An established operator launching a token already understands the technology. The legal question is whether that token is a security – and if it is, what the offering regime requires across every jurisdiction where the token will be sold or traded. Security token offering structuring (STO structuring) sits at the intersection of capital-markets regulation, AML compliance, and the increasingly codified digital-asset regimes now operating in the EU, Dubai, Singapore, and beyond. Getting the classification wrong converts a product launch into an unregistered securities offering, with consequences that include enforcement action, investor rescission claims, and licensing exposure for any exchange that lists the instrument. This page maps the full process: classification, regulatory basis, documentation, cross-border reach, and the decisions a general counsel must own before a token goes to market.
Why Classification Comes First
Token classification determines every subsequent legal decision in a security token offering, from prospectus obligations to AML treatment to exchange eligibility. The substance-over-form principle applies universally: a token labelled "utility" in a whitepaper still qualifies as a security if it confers investment rights, profit expectations, or governance entitlements that a court or regulator would read as equity- or debt-like. Regulators from the SEC and CFTC in the United States to ESMA under MiCA (the Markets in Crypto-Assets Regulation) to the SFC in Hong Kong have each stated publicly that the marketing label is not determinative. The rights the token confers – and the reasonable expectations of the purchaser at the point of sale – are.
For an established operator, the classification exercise is more consequential than for a start-up. An existing business issuing a token that represents a share in revenues, a debt instrument, or a tokenised fund interest is issuing a regulated financial instrument. The offering must comply with the prospectus or disclosure regime of every jurisdiction in which it is made. Cross-border reach amplifies that exposure: a token sold to investors in the EU, the UAE, and Singapore simultaneously engages MiCA, VARA, and the Payment Services Act in parallel.
In our practice, we begin every engagement with a written classification opinion before any whitepaper is drafted or any exchange relationship is established. That opinion documents the analytical basis, the jurisdictions assessed, and the disclosure obligations that flow from the result. It is the foundational document for every downstream step.
The common mistake at this stage is treating classification as a checkbox rather than a legal analysis. Operators who self-classify and proceed directly to drafting frequently discover – at the listing stage or after a regulatory inquiry – that the analysis was incomplete. Reconstructing the record after the fact is harder, and more expensive, than doing it correctly at the outset.
For a scoped classification opinion and offering roadmap, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the token rights, the investor base – change the analysis materially.
The Regulated Basis Across Leading Regimes
A security token offering engages different regulatory regimes depending on the classification output, the issuer's domicile, and the jurisdictions of intended investors. No single global standard exists. An operator must map each relevant jurisdiction independently and then identify the points of structural conflict.
Under MiCA, tokens that qualify as financial instruments fall outside MiCA's scope entirely and into the existing EU securities regime – meaning a MiCA CASP authorisation does not cover the issuance. The applicable framework is MiFID II and the Prospectus Regulation, administered by ESMA and the relevant national competent authority. Asset-referenced tokens (ARTs) and e-money tokens (EMTs) have their own MiCA-specific authorisation and whitepaper obligations. The practical implication: an EU-facing token issuer needs to determine, before drafting, whether it is issuing under MiCA or under legacy securities law, because the documentation, the regulator, and the timeline differ significantly.
In Dubai, VARA's activity-based licensing regime covers dealing, advisory, and custody of virtual assets, but the question of whether a given token constitutes a security is assessed against the UAE's financial instruments framework. Operators domiciled in the DIFC engage the FSRA rather than VARA; the two regimes do not overlap. A business with a VARA licence cannot assume it covers a securities-format token offering made to UAE investors.
Singapore's MAS applies the Payment Services Act to digital payment tokens and the Securities and Futures Act to capital-markets products. A token that qualifies as a capital-markets product requires a prospectus or an applicable exemption. MAS has published guidance on the digital-token framework and expects operators to document the basis for any exemption claimed.
In the United States, the SEC's position is that most tokens with investment characteristics are securities subject to registration or an available exemption. The CFTC asserts jurisdiction over commodity-like tokens. FinCEN's AML obligations apply across categories. State money-transmitter licensing and the NYDFS BitLicense add a further layer for operators with US-resident participants. We regularly advise operators who assumed a Reg D exemption covered their global offering – it does not.
