On paper, structuring a security token offering in the British Virgin Islands looks manageable. The BVI carries a common-law heritage, light corporate formalism and a well-understood international profile. In practice, the legal question is harder: does the token constitute a security under the applicable regime, and if so, what obligations attach before a single token reaches an investor? Mis-classifying a token converts a product launch into an unregistered securities offering — an outcome that exposes founders, the issuing entity and intermediaries to enforcement risk in every jurisdiction where investors reside.
A security token offering (an STO) is a capital-raising event in which digitally-represented instruments carry rights — profit participation, dividends, voting, or a claim on underlying assets — that regulators in most jurisdictions treat as securities. Under the BVI Virtual Asset Service Providers Act 2022 (the VASP Act), the BVI Financial Services Commission (BVI FSC) supervises virtual asset service providers operating in or from the BVI, while the broader securities regime sets the framework for instruments that qualify as securities regardless of their digital form. Token classification, offer mechanics, investor eligibility, disclosure obligations and post-issuance compliance all require analysis before the offering is opened. This page sets out the regime, the process and the cross-border interactions an issuer must resolve.
What makes a BVI STO structurally distinct from other offshore offerings?
The BVI combines three features that make it a considered choice for security token issuers: a Companies Act that permits flexible share and token structures, a common-law court system with predictable jurisprudence, and a VASP regime that is purpose-built for digital-asset activity. That said, the BVI is not a paperwork-light shortcut. The BVI FSC regulates virtual asset service providers under the VASP Act, and the Securities and Investment Business Act governs instruments that qualify as securities — including tokenized securities. Both regimes interact on an STO.
The structural question is entity design. A BVI Business Company (BC) is the most common issuing vehicle. It permits the issuance of different classes of shares, including tokenized shares, and accommodates the memorandum and articles amendments needed to give tokens their specific rights. For a debt-instrument STO, a separate special-purpose vehicle (SPV) is often used to isolate the offering from the operational entity. The choice between equity tokens, revenue-share tokens and debt tokens each carries a different securities-law consequence — and that classification must be settled before the entity structure is finalized.
In our practice, we assess classification against the substance of the rights conferred, not the marketing label. A token that entitles the holder to a share of revenues, regardless of whether it is called a "utility token" in the whitepaper, is analyzed as a securities instrument.
How does token classification work under BVI law?
Token classification under the BVI regime turns on the rights the instrument confers, not the name attached to it in a whitepaper or marketing document. The BVI FSC applies a substance-over-form analysis consistent with the VASP Act and the Securities and Investment Business Act: if a token carries rights to profits, a share of net assets, a claim against the issuer, or voting rights in an enterprise, it is likely a security regardless of its digital wrapper.
The classification exercise covers four questions. First, does the token carry an economic claim against the issuer or a third party? Second, does the holder acquire any governance or voting right? Third, does the token derive its value predominantly from the managerial efforts of a promoter or third party? Fourth, is the token being sold as an investment with an expectation of return?
A common assumption is that labeling a token "utility" in the offering documents settles the legal classification. It does not. Regulators in the BVI and in the jurisdictions where investors are based will look through the label to the functional rights. In our cross-border practice, we regularly advise issuers who have received preliminary legal opinions from other advisers treating a revenue-share token as utility on the basis of its name. Restructuring after an investor round has closed is significantly more costly than getting the classification right at the design stage.
The applicable test is functional and economic, not nominal. Once a token is classified as a security, the full disclosure, registration (or exemption) and ongoing compliance obligations of the securities regime apply.
Contact OBOLUS early in the token design process. The process above describes the standard classification path. Your facts — the rights structure, the investor pool, the jurisdiction of investors — change the analysis materially. For a scoped classification assessment, contact OBOLUS at info@oboluslaw.com.
What BVI regulatory steps does an STO require?
An STO structured through a BVI entity requires regulatory engagement at two levels: the BVI FSC under the VASP Act (if the issuer or any intermediary is a virtual asset service provider) and the Securities and Investment Business Act framework (if the token is classified as a security).
The preparatory steps run in a defined sequence. First, the entity structure is confirmed: the BVI BC or SPV is incorporated or adapted, the memorandum and articles are amended to authorize the token class, and the register of members is configured to reflect on-chain issuance. Second, the offering documents are drafted. A securities offering in the BVI typically requires a private placement memorandum (PPM) or a prospectus, depending on the offer size and the investor profile. The PPM sets out the rights attached to the token, the risk factors, the use of proceeds, the redemption or exit mechanics and the governance structure.
