On paper, Gibraltar looks like a clean choice for a token sale: a mature distributed ledger technology regime, a common-law legal system, and a regulator – the Gibraltar Financial Services Commission (GFSC) – with more than half a decade of hands-on crypto supervision. In practice, the agreement that governs your sale is the document that either protects the project or exposes it. A mis-drafted token sale agreement can convert a product launch into an unregistered securities offering overnight.
Token sale agreement drafting in Gibraltar requires a disciplined layering of Gibraltar's DLT Provider regime, the token's legal classification under substance-over-label analysis, and the cross-border reach of each buyer's home jurisdiction. The agreement must do more than define purchase mechanics. It must establish the nature of the instrument being sold, allocate regulatory risk, and survive scrutiny in multiple legal systems simultaneously. The sections below map the process, the decision points, and the mistakes that most frequently surface in our cross-border practice.
The Gibraltar DLT framework and where token sales sit within it
Gibraltar was the first jurisdiction in the world to introduce a purpose-built licensing regime for businesses using distributed ledger technology to store or transmit value belonging to others. The GFSC administers this regime and has developed published guidance on token sales alongside it. The DLT Provider authorisation is activity-based: it captures the business that operates the platform, not necessarily the act of selling tokens to the public. A token sale conducted by a Gibraltar entity may therefore engage the DLT regime, financial instruments rules, or both – depending on how the token is classified.
Gibraltar's Financial Services Act and its subsidiary regulations import a classification logic that follows the rights conferred on the holder. A token that grants a genuine, present right to use a defined service or product may fall outside the financial instrument perimeter. A token that carries profit expectations dependent on the efforts of a third party, or that resembles a share, bond, or collective investment unit, is likely to be treated as a security regardless of how the whitepaper labels it. The GFSC has been explicit on this point in its published guidance.
The GFSC's token classification guidance sits alongside the DLT Provider regime and is the starting point for any Gibraltar token sale analysis. Ignoring it – or substituting marketing language for legal analysis – is the single most common structural error we encounter in inbound token projects.
What a Gibraltar token sale agreement must cover
A properly drafted token sale agreement in Gibraltar addresses at least seven substantive areas. Omitting any one of them typically creates the enforcement gap that a regulator or a disgruntled purchaser exploits later.
First, the agreement must describe the token precisely – its technical standard, the rights it carries, and what it expressly does not carry. This description must be consistent with the whitepaper, the smart contract, and the on-chain mechanics. Inconsistency between these documents is one of the most reliable indicators of a poorly structured offering, and regulators have flagged it accordingly.
Second, the agreement must address the purchase mechanics: consideration, delivery, the point at which title (or its functional equivalent) passes, and the treatment of failed or delayed delivery. Gibraltar courts apply common-law contract principles. Clarity here reduces the risk of a restitution claim that treats the token as never having been delivered.
Third, the agreement must set out the representations the purchaser makes. These serve the dual function of limiting rescission risk and supporting the issuer's Know Your Customer (KYC) and AML documentation. Under FATF Recommendation 15, the applicable Travel Rule obligations attach to transfers of value in virtual assets – and those obligations begin at onboarding, not at delivery.
Fourth, the agreement must contain jurisdictional exclusions and representations. Tokens sold to persons in jurisdictions where the offer is not permitted – most prominently the United States under SEC oversight, and increasingly the EU under MiCA (the Markets in Crypto-Assets Regulation) – require express exclusions backed by verification procedures. A Gibraltar agreement that omits US-person representations does not insulate the issuer from SEC jurisdiction if tokens reach US persons.
Fifth, risk disclosures must be proportionate and specific. Generic disclaimers borrowed from other projects are not adequate. The GFSC expects risk language calibrated to the token's actual mechanics, the liquidity outlook, and the technical risks of the underlying protocol.
Sixth, the agreement must address lock-up, vesting, and secondary-market restrictions where applicable. Gibraltar's Financial Services Act contains secondary-market implications that interact with how token transfers are described in the primary agreement.
Seventh, governing law, jurisdiction, and dispute resolution must be stated clearly. Gibraltar law and GFSC jurisdiction is a defensible choice for the primary relationship. For larger institutional purchasers, a parallel arbitration clause referencing a recognized seat – London, Singapore, or the DIFC Courts – provides an internationally enforceable dispute path.
Token classification: why the substance test controls
A utility label on a whitepaper does not settle the legal classification of a token. This is the most persistent myth in token-project structuring, and it has a direct cost: projects that proceed on marketing characterization alone routinely discover mid-sale – or post-listing – that their token meets the definition of a financial instrument under Gibraltar law, MiCA, the UK FCA's rules, or multiple simultaneously.
