Stablecoin issuance sits at the intersection of payments law, securities regulation and, increasingly, e-money (electronic money) regime obligations. For a digital-asset firm deciding whether to issue a fiat-pegged token, a commodity-backed instrument or an algorithmic reserve structure, mis-classification of the token before launch can convert a product initiative into an unregistered offering – one that triggers enforcement, not just a remediation conversation. The legal question is precise: what regulatory category does the token fall into, who is the competent authority, and what authorization must be in place before the token reaches its first holder.
The short answer is that no single global regime governs stablecoin issuance; the applicable rules depend on where the issuer is incorporated, where the token is offered, and where the reserve assets are held. Under MiCA (the Markets in Crypto-Assets Regulation), the European Union's primary digital-asset law, a stablecoin is either an ART (asset-referenced token, pegged to a basket or commodity) or an EMT (e-money token, pegged to a single fiat currency) – and each carries its own authorization path, whitepaper obligation and ongoing reserve requirement. Outside the EU, VARA in Dubai, the FSRA within ADGM in Abu Dhabi, the MAS in Singapore, and FINMA in Switzerland each impose distinct requirements. This page maps the service OBOLUS provides across that multi-regime reality.
What the stablecoin issuance authorization service covers
OBOLUS advises digital-asset firms on the full authorization lifecycle for a proposed stablecoin – from initial token classification through regulatory submission, whitepaper preparation and post-authorization compliance design. The service is not a template exercise. Every engagement begins with a classification opinion that interrogates the substance of the rights conferred on token holders, the mechanics of the peg and redemption mechanism, and the jurisdictional nexus created by the issuer, the reserve custodian and the distribution channel.
In our practice, the classification step is the highest-stakes moment. A token marketed as a utility instrument that in fact confers a redemption right against a reserve pool, distributes a yield, or tracks the value of an underlying asset will be assessed by regulators against substance – not against the label in the whitepaper. We have seen enforcement actions initiated not because an operator was reckless, but because counsel focused on the marketing narrative rather than the structural rights embedded in the token's smart contract and terms.
The core work streams are: (1) classification and legal opinion; (2) jurisdictional selection and regulator engagement strategy; (3) whitepaper drafting and legal review to applicable standards; (4) reserve and custody structure; (5) ongoing AML/CFT and Travel Rule compliance design; and (6) cross-border distribution analysis. For firms pursuing MiCA authorization specifically, the service also covers the required interaction with the ESMA notification process and the national competent authority submission timetable.
The process above describes the standard path. Your facts – the peg mechanism, the reserve composition, the issuer's domicile, the user base's geography – change the analysis materially. To scope the engagement for your structure, contact OBOLUS at info@oboluslaw.com.
How does token classification work for a proposed stablecoin?
Token classification under every major regime turns on substance over form: the legal and economic rights that a token actually confers, not the label applied to it. Under MiCA, the threshold question is whether the token purports to maintain a stable value by reference to another value or right – if so, the ART or EMT classification applies, each with its own authorization requirements and whitepaper obligations. A token that references a single fiat currency and grants a redemption right falls squarely into the EMT category; a token referencing a basket of currencies, commodities or other assets is assessed as an ART.
The classification exercise for a proposed stablecoin requires counsel to map four elements. First, the reference asset or basket – what is the peg mechanism and how is stability maintained? Second, the redemption mechanics – does the holder have a contractual or quasi-contractual right to redeem at par, at net asset value, or at a market price? Third, the reserve structure – are reserve assets held by the issuer, a custodian, or a smart contract, and what rights do holders have against those reserves in insolvency? Fourth, the distribution pathway – how are tokens initially allocated, and to whom?
Outside the EU, the classification logic differs in form but not in underlying principle. FINMA in Switzerland applies its own token taxonomy distinguishing payment, utility and asset tokens, with hybrid categories where the facts warrant. MAS in Singapore assesses whether a stablecoin constitutes a digital payment token or a capital markets product under the Payment Services Act and the Securities and Futures Act respectively. The SFC in Hong Kong applies a similar substance test. The AML/CFT baseline set by FATF Recommendation 15 applies across virtually every jurisdiction, meaning a stablecoin issuer will face Travel Rule obligations – the obligation to pass originator and beneficiary data with each transfer – regardless of which regime authorizes the issuance.
