A token issuer preparing a capital raise discovers, late in the structuring process, that the rights embedded in its token – profit participation, governance votes, a redemption mechanism – read as securities interests under the laws of its target investor jurisdictions. The offering must be paused, re-documented or abandoned. The cost is not just legal fees; it is the window of market timing, the trust of early investors, and, in some venues, the exposure to regulatory enforcement for an unregistered offering. This is the scenario we are retained to prevent.
Security token offering structuring is the legal discipline of designing a digital-asset capital raise so that the rights embedded in the token, the disclosure documents, the mechanics of issuance and the distribution channel all align with the securities law or crypto-asset regulatory regime that governs each relevant jurisdiction. The work begins at classification – is this instrument a security, an asset-referenced token, an e-money token, or something else? – and runs through investor documentation, regulatory filing, cross-border distribution permissions and post-issuance compliance obligations. This page explains how that process works and where the legal risk concentrates.
What is a Security Token, and Why Does Classification Drive Everything?
A security token is a digital asset that confers rights – to income, capital appreciation, voting, or a share in an enterprise – that a competent regulator or court would characterize as a security or investment instrument under applicable law. Classification is the foundational question because the answer determines which regulatory regime applies, which disclosure obligations arise, which distribution channels are available, and whether an exemption from full registration is available at all.
Classification logic is substance over form. The label on a whitepaper is not controlling. What matters is the package of rights the holder receives. A token that entitles holders to a share of platform revenue, or that is marketed with an expectation of profit derived from others' efforts, will commonly fall inside the securities perimeter in the United States under SEC doctrine, in the European Union under MiCA's asset-referenced token or transferable-securities concepts, and under the SFC regime in Hong Kong. Regulators in all three venues have stated, repeatedly, that the word "utility" on a cover page changes nothing if the economic substance reads as an investment.
Under MiCA (the EU's Markets in Crypto-Assets Regulation), tokens that qualify as transferable securities are explicitly carved out of MiCA's scope and fall instead under the existing EU prospectus and MiFID II regimes – meaning the full weight of EU securities law applies. Tokens that qualify as asset-referenced tokens (ARTs) or e-money tokens (EMTs) remain inside MiCA but carry their own authorization and reserve requirements. Only tokens that fit neither category – sometimes called "other crypto-assets" in the MiCA taxonomy – enjoy the lighter-touch MiCA whitepaper regime. Getting that classification call right at the outset is not administrative housekeeping; it sets the entire compliance architecture.
The practical implication: every structuring engagement at OBOLUS begins with a formal classification opinion that maps the token's rights against the test in each distribution jurisdiction before a single line of investor documentation is drafted.
In our cross-border practice, we regularly advise on token structures that need to satisfy concurrent tests – the SEC's investment-contract analysis, MiCA's taxonomy, the SFC's collective-investment-scheme analysis, and MAS's capital-markets-services framework – because the issuer's investor base sits across multiple regulatory zones simultaneously. A structure that clears one test may fail another. The classification work must be done jurisdiction by jurisdiction, not as a single global conclusion.
What Legal Regime Applies to Your Token Offering?
The applicable regulatory regime turns on three overlapping factors: where the issuer is domiciled, where it solicits investors, and what rights the token confers. No single global standard governs security token offerings, and no single exemption travels across borders.
In the United States, the SEC regulates offers and sales of securities, and a security token offering to US persons without registration requires a valid exemption – most commonly Regulation D (private placement), Regulation S (offshore transactions), or Regulation A+ for smaller raises with broader distribution. FinCEN imposes separate AML/KYC obligations. State money-transmitter licensing under individual state frameworks, including the NYDFS BitLicense in New York, may also be triggered depending on the token's mechanics.
Across the European Union, the issuer must first establish whether MiCA or the EU prospectus regime applies. A token classified as a transferable security triggers the prospectus obligation, with the benefit of EU-wide passporting once a home-member-state authority approves the document. A token classified as an ART under MiCA requires ESMA-supervised authorisation in a member state, with significant own-funds and reserve requirements. The MiCA whitepaper route – available for "other crypto-assets" – is lighter but still carries liability for material misstatement.
In the UAE, an offering through a VARA-licensed entity in mainland Dubai or through the FSRA within ADGM must comply with the applicable activity-based licence and investment-product rules of the relevant authority. The DIFC, as a separate financial free zone, maintains its own framework. An issuer whose token touches the UAE market without the correct licence faces enforcement risk under both the VARA regime and the FSRA framework, depending on where activity occurs.