In our practice, classification analysis begins with the rights the token actually confers at the moment of sale. If the token does not yet provide access to a functional product or service – if deployment depends on future development, a roadmap milestone, or funds raised in the offering itself – the utility argument becomes significantly harder. Regulators apply a temporal test: the rights must be present and exercisable, not promised.
The secondary market behavior of the token is also relevant. A token marketed as utility but sold primarily as an investment vehicle, listed on exchanges before the product is live, and traded on price-discovery mechanics resembling equity markets, invites regulatory reclassification. The GFSC, FCA, and ESMA have each published guidance to this effect.
The practical consequence is that token classification is a legal analysis, not a marketing decision. It is performed before the agreement is drafted, not after. Getting it wrong early is cheaper to fix. Getting it wrong after a public sale is a restructuring exercise that involves regulators, secondary-market participants, and – in the worst case – litigation.
The substance-over-label principle applies across the major jurisdictions into which tokens routinely migrate: the EU under MiCA, Singapore under the Payment Services Act, Hong Kong under the SFC's VASP regime, and the UK under FCA rules. A Gibraltar agreement drafted to Gibraltar standards alone will not protect the project once tokens are in circulation globally.
How MiCA intersects with a Gibraltar token offering
Gibraltar is a British Overseas Territory. It is not part of the European Union and is not subject to MiCA as a matter of direct application. However, MiCA's reach is determined by where tokens are offered, not where the issuer is domiciled. A Gibraltar-based issuer that markets to EU residents triggers MiCA obligations for those purchasers.
Under MiCA, tokens classified as asset-referenced tokens (ARTs) or e-money tokens (EMTs) require issuer authorisation from an EU national competent authority and adherence to whitepaper and reserve requirements administered by ESMA and the relevant NCA. Tokens classified as "other crypto-assets" under MiCA require a compliant whitepaper filed with the competent authority of an EU member state before the public offer. A Gibraltar issuer who wants EU distribution must either obtain that authorisation or use a passporting vehicle – typically through a CASP-authorised entity in a member state such as Lithuania or Malta.
The agreement must reflect this structure. Buyers in the EU require disclosures that align with the MiCA whitepaper. The agreement's jurisdictional exclusions must either carve out EU persons or confirm that the EU-compliant whitepaper has been filed. A hybrid Gibraltar-plus-EU structure is commercially viable, but it requires two parallel documentation streams. Merging them into a single agreement invariably creates compliance gaps.
In our cross-border practice, we regularly advise token issuers on structuring the EU distribution leg through a Malta or Lithuania CASP entity while maintaining Gibraltar as the issuing entity – keeping the DLT Provider authorisation and common-law agreement structure in place and building the MiCA overlay on top of it. This approach is more document-intensive upfront. It is substantially less expensive than a regulatory enforcement action after the fact.
What is the drafting process and typical timeline for a Gibraltar token sale agreement?
The drafting process for a Gibraltar token sale agreement has five stages, each of which is a dependency for the next. Skipping stages does not accelerate the process; it defers the risk into the sale itself.
Stage one is the token classification memorandum. Before a single clause is drafted, counsel must confirm how the token is classified under Gibraltar law, and flag the classification risk in the key distribution jurisdictions. This stage typically takes one to two weeks and results in a written classification opinion that the drafting team and the GFSC can both rely on.
Stage two is the term sheet and structural election. Based on the classification memorandum, the project makes structural elections: the governing regime, the distribution channels, the jurisdictional exclusions, the KYC/AML framework, and the treatment of any tokens reserved for team, advisors, or treasury. These elections feed directly into the agreement's structure. This stage takes approximately one week.
Stage three is the first draft of the agreement. A competent first draft takes one to two weeks, depending on the complexity of the token mechanics and the number of distribution jurisdictions. The first draft circulates to the project team, the Gibraltar DLT Provider counsel (if already engaged), and any EU distribution counsel.
Stage four is comment, negotiation, and regulatory alignment. If the project is in active dialogue with the GFSC – as is common where the DLT Provider licence application is running in parallel – the agreement may require alignment with conditions or guidance issued by the regulator. Institutional investors in the sale may also negotiate agreement terms. This stage is the most variable in duration: a clean sale with retail-only buyers and no regulatory dialogue may take one week; a sale with institutional anchor purchasers and parallel GFSC engagement may take four to six weeks.
