A fintech founder in Vilnius prepares to raise capital by issuing tokenized equity stakes in a Lithuanian limited liability company. The investment memorandum describes the tokens as "access rights." The lawyers flag it on day three: the economic substance confers a residual claim on profits and a voting right. That is not an access right. That is a transferable security – and the entire offering must be structured accordingly, or halted. Mis-classifying a token can convert a product launch into an unregistered securities offering, exposing the issuer, its directors and its distribution partners to enforcement across every jurisdiction where a token reaches an investor.
Security token offering structuring in Lithuania sits at the intersection of the country's CASP authorisation regime (the Crypto-Asset Service Provider licence introduced under MiCA, the EU Markets in Crypto-Assets Regulation supervised by ESMA and the Bank of Lithuania at the national level) and the classical EU prospectus and financial-instruments framework. When a token confers rights equivalent to a transferable security – equity, debt, profit participation – the issuer must work through both regimes simultaneously. This page explains what that means in practice, how the process runs, and where the cross-border complications sit.
What makes a token a security in Lithuania?
Token classification in Lithuania – and across the EU – turns on the substance of the rights conferred, not the label applied in the marketing document. A token is a financial instrument if its economic profile matches the definition of a transferable security under the applicable EU financial-instruments directive: an equity-like claim, a debt-like claim, or a right that gives economic exposure to an underlying asset in the way a derivative does. Calling the instrument a "utility token" or an "access pass" in a whitepaper does not change that analysis.
The Bank of Lithuania has consistently applied a substance-over-form approach. In our cross-border practice, we see founders attach governance rights, dividend-equivalent distributions or redemption options to tokens they market as purely functional – and each of those features pulls the instrument toward the securities perimeter. The classification test is applied at the point of design, not at the point of distribution. That means the legal opinion must be obtained before the smart contract is finalized, not after the token is listed.
Three features are the primary classification triggers: (i) a right to receive a share of the issuer's profits or residual assets, (ii) a right to vote on matters of economic significance to token value, and (iii) a right to redeem the token for a cash or asset equivalent at a determined or determinable price. One of these, in most cases, is sufficient to bring the token within the securities perimeter. Two or more remove any realistic argument to the contrary.
MiCA introduced its own parallel classification layer. Tokens that do not qualify as financial instruments but reference a basket of assets qualify as asset-referenced tokens (ARTs) or, if referenced to a single fiat currency, as e-money tokens (EMTs). Both are MiCA-regulated categories distinct from the securities path. A token that falls into none of those categories – no financial instrument, no ART, no EMT – is classified under MiCA as an "other crypto-asset," subject to a whitepaper notification regime. The classification analysis must resolve all four pathways before the offering structure is fixed.
For a scoped classification opinion on your token design, contact OBOLUS at info@oboluslaw.com. The process above describes the standard analytical path. Your specific rights architecture – the smart-contract logic, the economic entitlements, the governance mechanism – changes the conclusion. Map your options
The regulatory regime for security tokens in Lithuania
A security token in Lithuania is regulated primarily as a financial instrument, meaning the applicable regime is the EU prospectus framework and the financial-instruments directive, supervised by the Bank of Lithuania in its capacity as national competent authority. The Bank of Lithuania operates a dedicated fintech sandbox and has published guidance on token offerings, making it one of the more accessible national authorities in the EU for structured dialogue before a formal filing.
The issuer of a security token offering intending to raise capital from EU investors is, in most cases, required to publish a prospectus approved by the Bank of Lithuania – or to rely on one of the recognized prospectus exemptions. The most commonly used exemptions limit either the aggregate offering size or the investor universe (offers restricted to qualified investors only, or offers below a defined total consideration threshold). The applicable thresholds are set at the EU level and are confirmed by the Bank of Lithuania for Lithuanian-domiciled issuers; the current figures are set in the EU Prospectus Regulation and should be confirmed against current legislation at the point of planning.
Where the offering is structured above the prospectus exemption threshold and targets retail investors, a full prospectus must be drafted, reviewed and approved before any public communication constituting an offer is made. The Bank of Lithuania's review process involves a comment-and-revision cycle. Operators we advise routinely find that the prospectus review occupies the longest segment of the project timeline – a matter of several months from submission to approval in standard cases, longer where the instrument is structurally novel.
MiCA sits alongside the prospectus regime, not above it. A token classified as a financial instrument is explicitly excluded from MiCA's own whitepaper regime. The MiCA whitepaper obligation applies only to tokens that are not financial instruments. This means an issuer of a genuine security token does not need a MiCA whitepaper – but it does need a compliant prospectus (or a valid exemption). Conflating the two regimes is one of the most common structural errors we see at the early-stage planning phase.
How does the structuring process work?
Security token offering structuring in Lithuania follows a defined sequence of legal and commercial steps, each of which carries a specific compliance obligation. The process runs from classification through entity setup, instrument design, prospectus (or exemption) work, AML/KYC architecture, distribution channel review and post-offering reporting.
The first step is the classification opinion. A qualified legal analysis must confirm that the token is (or is not) a financial instrument, and if it is, which sub-category applies. That opinion drives every subsequent decision – the applicable disclosure standard, the marketing restrictions, the distribution channels available, and the AML obligations of the offering itself.