Singapore's MAS and Hong Kong's SFC each apply their own tests. The SFC has been particularly active in applying its collective-investment-scheme and securities analysis to token structures, and the VASP licensing regime in Hong Kong applies to platforms that list security tokens.
The cross-border reality for most issuers is that they need a distribution strategy – deciding which investor jurisdictions to access, which to exclude via enforceable restrictions, and how to document those decisions – before the offering goes live. In our practice, we structure that distribution strategy as part of the legal architecture, not as an afterthought in the terms and conditions.
For a scoped assessment of your token's classification and the applicable regime in your target markets, contact OBOLUS at info@oboluslaw.com. The process above describes the standard analytical path. Your facts – the rights the token confers, the investor jurisdictions, the entity structure – change the analysis materially. Map your options.
How Does the Security Token Structuring Process Work in Practice?
A well-run security token offering structuring engagement follows a disciplined sequence: classification, entity and instrument design, regulatory filing strategy, investor documentation, distribution-channel compliance, and post-issuance obligations. Each step builds on the last, and the sequencing matters.
Step 1 – Classification opinion. Counsel produces a written opinion mapping the token's rights against the applicable tests in each distribution jurisdiction. The opinion identifies which regime applies, whether an exemption is available, and what conditions that exemption imposes. This document becomes the foundation for every subsequent decision.
Step 2 – Issuer entity and instrument design. The issuing entity is selected or established to optimize for the chosen regulatory path, tax treatment, and investor expectations. For an EU offering under MiCA's ART regime, the issuer must be an authorized legal person in a member state. For a US Regulation D placement, a domestic or foreign private issuer structure is chosen with an eye to ongoing reporting obligations. The token instrument – the smart-contract architecture that implements the rights – is reviewed alongside the legal documentation to ensure the on-chain mechanics match the off-chain commitments.
Step 3 – Disclosure document preparation. A MiCA whitepaper, an EU prospectus, a US private-placement memorandum, or a combination of jurisdiction-specific disclosure documents is prepared. Each document must describe the token's rights, the issuer's financial position, the use of proceeds, the risk factors, and the mechanics of the offering with sufficient precision to satisfy the applicable liability standard. Material misstatement in a security-token disclosure document carries civil and, in many jurisdictions, criminal exposure.
Step 4 – Regulatory filing or notification. Depending on the regime, this step involves filing the disclosure document with the competent authority (ESMA via the home-member-state NCA for a MiCA ART, the SEC for a Regulation A+ offering, the SFC for a Hong Kong-registered product), obtaining approval or passporting rights, or submitting a notification where no prior approval is required but a filing deadline applies.
Step 5 – Investor documentation and subscription mechanics. Subscription agreements, investor representations, and AML/KYC documentation are prepared and integrated into the offering workflow. For a token offering, this includes the technical integration of investor on-boarding with the issuance smart contract, so that tokens are only minted to wallets whose holders have completed the required compliance steps.
Step 6 – Distribution-channel compliance. The platforms or intermediaries through which the token is offered – whether a licensed exchange, a regulated broker-dealer, or a direct-placement portal – must themselves hold the applicable licences. Placing security tokens through an unlicensed venue can void the issuer's exemption. We advise on the selection and legal relationship with distribution partners as part of the structuring mandate.
Timelines vary significantly by regime. A MiCA whitepaper for an "other crypto-assets" offering can be prepared and notified in a matter of weeks once the classification is settled. A full EU prospectus for a transferable-security token takes materially longer, driven by the authority review period. A US Regulation D offering can close quickly once documentation is in order, though the restrictions on general solicitation under the standard exemption require careful management. In our experience, the most common cause of timeline slippage is not regulatory process – it is a classification question that was left open too long before counsel was engaged.
What Are the Most Common Structuring Mistakes in Security Token Offerings?
The errors we encounter most frequently are not obscure; they are predictable, and they tend to cluster at the classification and distribution-channel stages.
Relying on a utility label. A common assumption is that calling a token a "utility token" in the whitepaper settles the legal classification. It does not. Regulators and courts assess the rights the token actually confers, the manner in which it was marketed, and the reasonable expectation of the purchaser. A token that is sold with forward-looking statements about price appreciation, or that pays holders a share of platform fees, will be analyzed as a potential security regardless of its label. We assess classification against the substance of rights, not the marketing term.
Designing the offering without a distribution strategy. Issuers frequently prepare the offering document for their home jurisdiction and then, once the offering is live, find that investors from jurisdictions they did not formally exclude are purchasing. The absence of enforceable restrictions – in the smart contract, the subscription agreement, and the transfer mechanics – creates retroactive exposure in those jurisdictions. A properly structured offering builds the geographic restrictions into the technical and legal architecture from day one.