What Does a Security Token Offering Structure Actually Contain?
A properly structured STO comprises five interdependent components: the legal entity structure, the classification opinion, the offering document or whitepaper, the AML/KYC framework, and the exchange and custody arrangements. Each component must be coherent with the others, and the whole must be compliant in each target jurisdiction.
Legal entity structure. The issuer must be a correctly constituted entity in a jurisdiction whose law is recognised by the target investor base and, where applicable, by the exchange on which the token will be listed. Common issuer domiciles include the Cayman Islands (a regulated structure under CIMA), the BVI (under the VASP Act 2022 and, for fund vehicles, existing fund legislation), Malta (under the MFSA regime transitioning to MiCA), and ADGM in Abu Dhabi. The choice of domicile determines which prospectus or whitepaper regime applies, which AML framework governs onboarding, and which court system has jurisdiction over investor disputes.
Classification opinion. A written legal opinion, prepared by qualified counsel, documenting the token's classification in each material jurisdiction. This opinion should address both the issuance and the secondary trading of the token. The secondary-trading analysis matters because an exchange listing a security token without the necessary authorisation faces its own regulatory exposure.
Offering document or whitepaper. The MiCA whitepaper regime requires a specified set of disclosures for tokens within its scope; tokens outside MiCA's scope but within EU securities law require a prospectus that complies with the Prospectus Regulation. Other jurisdictions have their own disclosure standards. The offering document must be accurate, complete, and consistent with the classification opinion. It must not overstate utility characteristics to argue away a security classification that the substance of the token does not support.
AML/KYC framework. Under the FATF Recommendations – specifically Recommendation 15, which applies to virtual assets and VASPs – the issuer must implement a risk-based AML/CFT programme. The Travel Rule (the obligation to pass originator and beneficiary data with a transfer of value above the applicable threshold) applies to transfers of the token on secondary markets. The issuer's AML programme should address both the primary offering and the secondary-market lifecycle.
Exchange and custody arrangements. A security token can only be listed on a venue that is authorised to trade securities or digital assets in the relevant category. Most established exchanges operate tiered listing processes for security tokens. Custody of a security token is a regulated activity in most flagship regimes; the custodian must hold the appropriate authorisation.
How Does the Cross-Border Structure Work in Practice?
Cross-border STO structuring requires a coordinated multi-jurisdiction analysis rather than a series of independent country assessments. An operator offering to investors in the EU, the GCC, and Asia simultaneously faces three distinct disclosure regimes, at least two distinct AML regimes, and potentially conflicting rules on investor categorisation and marketing restrictions.
The standard approach is to identify the primary jurisdiction – where the issuer is domiciled and where the primary regulatory relationship will sit – and then map each additional jurisdiction as an overlay. The overlays may require local law opinions, local registration or notification filings, or local counsel engagement. We coordinate those engagements through allied counsel in each relevant jurisdiction; the operator deals with a single point of contact at OBOLUS for the overall structure.
A common structural choice is to issue from a jurisdiction with a well-developed securities exemption framework – Cayman or BVI for a global offering with no EU retail component, or an EU domicile if passporting across the EEA is a primary objective. The issuer then layers jurisdiction-specific investor restrictions into the offering document: EU retail investors receive MiCA-compliant disclosures; US persons are excluded or receive a Regulation D-compliant offering; Singapore investors receive documentation consistent with the MAS digital-token guidance.
Banking and custody present a separate cross-border problem. A Cayman-domiciled issuer with EU investors and a Singapore exchange listing needs banking relationships that span those geographies. We have seen operators complete the legal structure and then discover that no bank in the issuer's domicile will service a security token issuer. Banking due diligence is not an afterthought; it is part of the structure from day one.
To map the licence, banking, and token-structure stack for your offering, write to info@oboluslaw.com. If a prior application stalled or a banking relationship collapsed, a second read of the structure can identify the cause and the route forward.
