Institutional token issuers face a deceptively simple threshold question before any offering documentation is drafted, any roadshow is run, or any exchange listing is contemplated: is this instrument a security? The answer determines the entire legal architecture – the applicable regulatory regime, the disclosure obligations, the eligible investor pool, and the cross-border distribution strategy. Getting it wrong does not merely delay a launch. It converts a product launch into an unregistered securities offering, with enforcement, civil liability, and reputational consequences that are difficult to reverse.
A security token offering (an STO – the issuance of a digitally native instrument that constitutes a regulated security or financial instrument) sits at the intersection of capital markets law, digital-asset regulation, and multi-jurisdictional compliance. Under MiCA, instruments that qualify as financial instruments are explicitly carved out of that regime and remain subject to the existing securities laws of each EU member state. Under VARA in Dubai and the FSRA in Abu Dhabi, the activity-based licence framework captures investment-type tokens as a distinct regulated activity. Across common-law jurisdictions from the BVI to Singapore, the substance-over-label principle applies: the rights conferred by the token, not its marketing name, determine its classification. This page maps the structuring process that institutional issuers need to execute a compliant, cross-border STO.
Classification: The Threshold Question Every Issuer Must Answer First
Token classification is a legal analysis of economic substance, not a drafting choice. The dominant global test – applied in analogous forms by the SEC in the United States, the FCA in the United Kingdom, ESMA and the national competent authorities across the EU, the SFC in Hong Kong, and MAS in Singapore – asks whether the instrument confers investment rights that are characteristic of a security: profit participation, governance rights over a common enterprise, or a claim on the issuer's assets or revenue. A token that pays a dividend-equivalent yield, grants voting rights over protocol governance with economic consequence, or represents a fractional interest in real-world assets will almost always satisfy the relevant threshold, regardless of what the whitepaper calls it.
In our cross-border practice, we assess classification simultaneously against the law of the issuer's domicile, the law of the jurisdiction where the offering is distributed, and the law of any exchange where secondary trading is expected. A token that falls outside the securities perimeter in one hub may constitute a regulated instrument in another. The consequence of misclassification in distribution jurisdictions is particularly acute: securities laws in the United States, the UK, and the EU each impose strict-liability consequences on unregistered offers to the public.
The substance-over-label principle is the single most important concept for institutional issuers to internalise. A utility label on a whitepaper does not settle the legal classification. Regulators at the SEC, the FCA, and ESMA have each affirmed, through published guidance and enforcement action, that characterising a token as "utility" carries no legal weight if the economic substance points the other way. We regularly advise issuers who arrive with a drafted whitepaper that uses utility language to describe what is, on analysis, an investment contract. Reengineering the instrument at that stage is possible but expensive. Starting from the legal analysis saves material time and cost.
For a preliminary classification assessment of your proposed token structure, contact OBOLUS at info@oboluslaw.com. The legal architecture of your offering depends entirely on where classification lands. Your entity structure, your user base, and your intended distribution markets each shift the analysis in ways that a generic template cannot capture.
What Is the Regulatory Perimeter for Security Token Offerings?
Security token offerings are subject to the securities and capital markets laws of every jurisdiction in which the offer is made or the instruments are distributed – not merely the laws of the issuer's home jurisdiction. This is the cross-border reality that distinguishes an STO from a standard corporate finance transaction, and it demands a structuring approach that is built outward from a global distribution map rather than inward from a single regulatory regime.
In the European Union, the MiCA regime explicitly excludes financial instruments from its scope, leaving security tokens governed by MiFID II, the Prospectus Regulation, and the EU Pilot Regime for DLT-based market infrastructure. A CASP authorisation under MiCA is insufficient for an STO; the issuer and any intermediary arranging, dealing in, or advising on the tokens must hold appropriate MiFID II permissions or operate through an authorised firm. ESMA and the national competent authorities supervise compliance at the member-state level.
In the United Arab Emirates, VARA in Dubai and the FSRA in Abu Dhabi each operate activity-based licensing regimes that treat investment-type tokens as a distinct category. Advisory, broker-dealer, and management activities involving security tokens require separate VARA activity approvals. The ADGM / FSRA framework in Abu Dhabi maintains a list of recognised virtual assets and applies its regulated-activity rules to any investment token that meets the relevant criteria.
In Singapore, the Monetary Authority of Singapore (MAS) applies the Payment Services Act to digital payment tokens and the Securities and Futures Act to capital markets products – a category that captures most security tokens. A digital token that constitutes a capital markets product triggers the full prospectus and licensing regime under MAS supervision.