In a recent matter, a payments-focused issuer had prepared a whitepaper describing its token as a "utility voucher." Our classification analysis identified that the token's smart contract included a redemption function against a fiat reserve pool, bringing it squarely within the EMT definition under MiCA and triggering authorization requirements the issuer had not anticipated. Correcting the structure before any regulatory interaction – not after – preserved the project timeline and avoided the far more costly scenario of a post-launch remediation.
Which regimes require formal authorization before issuance?
Most flagship digital-asset regimes now require formal authorization – not mere registration or notification – before a stablecoin issuer may operate. Under MiCA, an EMT issuer must be an authorized credit institution or e-money institution; an ART issuer requires a specific MiCA authorization granted by the national competent authority of the member state in which it is established, with ESMA consulted for significant tokens. The MiCA passporting mechanism then allows an authorized issuer to offer tokens across all EU and EEA member states without seeking separate national authorization – a structural advantage that explains why we advise many non-EU issuers to establish their EU authorization anchor in a jurisdiction with an efficient competent authority.
In Dubai, VARA requires entities conducting stablecoin or virtual-asset transfer and settlement activities to hold the relevant VARA activity-based licence before engaging users. The VARA rulebooks impose capital, governance and reserve-holding requirements that are activity-specific. An issuer operating from the DIFC financial free zone in Dubai operates outside VARA's jurisdiction and instead interacts with the DFSA – a distinction that matters for structuring and that we assess at the outset of every UAE engagement.
Singapore's MAS requires stablecoin issuers to comply with the stablecoin-specific provisions introduced into the Payment Services Act framework, which set reserve composition and audit expectations. FINMA in Switzerland may require a banking licence or an e-money affiliation depending on the reserve structure and the level of public issuance. The BVI FSC and CIMA in the Cayman Islands each operate registration regimes under their respective VASP frameworks that capture issuance activity, though the depth of requirements differs from the EU and UAE authorization tracks.
What does the authorization process involve, and how long does it take?
The authorization process for a stablecoin issuer typically runs across four phases: pre-application structuring, application preparation, regulator review and conditions-satisfaction. The duration of each phase varies materially by jurisdiction and by the complexity of the token structure – timelines that are described in weeks in a press release frequently extend into months in practice once the regulator's information requests are addressed.
In the pre-application phase, counsel works with the issuer to finalize the legal structure of the issuance vehicle, the reserve custody arrangement, the whitepaper content and the governance framework that the regulator will scrutinize. This phase frequently uncovers structural issues – a reserve custodian that is not appropriately regulated, a smart contract function that creates an unintended redemption obligation, or a distribution mechanism that implicates a securities regime – that are far less costly to resolve before submission than after.
The application preparation phase involves assembling the regulatory submission: the whitepaper, the issuer's financial statements, the reserve policy, the AML/CFT program documentation, the key personnel fitness-and-propriety materials, and the legal opinion on classification. Under MiCA, the whitepaper must meet prescribed content requirements before the competent authority notification is filed; errors in the whitepaper – whether in the description of rights, the reserve disclosure or the risk factor presentation – can cause a submission to be returned or delayed.
The regulator review phase involves the competent authority's formal assessment. Most jurisdictions have a statutory assessment clock that begins running from the date a complete application is accepted. The length of that clock varies by jurisdiction and by licence category; in our experience, complex applications – those involving novel reserve structures, cross-border custody or algorithmic peg mechanisms – draw significantly more questions and longer review periods than straightforward single-fiat EMT applications.
The conditions-satisfaction phase addresses any conditions attached to the authorization: minimum capital subscription, appointment of a compliance officer, completion of a systems-and-controls audit, or execution of reserve custody agreements. Authorization becomes effective only when all conditions are discharged.
A decision matrix by issuer profile: an EU-incorporated e-money institution applying for MiCA EMT authorization can, if the application is well-prepared, expect to move through the process in a matter of months, depending on the competent authority's caseload. A non-EU issuer establishing a new EU authorization vehicle faces the additional time of entity formation and the competent authority's baseline review of a newly incorporated applicant. A VARA applicant in Dubai who has not previously engaged the regulator faces an onboarding process before formal application. FINMA submissions for novel structures may require extended pre-application dialogue. In all cases, the single largest driver of timeline is the quality and completeness of the initial submission – and that is the investment that pre-application legal work protects.
