Token classification in Bermuda turns on substance, not label. Under the Digital Asset Business Act (DABA) regime administered by the Bermuda Monetary Authority (BMA), a token's legal character is determined by the economic rights it confers – not by what an issuer calls it. A token that grants profit participation, governance rights tied to residual value, or a right to share in enterprise proceeds can fall within the regulated perimeter regardless of whether the whitepaper describes it as a "utility" instrument. Getting that analysis wrong converts a product launch into an unregistered securities offering.
Bermuda has built one of the most explicitly structured digital-asset regimes in the Atlantic basin. The BMA supervises digital asset businesses under DABA and addresses token issuances under the Digital Asset Issuance Act (DAIA), which imposes registration and disclosure requirements on public token offerings. For operators considering Bermuda as a base – or as the legal home for a token launch – the classification question is the threshold determination that shapes every downstream decision: whether DAIA registration is required, which BMA licence category applies, and how the offering interacts with securities law in the jurisdictions where tokens are distributed.
This page sets out the classification analysis under Bermuda law, the practical steps to a compliant offering, the cross-border complications that most operators underestimate, and the decision point at which outside counsel becomes necessary.
How does Bermuda classify digital assets legally?
Bermuda's classification regime distinguishes broadly between digital assets that are securities and those that are not. The BMA's approach under DABA and DAIA is functional: it asks what the token actually does and what rights it actually confers, assessed against the substance of the instrument rather than the label applied in marketing materials. A token that, in practice, gives holders a share in the financial performance of an enterprise will attract securities-equivalent treatment even where the issuer has structured it as a "utility" access right.
The key categories relevant to a Bermuda-based issuer are: tokens that function as securities (triggering DAIA registration and full disclosure obligations); tokens that are payment instruments or digital currencies (subject to DABA licensing for the business operating with them); and tokens that are genuinely consumptive utility instruments with no investment character. The last category is the narrowest in practice. Regulators – including the BMA – apply a substance-over-form analysis that is consistent with the direction of travel in leading jurisdictions: the ESMA guidance under MiCA, the SFC's position in Hong Kong, and the SEC's long-standing economic-substance test in the United States all converge on the same analytical axis.
In our cross-border practice, we regularly advise issuers who discover late in a project cycle that a token they designed as a utility instrument has accumulated rights – secondary-market liquidity mechanisms, staking rewards tied to treasury performance, governance votes with economic consequence – that collectively shift its classification toward the securities end of the spectrum. The analysis is not binary; it is a graduated assessment that must be conducted token-by-token, on the final version of the smart-contract and whitepaper, not on a preliminary concept deck.
What does DAIA registration require for a token offering?
An issuer conducting a public token offering in or from Bermuda is required to register with the BMA under the Digital Asset Issuance Act and to publish a digital asset offering document – Bermuda's statutory equivalent of a securities prospectus – that meets the BMA's prescribed disclosure standards. Registration is not a formality. The BMA reviews the offering document, the issuer's governance structure, the rights attached to the tokens, the use of proceeds, and the fitness of key persons before authorising the offer to proceed.
The offering document must describe the token's characteristics, the issuer's business, material risk factors, and the rights and obligations of token holders with precision. Errors or omissions in that document carry civil and regulatory consequence. The BMA may suspend or revoke an authorisation, and investors who suffer loss in connection with a materially misleading offering document may have statutory recourse.
For the cross-border operator, the DAIA registration is one layer. A Bermuda-registered offering does not create a passport into the EU, the United States, or the United Kingdom. Each jurisdiction in which tokens are distributed applies its own classification test to the same instrument. An operator who obtains BMA authorisation and then sells tokens to EU retail users must separately assess whether those tokens are asset-referenced tokens or e-money tokens under MiCA, triggering ESMA-supervised issuer authorisation. Distribution to US persons implicates FinCEN's virtual asset framework and, depending on classification, SEC or CFTC oversight. The BMA authorisation is necessary but not sufficient for a global distribution.
For a scoped assessment of your token's classification across the jurisdictions relevant to your distribution plan, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base, the banking relationships – change the analysis materially. Map your options.
Does calling a token a utility instrument settle its legal classification?
It does not. A utility label on a whitepaper is a marketing choice, not a legal determination. The BMA – consistent with every major regulator operating in this space – looks through the label to the economic substance of the rights the token confers. This is the most consequential misconception we encounter in practice, and it is worth addressing directly.
A common assumption is that drafting a whitepaper that describes tokens as access rights, rather than as investment instruments, insulates the issuer from securities regulation. In practice, the BMA will assess: whether the token is marketed with reference to expected appreciation; whether secondary-market trading mechanisms are embedded in the design; whether holders derive economic benefit from the performance of the issuer's enterprise; and whether governance rights carry real economic weight. The presence of any one of these features does not automatically trigger securities treatment, but their combination – assessed in the context of the offering's commercial reality – frequently does.
