On paper, labeling a token "utility" feels like a solved problem. In practice, the legal characterization of a digital asset turns on the substance of the rights it confers – not the term a marketing team chose for the whitepaper. For an established operator running a live product, a mis-classification is not a paperwork error. It converts a token distribution into an unregistered securities offering, triggering enforcement exposure across every jurisdiction where a holder resides.
Token legal classification – the formal legal determination of whether a digital asset (a cryptographic token representing rights, value or both) constitutes a security, an e-money instrument, an asset-referenced token, a utility token or another regulated category – is a jurisdiction-by-jurisdiction analysis anchored in substance. Under MiCA (the EU's Markets in Crypto-Assets Regulation, supervised by ESMA and national competent authorities), the classification drives the whitepaper obligation, the issuer authorisation requirement and the marketing restrictions that follow. Under the securities regimes administered by the SEC and CFTC in the United States, the same question determines whether a token is a financial instrument subject to federal registration or exemption. This page sets out the analytical framework an established operator should apply, the process OBOLUS runs, and the cross-border realities that make a single domestic opinion insufficient.
The sections below move from regulatory basis, through the classification methodology, to practical risks and a decision matrix by operator profile.
Why Classification Matters More Than It Did at Launch
Token classification is not a one-time question answered at genesis. Regulators in the leading hubs have consistently held that changes in token functionality, secondary-market behavior and the degree of decentralization of the issuing protocol can change the legal characterization of an asset already in circulation. An operator that classified its token as a utility instrument three years ago, based on the state of the protocol at launch, may be operating under an analysis that no longer holds.
The regulatory environment has shifted materially. MiCA came into full application for most crypto-asset service providers in late 2024, replacing the patchwork of national regimes across EU member states and introducing a tiered classification that distinguishes asset-referenced tokens, e-money tokens and "other" crypto-assets. Each category carries different obligations: an asset-referenced token (ART) – a token that purports to maintain a stable value by reference to multiple assets or currencies – requires issuer authorization from an EU national competent authority. An e-money token (EMT) – a token referencing a single fiat currency – requires an electronic money institution license under existing e-money rules. Other crypto-assets, including those marketed as utility tokens, require a compliant whitepaper and mandatory notification to the relevant national competent authority before a public offer.
Outside the EU, the SFC in Hong Kong, MAS in Singapore and VARA in Dubai have each sharpened their classification guidance. The practical effect is that a classification opinion that was defensible under 2021 standards may no longer provide the regulatory cover an operator needs today.
In our cross-border practice, we advise operators who inherited a classification from a prior counsel engagement and now need to pressure-test it against the current regulatory position across their key jurisdictions. The consequence of not doing so is not abstract. Enforcement actions in multiple jurisdictions in the past several years have specifically targeted operators who relied on a utility label without subjecting that label to the functional analysis regulators apply.
The process above describes the standard path. Your facts – the entity, the user base, the token's rights architecture – change the analysis. For a scoped classification assessment, contact OBOLUS at info@oboluslaw.com.
What Is the Classification Framework an Established Operator Should Apply?
The correct classification framework begins with the rights the token actually confers, measured against the functional tests each relevant regime applies – not against the label the issuer assigned at the design stage. This is the principle that unifies otherwise divergent national approaches.
Under MiCA and the ESMA-supervised framework, the primary classification axis is function: does the token reference the value of another asset or basket of assets (pointing toward an ART), reference a single fiat currency (pointing toward an EMT), or confer access rights to a service or product without functioning as a means of payment or store of value (pointing toward the "other crypto-assets" category)? Critically, MiCA explicitly carves out financial instruments – if a token qualifies as a transferable security under MiFID II, MiCA does not apply and the full securities law regime does. The classification exercise therefore requires a sequential analysis: securities law first, MiCA second.
In the United States, the analysis follows the investment contract doctrine and the multi-factor test developed through decades of securities law enforcement by the SEC and CFTC. The key question is whether holders acquired the token expecting profit derived principally from the managerial or entrepreneurial efforts of others. Tokens that carry governance rights, that appreciate in value correlating with the success of a development team, or that were sold in pre-launch rounds to fund protocol development are the categories most heavily scrutinized. The SEC has not adopted a bright-line rule, and the CFTC's jurisdiction over commodity tokens overlaps with the SEC's analysis in ways that operators frequently underestimate.
