A token issuer preparing a capital raise discovers, mid-structuring, that the rights embedded in its token – economic participation, revenue sharing, governance power – look far more like a security than a utility instrument. That discovery, made late, converts a planned product launch into exposure for an unregistered securities offering across every jurisdiction where investors reside. The legal question is not whether the token feels like a utility. The question is what the token does – and what regulators and courts will say it is.
Structuring a security token offering (STO – the issuance of a digital token that embodies security-like rights and is regulated accordingly) under heightened regulatory scrutiny requires a methodology that begins with substance, not marketing. The applicable regimes – including MiCA (the EU's Markets in Crypto-Assets Regulation, overseen by ESMA and national competent authorities), the SEC and CFTC frameworks in the United States, and the VARA rulebooks in Dubai – each apply their own classification tests, disclosure obligations and distribution restrictions. A structure that is clean in one jurisdiction may trigger unregistered-offering liability in another. In our practice, we see this cross-border mismatch as the single most consequential structuring risk for token issuers today.
This page explains the regulated basis for STO structuring, the process we apply, the cross-border complications that most issuers underestimate, and the decision matrix that guides our advice from initial classification through to post-issuance compliance.
What makes a token a security?
Whether a token is a security turns on the rights it confers, not the label its issuer applies. This is the foundational principle across every leading regime, and it is the one most frequently misunderstood by issuers arriving at counsel after structuring is already advanced.
Under US federal law, the economic substance test (the analytical framework originating from decades of SEC enforcement and judicial development, often called the investment contract analysis) asks whether investors contribute value to a common enterprise with an expectation of profit derived primarily from the efforts of others. A token that channels revenue to holders, grants residual claims on assets, or confers governance rights that track economic value will satisfy that test regardless of what the whitepaper calls it. The SEC has applied this analysis to tokens with governance labels, tokens styled as access rights, and tokens marketed as rewards.
MiCA introduces a parallel but distinct regime for the EU. Under MiCA, tokens are classified as asset-referenced tokens (ARTs, which reference multiple assets), e-money tokens (EMTs, which reference a single fiat currency), or other crypto-assets – including those that fall outside MiCA entirely because they qualify as financial instruments under MiFID II. That last category is the critical one: a token that qualifies as a transferable security under MiFID II sits outside MiCA and inside the EU Prospectus Regulation and MiFID II itself. ESMA and national competent authorities apply the financial-instrument analysis on a substance-over-form basis.
VARA in Dubai maintains activity-based licensing that covers securities-type token activity. The ADGM's FSRA applies its own recognised virtual assets framework. The SFC in Hong Kong subjects virtual asset trading platforms (VATPs) to its VASP licensing regime, and tokens that constitute securities or collective investment scheme interests carry additional regulatory consequences for issuers and intermediaries alike.
The practical implication: classification is multi-jurisdictional by default. An issuer whose token is utility-grade in one regime may be distributing an unregistered security in another. We assess classification against the substance of rights at the outset – before any whitepaper is finalised, before any exchange listing is pursued, and before any public communication is made.
The regulated perimeter: where securities token rules apply
The regulated perimeter for STOs is broader than most issuers expect, because it is defined not just by where the issuer sits but by where its investors are, where the token is listed, and where the economic effects are felt.
In the United States, the SEC's jurisdiction extends to any offer or sale of a security to US persons, regardless of where the issuer is domiciled. Exemptions from registration – most commonly Regulation D (private placement to accredited investors) and Regulation S (offshore transactions with no US-directed selling efforts) – are available but carry specific conditions. Regulation D restricts general solicitation absent compliance with Regulation D Rule 506(c); Regulation S requires genuine offshore placement with documented selling restrictions. Combining both in a single raise is possible but requires careful structuring to avoid bleed-through.
In the EU, a token qualifying as a transferable security triggers prospectus obligations under the EU Prospectus Regulation unless an exemption applies – typically the €8 million threshold exemption for smaller offers, the qualified investor carve-out, or the private placement exemption. Each carries conditions on investor count, offer size and selling restrictions. MiCA's whitepaper regime does not substitute for a prospectus where the token is a financial instrument; the two regimes operate in parallel and both may apply to an STO.
In the UK, the FCA's financial-promotion regime applies to any communication inviting or inducing investment in a controlled investment, including securities-type tokens, where the communication is made to UK persons. The MLR registration requirement and the financial-promotion approval requirement are distinct; satisfying one does not satisfy the other.
VARA in Dubai and the FSRA within ADGM both impose restrictions on securities-type token activity for entities operating in or from those jurisdictions. The AIFC's AFSA in Kazakhstan maintains its own digital-asset trading facility and custody framework, with a common-law basis that makes it a credible structuring hub for issuers seeking a regulated environment outside the EU and US.