Ignoring the secondary market. The obligation to comply with securities law does not end at primary issuance. Secondary trading of security tokens on unlicensed venues, resales by investors who do not meet holding-period requirements under applicable exemptions, and transfers to persons in restricted jurisdictions all create ongoing compliance risk. The offering structure must address secondary-market behavior, typically through transfer restrictions encoded in the smart contract and enforceable in the token's terms.
Separating the legal and technical workstreams. The smart-contract mechanics that implement the token's rights must be reviewed by legal counsel at the same time as the documentation. A contract that pays dividends in a manner inconsistent with the described distribution waterfall, or that permits transfers to restricted investors, creates a material mismatch between the legal offer and the on-chain reality. We review smart-contract specifications as part of the structuring mandate, not as an afterthought.
In a recent structuring matter, a technology company came to us after a prior adviser had completed a whitepaper for a "utility" token that, on analysis, embedded revenue-sharing rights and a buyback mechanism typical of a debt instrument. The token had been marketed to early investors in the EU and Singapore. We rebuilt the classification analysis, restructured the rights to separate the utility and investment components into two instruments, and prepared jurisdiction-specific disclosure for each. The EU instrument was notified under the applicable MiCA pathway; the Singapore component was restructured to fall within an available exemption under the Payment Services Act framework. The offering reached close within a commercially acceptable period without a regulatory flag.
If a prior structuring effort stalled or produced a classification opinion you are no longer confident in, a second review can surface the structural issue and the route forward. Write to info@oboluslaw.com. If the structure needs rebuilding before the next round, the earlier that work begins, the lower the cost. Map your options.
How Do Cross-Border Securities Laws Interact in a Token Offering?
Cross-border complexity in security token offerings arises because securities laws are territorial but token transfers are not. A token issued in Switzerland under a FINMA-compliant structure does not travel with a regulatory clearance certificate when a holder transfers it to a US person. The receiving jurisdiction applies its own test.
For issuers targeting multiple investor jurisdictions simultaneously, the structuring work involves building a concentric ring of protections: the primary offering documentation covers the home jurisdiction; jurisdiction-specific addenda or separate offering circulars cover other material markets; and transfer restrictions – both legal and technical – prevent tokens from reaching investors in jurisdictions where no compliance has been established.
The most common cross-border tension we advise on involves the intersection of MiCA passporting rights and US securities law. An issuer authorized as a CASP in an EU member state, offering tokens passported across the EU/EEA, still faces a hard stop at the US border. The Regulation S safe harbor, which excludes US persons from an offshore offering, requires specific measures: no directed selling efforts into the United States, contractual representations from investors, and transfer restrictions enforceable at the smart-contract level. Getting this right requires US-law input coordinated with the EU structuring counsel, which is why we work alongside allied counsel in the relevant jurisdiction for any offering with a US nexus.
The interaction between the FSRA within ADGM and VARA in mainland Dubai creates a second common cross-border friction point. An issuer operating in both the DIFC financial free zone and mainland Dubai faces two regulatory frameworks with different activity definitions and licensing requirements. We regularly advise on how to structure the issuing entity and the distribution mechanics to avoid inadvertently triggering the second regime.
Tax and banking sit alongside the regulatory structure. The jurisdiction in which the issuing entity is domiciled affects the tax treatment of token proceeds, the withholding obligations on distributions, and the availability of banking services. We structure licensing, banking and tax as one mandate rather than three disconnected workstreams – because a structure that is regulatory-clean but unbankable is not viable.
Which Structuring Path Fits Your Profile?
The right structuring approach depends on the issuer's profile, the token's rights, and the target investor base. The following analysis maps the common operator profiles to the typical instrument and regime choice.
Profile A – EU-domiciled issuer, EU investor base, token with revenue-sharing rights. The token is likely an ART or a transferable security under MiCA / the EU prospectus regime. The structuring path runs through ESMA-supervised authorisation in a member state (for ART) or a prospectus approved by the home-member-state NCA with EU-wide passporting (for a transferable security). Timeline to market is measured in months, not weeks, driven by the authority review period. The key risk is undercapitalizing the own-funds requirement for an ART authorisation or underestimating the disclosure standard for a prospectus.