Across the Asia-Pacific hubs, the MAS Payment Services Act in Singapore and the SFC's virtual asset regime in Hong Kong each apply distinct classification logic. MAS distinguishes digital payment tokens from capital markets products; the SFC's securities analysis maps closely to the common-law investment contract approach. An operator with users across both jurisdictions faces two independent classification exercises that can yield different outcomes for the same token design.
The practical implication is that an established operator cannot rely on a single-jurisdiction opinion. The token sits in a multi-regime environment, and the classification result in the most restrictive applicable regime sets the floor for what the operator must do structurally.
What Are the Most Common Classification Mistakes Established Operators Make?
The most persistent mistake is treating a utility whitepaper as a classification shield. A common assumption is that describing a token as a "utility token" in published documentation settles the legal question. It does not. Regulators across every major regime have repeatedly held that the label an issuer assigns is irrelevant to the legal analysis; what matters is the economic substance of the instrument, the context of its sale and the reasonable expectations of purchasers.
We regularly advise operators who have encountered a second related error: the static opinion. A classification opinion issued at the time of a token generation event addressed the token as it existed then. After two or three years of protocol development, governance upgrades, staking mechanisms and secondary-market price behavior, the token may be functionally different. The opinion is not a permanent clearance; it is a snapshot. Operators who treat it as durable protection expose themselves to enforcement based on the current state of the instrument.
A third error is geographic overreach – distributing a token globally while relying on a classification opinion from a single jurisdiction. A determination that a token is not a security under English law, or that it falls within the "other crypto-assets" category under MiCA, says nothing about its characterization under US federal securities law, Singapore capital markets rules or Hong Kong's securities regime. Each analysis must be run independently, and the operator's distribution strategy must be tailored to the most restrictive result.
A fourth mistake specific to established operators is failing to account for the effect of secondary-market infrastructure. When a token is listed on a centralized exchange, it acquires liquidity characteristics and price-discovery dynamics that were absent at launch. Several regulators, including in the United States, have pointed to secondary-market trading patterns as evidence relevant to whether the instrument functions as an investment contract. Classification analysis conducted before a major exchange listing should be revisited after it.
How Does the Token Classification Process Work at OBOLUS?
Our classification mandate runs in three phases – evidence gathering, legal analysis across the relevant regimes, and the delivery of a structured legal opinion with a distribution-strategy annex. Each phase produces a defined output that the operator can use both internally and as evidence of good-faith regulatory compliance.
In the evidence-gathering phase, we work through the token's technical and commercial architecture: the rights embedded in the smart contract, the governance structure, the issuance history, any prior sale rounds and the current state of secondary-market activity. We also review existing documentation – the whitepaper, the terms of token sale, any prior legal opinions and any regulatory correspondence. Operators frequently discover in this phase that the existing documentation contains inconsistencies between the rights described in the whitepaper and the rights actually encoded in the contract.
In the legal analysis phase, we assess the token against the applicable classification frameworks in each identified jurisdiction. For an operator with EU users, that means running the MiCA sequential analysis – financial instrument first, then ART/EMT/other. For US exposure, we run the investment contract analysis and assess whether the commodity characterization under CFTC jurisdiction applies concurrently. For operators active in Singapore or Hong Kong, we layer in the MAS and SFC analyses. Where exposure exists in jurisdictions where we rely on allied counsel, we coordinate and synthesize their input into a single cross-border view.
The delivery phase produces a written classification opinion structured as a legal memorandum: the applicable regimes, the analysis, the classification result in each jurisdiction, and a distribution-strategy annex that maps the result to concrete operational recommendations. The annex addresses which jurisdictions permit unrestricted distribution, which require a whitepaper or registration, and which require the operator to block access or implement enhanced KYC controls for users in that jurisdiction.
In a recent classification matter, an exchange operator holding a token portfolio acquired through a seed round needed to determine whether secondary distribution to retail users would constitute an unregistered securities offering in multiple EU member states and in the United States. We assessed the token architecture, ran the parallel analyses and delivered a cross-jurisdictional opinion with a distribution matrix. The operator restructured its distribution strategy – restricting access in two jurisdictions pending whitepaper notification and blocking US access absent a registered offering – before the public distribution event launched. This avoided the enforcement exposure that an unreviewed global rollout would have created.