The cross-border reality is that a well-structured STO requires a jurisdiction-by-jurisdiction distribution map before the offering document is drafted – not after. Each distribution geography creates a separate regulatory exposure, and the exemptions in each are not congruent.
To map the licence, disclosure and distribution requirements for your offering across your target investor base, contact OBOLUS at info@oboluslaw.com. The process above describes the standard perimeter. Your specific token structure, investor profile and listing ambitions change the analysis materially.
How does the STO structuring process work?
STO structuring at OBOLUS proceeds in five defined phases, each producing a discrete legal output that feeds the next phase and remains usable in regulatory dialogue.
Phase 1 – Classification analysis. We receive the token's technical specification, the commercial whitepaper draft, and a description of the rights the token confers. We apply the applicable classification tests – including the US investment contract analysis, the MiFID II financial-instrument test, and the relevant non-EU regime analyses for each target distribution geography. The output is a written classification memo that identifies the token's regulatory status in each relevant jurisdiction and flags the distribution geographies that require a formal exemption or registration.
Phase 2 – Structure design. Based on the classification memo, we design the offering structure: the issuing entity (jurisdiction, legal form), the class of securities or token rights to be issued, the applicable exemptions, the transfer restrictions to be embedded in the token's smart contract and in the legal documentation, and the investor eligibility conditions. Where the issuer has a preference for a particular jurisdictional home – the EU under MiCA, Dubai under VARA, or another hub – we factor in the licensing implications for the issuer entity itself.
Phase 3 – Disclosure documentation. We draft or review the offering document (private placement memorandum, information memorandum, or regulated prospectus, depending on the applicable regime), the subscription agreement, and the token terms. We also prepare or review the MiCA whitepaper where the offering involves EU investors, noting that the whitepaper for a token qualifying as a financial instrument sits within the Prospectus Regulation rather than MiCA's whitepaper regime.
Phase 4 – AML/KYC and Travel Rule integration. Every STO involves investor onboarding that must satisfy the applicable AML/CFT (anti-money laundering and countering the financing of terrorism) obligations, including the Travel Rule (the FATF-derived obligation to pass originator and beneficiary information with a transfer) where the token subsequently moves between regulated intermediaries. We advise on the KYC gating required at subscription and on the secondary-market transfer restrictions that are consistent with the securities regime in each jurisdiction.
Phase 5 – Post-issuance compliance. The regulatory exposure does not end at closing. Ongoing reporting obligations, insider-dealing rules and market-abuse considerations (under MiCA and under national securities laws) continue to apply. We advise on the compliance programme the issuer needs to maintain, including monitoring secondary-market activity and managing material disclosure obligations.
In a recent STO matter, a technology platform seeking to raise capital from institutional investors across the EU and the Gulf had structured its token as a governance instrument, assuming utility classification. Our classification analysis identified that the economic rights embedded in the token – pro-rata revenue participation and a liquidation preference – met the financial-instrument test under MiFID II and the investment contract analysis under US law. We restructured the offering, carved out US and EU retail investors using Regulation S and the qualified-investor exemption respectively, and advised on a parallel VARA-compliant offering to Gulf-based institutions. The offering closed without a regulatory challenge in any of the three active distribution geographies.
What are the most common mistakes in STO structuring?
The most consequential mistakes in STO structuring are structural, not administrative – and they are almost always made before counsel is engaged.
Mistake 1: Treating the whitepaper label as the classification. A whitepaper that calls a token a "utility token" or a "governance token" does not bind regulators or courts. The SEC, ESMA and VARA each apply substance-over-label analysis. A token whose economic architecture confers investment-like rights is a security, regardless of what the issuer's documentation says. We regularly receive instructions from issuers whose prior counsel approved a whitepaper on the basis of the label without conducting a formal classification analysis. Correcting that after distribution has begun is orders of magnitude more expensive than getting it right at the outset.
Mistake 2: Ignoring distribution geography. Issuers frequently focus on the jurisdiction of the issuing entity and neglect the jurisdiction of each investor. Regulation S requires genuine offshore placement with no US-directed selling efforts and documented re-sale restrictions. A single US-resident investor receiving the offering absent a Regulation D exemption triggers unregistered-offering exposure for the entire raise, not just for that investor's participation.
Mistake 3: Failing to embed transfer restrictions in the token itself. Contractual transfer restrictions in a subscription agreement do not prevent on-chain transfers. If the token's smart contract does not enforce the applicable selling restrictions – a whitelist of eligible wallets, a lock-up mechanism, a regulatory hold – the contractual restriction is effectively unenforceable against a transferee who did not sign the agreement. The smart contract architecture must mirror the legal documentation.