We assess classification against the substance of rights, not the marketing label. That means reviewing the final smart-contract code, the whitepaper, the token economics model, and the distribution mechanism as an integrated whole. Changes to any one element can shift the classification conclusion. Issuers who receive a classification opinion based on an early draft and then modify the token design before launch are operating without a current legal position.
What cross-border risks arise when distributing tokens from Bermuda?
Distribution risk is the area where Bermuda-incorporated issuers most frequently underestimate their exposure. Bermuda is a credible and well-regulated jurisdiction for a digital-asset business. It is not, however, a shield against regulatory reach from jurisdictions in which tokens are actually received by users.
The United States is the clearest example. US persons are subject to the SEC's securities analysis regardless of where the issuer is domiciled. An issuer that structures around US person exclusions must implement those restrictions at the technical level – wallet-address verification, geofencing, KYC at the point of distribution – and must maintain documentary evidence that the exclusions were operative. A commercial-grade whitepaper restriction without a technical enforcement mechanism will not satisfy a US regulator examining the offering after the fact.
The EU picture is similarly layered. Under MiCA, an issuer marketing tokens to EU retail users faces the CASP authorisation regime for service providers and the ART/EMT issuer authorisation track for stablecoins or asset-referenced instruments. A Bermuda entity with no EU establishment operating toward EU users may still be within MiCA's territorial scope, depending on the facts. The ESMA guidance on reverse solicitation is narrow and should not be read as a broad safe harbour.
Banking is a separate constraint. Bermuda has a well-developed private banking sector with genuine experience in digital-asset businesses. However, a token issuer whose offering has not been classified and documented with care will encounter difficulties opening and maintaining business bank accounts both in Bermuda and in correspondent relationships. Banks apply their own substance-over-form analysis; an account relationship built on a token characterised as utility that is later reclassified as a security creates compliance exposure for the bank, which the bank will manage by exiting the relationship.
In a recent structuring matter, a token issuer domiciled in a mid-Atlantic jurisdiction was preparing a public offering and had relied on an informal utility classification from an early-stage advisor. We reviewed the final token design and identified that the staking mechanism, when read alongside the governance structure and the secondary-market liquidity pool, produced a composite rights package that met the economic-substance threshold for securities treatment in three of the five distribution jurisdictions. The issuer redesigned the staking mechanism and added technical user restrictions before launch, achieving a clean classification position across the relevant regimes.
How does token classification interact with the BMA licence requirement?
Classification and licensing are related but distinct questions. Whether a token is a security determines whether the offering requires DAIA registration. Whether the business operating with digital assets requires a BMA licence under DABA depends on the activity: issuing, selling, buying, exchanging, arranging transactions in, or managing digital assets for or on behalf of others each trigger a licence requirement under the DABA regime.
A company that issues tokens classified as digital assets (whether or not they are securities) and provides a trading platform or custody service alongside the issuance will likely require both a DAIA registration for the offering and a DABA licence for the operating business. The BMA assesses these requirements independently. An operator who obtains one without the other is not compliant.
The licence category also matters for ongoing obligations. BMA-supervised digital asset businesses are subject to AML/CFT requirements consistent with the FATF Recommendations, including the Travel Rule (the obligation to pass originator and beneficiary data with a transfer of digital assets above the applicable threshold). Compliance with the Travel Rule requires a technical and operational infrastructure that many early-stage issuers have not built at the time they first approach the BMA. Regulators in the leading hubs increasingly expect that Travel Rule readiness is demonstrated as part of the licence application, not after authorisation.
What is the process for a Bermuda token offering authorisation?
A DAIA registration for a public token offering typically begins with pre-application engagement with the BMA – a stage that experienced counsel use to identify classification questions, disclosure gaps, and fitness concerns before a formal submission is made. The BMA operates a structured review process: the offering document is submitted, the BMA issues queries, the issuer responds, and the BMA determines whether to grant registration. The process is iterative and document-intensive.
Timeline from initial engagement to BMA authorisation varies depending on the complexity of the token structure, the completeness of the submission, and the BMA's current caseload. Simple, well-structured offerings with experienced counsel tend to move more quickly; novel structures or incomplete submissions extend the process materially. Operators should plan for a multi-month process and should not set a public launch date before the BMA review is substantially advanced.
Parallel workstreams typically running alongside the BMA review include: legal opinions on classification in key distribution jurisdictions; AML/CFT policy drafting and Travel Rule vendor selection; banking relationship establishment; and, where the token is to list on an exchange, early-stage exchange-listing due diligence. Each of these workstreams has its own timeline, and delays in any one can hold up the others. We regularly advise on coordinating these parallel tracks to prevent bottlenecks.
If a prior application stalled or a bank account was closed in connection with a token offering, a second read can surface the structural reason and the route forward. Write to us at info@oboluslaw.com or message us via t.me/oboluslaw. Map your options.
Which operator profile should structure a token offering through Bermuda?
Bermuda works well for a specific profile of token issuer. It does not work for every one. Choosing the right jurisdiction for a token offering involves matching the issuer's profile against the regime's strengths, and Bermuda's profile is distinct from, say, a MiCA-passport structure through Lithuania or a Singapore MAS-licensed issuance.