The second step is entity and instrument design. Lithuanian law permits several issuer structures for tokenized securities. The choice turns on investor expectations, tax efficiency (discussed below), governance requirements and the intended secondary-market mechanism. In our practice, the issuer entity, the SPV or fund wrapper, and the token terms are reviewed in parallel, not sequentially, because a change in one affects the others.
The third step is the prospectus or exemption filing. Where a prospectus is required, a Lithuanian-law document – conforming to the EU Prospectus Regulation standards as implemented by the Bank of Lithuania – must be prepared, submitted and approved before any public distribution. Where an exemption is available, the exemption conditions must be documented and maintained throughout the offering period.
The fourth step is AML/KYC and investor-qualification architecture. Security token offerings in Lithuania are subject to the applicable AML/CFT provisions, including the FATF Travel Rule (the obligation to pass originator and beneficiary information with a virtual-asset transfer) once the tokens move across VASP infrastructure. Investor onboarding procedures, wallet verification and on-chain tracing capability must be designed before the offering opens.
The fifth step is distribution channel review. Every platform, exchange or intermediary involved in distributing or providing liquidity for the security token must hold the appropriate authorisation in each jurisdiction where it operates. A Lithuanian-issued security token offered to US persons triggers US securities law. An offering reaching UK retail investors triggers FCA financial-promotion rules. The distribution review must map the investor geography against the applicable exemptions, blocking lists and marketing restrictions.
What is the cross-border interaction with tax and banking?
For a business sitting between the Lithuanian operating company, a non-EU holding structure and an investor base that spans several time zones, the legal question turns on which entity issues, which entity collects proceeds, and where the economic substance sits. Tax treatment of security token offering proceeds, token holder distributions and secondary-market gains varies by jurisdiction and by the classification of the instrument. Proceeds received in Lithuania by a Lithuanian-resident issuer are subject to Lithuanian corporate income tax in the standard way; the tokenized form of the instrument does not change the tax character of the underlying economic event.
Staking rewards and secondary-market gains flowing to token holders are taxed according to each investor's home jurisdiction. We advise issuers to build a disclosure mechanism into the offering document that sets out the tax information obligations accurately – not as tax advice to investors, but as a statement of the issuer's understanding of its own withholding and reporting obligations.
Banking is the practical constraint that the regulatory analysis does not fully capture. Lithuanian banks and EU-licensed payment institutions differ materially in their appetite for security token offering proceeds. A bank treating an inbound transfer from a digital-asset exchange or a non-EU investor as proceeds of a token sale will apply enhanced due diligence. In our cross-border practice, we prepare a banking narrative in parallel with the legal structuring: a plain-language explanation of the offering, the investor qualification process, the AML architecture and the source of funds for each investor tranche. Presenting that narrative proactively – before the first transfer arrives – shortens the bank's review cycle and reduces the risk of account suspension.
The cross-border complexity compounds when the issuer uses a non-Lithuanian holding entity – a BVI company, a Cayman fund or a Delaware LLC – as the economic owner of the underlying business while the Lithuanian entity issues the token. In that structure, the issuer prospectus must accurately describe the full economic chain, and the Bank of Lithuania's review will extend to the upstream entities. Allied counsel in the relevant jurisdiction must be engaged for the holding-structure analysis; the Lithuanian local counsel cannot give an opinion on, for example, BVI company law without that support.
A practice illustration: stabilizing a hybrid offering structure
In a recent matter, a fintech company approached us mid-process, having received a Bank of Lithuania comment letter querying whether its proposed token – structured as a revenue-sharing instrument – constituted a transferable security rather than a MiCA-category "other crypto-asset." The company had filed a MiCA whitepaper notification without first obtaining a classification opinion. We reviewed the smart-contract terms, the distribution waterfall and the governance schedule; the instrument was plainly a financial instrument. We restructured the offering as a prospectus-exempt private placement to qualified investors only, revised the investor-qualification architecture, and coordinated the AML documentation with the company's banking partner. The offering closed in the following quarter on the revised basis without further regulatory objection.
What are the most common structuring mistakes?
A common assumption is that attaching a utility function to a security-like instrument converts the token into a utility token for legal purposes. It does not. Regulators across the EU – and the Bank of Lithuania specifically – apply the financial-instrument test to the economic substance of the primary rights. A token that entitles the holder to platform discounts but also carries a profit-participation right is a financial instrument with utility features, not the other way around. The utility feature does not neutralize the securities classification.
A second common error is timing the legal opinion too late. Founders who approach us after the smart contract is audited and the investor deck is circulating face a harder path. The classification opinion must inform the contract design, not ratify it retrospectively.
A third error is treating the EU as a single regulatory unit for distribution. MiCA creates a single CASP passporting regime, but the EU prospectus regime operates differently: a prospectus approved in Lithuania passports across the EU, but a Lithuanian exemption does not necessarily carry the same effect in every member state. Distribution to investors in other EU countries requires a review of the national implementation of the prospectus thresholds and any additional marketing restrictions those countries impose.