What cross-border considerations apply to a stablecoin issuance?
A stablecoin issued from one jurisdiction but held by users in multiple others creates a layered compliance obligation that frequently surprises issuers who have focused exclusively on their domicile regime. The cross-border dimension has three main vectors: where the token is offered, where the reserve is held, and where the issuer's operating entities sit.
On the distribution side, an issuer authorized under MiCA may passport freely within the EU and EEA, but distribution to users in the United Kingdom requires compliance with FCA financial-promotion rules. Distribution to US persons implicates FinCEN's BSA obligations and potentially SEC or CFTC jurisdiction, depending on how the token is characterized under US law. Distribution to users in Hong Kong triggers the SFC's VASP framework. Stablecoin issuers who assume that a single authorization addresses their global user base invariably discover, at enforcement stage, that it does not.
On the reserve side, the choice of reserve custodian jurisdiction matters for two reasons. First, the regulatory capital and safeguarding rules that apply to the custodian will affect the structural protections available to token holders in an insolvency – a consideration that is increasingly scrutinized by competent authorities under MiCA and the VARA rulebooks. Second, the reserve currency and custody location affect the issuer's exposure to sanctions regimes; an OFAC-designated party seeking to acquire or redeem a stablecoin requires the issuer to have in place a real-time screening capability.
Operators we advise routinely hold authorization in one jurisdiction, custody reserves in a second, and distribute to users across ten or more markets. The practical answer is not to replicate the full authorization stack in each user-facing market – that is rarely commercially viable – but to build a structure in which the primary authorization anchors the issuer's obligations, distribution agreements allocate jurisdiction-specific compliance to appropriately licensed partners, and the AML/CFT program addresses every user-facing market's FATF-derived baseline obligations.
If your structure spans more than one regulatory perimeter – and most commercially serious stablecoin issuances do – the analysis requires mapping every relevant regime before any token is distributed. To map the licence, banking and reserve stack for your build, write to info@oboluslaw.com.
What are the most common legal mistakes in stablecoin issuance?
The most costly mistake we see in stablecoin issuance matters is launching first and classifying later. An issuer that distributes tokens before obtaining the required authorization exposes itself to enforcement by every competent authority in the markets where those tokens are held. The cost of remediation – restructuring the token, unwinding distributions, engaging with multiple regulators simultaneously – consistently exceeds the cost of front-loading the legal work by an order of magnitude.
The second most common error is treating the whitepaper as a marketing document rather than a legal instrument. Under MiCA, the whitepaper is a statutory document with prescribed content; an issuer who produces a marketing-oriented document and then seeks to comply with the prescribed requirements retrospectively faces a rewrite that delays the authorization and, in some cases, requires reprinting and re-notification obligations. ESMA's expectations for ART and EMT whitepapers are detailed and specific; the document must cover the rights attaching to the token, the reserve composition and management policy, the conflict of interest framework, the technology description and the redemption procedure – among other requirements.
A common assumption is that labeling a token "utility" in the whitepaper resolves the classification question. It does not. The applicable test under every major regime is substantive: what rights does the token confer, what value-maintenance mechanism is embedded in the structure, and would a reasonable holder expect the token to maintain a stable value relative to a reference asset? A token with a redemption mechanism, a reserve pool and a fiat peg is an EMT or ART as a matter of law, regardless of what the whitepaper calls it. Regulators are now sophisticated on this point; ESMA has published guidance on classification, and national competent authorities apply it.
The fourth common mistake is treating AML/CFT design as a post-authorization task. Most competent authorities require a detailed AML/CFT program – including Travel Rule procedures, transaction monitoring parameters and a PEP/sanctions screening policy – as part of the initial application. An issuer who has not designed this infrastructure before submission will be required to do so during the review period, extending the timeline and signaling to the regulator that governance readiness is incomplete.
How should an issuer choose the right authorization path?
The right authorization path for a stablecoin issuer is a function of three factors: the issuer's existing regulatory relationships and entity structure, the target markets for distribution, and the token's structural characteristics. OBOLUS works through this decision with each client systematically.