Mistake 4: Conflating MiCA compliance with EU securities compliance. MiCA governs crypto-assets that are not financial instruments. A token that is a financial instrument sits under the Prospectus Regulation and MiFID II. Issuing a MiCA-compliant whitepaper for a token that should have had a prospectus is not a defence; it may itself be a regulatory violation if it constitutes a public offer of securities without the required disclosure document.
Mistake 5: Underestimating secondary-market obligations. The market-abuse and insider-dealing provisions under MiCA and under national securities laws apply to significant crypto-assets after issuance. Issuers who did not build a compliance programme at structuring stage find themselves exposed when secondary trading volumes attract regulatory attention.
How does cross-border distribution change the analysis?
Cross-border STO distribution is the area where the legal risk concentrates most acutely, because every new distribution geography adds a new regulatory regime and a new set of exemption conditions.
The US–EU interaction is the most common structuring challenge we manage. Regulation S and the EU Prospectus Regulation qualified-investor exemption can co-exist in a single offering, but the investor eligibility conditions, the selling restriction periods, and the disclosure document requirements are different. A US Reg S offering requires no US-directed selling efforts and documented first-sale restrictions. An EU QI offering requires that each investor meets the MiFID II definition of a qualified investor and that the offer is made to fewer than a defined threshold of investors per member state. Both conditions must be satisfied independently.
The Gulf adds a further layer. VARA in Dubai permits securities-type token activity under its activity-based licensing framework, but the issuer entity or the intermediary distributing to Dubai investors must hold the applicable VARA authorisation or use a VARA-licensed distributor. The FSRA within ADGM maintains a parallel framework for Abu Dhabi. An issuer targeting institutional investors in both Dubai and Abu Dhabi needs to map both regimes and cannot assume that VARA licensing covers ADGM-based distribution or vice versa.
Asia-Pacific introduces additional complexity. The SFC in Hong Kong applies its VASP regime to platforms and its securities laws to tokens constituting securities or collective investment scheme interests. MAS in Singapore regulates digital payment token services under the Payment Services Act, but tokens constituting capital markets products fall under a separate regulatory track. An issuer distributing to both Hong Kong and Singapore institutional investors needs jurisdiction-specific analysis for each.
The cross-border structuring conclusion is that there is no universal STO template. The offering structure must be built around the distribution map, and the distribution map must be finalised before the offering document is drafted. Allied counsel in the relevant jurisdiction are engaged where local law sign-off is required for the issuer's chosen distribution geographies.
If a prior structuring attempt stalled at a regulatory gateway, or if an exchange declined to list the token pending classification clarity, a structured review can identify the obstacle and the route forward. Write to OBOLUS at info@oboluslaw.com to start that conversation.
Decision matrix: which STO structure fits which issuer profile?
The right STO structure depends on the issuer's entity home, target investor base, listing ambitions and timeline. The following decision matrix describes four common profiles and the structures that typically fit them – based on the regulatory environment as we see it in our practice.
Profile A – EU-based issuer, institutional-only European raise. An EU-domiciled issuer targeting qualified investors in the EU only can structure the STO using the Prospectus Regulation qualified-investor exemption, avoiding a full prospectus. The token's classification as a financial instrument is confirmed by the NCA in the issuer's home member state. MiCA's whitepaper regime does not apply if the token is a financial instrument. The issuer should expect meaningful AML/KYC compliance work and may need a MiFID-authorised intermediary for placement. Timeline from classification memo to closing is typically measured in several months, depending on structuring complexity and NCA engagement.
Profile B – Non-US issuer, global institutional raise excluding US persons. A non-US issuer targeting institutional investors globally – with a genuine Regulation S carve-out for US persons – can structure the STO using Regulation S combined with the applicable exemptions in each non-US distribution jurisdiction. The smart contract must enforce the initial selling-restriction period and the re-sale conditions. Each non-US geography requires its own exemption analysis; the Gulf, Singapore, Hong Kong and the UK each have their own rules. This is the most complex profile and typically requires the longest pre-closing structuring period.
Profile C – US-based issuer, domestic accredited investors under Regulation D. A US-domiciled issuer targeting accredited investors domestically can use Regulation D Rule 506(b) or 506(c). The 506(c) route permits general solicitation but requires verification of accredited investor status for each purchaser. The token must be treated as a restricted security; secondary trading on registered exchanges is unavailable until applicable holding periods lapse. The SEC Form D filing is required. This profile offers regulatory certainty but limits the investor universe to accredited investors and imposes secondary-market restrictions.
