a foundation with no shareholders, governed by its constitutional documents – is more widely recognized and allows a DAO to hold assets, enter contracts and sue or be sued. A Wyoming DAO LLC provides US legal personality but anchors the entity to US regulatory jurisdiction, which may or may not be desirable. A Swiss association or foundation is workable for European projects but carries Swiss regulatory exposure.
In each case, the wrapper does not resolve the securities question. It addresses liability allocation between participants. The question of whether the DAO's NFT issuance constitutes a regulated activity in a given jurisdiction is answered by the substance of the token's rights and the manner of the offering – not by the legal form of the DAO itself.
We regularly advise founders on the tension between decentralization and liability management. A project that is meaningfully decentralized – where no party controls the outcome of governance votes, where the protocol operates autonomously and where no founding team profits from holder activity – has a stronger argument against certain securities characterizations. But the path to genuine decentralization takes time, and the period between launch and decentralization is typically the period of highest legal risk.
What Are the Cross-Border Tax and Banking Pressure Points for NFT Projects?
Cross-border NFT projects face two practical bottlenecks that legal structuring must address in parallel with regulatory classification: tax treatment of primary-sale proceeds and of royalty flows, and access to banking and payment infrastructure.
Tax treatment of NFT issuance proceeds is not uniform. In most jurisdictions, primary-sale proceeds are ordinary income to the issuing entity. Royalty flows on secondary sales may be income or capital gains depending on the jurisdiction and the characterization of the underlying right. VAT and GST treatment of NFT sales is contested in several jurisdictions; the EU has not issued a definitive position applicable to all member states, and individual NCA positions differ. A project structured to hold intellectual property in one jurisdiction and operate in another needs a careful transfer-pricing analysis – particularly if the operational entity is in a zero- or low-tax jurisdiction and the IP is licensed to it from an onshore parent.
Banking access is a persistent operational constraint. Many correspondent banks apply blanket policies against serving crypto-native businesses, and the NFT sector is viewed with particular caution because of anti-money-laundering and sanctions-screening concerns. Projects we advise have found that banking access is significantly improved by: (a) a clear regulatory home – an MFSA, VARA or Bank of Lithuania authorization provides a named supervisor; (b) a documented AML/KYC policy applied to primary-sale participants; and (c) a credible off-ramp narrative – banks are more willing to service a business that can explain how fiat proceeds flow and where they are reported for tax purposes.
The FATF virtual assets guidance, which most VASP regimes implement domestically, does not impose direct requirements on NFT projects that are not VASPs – but projects that operate secondary marketplaces, provide custody of NFTs on behalf of users or facilitate peer-to-peer transfers through a centralized order book may cross the VASP threshold in one or more jurisdictions. That threshold analysis must be conducted separately for each relevant jurisdiction.
If your project's banking arrangements have stalled or your account was closed following a compliance review, a structural reassessment can identify the specific issue and map the path to a compliant banking relationship. Contact OBOLUS at Map your options.
Micro-Matter: Rescuing a Stalled Cross-Border NFT Structure
In a recent structuring mandate, a media-focused NFT project had launched an initial collection through a Cayman holding entity without completing a jurisdiction-by-jurisdiction rights analysis. The collection included an embedded royalty mechanism that distributed a percentage of secondary-sale proceeds to original holders. Following the launch, the project's EU banking partner raised concerns about the token structure's potential classification as a regulated instrument under the applicable ESMA guidance. The banking relationship was suspended pending clarification. We conducted a rights-isolation analysis across the four jurisdictions where the project had material user exposure, identified the royalty feature as the primary classification risk under two of the four regimes, and advised on a contract migration to a non-income-distributing royalty structure directed exclusively to the project treasury. We also drafted an updated whitepaper and legal opinion addressing the classification question for the EU banking partner. The banking relationship was restored within a matter of weeks, and the revised structure was implemented before the second collection launch. No enforcement action arose from the initial structure.
Decision Matrix: Which Structure Fits Which NFT Project Profile?
No single entity structure is optimal across all NFT project profiles. The choice turns on four axes: the nature of the rights the token confers, the geographic concentration of the user base, the founders' willingness to accept a regulatory home jurisdiction and the project's relationship with DeFi infrastructure.
Profile A – Art and collectibles, global retail distribution, no income rights. The offshore holding company model – Cayman or BVI – is the natural starting point. Securities risk is low if the token confers no governance rights, no income entitlement and no expectation of profit from the project's efforts. The primary compliance obligation is AML at the marketplace level. Timeline from entity formation to launch is typically a matter of weeks once the structure is finalized. Key risk: creeping feature addition post-launch that reopens the classification question.
Profile B – Gaming or metaverse NFTs with in-game utility and a secondary DeFi market. The foundation-plus-operating-entity model is common here. The foundation holds the IP and governs the protocol; the operating entity manages the marketplace. FINMA's token taxonomy provides a workable framework in Switzerland for the utility characterization, but the DeFi integration – staking, wrapping, collateralization – requires separate analysis under each relevant regime. Timeline is longer because the DeFi interface layer generates additional questions. Key risk: the DeFi primitives attached to the token re-characterize it as a financial instrument in jurisdictions with broad definitions.