A fourth mistake is ignoring the secondary market. A security token that lists on a secondary platform – whether within the EU or outside – re-triggers the marketing and prospectus regime in the jurisdictions where that platform's users are located. The offering document must address secondary-market transfer restrictions, and the smart contract should embed them technically where possible.
Which structuring path fits your profile?
Issuers approaching a Lithuanian security token offering fall into broadly recognizable profiles, and the appropriate structuring path differs by profile.
An early-stage company raising a modest initial round from sophisticated investors is best served by a prospectus-exempt private placement, restricted to qualified investors. The offering size stays below the relevant prospectus threshold; the investor universe is limited; the documentation burden is significantly lower than a full prospectus. The timeline from instruction to close is relatively short in clean cases. The key risk is investor count and any public communication that could be construed as a general solicitation – both of which must be actively managed.
A growth-stage company seeking a larger raise from a broader investor base must engage with the full prospectus path. The Bank of Lithuania review cycle adds meaningful time. The documentation is substantial. But the outcome – a Bank of Lithuania-approved prospectus – passports across the EU, giving the issuer access to the full EU retail investor market. For an issuer with a genuine EU-scale investor ambition, the prospectus path is not a burden; it is the mechanism.
An issuer using a non-Lithuanian holding structure must resolve the economic chain before either path is available. The prospectus – or the exemption filing – must accurately describe the full corporate structure. A material mismatch between the described structure and the actual economic arrangement is a prospectus disclosure failure with enforcement consequences. Resolving that mismatch at the instruction stage, not the review stage, is the operational discipline that separates a clean filing from a regulatory comment spiral.
If a prior application stalled or a Bank of Lithuania comment letter raised classification concerns, a second structural read can identify the route forward. Write to OBOLUS at info@oboluslaw.com. Map your options
Self-assessment: before you instruct counsel
The following checklist does not substitute for legal advice, but it frames the questions that a qualified opinion must answer before any Lithuanian security token offering is launched.
- Has a formal classification opinion been obtained confirming whether the token is a financial instrument, an ART, an EMT or a MiCA "other crypto-asset"?
- Has the offering structure been reviewed against the applicable prospectus exemption thresholds for Lithuania and for each other EU member state targeted?
- Is the investor qualification architecture – KYC, accredited-investor or professional-investor verification, wallet verification – documented and tested before the offering opens?
- Does the AML/CFT policy address the Travel Rule obligations for token transfers across VASP infrastructure?
- Has the distribution channel review confirmed that every platform, exchange or intermediary involved holds the necessary authorisation in each distribution jurisdiction?
- Are secondary-market transfer restrictions addressed in both the offering document and the smart-contract logic?
- Has banking been confirmed – meaning that the issuer's bank has reviewed the offering structure and confirmed it will accept offering proceeds under the proposed AML narrative?
- For cross-border holding structures: has allied counsel in the upstream jurisdiction reviewed the holding-entity layer?
Related at OBOLUS
- Token offerings and securities law for digital-asset businesses – structuring, classification and prospectus counsel for token issuers globally
- Utility token legal opinion in the British Virgin Islands – BVI-law classification opinions for issuers using offshore holding structures
- AML/CFT policy drafting for early-stage founders – Travel Rule-ready compliance documentation for token offering issuers
FAQ
Is my token a security?
The answer depends entirely on the economic substance of the rights the token confers, not on the label in the documentation. Under the applicable EU financial-instruments framework as implemented in Lithuania, a token is a transferable security if it carries equity-like, debt-like or derivative-like economic rights. A formal classification opinion – reviewed against the smart-contract terms, the distribution mechanism and the governance structure – is the only reliable basis for a definitive answer. We assess classification against the substance of rights, not the marketing label.
Do I need a MiCA whitepaper?
Only if your token is not a financial instrument. MiCA explicitly excludes financial instruments from its whitepaper regime. A token classified as a transferable security is regulated under the EU prospectus framework, not under MiCA. If the token qualifies as an asset-referenced token or an e-money token, a MiCA-compliant whitepaper and issuer authorisation are required. If the token falls into none of those categories, the MiCA "other crypto-asset" whitepaper regime applies. The classification analysis must be completed before the whitepaper question is answered.
How should an airdrop be structured legally?
An airdrop of tokens that qualify as financial instruments is a distribution of securities, regardless of whether consideration is charged. Structuring it as "free" does not remove the securities-law analysis. The applicable exemptions must be reviewed for each recipient jurisdiction: most EU prospectus exemptions that limit offering size are calculated on consideration received, meaning a zero-price airdrop may fall outside the standard thresholds but must still satisfy the qualified-investor or limited-circle exemption where applicable. Airdrops of MiCA-category tokens carry their own whitepaper and marketing obligations.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance architecture that surrounds them. Digital assets are the whole of our practice. In token offering matters, we assess classification against the substance of rights, not the marketing label – because a label that does not match the economics is a liability, not a protection. To discuss your offering structure, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Roman Levitt, Technology & DeFi Counsel – advising token issuers and DeFi protocol operators on classification, structuring and cross-border regulatory positioning across EU and offshore frameworks.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.