Common Mistakes Established Operators Make
Established operators make a distinct set of mistakes in STO structuring – different from start-up errors, and often more costly, because the business already has regulatory relationships, investors, and a reputation to protect.
Assuming the utility label controls. This is the most frequent and most expensive mistake. A common assumption is that labelling a token "utility" in the whitepaper, and structuring the rights accordingly at the marketing level, settles the classification question. It does not. Regulators and courts assess classification on the economic substance of the rights conferred and the reasonable expectations of purchasers, not on the label the issuer applies. We assess classification against the substance of rights, not the marketing label. An established operator with an existing product line that issues a token representing access to that product still needs a full classification analysis, because the access right may constitute an investment contract depending on the structure.
Treating the whitepaper as a marketing document. A MiCA-regime whitepaper is a regulatory filing with specific mandatory content and a liability regime attached to material inaccuracies. Operators accustomed to drafting commercial white papers for product launches sometimes underestimate the legal weight of the instrument. The offering document is a legal disclosure document first.
Ignoring secondary-market compliance. The regulatory obligations for a security token do not end at the primary offering. Secondary trading on exchanges engages AML, Travel Rule, and potentially market-abuse obligations. Operators who structure the primary offering correctly but fail to address the secondary-market lifecycle face enforcement exposure at a later stage.
Underestimating the AML build. A risk-based AML programme for a security token offering is more complex than the programme for a utility token. The investor base is likely to include institutional participants with their own AML expectations; the offering may trigger enhanced due diligence obligations; and the cross-border nature of most offerings means that sanctions screening must cover multiple lists simultaneously.
Late engagement of counsel. In our practice, the most common structural problem we are asked to remedy is one that was baked in at the design stage. Engaging legal counsel after the token economics are fixed, the smart contracts are written, and the investor conversations have started is significantly more constrained than engaging at the design stage, when the structure can still be adjusted cleanly.
Decision Matrix: Which Structure Fits Which Operator Profile?
STO structuring is not one-size-fits-all. The right structure depends on the operator's existing regulatory footprint, the intended investor base, the token's economic purpose, and the exchange on which listing is sought. The following profiles describe the most common scenarios we encounter.
Profile A – Established exchange or custodian expanding into tokenised securities. This operator already holds a CASP authorisation or equivalent in a primary jurisdiction. The structural question is whether the new instrument falls within the existing licence scope or requires a separate authorisation. Under MiCA, financial instruments fall outside the CASP regime; the operator will need to engage the relevant national competent authority under the securities framework. The indicative lead time for a new authorisation in a major EU jurisdiction is a matter of months, not weeks. The key risk is that the operator assumes the existing licence covers the new activity and begins operating before the additional authorisation is in place.
Profile B – Asset manager or fund issuing a tokenised fund interest. This operator is likely already regulated as a fund manager or investment adviser. The token represents a fund interest; the issuance is a securities offering; the operator needs to assess whether the tokenised interest is a new regulated product requiring fund registration or whether it fits within an existing structure. Cayman and BVI offer established fund structures that can accommodate tokenised interests under existing legislation. The indicative process involves fund structuring, a classification opinion, an offering memorandum, and exchange/transfer-agent arrangements. The key risk is characterising the token as "utility" to avoid the fund registration requirement – a characterisation that regulators with jurisdiction over the investor base will test against the economic substance of the interest.
Profile C – Corporate issuer tokenising debt or equity. A company issuing tokenised bonds or tokenised equity is issuing a security by definition. The prospectus or disclosure obligations of each jurisdiction in which the offering is made apply in full. The structural advantage of a tokenised instrument – settlement efficiency, secondary-market liquidity, fractionalisation – does not alter the securities law analysis. The operator needs a full prospectus or an applicable exemption in each target jurisdiction, a licensed exchange for secondary trading, and a custodian authorised to hold security tokens. The key risk is proceeding under a "private placement" exemption without adequate documentation of investor eligibility and distribution restrictions.