Profile D – VARA-regulated issuer, Gulf institutional raise with secondary listing ambitions. An issuer domiciled in Dubai under VARA can structure the STO using VARA's activity-based licensing framework, distributing to Gulf institutional investors through VARA-licensed intermediaries. A secondary listing on a VARA-regulated exchange is possible within the same regulatory perimeter. Distribution outside the Gulf – to EU or US investors – requires the applicable external exemptions and cannot be assumed to be covered by the VARA authorisation. This profile offers a well-defined regulatory path for Gulf-centric raises and is increasingly used by issuers whose primary investor base is in the region.
A common assumption that misses the mark
A common assumption among first-time token issuers is that applying a utility label in the whitepaper settles the legal classification. It does not. The assumption conflates marketing positioning with legal analysis, and it is one of the more consequential mistakes we see in this practice area.
Every major regulatory regime – the SEC's investment contract analysis, MiFID II's financial-instrument test, VARA's activity-based definitions, the SFC's securities analysis – applies a substance-over-form test. The relevant question is what the token actually does for its holder: does it confer an economic return derived from the issuer's or a third party's efforts? Does it give the holder a claim on revenues, profits or residual value? Does the governance power it grants track economic exposure rather than purely operational participation?
A token designed as a governance instrument but whose governance rights are effectively worthless without the economic upside is, in substance, an investment instrument. The label on the whitepaper will not protect the issuer in an enforcement action or, worse, in a class action by investors who suffered losses.
The analysis we apply at OBOLUS begins with the token's technical specification and the rights architecture – not the whitepaper's positioning. Classification is determined by what the token does, evidenced by the smart contract, the commercial terms and the issuer's communications to investors. A utility label that is inconsistent with the economic architecture of the token is not a defence; it may be evidence of an intent to evade the applicable securities regime.
The protective move is to conduct a formal classification analysis before any investor communication is made, and to structure the token's rights architecture from the outset to be consistent with its intended classification. If the business model requires security-type economics, structure it as a security and use the available exemptions. If a genuine utility structure is possible, build the rights architecture to support that conclusion from the ground up.
Related at OBOLUS
- Token Offerings & Securities Practice – OBOLUS's full practice scope for token issuers and securities counsel
- Exchange Listing Legal Counsel in Kazakhstan (AIFC) – structuring a token listing under the AFSA's digital-asset framework
- EMI Licence for Crypto Firms in Panama – payments structuring options for token issuers needing banking infrastructure
FAQ
Is my token a security?
Whether a token is a security depends on the rights it confers, not the label in the whitepaper. The applicable test varies by jurisdiction – the US investment contract analysis, MiFID II's financial-instrument test, and equivalent regime-specific standards each apply on a substance-over-form basis. If the token confers economic participation rights, a revenue claim, or governance power tied to economic value, it will typically qualify as a security in the relevant regime. A formal classification memo, assessed against each target distribution geography, is the only reliable answer.
Do I need a MiCA whitepaper?
A MiCA whitepaper is required for crypto-assets offered to the public in the EU that fall within MiCA's scope – broadly, tokens that are not financial instruments under MiFID II, not e-money, and not excluded by MiCA's other carve-outs. If your token qualifies as a financial instrument, MiCA's whitepaper regime does not apply; the EU Prospectus Regulation applies instead, imposing a separate and more demanding disclosure requirement. Mapping the correct EU disclosure obligation is an early structuring step, not an afterthought.
How should an airdrop be structured legally?
An airdrop is not automatically outside the securities regulatory perimeter. If the tokens distributed carry investment-type rights, or if the airdrop is conditioned on consideration – even non-monetary consideration such as social sharing or exchange listing activity – regulators in several major jurisdictions may treat the airdrop as a distribution of securities or as an offer requiring disclosure. The structuring analysis covers the nature of the token, the conditions attached to the distribution, the recipient jurisdictions, and whether any exemption applies. We advise on airdrop structuring as part of the pre-issuance classification process.
OBOLUS is an independent digital-asset law boutique acting exclusively for businesses. We advise token issuers, exchanges, custodians and funds on structuring across more than 70 licensing jurisdictions, on disclosure obligations under the applicable securities and crypto-asset regimes, and on the AML, banking and compliance infrastructure that surrounds a token offering. We assess classification against the substance of rights, not the marketing label – and we do so before any investor communication is made, not after a regulatory challenge has been filed. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums where token offerings become the subject of investor claims. To discuss your offering structure, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in token classification, smart-contract legal architecture and cross-border securities compliance for digital-asset issuers.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.