A token issuer with an EU nexus expanding into Dubai faces a deceptively layered question: does MiCA (the EU Markets in Crypto-Assets Regulation) govern the whitepaper for a token that will be offered to purchasers across two distinct regulatory regimes, and how does the VARA (Virtual Assets Regulatory Authority) regime in Dubai interact with or diverge from that obligation? The answer determines whether a single disclosure document can satisfy both regulators or whether two structurally different instruments are required. This page sets out the applicable regimes, the classification logic that drives the analysis, and the process a business should follow before committing to a whitepaper in either jurisdiction.
Under MiCA, a crypto-asset whitepaper (the formal disclosure document required for public offers or admission to trading of certain tokens) is mandatory for most token categories unless a statutory exemption applies. Under the VARA regime, Dubai-licensed entities offering virtual assets must comply with VARA's own marketing and disclosure rulebooks. Where an issuer sits in the VARA perimeter but targets EU-based purchasers – or passports a MiCA-authorised offering into a GCC market – the cross-border classification exercise must be done twice, on the standards of each regime. Getting it right before launch is a precondition to a lawful offering.
Why Token Classification Comes Before the Whitepaper
Token classification is the threshold legal question: the content, form and obligation to produce a whitepaper at all depend entirely on how the token is classified. Under MiCA, the three principal categories are ARTs (asset-referenced tokens, which reference multiple assets or rights), EMTs (e-money tokens, which reference a single fiat currency) and "other crypto-assets," which encompass utility tokens and similar instruments not caught by the ART or EMT regimes. Each category carries different whitepaper content standards, competent-authority notification requirements and, in the case of ARTs and EMTs, authorisation obligations rather than mere notification. Under the VARA regime, the classification logic is activity-based: VARA's licensing rulebooks map to specific virtual asset activities, and the disclosure obligations that attach depend on which activity the issuer is conducting. A token that functions as a payment instrument in Dubai may carry different VARA disclosure expectations than a token structured as a yield-bearing instrument referencing off-chain assets.
The critical error many issuers make is to assign a label – "utility," "governance," "points" – and draft the whitepaper around the label rather than the substance. ESMA guidance under MiCA is explicit: classification turns on the rights actually conferred by the token, not the marketing description. A token that grants holders a pro-rata claim on a reserve pool is an ART regardless of what its terms sheet calls it. VARA takes an equally substance-first posture. In our cross-border practice, we routinely see issuers present a whitepaper drafted for a utility position that, on analysis, describes an instrument with security-like characteristics. Re-classifying after a public offer has begun is operationally disruptive and, in the worst case, converts the offering into an unregistered securities transaction.
The applicable test under both MiCA and the VARA regime is whether the rights and obligations written into the token's smart contract and governing documents match the claimed category. Counsel's role at this stage is forensic: reading the token mechanics against the classification criteria of each applicable regime before a single line of the whitepaper is drafted.
For a scoped classification opinion covering both the MiCA and VARA perimeters, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the token's rights structure, the intended purchaser base, and the banking and distribution arrangements – change the analysis.
What Does a MiCA Whitepaper Actually Require?
A MiCA whitepaper for "other crypto-assets" – the category most utility-style tokens will fall into if they are properly classified – must contain specified information about the issuer, the project, the technology, the rights attached to the token, the use of proceeds, the risk factors and the environmental footprint of the underlying protocol. The whitepaper must be notified to the competent authority of the issuer's home member state before publication, though for "other crypto-assets" the obligation is notification rather than prior approval. The competent authority may request changes within a specified review period. Only after the process is complete can the public offer or admission to trading proceed.
For ARTs, the obligation is stricter: full authorisation from the relevant national competent authority (working under ESMA oversight) is required, and the issuer must hold own funds and maintain a reserve of assets whose composition satisfies the MiCA reserve rules. EMTs trigger a parallel track that incorporates the e-money regulatory regime. Both ART and EMT authorisations involve a more substantive regulatory examination than the notification track for other crypto-assets. Timelines for authorisation vary by member state and by the complexity of the application; issuers should treat the process as taking a meaningful number of months, not weeks, and plan their capital raise timeline accordingly.