Profile B – Non-US issuer, global investor base, token with governance and staking rights. The structuring path typically involves a Regulation S exclusion for US persons, MiCA compliance for EU investors (under the "other crypto-assets" whitepaper route if the token clears the classification test), and jurisdiction-specific analysis for Singapore, Hong Kong, and the UAE. Timeline is driven by the most demanding jurisdiction in the target set. The key risk is the secondary-market transfer problem: staking and governance tokens trade actively, and post-issuance transfers to restricted jurisdictions are difficult to police without smart-contract-level controls.
Profile C – US-connected issuer, accredited-investor raise, token representing equity-like rights. The structuring path runs through Regulation D (private placement to accredited investors) or, for a broader raise, Regulation A+. Secondary trading requires either a registered alternative trading system or a restriction on resale until the applicable holding period has run. Timeline under Regulation D is relatively short once documentation is in order; Regulation A+ carries a longer SEC review period. The key risk is an inadvertent general solicitation that voids the Regulation D exemption.
Profile D – Fund vehicle issuing tokens representing fund interests. The token is almost certainly a security or a collective-investment-scheme interest in every material jurisdiction. The structuring path requires both the fund regulatory approval (from MAS, the SFC, CIMA, or the relevant authority depending on domicile) and the securities-law compliance for the token issuance. These two workstreams must be run in parallel and the documentation must be consistent. Timeline is driven by fund authorisation, which typically takes longer than the token documentation. The key risk is treating the token issuance as a separate workstream from the fund authorisation and producing inconsistent documents.
Self-Assessment: Is Your Token Offering Structurally Ready?
Before engaging counsel, a useful first-pass diagnostic is to ask the following questions about your proposed structure. If the answer to any of them is uncertain, the structuring work is not yet complete.
- Has a formal written classification opinion been obtained for each jurisdiction in which you intend to offer the token to investors?
- Does the offering document accurately describe the rights the token confers, including any secondary or contingent rights (e.g., fee shares, buyback obligations, governance votes)?
- Are geographic restrictions on purchase and transfer enforceable both in the subscription agreement and at the smart-contract level?
- Has the applicable regulatory filing or notification been completed, or has a valid exemption been identified and documented in each distribution jurisdiction?
- Have the platforms or intermediaries through which the token will be offered confirmed they hold the required licences in each relevant jurisdiction?
- Has the AML/KYC on-boarding workflow been integrated with the token-issuance mechanics so that tokens cannot be minted to wallets whose holders have not completed compliance checks?
- Is there a post-issuance compliance plan covering secondary trading, transfer restrictions, and ongoing disclosure obligations?
In our practice, we find that issuers who can answer each of these questions affirmatively are in a structurally sound position. Those who cannot are carrying regulatory risk that will surface either at the offering stage or, more expensively, after tokens have been distributed.
Related at OBOLUS
- Token Offerings & Securities Practice – full-scope legal advisory for token issuers across capital markets and crypto-asset regimes.
- Security Token Offering Structuring in Turkey – jurisdiction-specific analysis for issuers targeting or domiciled in the Turkish market.
- Custody Arrangements for Funds in Liechtenstein – structuring digital-asset custody within the Liechtenstein regulatory regime for fund vehicles.
FAQ
Is my token a security?
Whether a token is a security depends on the rights it confers and the jurisdiction in which it is offered – not the label on the whitepaper. In the United States, the SEC applies an investment-contract analysis. Under MiCA, the question is whether the token constitutes a transferable security, an ART, an EMT, or another category. In Hong Kong and Singapore, collective-investment-scheme and capital-markets-services tests apply. A formal, written classification opinion covering each distribution jurisdiction is the required starting point. No single global answer exists.
Do I need a MiCA whitepaper?
A MiCA whitepaper is required for "other crypto-assets" offered to the public in the EU. However, if your token qualifies as a transferable security under existing EU law, MiCA does not apply – the EU prospectus and MiFID II regimes govern instead, and a prospectus rather than a whitepaper is required. If the token is an ART or EMT, different MiCA obligations apply, including authorisation requirements beyond a whitepaper. The correct document depends on the classification outcome, which must be established first.
How should an airdrop be structured legally?
An airdrop – the distribution of tokens to recipients without direct payment – can still trigger securities-law obligations if the tokens are securities and recipients are in regulated jurisdictions. Key considerations include whether the airdrop constitutes a "public offer" under applicable law, whether KYC obligations apply, and whether the distribution creates secondary-market supply that undermines transfer restrictions in the primary offering. A legally compliant airdrop structure typically includes jurisdiction-based eligibility screens, documented rationale for the distribution, and integration with the issuer's AML program.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess classification against the substance of rights, not the marketing label, and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. To discuss your situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in token structuring, smart-contract legal review, and the intersection of securities law with on-chain instrument design.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.