If a prior classification analysis has become stale or your token has undergone material changes since launch, a fresh analysis is warranted. Write to OBOLUS at info@oboluslaw.com to scope a review.
What Does MiCA Require by Way of Whitepaper for a Token Offering?
Under the MiCA regime, a crypto-asset whitepaper is a mandatory disclosure document that must be prepared, filed and published before any public offer of crypto-assets within the EU, subject to defined exemptions. The whitepaper obligation is not a formality. It is a legally prescribed document with defined content requirements, a liability regime attaching to inaccurate or misleading disclosures, and a notification procedure with the relevant national competent authority.
The content requirements differ by token category. For "other crypto-assets" – the category most utility tokens fall into – the whitepaper must describe the issuer, the project, the rights and obligations attached to the token, the underlying technology, the risks and the details of the offer. For ARTs, the requirements are more extensive, including a description of the reserve assets, the stabilization mechanism and the redemption rights. For EMTs, the whitepaper must demonstrate the electronic money institution authorization or the application for it.
The exemptions are narrowly drawn. A public offer directed exclusively at qualified investors, a total consideration below the threshold set in the applicable national implementing rules, or an offer to fewer than a defined number of persons in the EU may fall outside the whitepaper obligation – but each exemption carries conditions and must be assessed against the specific facts of the offer. Operators who assume that a small raise or an institutional-only round automatically escapes the whitepaper requirement without conducting that analysis take on avoidable risk.
The cross-border dimension of the MiCA whitepaper is significant. Once notified to the home-state NCA and published, a whitepaper filed in one EU member state is effective for the full EU single market. For an established operator with users across the EU, the whitepaper is therefore both a regulatory compliance document and the legal instrument that enables pan-EU access without repeated national filings. Getting the content right at the filing stage matters because ESMA and the NCAs have enforcement tools for post-publication inaccuracies.
How Does Cross-Border Reality Change the Classification Analysis?
The cross-border dimension of token classification is where established operators most frequently underestimate their exposure. A token issuer incorporated in the Cayman Islands, with a team in Dubai, a token listed on a Singapore-licensed exchange and holders in Germany, the United States and the United Kingdom faces at minimum five concurrent classification analyses. The result in each jurisdiction is independent; the most restrictive result governs the operator's practical options.
The entity jurisdiction is often irrelevant to the applicable regulatory regime. A Cayman Islands SPV issuing tokens to EU retail investors is subject to MiCA. The fact that the issuer is not incorporated in the EU does not provide an exemption. MiCA applies based on where the offer is made and where the recipients are located. VARA in Dubai and the FSRA in Abu Dhabi each apply their own licensing analysis to token offerings directed at UAE residents, regardless of where the issuer is domiciled. The FCA's financial-promotion rules in the United Kingdom apply to communications with UK persons, including social-media and website communications accessible to UK users.
The practical consequence for an established operator is that the distribution strategy must be mapped to the classification result in each jurisdiction before distribution begins. This means either obtaining clearance in every target jurisdiction, structuring the offer to fall within available exemptions in each, or geo-blocking access for users in jurisdictions where the operator cannot comply with applicable requirements.
We have seen operators take the position that geo-blocking alone is sufficient to limit regulatory exposure in a jurisdiction. It is a useful control, but it is not a legal defense if the token is nonetheless accessible to users in that jurisdiction or if the operator's marketing communications are directed at residents there. The combination of geo-blocking and affirmative marketing restrictions – reviewed against the communications rules in each relevant jurisdiction – is a more defensible position.
For operators whose token is listed on a major exchange, the exchange's geographic access controls become part of the compliance picture. The operator should understand which jurisdictions the exchange blocks or restricts and whether those controls align with the operator's own distribution analysis. Gaps between the two create exposure.
Which Profile Fits Which Classification Path?
Classification strategy is not uniform. The appropriate path depends on the operator's entity structure, the token's functional design, the target user base and the distribution timeline. The following profiles describe the practical decision branches we work through with clients.