The whitepaper passporting mechanic is one of MiCA's structural advantages: a whitepaper notified in one EU member state allows the offer to proceed across the entire EU/EEA without further filings in each jurisdiction. For an issuer that has, or is seeking, a MiCA CASP authorisation in a member state like Lithuania or Malta, the whitepaper can ride alongside the licensing structure rather than requiring a separate regulatory relationship in each target market.
How Does VARA's Disclosure Regime Differ?
VARA's disclosure and marketing obligations are set out in activity-specific rulebooks rather than in a single whitepaper statute, and they apply to entities operating within VARA's jurisdictional perimeter – which covers mainland Dubai but excludes the DIFC financial free zone. An entity licensed by VARA to conduct exchange, advisory, custody, broker-dealer or other regulated virtual asset activities must comply with applicable VARA rulebook provisions when communicating about virtual assets to clients or the public. The content standards overlap with MiCA in some areas – issuer information, risk disclosure, asset descriptions – but the structure and verification process differ.
Critically, VARA's regime is activity-based rather than token-category-based. The licence the issuer holds, or is applying for, determines which rulebook sections apply to a given marketing or disclosure activity. An entity holding a management and investment licence under VARA faces different disclosure requirements when making an offer than an entity holding a broker-dealer licence. This means that the whitepaper review exercise in a Dubai context must begin with a clear map of the intended licensed activities, not solely with the token classification analysis that drives the MiCA path.
Where an issuer is dual-regulated – holding or seeking a MiCA CASP authorisation in the EU and a VARA licence in Dubai – the disclosure documents for each perimeter are likely to diverge in structure and verification pathway. In our practice, we advise these issuers to produce a master disclosure document and then derive jurisdiction-specific supplements. This avoids the more common error of producing two entirely separate documents that make inconsistent representations about the same token.
What Is the Cross-Border Classification and Whitepaper Process?
The cross-border whitepaper process for a Dubai-EU issuer follows four discrete stages, each with its own decision point.
Stage one: rights-mapping. Counsel reviews the token's governing documents, smart contract logic, economic terms and intended distribution to produce a written classification opinion under both MiCA and VARA standards. The output of this stage is a definitive classification for each regime and a list of any structural amendments required to support that classification before drafting begins.
Stage two: whitepaper drafting. For MiCA, a compliant whitepaper is drafted to the content standards applicable to the classified category – including all mandatory fields, the risk factor section, the environmental assessment and the liability statement from the issuer's responsible persons. For VARA, the relevant marketing and disclosure document is drafted to the applicable rulebook standard, cross-referenced to the master document where content overlaps.
Stage three: regulatory process. For MiCA, the whitepaper is filed with the competent authority of the home member state; the notification or authorisation process runs. For VARA, the relevant disclosure materials are submitted as part of the licensing or activity-approval process, or published in compliance with applicable VARA marketing rules. These two tracks run in parallel where the issuer is pursuing both regimes simultaneously, but they have different review windows and different gating conditions.
Stage four: publication and ongoing obligations. Once each regulatory process is complete, the whitepaper may be published and the offer may proceed. Both MiCA and VARA impose ongoing obligations after publication – including update and liability obligations under MiCA and continuing compliance with VARA's post-offer monitoring and client disclosure rules. A whitepaper is not a one-and-done document; it is a live regulatory instrument.
In a recent cross-border matter, a token issuer with a VARA-licensed entity in Dubai sought to extend a token offering to EU purchasers. The initial whitepaper had been drafted entirely to VARA standards and omitted several mandatory MiCA fields, including the environmental-impact section and the required information on the token's price-stabilisation mechanism. We restructured the document, produced a MiCA-compliant version with a VARA supplement, and managed both the notification filing in the home EU member state and the issuer's updated VARA marketing disclosure. The parallel process completed within the regulatory windows of each regime and the offer proceeded on schedule.
When Does Token Classification Trigger Securities Law?
Neither MiCA nor VARA is a securities law. Both regimes operate in parallel with, and are subject to the primacy of, securities regulation. A token that constitutes a transferable security in an EU member state falls outside MiCA's scope and into the prospectus and securities laws of each applicable jurisdiction. VARA operates under a broadly equivalent carve-out: tokens that are securities under applicable UAE law are not governed by VARA's virtual asset rulebooks but by the UAE Securities and Commodities Authority and applicable capital-markets law.