In the United Kingdom, the FCA applies the existing regulated-activities regime to security tokens that constitute specified investments. FCA registration under the Money Laundering Regulations alone is insufficient; firms dealing in or arranging security tokens require a full FCA authorisation for the relevant specified activities.
The practical implication: a multi-jurisdiction STO requires a regulatory map produced before the offering document is drafted. That map identifies, for each target market, the classification outcome, the applicable exemptions (private placement, qualified investor carve-outs, or equivalent), and the disclosure obligations that attach.
How Is a Security Token Offering Structured? A Step-by-Step Process
An institutional STO moves through five defined phases, each with legal deliverables that condition the next. The timeline across all five phases varies by the number of jurisdictions involved, the complexity of the underlying asset, and whether an existing regulatory relationship exists in any target market – but the sequence is consistent across deal types.
Phase 1 – Classification and Regime Mapping. Legal counsel produces a classification memorandum addressing the issuer's home jurisdiction and each distribution market. The memo identifies the applicable regulatory regime, the available exemptions, and the structural choices that follow from classification. This phase typically runs concurrently with early commercial diligence.
Phase 2 – Entity and Offering Structure. The issuer selects the domicile for the token-issuing special purpose vehicle (SPV), the governing law for the token instrument, and the investor eligibility criteria. Common SPV domiciles for STOs include the BVI (under the VASP Act 2022 and its securities overlay), the Cayman Islands, Luxembourg, and Singapore. The choice of domicile interacts with the distribution strategy: an EU-regulated offering typically benefits from a Luxembourg or Irish vehicle for prospectus passporting purposes; a private placement to qualified investors may use a Cayman or BVI SPV with appropriate transfer restrictions.
Phase 3 – Disclosure Documentation. Depending on the regulatory regime and the exemption relied upon, the offering documentation will take the form of a full prospectus, an exempt offering memorandum, or a MiFID II-compliant information document. Where the offering is structured as a public offer in an EU member state, the Prospectus Regulation imposes specific content requirements supervised by the relevant national competent authority. For exempt placements, the documentation must nonetheless satisfy anti-fraud standards and the disclosure obligations imposed by each distribution jurisdiction's securities laws.
Phase 4 – Smart Contract and Technical Documentation. The token's on-chain mechanics must reflect the legal rights described in the offering documentation. Transfer restrictions, investor eligibility whitelists, and dividend or redemption mechanics embedded in the smart contract need to be legally reviewed against the instrument's classification and the issuer's compliance obligations. Misalignment between the legal instrument and the on-chain code creates regulatory and civil-liability exposure.
Phase 5 – Ongoing Compliance and Secondary Market Considerations. Post-issuance obligations include AML/KYC maintenance, the Travel Rule (the obligation to pass originator and beneficiary data with transfers, applied under FATF Recommendation 15 and implemented at varying thresholds across jurisdictions), periodic disclosure, and – where applicable – registered reporting to the relevant supervisory authority. Exchange listing of a security token requires the exchange to hold the appropriate permissions for dealing in securities, adding a further regulatory layer to the secondary market strategy.
What Are the Most Common Structuring Mistakes in an STO?
The structuring mistakes that most frequently convert a well-intentioned institutional STO into a compliance problem fall into four categories. Each is preventable with early legal engagement, and each is materially harder to address after the offering documentation has been distributed.
First, classification deferred to the whitepaper writer. The legal classification of a token is a question of law, not a marketing decision. When the classification analysis is performed after the commercial structure is fixed, the legal team is often forced to work around economic terms that, on their face, satisfy the definition of a security in one or more distribution jurisdictions. We have seen this produce offering structures that are technically exempt in the issuer's home jurisdiction but constitute unregistered public offers in the investors' home jurisdictions – a distribution problem that is expensive to unwind.
Second, reliance on a single-jurisdiction legal opinion. An opinion from counsel in the issuer's domicile jurisdiction addresses the law of that jurisdiction. It says nothing about the securities laws of Switzerland, Singapore, the UK, or Hong Kong – all jurisdictions where institutional investors may be located. Multi-jurisdictional STOs require a legal opinion matrix covering each material distribution market.
Third, misaligned transfer restrictions. Institutional investors in exempt placements are typically subject to transfer restrictions during a lock-up period or until resale exemptions are established. If those restrictions are not enforced at the smart-contract level, secondary transfers can occur to non-eligible investors, triggering a securities-law violation in the receiving investor's jurisdiction.