Third, investor eligibility is assessed. BVI securities law recognizes exemptions for professional investors and private placements with restricted offer counts; the applicable exemption determines the offering mechanics, the geographic reach and the secondary-trading restrictions. Fourth, AML/KYC procedures are implemented at the issuer level. Under the VASP Act and the applicable FATF Recommendations (the global AML/CFT standards, including Recommendation 15 on virtual assets), BVI entities are required to identify and verify investors, apply risk-based due diligence and maintain records.
Fifth, if a token transfer agent or custody service is involved, that party's VASP Act registration status must be confirmed. An unregistered intermediary handling virtual assets in or from the BVI creates regulatory exposure for the issuer.
Timelines from entity readiness to offering launch are driven primarily by document drafting, legal review cycles and investor onboarding — not by a formal multi-week regulator approval queue for every private placement. Where FSC engagement is required (for example, for a VASP registration), the timeline extends accordingly; specific periods vary by workload and application complexity and should be confirmed with current BVI FSC guidance.
How does the cross-border investor reality affect a BVI STO?
The BVI entity is the issuer, but the investors rarely are in the BVI. This cross-border gap is where most STO enforcement risk accumulates. A BVI company offering a security token to US persons triggers SEC and CFTC oversight regardless of where the entity is incorporated; offering to EU-resident investors raises MiCA and national securities-law obligations; offering into the UK engages FCA rules on financial promotions and securities offerings.
Every STO that we structure addresses the investor-jurisdiction matrix explicitly. The offering documents define eligible investor categories and, critically, the geographic restrictions. A US exemption — typically Regulation S (offshore offering to non-US persons) or Regulation D (restricted domestic private placement) — must be properly documented if any US investors are involved or if US persons could access the offering. MiCA introduces a parallel regime for asset-referenced and e-money tokens; security tokens fall outside MiCA's primary scope but remain subject to the individual EU member-state securities laws and, where applicable, the EU Prospectus Regulation.
Banking for a BVI STO is a related pressure point. Proceeds from a token offering often need to move through a bank account held by the BVI entity or a related operating company. Banks in traditional jurisdictions apply enhanced due diligence to digital-asset issuers; having a well-structured offering document, a clear AML/KYC framework and an explainable token classification makes the banking conversation materially easier. We structure licensing, banking and tax as one mandate rather than three disconnected workstreams — because a licensing structure that cannot support a bank account is not a functioning structure.
In our cross-border practice, we regularly advise issuers on the interaction between the BVI offering structure and the banking and tax domicile of the operating entity. The BVI holding company model — issuer in BVI, operations in a taxed jurisdiction, banking through a regulated financial center — is common, and each leg requires its own legal coordination.
What does the whitepaper and disclosure obligation cover for a BVI security token?
A whitepaper for a BVI security token offering is a legal disclosure document, not a marketing brochure. Its content is shaped by the offering exemption being relied upon, the investor profile and the cross-border jurisdictions into which the offering reaches.
At minimum, the offering documentation for a BVI STO covers: a description of the issuing entity and its governance; a precise description of the rights attached to the token (economic, governance, redemption); the use of proceeds; the risk factors specific to the instrument and the sector; the transfer restrictions and secondary-market limitations; the AML/KYC procedures that investors must complete; and the regulatory status of the token in the jurisdictions addressed by the offering.
The whitepaper also functions as the primary evidence of what was represented to investors. Inaccuracies or omissions in a whitepaper that is later treated as a prospectus or offering document create liability exposure. In our practice, we draft and review offering documentation with the investor's enforcement rights in mind, not only the issuer's fundraising narrative.
Where the offering reaches EU investors, the question of whether a MiCA-equivalent whitepaper is required turns on the token classification. Security tokens are carved out of MiCA's whitepaper regime — they fall under EU securities law instead. However, a number of issuers we advise maintain parallel disclosure standards precisely because the regulatory perimeter can shift as the instrument's use evolves post-issuance.
If a prior offering document has already been circulated without full legal review, a second read can surface the structural exposure and the route to remediation. Contact OBOLUS at info@oboluslaw.com to discuss a document-review mandate.
What AML, Travel Rule and VASP Act obligations apply to a BVI security token issuer?
A BVI entity involved in the issuance, transfer or custody of a security token is subject to AML/CFT obligations under the VASP Act and the BVI's broader anti-money laundering regime, which aligns to FATF standards. The Travel Rule — the obligation to pass originator and beneficiary identifying information with a virtual asset transfer — applies to virtual asset service providers transacting above the applicable threshold; the BVI has adopted this obligation in line with Recommendation 16 of the FATF framework.