This means that the classification exercise has two layers. The first is the securities-law question: does the token constitute an investment contract or transferable security under the laws of any jurisdiction into which it will be offered? Where the answer is yes, a whitepaper process is the wrong instrument entirely; a prospectus or private placement memorandum under the applicable securities regime is required instead. The second layer – MiCA and VARA classification – is only reached once the securities question is resolved in the negative.
The securities question is particularly live for tokens with the following characteristics: profit expectations tied to the efforts of a third party; a contractual claim on revenue or earnings; voting rights over a commercial enterprise; or a share of liquidation proceeds. These features, individually or in combination, tend to attract securities-law analysis in virtually every major jurisdiction. A utility label does not override that analysis. In our practice, we assess classification against the substance of the rights actually conferred, not the marketing term.
Issuers targeting US purchasers – even incidentally – face an additional layer under SEC and CFTC jurisdiction. Tokens that the SEC regards as securities must comply with US registration or exemption requirements regardless of where the issuer is domiciled. A VARA licence and a MiCA-compliant whitepaper do not provide a shield from US securities enforcement if US purchasers can access the offering. The structuring decision on purchaser eligibility and geographic restrictions must therefore be made at the classification stage, not as an afterthought to the whitepaper process.
How Do Tax and Banking Interact with the Whitepaper Process?
The whitepaper and token classification are not purely legal instruments: they have direct tax and banking consequences that a business must work through before launch.
On the tax side, the classification of the token determines its treatment in the issuer's jurisdiction of residence. In Dubai, the absence of a corporate income tax on most activities is a structural advantage, but the issuance of tokens with ART-like characteristics or security-like features may generate taxable events in the jurisdictions of the purchasers, of any distributor entities and of any treasury operations located in higher-tax jurisdictions. An issuer with treasury operations in an EU member state, a Dubai VARA-licensed entity and token purchasers across multiple jurisdictions needs a tax opinion that tracks the token classification, not a generic zero-tax assertion based on the Dubai domicile alone.
On the banking side, the whitepaper and the VARA or MiCA classification are live documents in the bank's due-diligence process. A banking relationship for a token-issuing entity is genuinely difficult to obtain and maintain without a clear regulatory status. Banks conducting AML/CFT (anti-money laundering and counter-terrorist financing) compliance reviews on prospective crypto clients will review the whitepaper, the classification opinion and the applicable licence. An incomplete or inconsistently drafted whitepaper – particularly one that is silent on the use of proceeds, the token's economic mechanics, or the applicable regulatory regime – is a common reason for banking applications to be declined or for existing accounts to be closed. The VARA regime's requirement for licensed entities to maintain compliant banking arrangements makes the whitepaper-banking connection especially acute in Dubai.
Allied counsel in the relevant jurisdiction can support tax analysis specific to the issuer's corporate structure; OBOLUS coordinates that engagement as part of the cross-border structuring process.
If your prior application stalled or a banking relationship was declined following a whitepaper review, write to info@oboluslaw.com. A second read can surface the structural reason and the route back.
How Should Token Distributions and Airdrops Be Structured?
An airdrop – a free or near-free distribution of tokens to a defined set of recipients – is not exempt from the classification and whitepaper analysis simply because no consideration is paid. Under MiCA, an offer of crypto-assets to the public at no charge, or in exchange for promotional activity, may still engage the whitepaper obligation depending on the token category and the nature of the distribution. Airdrops that are genuinely free, wide and unconditional to more than a de-minimis number of recipients are treated differently from targeted distributions used as a marketing device to build a user base or create secondary-market liquidity.
The legal questions a structured airdrop must answer are: does the distribution constitute a "public offer" under the applicable regime; does the recipient pool include persons in jurisdictions that require a formal offer document; and does the airdrop create or imply economic rights that alter the token's classification? In our practice, we advise issuers to document the airdrop design – including the eligibility criteria, the geographic scope, and the relationship between the airdrop and any future economic or governance rights – before distribution begins. An undocumented airdrop that is later analysed in an enforcement context is a significantly weaker position than one where the legal analysis is contemporaneous.
For VARA-licensed issuers, marketing rules apply to any communication about virtual assets directed at clients or the public, which may encompass airdrop announcements. VARA's marketing rulebook provisions require communications to be fair, clear and not misleading, and the applicable standards apply regardless of whether consideration is exchanged.