Profile A – Atlantic-basin issuer, non-US-focused distribution, seeking a common-law regime with BMA credibility: Bermuda is a strong fit. The BMA has demonstrated commitment to the digital-asset sector, the common-law legal environment is familiar to institutional counterparties, and the DAIA framework provides a recognised disclosure mechanism. Banking relationships are accessible for well-structured issuances. The cross-border note: distribution into the EU still requires MiCA assessment, and US-person restrictions must be technically enforced.
Profile B – EU-focused issuer seeking single-regime access to all EU/EEA retail users: A MiCA CASP structure through a member state – Lithuania or Malta for speed of access, though each carries different operational demands – will provide passport rights that Bermuda cannot. Bermuda can complement a MiCA structure as the holding or treasury jurisdiction, but it is not a substitute for EU authorisation where EU retail distribution is the primary commercial objective.
Profile C – US-connected issuer with material US-person user base: Bermuda alone does not resolve the US regulatory question. A Bermuda offering structure for an issuer with significant US-person exposure requires independent US legal analysis – likely involving FinCEN registration, state money-transmitter licensing, and, depending on token classification, a Regulation D or Regulation S analysis under SEC oversight. Allied counsel in the relevant jurisdiction should be engaged in parallel with the BMA process.
Profile D – Token issuer at the concept stage, classification uncertain: The first step is a classification opinion, not a jurisdiction selection. Choosing Bermuda – or any jurisdiction – before the classification question is resolved creates the risk of designing a structure around the wrong legal framework. The classification analysis should drive the structuring decision, not the reverse.
How should an airdrop be structured to manage legal risk?
An airdrop – a gratuitous distribution of tokens to wallet addresses, typically without payment – is not exempt from classification analysis. The legal character of the token being distributed is the same regardless of whether consideration is paid for it. A security distributed by airdrop is still a security; the absence of a sale price does not convert it into an unregulated instrument.
The structural questions for an airdrop are: who receives the tokens (the KYC and sanctions-screening question); what rights do those tokens confer (the classification question); and whether the airdrop constitutes a public offering of digital assets triggering DAIA registration (the disclosure question). In Bermuda, an airdrop of tokens that constitute digital assets within the DAIA scope may require BMA registration depending on the breadth of the distribution and the nature of the tokens.
Practically, well-structured airdrops implement: a jurisdictional eligibility screen that excludes US persons and other restricted jurisdictions at the technical level; a sanctions list check against OFAC and the applicable local lists; documentation of the classification basis for the tokens being distributed; and, where the airdrop is part of a broader marketing strategy, a review of whether the communication itself constitutes a regulated financial promotion in any distribution jurisdiction. In the UK, for example, the FCA's financial promotion rules apply to crypto marketing regardless of where the issuer is based.
Related at OBOLUS
- Token Offerings & Securities practice – end-to-end legal counsel on token issuance, classification and whitepaper compliance
- Stablecoin issuance authorisation in Poland – MiCA EMT/ART registration for EU-focused stablecoin issuers
- AML/CFT policy drafting: cross-border perspective – Travel Rule readiness and AML documentation for licensed digital-asset businesses
FAQ
Is my token a security?
It depends on the rights the token actually confers, not what the whitepaper calls it. The BMA and courts in leading jurisdictions apply a substance-over-form analysis: if the token gives holders a share in enterprise value, profit participation, or economically weighted governance rights, it is likely to be treated as a security. Classification must be assessed against the final token design, the smart-contract code, and the distribution mechanism – not an early-stage concept. A formal classification opinion from qualified counsel is the appropriate starting point.
Do I need a MiCA whitepaper?
If you distribute tokens to EU retail users – regardless of where your entity is domiciled – the MiCA regime administered by ESMA and national competent authorities may apply to your offering. A Bermuda-registered offering does not create an EU exemption. Whether a full MiCA whitepaper and CASP authorisation are required turns on the token's classification under MiCA (ART, EMT, or other crypto-asset), the scale of the offering, and whether reverse solicitation genuinely applies. The reverse solicitation safe harbour is narrow and is not a substitute for MiCA analysis where EU distribution is a commercial objective.
How should an airdrop be structured legally?
The starting point is classifying the token being airdropped – the absence of a sale price does not remove the offering from the regulatory perimeter if the token is a security or falls within the DAIA scope in Bermuda. A well-structured airdrop implements technical exclusions for US persons and other restricted jurisdictions, conducts OFAC and local sanctions screening, documents the classification basis, and reviews the distribution communication against the financial promotion rules in every relevant jurisdiction. In the UK, the FCA's crypto financial-promotion rules apply to marketing directed at UK users regardless of the issuer's location.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We assess classification against the substance of rights, not the marketing label – and we work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications where token misappropriation is in issue. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in token classification, smart-contract legal analysis and DeFi regulatory structuring across common-law digital-asset regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.