For an issuer, the most immediate AML obligations are at the point of investor onboarding: identity verification, source-of-funds assessment for large subscriptions, and ongoing monitoring of the investor relationship. These requirements apply regardless of whether the token is classified as a security or a utility instrument.
If the issuer is itself performing VASP activities — operating a transfer mechanism, providing custody, or facilitating secondary trading — VASP Act registration with the BVI FSC is required. An unregistered entity performing registrable virtual asset services faces enforcement risk and, more practically, will be unable to open and maintain banking relationships. The VASP Act registration is a prerequisite, not an afterthought, for any BVI entity that plays an operational role in the token lifecycle beyond passive issuance.
We advise issuers to map the full activity set at the outset: what the issuer does, what intermediaries do, and where each party's VASP Act exposure sits. This mapping determines which entities require registration and which can rely on an exemption or on a registered service provider.
A recent matter: BVI equity token offering with multi-jurisdiction investor base
In a recent matter, a fintech company approached us after having received competing legal opinions on whether its revenue-participation token constituted a security. The entity had already been incorporated in the BVI but the offering documents had not been finalized. We conducted a classification analysis across the BVI, UK and EU investor profiles the company intended to address, concluded that the instrument was a security in all three, and restructured the offering as a private placement under the relevant exemptions. We also coordinated a Regulation S compliance framework for the US-person exclusion and drafted updated AML/KYC procedures consistent with the VASP Act. The offering launched several months later with a compliant disclosure package and banking arrangements in place.
Decision matrix: which BVI STO structure fits your profile?
Profile A is the startup raising its first institutional round through tokenized equity. The typical instrument is a tokenized share class in a BVI BC, offered under a private placement exemption to a small group of accredited or professional investors. The timeline from entity readiness to first closing is measured in weeks, not months, assuming documentation moves promptly. The primary risks are token classification, investor-jurisdiction compliance and post-issuance transfer restrictions on the cap table.
Profile B is the established operating company issuing a tokenized debt instrument or revenue-share security to a broader investor base. The offering requires a more detailed PPM, a formal AML/KYC process at scale and careful attention to the secondary-market trading regime if the tokens are to be transferable. Banking for proceeds is a key coordination point. The timeline extends relative to Profile A in proportion to the complexity of the investor onboarding and the number of jurisdictions addressed.
Profile C is the fund or asset manager issuing tokenized fund interests. The regulatory analysis here extends beyond the BVI to cover the investment management regime in the fund manager's home jurisdiction and the applicable securities law in investor jurisdictions. A BVI partnership or segregated portfolio company structure may be appropriate. In our cross-border practice, we have seen this profile grow as institutional appetite for on-chain fund interests increases; the legal architecture is more complex but the BVI framework is well-suited to it.
No single structure fits every issuer. The decision turns on the investor profile, the instrument type, the geographic distribution of investors, and the operational structure of the business. To pressure-test your structure before you commit, message us via t.me/oboluslaw.
Related at OBOLUS
- Token Offerings & Securities – Legal structuring for token issuances, STOs and digital securities across jurisdictions
- Token issuance and offering rules in the United Kingdom – FCA rules on financial promotions and securities for UK-connected token offerings
- Regulator AML audit defence: the compliance burden in practice – How to manage an AML audit from a virtual asset regulator
FAQ
Is my token a security?
Classification turns on the rights the token confers, not what it is called. If the token carries an economic claim against the issuer, a share of profits or revenues, governance rights, or derives its value from a promoter's efforts, it will likely be treated as a security under the BVI regime and in the jurisdictions where investors reside. A classification opinion should be obtained before any offering document is drafted or investor outreach begins.
Do I need a MiCA whitepaper?
MiCA's whitepaper regime applies to asset-referenced tokens, e-money tokens and other crypto-assets as defined under MiCA. Security tokens are explicitly carved out of MiCA and fall under the EU securities law framework instead. If your token is classified as a security and you are offering to EU investors, the relevant national securities laws and, for larger offerings, the EU Prospectus Regulation govern disclosure obligations — not the MiCA whitepaper rules.
How should an airdrop be structured legally?
An airdrop is not automatically free of securities-law obligations. If airdropped tokens carry rights that would classify the instrument as a security, distributing them without a valid offering exemption creates the same exposure as a sale. The legal analysis covers the instrument rights, whether consideration is being exchanged (including data or platform engagement), and the jurisdictions of recipients. Structure the token and the distribution mechanics before launch, not after.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess classification against the substance of rights conferred, not the marketing label, and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. To discuss your STO or token structuring situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel — specialising in token classification, on-chain instrument structuring and cross-border securities compliance for digital-asset issuers.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.