Which Profile Should Choose Which Path?
Profile A: EU-domiciled issuer, no Dubai nexus, utility token offer to EU purchasers. The correct instrument is a MiCA whitepaper for other crypto-assets, notified to the competent authority in the issuer's home member state. Once notified and published, the offer passports across the EU/EEA. The issuer does not require a VARA licence unless it intends to conduct regulated virtual asset activities in mainland Dubai. Timeline is determined by the home member state's review window and by the completeness of the application package. Key risk: misclassification at the ART or securities threshold.
Profile B: VARA-licensed Dubai entity, targeting purchasers globally including the EU. The issuer requires a MiCA-compliant whitepaper for EU purchasers and must hold or appoint a MiCA-authorised CASP as the legal offeror in the EU. VARA disclosure obligations apply to the Dubai-perimeter marketing. The two processes run in parallel. The key structural question is whether the EU legal offeror entity is already authorised or whether a new MiCA authorisation or notification process is required. Key risk: dual obligations not satisfied simultaneously, creating a window where the EU offer proceeds without a notified whitepaper.
Profile C: Issuer with US person exposure. Securities-law analysis under federal and state law (SEC/CFTC/FinCEN) must precede the MiCA and VARA whitepaper process. The US regulatory perimeter cannot be managed by a VARA licence alone. The correct structure typically involves restricting US-person access at the smart-contract or distribution level and documenting that restriction in the whitepaper. Allied counsel in the US should review the offering structure before any public disclosure is made.
Profile D: ART or EMT issuer. Full authorisation – not mere notification – is required under MiCA before any offer. The authorisation process involves substantive regulatory review of the reserve structure, the redemption mechanism, and the issuer's own funds. This is materially more demanding than the notification track and requires engagement with the competent authority well in advance of the intended launch date. VARA has its own rules for asset-referenced instruments and stablecoin-adjacent products; the two tracks must be managed separately.
Related at OBOLUS
- Token Offerings & Securities practice – full-scope counsel on token classification, securities law and whitepaper structuring for digital-asset businesses.
- Stablecoin issuance authorisation under heightened scrutiny – ART and EMT authorisation under MiCA and equivalent regimes for stablecoin issuers.
- Worldwide freezing orders for regulated entities – rapid injunctive relief and on-chain asset recovery for businesses operating in regulated markets.
FAQ
Is my token a security?
Whether a token is a security depends on the rights it confers, not the label applied to it. The analysis runs under the laws of each jurisdiction into which the token will be offered. In the EU, a token that constitutes a transferable security falls outside MiCA and into applicable securities law. In the UAE, VARA's perimeter excludes tokens regulated as securities under UAE capital-markets law. The test is substantive: profit expectations tied to third-party efforts, claims on earnings or liquidation proceeds, and voting rights over a commercial enterprise are features that attract securities-law scrutiny across most major jurisdictions. Counsel should conduct this analysis before any public disclosure is made.
Do I need a MiCA whitepaper?
You need a MiCA whitepaper if you are making a public offer or seeking admission to trading of a crypto-asset in the EU/EEA and no statutory exemption applies. Exemptions exist for offers below a defined recipient threshold, offers to qualified investors only and certain small-scale offers. If you are offering a token that classifies as an ART or EMT, you need authorisation rather than mere notification, which is a more demanding process. The obligation attaches to the offer or trading activity, not to the issuer's domicile: a Dubai-based issuer targeting EU purchasers is within scope of MiCA for that offer.
How should an airdrop be structured legally?
A legally structured airdrop should document the eligibility criteria, the geographic scope and the relationship between the distribution and any future economic or governance rights before distribution begins. Whether the airdrop constitutes a "public offer" under MiCA depends on the token category, the number of recipients and the conditional or unconditional nature of the distribution. Marketing rules under the VARA regime apply to any communication about virtual assets to clients or the public, including airdrop announcements. Restricting the airdrop from jurisdictions that require a formal offer document, and documenting that restriction contemporaneously, is a baseline prudential step.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses. In our cross-border practice, we assess token classification against the substance of rights – not marketing labels – and manage the parallel whitepaper processes that dual-regulated issuers require. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Roman Levitt, Technology & DeFi Counsel – specialising in token classification, smart-contract legal analysis and cross-border whitepaper structuring for digital-asset issuers.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.