Profile C – DAO-governed protocol issuing NFTs as governance tokens. The Cayman foundation company structure, with a separately incorporated operating entity, is currently the most frequently adopted model for this profile. The foundation provides legal personality; the operating entity manages treasury execution. Timeline from initial structuring engagement to compliant launch is typically several months for a full DAO-governance stack. Key risk: the period before meaningful decentralization is achieved, during which founding-team control may satisfy the "efforts of others" element of a securities analysis.
Profile D – Institutional-grade fractionalized NFT or tokenized real-world asset. This profile requires a regulated entity from the outset. Depending on the asset class and user base, the applicable regime may be MiCA for EU distribution, VARA for Gulf distribution or the Payment Services Act for Singapore distribution. Each of these regimes imposes capital, disclosure and custody requirements. Timeline is measured in months, not weeks. Key risk: treating the fractionalization as a structural detail rather than a regulatory trigger.
Objection Handler: Common Structuring Assumptions That Create Risk
A common assumption among NFT founding teams is that structuring decisions can be deferred until the project reaches scale. In practice, the riskiest period for an NFT project is the first mint – before the entity structure is finalized, before the classification analysis is documented, before the terms of sale are reviewed for compliance with the offering rules of the relevant jurisdictions. Enforcement actions in the digital-asset sector have repeatedly targeted the launch period, not the mature project. Retroactive structuring is more expensive, more disruptive and less persuasive to regulators than pre-launch compliance.
A second assumption is that using a non-US entity eliminates US regulatory exposure. It does not. The SEC and CFTC apply their jurisdiction based on where the token is offered and where the purchasers are located, not where the issuer is incorporated. A Cayman entity with US-resident purchasers in the buyer list for its NFT collection faces the same analysis as a Delaware LLC. The practical implication is that US-person exclusion protocols – robust enough to withstand regulatory scrutiny – must be built into the sale mechanics before launch.
A third assumption is that smart contracts are self-executing and therefore outside the scope of contract law. They are not. In England and Wales, Singapore and several other leading common-law jurisdictions, courts have confirmed that a smart contract can constitute a binding legal agreement, that code and natural-language terms interact, and that the outcome of a contract execution can be challenged on ordinary contractual grounds – mistake, fraud, misrepresentation – in addition to code-specific claims. A project that has not thought through the relationship between its smart contract, its terms of service and the legal rights of holders in their home jurisdiction has not completed its structuring work.
FAQ
Can a DeFi protocol be regulated?
Yes. Whether a DeFi protocol is subject to regulation depends on whether it performs a regulated activity – such as operating an exchange, providing custody or facilitating payments – in a jurisdiction that regulates those activities for virtual assets. The presence of smart-contract automation does not remove the activity from the regulatory perimeter if a legal person controls, deploys or profits from the protocol. Regulators under MiCA, the Payment Services Act and the VARA regime have each addressed the DeFi question, with varying conclusions. The analysis is fact-specific and entity-specific.
What legal wrapper suits a DAO?
The most widely adopted wrapper for a DAO with material financial activity is the Cayman foundation company – a foundation with no shareholders, governed by its constitutional documents, capable of holding assets and entering contracts. Marshall Islands DAO LLCs and Wyoming DAO LLCs provide US-adjacent alternatives with different jurisdictional implications. A Swiss association works for European projects with a primarily non-commercial membership model. No wrapper eliminates the need for a jurisdiction-by-jurisdiction assessment of whether the DAO's activities constitute a regulated service in each relevant market.
Who is liable when a smart contract fails?
Liability for a smart-contract failure depends on the governing law of the contract, the legal form of the deploying entity and the nature of the failure. In common-law jurisdictions including England and Wales and Singapore, a deployer who retains control or upgrade authority over a contract may carry contractual and tortious exposure. If the failure results from a known bug that was not disclosed, misrepresentation and fraud claims become possible. In a DAO context, the absence of a legal wrapper can expose active token-holder participants to general partnership liability. Structuring the deployment entity and the upgrade pathway is therefore a pre-launch risk-management step, not a post-incident consideration.
Related at OBOLUS
- DeFi, Tokenization and Smart-Contract Law – our core practice covering protocol structuring, token classification and smart-contract legal architecture for digital-asset businesses
- DeFi Protocol Legal Structuring in Canada – jurisdiction-specific guidance on structuring DeFi protocols under Canadian securities and MSB rules
- Staking and Rewards Taxation in Bermuda – analysis of how Bermuda treats staking income and validator rewards for digital-asset businesses
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess token classification against the substance of rights conferred – not the marketing label – and we have worked through classification analyses across the US, EU, UAE, Singapore and Hong Kong simultaneously on a single project. To discuss your NFT project structure, contact info@oboluslaw.com.
By Roman Levitt, Technology and DeFi Counsel – specializing in smart-contract legal architecture, token classification and DAO structuring for cross-border digital-asset projects.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.