Profile A – EU-focused issuer with existing e-money institution authorization: The most efficient path is to add the MiCA EMT permission to the existing authorization. The competent authority is familiar with the issuer; the AML/CFT infrastructure is already in place; the primary incremental work is the whitepaper, the reserve policy and the updated governance documentation. Timeline to authorization is typically measured in months, not years, for a well-prepared submission. Key risk: reserve composition must meet MiCA's prescriptive requirements, and any shortfall triggers remediation before authorization is effective.
Profile B – Non-EU issuer seeking EU market access via a new vehicle: The issuer must first establish and capitalize a new EU entity in the chosen member state, then pursue CASP or EMT authorization from the national competent authority of that state. This path is longer – entity formation, local directorship, competent authority familiarity – but it unlocks EU-wide passporting. Key risk: the competent authority will scrutinize the issuer's existing group structure and the adequacy of group-level AML/CFT controls; deficiencies at group level will delay or prevent the local authorization.
Profile C – Issuer targeting the Gulf markets (Dubai / Abu Dhabi): A VARA-licensed issuer in mainland Dubai or an FSRA-authorized issuer within ADGM can access significant institutional and retail flows in the region. The VARA activity-based framework for transfer and settlement applies to stablecoin-adjacent activities; the FSRA's recognized virtual-asset list concept determines which tokens can be offered within ADGM. Key risk: both regulators are actively developing their rulebooks, and requirements can evolve materially between application and authorization. Counsel embedded in the current regulatory dialogue is a material advantage.
Profile D – Issuer seeking a structurally flexible domicile: Some issuers – particularly those issuing commodity-backed or algorithmic structures that do not fit neatly into the ART/EMT binary – benefit from an initial domicile in a jurisdiction with a principles-based framework (Switzerland under FINMA, or Singapore under MAS) while they develop the product. This buys time and structural clarity before committing to the MiCA authorization pathway. Key risk: the chosen domicile must genuinely regulate the activity – a shell authorization in a light-touch regime that is then used to distribute into MiCA jurisdictions without a local nexus will not satisfy the competent authority's substance requirements.
Related at OBOLUS
Related at OBOLUS
- Token Offerings & Securities Practice – full-service legal counsel on token classification, securities law and offering structures for digital-asset businesses.
- Where the Legal Lines Are Drawn in Stablecoin Issuance – analysis of the regulatory boundaries, enforcement risk and classification disputes in stablecoin law.
- Tax Treatment of Tokens in Switzerland – FINMA's token taxonomy and the Swiss tax consequences of issuance, holding and transfer for digital-asset firms.
FAQ
Is my token a security?
Whether a token constitutes a security depends on the rights it confers and the regime that governs the issuer and the offering. Under MiCA, a token that meets the ART or EMT definition is subject to that regime rather than EU securities law. In the US, the SEC applies a substance-over-form test derived from established investment-contract doctrine. In Singapore, MAS assesses whether the token is a capital markets product. Classification must be assessed jurisdiction by jurisdiction, based on the token's actual mechanics – not its marketing label. OBOLUS prepares classification opinions against the applicable regime before any public distribution.
Do I need a MiCA whitepaper?
An issuer of an ART or EMT under MiCA must prepare a whitepaper that meets ESMA's prescribed content requirements and notify it to the relevant national competent authority before public offering. The whitepaper must disclose the rights attaching to the token, the reserve composition and management policy, the redemption procedure, the technology and the conflict-of-interest framework. Certain exemptions apply – for example, small-scale issuance or offers limited to qualified investors – but the thresholds and conditions are specific. We regularly advise on whether a proposed issuance falls within an exemption and, where it does not, on the preparation of a compliant whitepaper.
How should an airdrop be structured legally?
An airdrop – the gratuitous distribution of tokens to a defined recipient pool – does not automatically fall outside securities or AML obligations. If the token being airdropped is classified as a security in the recipient's jurisdiction, the distribution may constitute a securities offering regardless of price. Under MiCA, an airdrop of an ART or EMT to EU persons requires a compliant whitepaper. AML obligations may be triggered by the Know Your Customer requirements of the distribution platform, even where no consideration passes. We assess each airdrop structure against the token's classification and the jurisdictions of the intended recipients before distribution.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess classification against the substance of rights, not the marketing label – a distinction that matters at the enforcement stage, not just at launch. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when a stablecoin or token structure is challenged in litigation. To discuss your stablecoin issuance, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in token classification, smart-contract legal analysis and stablecoin authorization across MiCA, VARA and Asia-Pacific regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.