Fourth, AML/KYC architecture that does not scale. An institutional STO that begins with a handful of investors at launch may contemplate secondary market liquidity within a defined period. The AML/KYC infrastructure must be designed to handle transfer-time verification at scale, including Travel Rule compliance for inter-platform transfers. Retrofitting that infrastructure after secondary market activity begins is both costly and operationally disruptive.
Cross-Border Distribution: How Does Jurisdiction Affect the STO Strategy?
For a business issuing tokens that will be distributed across multiple markets, the cross-border interaction between securities regimes is the central legal challenge. It is also the area where institutional issuers most commonly underestimate complexity.
Consider a token issuer domiciled in the ADGM, targeting investors in the EU, Singapore, and the United Kingdom. The FSRA regime governs the issuer's regulated activities. But the Prospectus Regulation – supervised by an EU national competent authority – governs any public offer in an EU member state. The Securities and Futures Act – supervised by MAS – governs any offer of a capital markets product in Singapore. And the FCA's financial-promotion rules apply to any communication directed at UK persons that constitutes an invitation to invest in a specified investment. Each regime operates independently. Compliance with one does not satisfy the others.
In our practice, operators who enter the cross-border STO process with a distribution-first mindset – mapping the investor pool before fixing the structure – consistently produce more efficient offering architectures than those who begin with a structure and retrofit the distribution analysis. The distribution map drives the exemption strategy, the SPV domicile choice, and the disclosure content – not the reverse.
Allied counsel in the relevant jurisdictions are engaged for local-law opinions where the matter requires in-country analysis that falls outside our direct coverage. The coordination of those opinions into a unified legal memorandum is a core part of our institutional STO offering.
In a recent STO structuring engagement, a digital-asset fund manager sought to issue tokenised fund interests to institutional investors across three continents. The classification analysis identified the tokens as regulated collective investment scheme interests in two of the three target jurisdictions. We restructured the SPV and the distribution approach to use available private placement exemptions in each market, coordinated local-law opinions, and delivered a consolidated offering memo that satisfied the disclosure standards of each target regulator. The offering closed to a qualified investor cohort without regulatory objection.
If your distribution strategy crosses more than one major securities regime, a cross-border structuring review is the most time-efficient first step. Write to OBOLUS at info@oboluslaw.com or message us at t.me/oboluslaw. If a prior application or offering structure encountered a regulatory objection, a second-opinion review can identify the structural reason and the route forward.
Decision Matrix: Which STO Structure Fits Which Issuer Profile?
No single STO structure is optimal across all issuer profiles. The right architecture depends on the nature of the underlying asset, the investor base, the distribution geography, and the issuer's existing regulatory relationships. The following profiles illustrate the decision logic.
Profile A – Fund Manager Tokenising Interests in an Existing Fund. The instrument is likely a collective investment scheme interest or equivalent in most target jurisdictions. The optimal structure is typically a Cayman or BVI SPV issuing tokenised LP interests under a private placement to qualified investors. The exemption relies on investor eligibility verification at the smart-contract level, with transfer restrictions enforced on-chain. The timeline from classification memo to close is typically a matter of months, dependent on the number of distribution jurisdictions and the pace of investor onboarding. The key risk is the CIS classification in distribution jurisdictions where the manager holds no licence or exemption.
Profile B – Corporate Issuer Tokenising Debt Instruments. A tokenised bond or note issued by an operating company is a debt security in virtually every major regime. The optimal structure depends on whether the issuer seeks a public or exempt offer. A public offer in the EU requires a prospectus approved by a national competent authority, with passporting available across member states once approved. An exempt placement to qualified investors is faster but restricts the eligible investor pool. The key risk is the financial-promotion perimeter: any communication about the offering that reaches non-qualified investors in a jurisdiction with a financial-promotion rule creates liability even if the offer itself is exempt.
Profile C – Real-World Asset (RWA) Tokenisation Platform. An issuer tokenising real-world assets – real estate, commodities, receivables – creates instruments that are likely to constitute securities, collective investment scheme interests, or structured products depending on the cash-flow characteristics and the governance rights conferred. The regime interaction is complex: the token classification, the underlying asset regulation, and the exchange listing rules each apply independently. The optimal structure combines a regulated-entity SPV in a hub jurisdiction (ADGM, Singapore, or Luxembourg are common choices), a private placement exemption for initial distribution, and a phased secondary-market strategy that builds toward regulated exchange listing as the platform matures.