Stage five is execution-ready documentation: the final agreement, the whitepaper legal review, the KYC/AML procedural documentation, and the jurisdictional exclusion verification procedures. From first instruction to execution-ready, a well-structured Gibraltar token sale agreement typically takes six to ten weeks. Projects that attempt to compress this timeline by running legal work in parallel with public marketing create the conditions for the structural errors described above.
Cross-border tax and banking: the interaction with a Gibraltar token sale
A Gibraltar token sale agreement does not operate in isolation. Two external dimensions – tax and banking – directly affect how the agreement is structured and what risks it must address.
On tax, Gibraltar has historically been a low-corporate-tax environment with no capital gains tax and no VAT. The proceeds of a token sale are typically treated as income in the hands of the issuing entity, subject to Gibraltar income tax on a territorial basis. However, the tax treatment of token-sale proceeds is fact-specific: whether proceeds are income on receipt, a liability to token-holders, or something else, turns on the rights the token confers and the accounting treatment the entity adopts. The agreement must be drafted in a way that is consistent with the chosen tax treatment. Counsel drafting the agreement without sight of the tax analysis – or worse, without a tax analysis having been prepared at all – creates a mismatch between the commercial instrument and the financial statements.
On banking, token-sale proceeds denominated in fiat currency require a banking relationship capable of receiving and holding those funds. This is a known bottleneck in the Gibraltar ecosystem: banks that service DLT entities and token issuers are a limited pool globally, and the onboarding timelines can be substantial. The agreement must address what happens to fiat proceeds pending bank onboarding, who holds them, and under what conditions. Projects that raise fiat into an inadequate holding structure – personal accounts, unsegregated wallets, or unregulated escrow arrangements – expose both the issuer and the purchasers to legal and regulatory risk.
We have seen situations in which the agreement was well-drafted and the token correctly classified, but the proceeds management was inadequate. The resulting regulatory inquiry focused on the fiat handling, not the token. Banking is not a post-legal issue; it is a drafting variable.
How these issues present in practice
In a recent matter, a technology company domiciled in Gibraltar sought to launch a token granting access to a data-sharing protocol. The whitepaper described the token as a utility instrument. By the time the project reached us, a first-draft agreement had already been prepared by non-specialist counsel and circulated to prospective purchasers. On review, the agreement omitted MiCA-compliant disclosures for EU buyers, contained no US-person exclusion mechanism, and described the token in terms that partially satisfied the profit-participation test under Gibraltar's financial instrument definition. The token was not clearly a security, but it was not clearly not one either. We advised the project to pause circulation of the agreement, prepare a classification memorandum, and redraft with explicit jurisdictional exclusions and risk disclosures calibrated to the actual token mechanics. The revised agreement and a parallel MiCA whitepaper filed through a Malta CASP entity allowed the sale to proceed. The delay was several weeks. An enforcement inquiry would have taken substantially longer.
A common assumption – and why it costs more than the fix
A common assumption among token project founders is that Gibraltar's relatively accessible regulatory environment means the legal documentation requirements are correspondingly light. This is incorrect on two levels. First, the GFSC's DLT guidance and token-sale materials set a substantive standard for documentation quality. Second, and more importantly, the agreement must be defensible not only before the GFSC but before every regulator with jurisdiction over every buyer. A Gibraltar agreement that satisfies Gibraltar law but fails SEC, MiCA, or FCA requirements does not protect the project when tokens reach US, EU, or UK persons – and tokens routinely do.
The objection we hear most frequently is that robust documentation will delay the launch. In our experience, the projects that invest in correct documentation before the sale are the ones that complete on schedule. The projects that shortcut the documentation phase are the ones that face regulatory inquiries, purchaser disputes, or exchange listing rejections that consume multiples of the time the documentation would have taken.
A self-assessment checklist for issuers before engaging counsel: Have you prepared a written classification opinion for this jurisdiction and the key distribution markets? Does your whitepaper contain MiCA-consistent disclosures for EU buyers? Does your agreement contain US-person exclusions supported by a KYC mechanism? Is the governing law and dispute forum consistent with the institutional investors you are targeting? Have you confirmed the banking structure for fiat proceeds before drafting the payment mechanics? If the answer to any of these is no, the agreement is not ready to circulate.
To map the agreement structure and classification analysis for your token project, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the buyer profile, the token mechanics, the target markets – change the analysis materially. A scoped classification and drafting engagement begins with a strategy call under NDA. Map your options.