A Cross-Border Matter in Practice
In a recent engagement, a fintech group with an existing payments licence sought to issue a revenue-participation token to institutional investors across three jurisdictions – one in the EU, one in the GCC, and one in Asia. Initial internal analysis had characterised the token as utility on the basis that it provided access to the group's payment infrastructure. Our classification review identified that the revenue-participation feature, combined with a secondary-market liquidity mechanism, gave the token the economic characteristics of a profit-participating instrument. The utility characterisation was not supportable in the EU jurisdiction or in the GCC jurisdiction under their respective securities frameworks. We restructured the offering: the EU tranche was issued under a securities exemption with a compliant disclosure document; the GCC tranche was restructured to remove the revenue-participation feature for GCC investors; the Asian tranche proceeded under the applicable securities exemption with local counsel coordinated through OBOLUS. The group launched the offering on a timeline that was longer than originally projected but structurally defensible across all three jurisdictions. No enforcement action followed.
Self-Assessment Checklist Before You Proceed
Before committing to a security token offering, an established operator should be able to answer each of the following questions with documented support:
- Has a written classification opinion been prepared by qualified counsel covering each material jurisdiction?
- Has the issuer entity been constituted in a jurisdiction whose law is recognised by the target investor base and the intended exchange?
- Has the offering document been prepared, reviewed against the applicable disclosure regime, and approved by legal counsel?
- Has an AML/KYC programme been implemented that addresses both the primary offering and secondary-market transfers, including Travel Rule compliance?
- Has the exchange on which listing is sought confirmed that it holds the necessary authorisation to trade the token in each relevant jurisdiction?
- Has a custodian been engaged that holds the appropriate authorisation for security tokens in the issuer's domicile and in the key investor jurisdictions?
- Has banking due diligence been completed and a banking relationship established that will accommodate the offering proceeds and ongoing operations?
- Have investor marketing and distribution restrictions been documented in the offering materials and in all promotional communications?
If any of these questions cannot be answered with documented support, the offering is not ready to proceed. The cost of remediation after launch is a multiple of the cost of preparation before it.
Related at OBOLUS
- Token Offerings & Securities Practice – the full practice overview covering our approach to token classification, STO structuring, and cross-border securities compliance.
- Token Legal Classification in the Bahamas – jurisdiction-specific classification analysis for operators considering the Bahamas as an issuer or listing domicile.
- Security Token Offering Structuring for Institutional Clients – the parallel service page addressing STOs structured for institutional investor distribution.
FAQ
Is my token a security?
Classification depends on the economic substance of the rights conferred and the reasonable expectations of purchasers – not on the label applied in marketing materials. A token that provides profit participation, investment exposure, or governance rights analogous to equity or debt is likely a security in most major jurisdictions. The analysis must be conducted jurisdiction by jurisdiction; a token that qualifies as a utility instrument in one regime may be a security in another. Qualified legal counsel should prepare a written opinion covering each material jurisdiction before any offering is made or any exchange listing is sought.
Do I need a MiCA whitepaper?
A MiCA whitepaper is required for most crypto-asset offerings made to the public in the EU – covering asset-referenced tokens, e-money tokens, and other crypto-assets within MiCA's scope. However, tokens that qualify as financial instruments under EU law fall outside MiCA and into the existing EU securities regime, where a prospectus or an applicable exemption is required instead. The first step is classification; the whitepaper or prospectus obligation follows from that result. The mandatory content, liability regime, and regulatory notification process differ significantly between MiCA and the securities track.
How should an airdrop be structured legally?
An airdrop distributes tokens without direct monetary consideration, but the absence of a purchase price does not remove the regulatory analysis. If the airdropped token is a security, distributing it – even without charge – may constitute an unregistered offering in jurisdictions with broad securities definitions, including the United States. The classification analysis applies with equal force to airdropped tokens. The structure should document the basis for any exemption claimed, restrict distribution to eligible jurisdictions, and include AML screening of recipient wallet addresses where legally required. Airdrop mechanics should be reviewed by counsel before distribution begins.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking, and compliance that sit around them. Digital assets are the whole of our practice. We assess token classification against the substance of rights, not the marketing label – giving operators a defensible analytical record before any offering is made. To discuss your situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in token classification, smart-contract legal risk, and cross-border security token offering structuring for established digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.