Addressing the Assumption That a Utility Label Resolves Classification
A common assumption among issuers approaching their first STO is that the legal classification of a token is, to a significant degree, within the issuer's control – that a carefully drafted whitepaper describing a token as a "utility token" or a "governance token" will settle the question. It will not. Every major securities regulator has published guidance to the effect that the label applied in the offering documentation is irrelevant if the economic substance of the instrument satisfies the relevant securities definition.
The SEC's position – articulated through its published framework for investment contract analysis and its enforcement programme – is that a token is an investment contract if the purchaser invests money in a common enterprise with an expectation of profit from the efforts of others. The presence of a utility function does not, by itself, take the token outside that definition. The FCA has issued equivalent guidance in the UK. ESMA has addressed the point in the context of MiCA's exclusion of financial instruments from that regime's scope.
The practical implication is straightforward. Classification is a legal conclusion reached by applying the relevant test to the economic facts of the instrument. The whitepaper describes the instrument; it does not determine its legal character. Institutional issuers who start the STO process with a classification memo – produced before the commercial terms are fixed – avoid the structural rework that arises when the classification analysis is performed on a document that was drafted without it.
STO Readiness: A Self-Assessment Checklist for Institutional Issuers
Before engaging counsel for a full STO structuring mandate, institutional issuers can use the following checklist to assess their current state of readiness. Each item maps to a stage of the structuring process.
- Has a classification memorandum been produced by legal counsel covering the issuer's home jurisdiction and each intended distribution market?
- Has the token's on-chain economic mechanics – yield, governance rights, redemption features – been documented in sufficient detail to support a classification analysis?
- Has the SPV domicile been selected with reference to the distribution strategy and the applicable exemptions in each target market?
- Does the offering documentation address the disclosure requirements of each distribution jurisdiction, or only the issuer's home regime?
- Are transfer restrictions enforced at the smart-contract level, consistent with the investor eligibility criteria in the offering documentation?
- Has the AML/KYC infrastructure been designed to handle Travel Rule compliance for inter-platform transfers at secondary market scale?
- Have post-issuance reporting obligations – to the supervisory authority, to investors, and to any exchange – been mapped and assigned to a responsible team?
If any of these items is unresolved at the point the issuer is ready to proceed, the structuring engagement begins with resolving them. In our experience, issuers who complete items one through three before engaging on documentation consistently close faster and at lower total legal cost.
Related at OBOLUS
- Token Offerings and Securities for Digital-Asset Businesses – the full practice overview covering regulated and exempt token issuance across all major hubs
- Utility Token Legal Opinion in the British Virgin Islands – classification and legal opinion services for BVI-domiciled token issuers
- Crypto Fraud and Asset Recovery: Where the Legal Lines Are Drawn – enforcement and recovery options when a token offering becomes the subject of a dispute
FAQ
Is my token a security?
That depends on the economic substance of the rights it confers, assessed against the securities law of each jurisdiction in which it is offered or distributed. The relevant tests – applied by the SEC, the FCA, ESMA, MAS, and the SFC, among others – focus on investment rights, profit participation, and reliance on the efforts of a common enterprise. A utility label in the whitepaper carries no determinative legal weight. A formal classification memorandum produced by counsel covering your issuer domicile and your target distribution markets is the only reliable answer.
Do I need a MiCA whitepaper?
MiCA whitepapers apply to crypto-assets within the MiCA scope – primarily asset-referenced tokens, e-money tokens, and "other" crypto-assets as defined under the regulation. If your token constitutes a financial instrument under MiFID II, it falls outside MiCA entirely and is instead subject to the Prospectus Regulation or an equivalent securities disclosure regime. Whether you need a MiCA whitepaper, a MiFID II-compliant information document, or a full prospectus depends on the classification outcome – which is why classification analysis must come first.
How should an airdrop be structured legally?
An airdrop – the distribution of tokens to recipients without direct payment – is not automatically exempt from securities regulation. If the tokens being distributed qualify as securities, an airdrop constitutes a distribution of securities and triggers the registration or exemption requirements of the relevant jurisdictions. Legal structuring of an airdrop requires a prior classification analysis, identification of the jurisdictions in which recipients are located, and application of available exemptions (typically de minimis thresholds or qualified-investor carve-outs). Airdropping an unclassified token to a global recipient pool is one of the higher-risk distribution decisions an issuer can make.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We assess token classification against the substance of rights conferred, not the marketing label used in the whitepaper – because that is the test regulators apply. Digital assets are the entirety of our practice, and we act only for businesses. To discuss your STO structure, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in token classification, smart-contract legal review, and the cross-border regulatory architecture of digital-asset issuances.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.