Who needs a Gibraltar token sale agreement and when should they engage counsel?
The question of when to engage counsel is consistently answered wrongly by first-time token issuers. Counsel is engaged when the agreement needs to be signed, not when the structure needs to be decided. By the time the agreement is being drafted, the structural elections – classification, jurisdiction, distribution channel, proceeds handling – should already have been made. If they have not, the drafting process will surface them, which takes longer and costs more than addressing them at the term-sheet stage.
For a project issuing a token that grants genuine, present utility rights, has no EU distribution ambitions, and has a clean banking arrangement in place, a Gibraltar token sale agreement is a manageable and relatively streamlined exercise. Counsel should be engaged as soon as the project has a whitepaper draft and a defined token mechanic – typically six to eight weeks before the intended sale date.
For a project with a more complex profile – EU distribution, institutional anchors, a token that sits near the securities perimeter, or a parallel DLT Provider licence application – the documentation process is longer and the engagement should begin earlier. In our practice, we advise these projects to engage counsel at the term-sheet stage, before the whitepaper has been published and before any soft-circle conversations with purchasers have taken place. Public communications made before the legal structure is confirmed can create estoppel and regulatory exposure that is difficult to unwind.
Profile A: a utility token issuer with a live product, Gibraltar domicile, and non-EU distribution. Agreement drafting is the primary deliverable. Timeline: six to eight weeks from first instruction. Key risk: token description inconsistency between the agreement and the smart contract.
Profile B: a token issuer with EU and US distribution ambitions and a token that has investment characteristics. Requires parallel Gibraltar agreement, MiCA whitepaper via an EU CASP entity, and US-person exclusion mechanism. Timeline: ten to sixteen weeks. Key risk: regulatory reclassification in a distribution jurisdiction after tokens are in secondary circulation.
Profile C: an issuer running a DLT Provider licence application alongside the token sale. The GFSC will expect the agreement and the whitepaper to be consistent with the licence application. Timeline is driven by the licence process, not the agreement. Key risk: agreement drafted before GFSC feedback on the licence application creates alignment problems.
If your agreement has already been drafted by non-specialist counsel or has been circulated without a classification opinion, a second review can surface the structural gaps before they become enforcement issues. Write to info@oboluslaw.com or message us at t.me/oboluslaw. Map your options.
Related at OBOLUS
- Token Offerings & Securities practice – end-to-end legal counsel for token issuers across licensing, classification, and distribution
- Token legal classification: practical lessons for boards – the substance-over-label analysis boards need before any public offer
- Custody arrangements for funds in the British Virgin Islands – how BVI fund structures interact with digital-asset custody obligations
FAQ
Is my token a security?
The answer depends on the rights the token actually confers, not the label applied to it. If the token carries profit expectations linked to a third party's efforts, resembles a share or bond in economic substance, or is sold primarily as an investment vehicle, it is likely to be treated as a security under Gibraltar law, MiCA, the FCA's rules, or all three. Classification is a legal analysis performed against the substance of the instrument before the agreement is drafted. A written classification opinion, covering the key distribution jurisdictions, is the correct starting point.
Do I need a MiCA whitepaper?
If you offer tokens to persons in the European Union, MiCA applies to that distribution regardless of where you are domiciled. Gibraltar is outside the EU, so MiCA does not apply to you as an issuer by virtue of your location – but it applies to the offer when it reaches EU residents. Tokens classified as asset-referenced tokens or e-money tokens require issuer authorisation from an EU competent authority. Tokens classified as other crypto-assets require a MiCA-compliant whitepaper filed with a member-state regulator. If you intend EU distribution, the whitepaper obligation almost certainly applies.
How should an airdrop be structured legally?
An airdrop is not automatically exempt from regulatory requirements. If the tokens being airdropped carry financial instrument characteristics, the airdrop may constitute a public offer triggering disclosure and authorisation obligations. The legal analysis follows the same substance-over-label logic as a paid sale: what rights does the token confer, to whom are the tokens being distributed, and in what jurisdictions? Airdrops to existing users of a live product carry lower regulatory risk than airdrops used as a marketing mechanism to generate interest in an unlaunched project. Each structure requires a jurisdictional assessment before distribution.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess classification against the substance of rights, not the marketing label – and we work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications when a matter moves into disputes. To discuss your token sale structure, contact info@oboluslaw.com. Map your options.
By Roman Levitt, Technology & DeFi Counsel – specialising in token structuring, smart-contract legal analysis, and cross-border DLT regulatory advice for issuers and protocol teams.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.