Profile A – Established operator with an existing token, EU user base and a pre-MiCA whitepaper: The operative question is whether the existing whitepaper meets MiCA's content standards. A pre-MiCA whitepaper drafted under the prior national regime – for example, under Malta's VFA framework or Lithuania's prior VASP registration regime – will typically not meet MiCA's content requirements without revision. This profile requires a gap analysis against the MiCA whitepaper template, an updated classification analysis and a notification procedure with the home-state NCA. The timeline is driven by the NCA's processing capacity and the complexity of the token architecture – treat it as a matter of weeks to several months for a straightforward "other crypto-assets" filing.
Profile B – Operator planning a new token issuance with a global distribution strategy: This profile requires the full multi-jurisdictional classification analysis before any public communication about the offer. The classification result in each target jurisdiction drives the whitepaper content, the exemption strategy and the distribution controls. An operator in this profile should resist the commercial pressure to publish a whitepaper before the classification analysis is complete. Early publication creates an estoppel risk: regulatory and user reliance on a whitepaper that is subsequently revised is harder to manage than a slightly delayed launch.
Profile C – Operator with a token that has undergone material post-launch changes (staking, governance, burn mechanisms): This is the profile where the static opinion risk is most acute. The classification analysis must be re-run against the current state of the token, not the genesis state. Where the new analysis yields a different classification result – for example, where a governance mechanism has moved the token closer to an investment contract characterization – the operator will need to assess whether its existing distribution approach must be modified, whether additional regulatory notifications are required and whether any existing exchange listings create ongoing compliance obligations.
Profile D – Operator conducting a token airdrop to an existing user base: An airdrop – the gratuitous or conditional distribution of tokens to wallet addresses without direct payment consideration – does not automatically fall outside the securities law analysis. Several regulators have taken the position that an airdrop with conditions (for example, requiring users to hold existing tokens or to perform tasks) can constitute a distribution of a security if the underlying token would otherwise be characterized as one. The airdrop structure must be assessed against the classification of the underlying token and the terms of the distribution, not assumed to be exempt as a "free" distribution.
Self-Assessment: Is Your Token Classification Analysis Current?
Established operators can use the following checklist to assess whether an existing classification requires review. An affirmative answer to any of these questions is an indicator that a fresh analysis is warranted.
- Has the token's functionality changed materially since the last classification opinion – through staking, governance rights, burn mechanisms or protocol upgrades?
- Has the token been listed on a new exchange, including one in a jurisdiction not covered by the original analysis?
- Has the operator begun distributing to users in new jurisdictions since the classification was completed?
- Was the classification opinion issued before MiCA came into full application?
- Does the operator's existing whitepaper pre-date MiCA and has it not been reviewed for compliance with MiCA's content requirements?
- Has the operator received any regulatory inquiry or informal correspondence from a regulator about the token?
- Has the secondary market for the token developed in a way that increases its price correlation with the performance of the issuing entity?
- Is the operator planning an airdrop, a secondary issuance or a token restructuring?
In our practice, operators who work through this checklist regularly identify at least one item that has changed since the original analysis was done. The cost of a classification review is significantly lower than the cost of an enforcement action that could have been avoided by one.
Related at OBOLUS
- Token Offerings and Securities Practice – full-spectrum legal counsel on token issuance, classification and regulatory strategy
- How to Obtain a Utility Token Legal Opinion – step-by-step guidance on the evidence, process and deliverable for a utility token opinion
- Corporate Tax Residency Planning Under Heightened Scrutiny – structuring the issuer entity for tax efficiency alongside the classification mandate
FAQ
Is my token a security?
Whether a token constitutes a security depends on the rights it confers and the regime analyzing it, not the label you assigned it. Under US federal securities law, the operative question is whether purchasers invested expecting profit from the efforts of others. Under MiCA, the first question is whether the token is a financial instrument under MiFID II; if it is, MiCA does not apply. Under MAS and SFC frameworks, parallel but distinct analyses apply. Classification requires jurisdiction-specific analysis against the current state of the token, not the original whitepaper description.
Do I need a MiCA whitepaper?
If you make a public offer of crypto-assets to EU residents, you will generally need a MiCA-compliant whitepaper filed with the relevant national competent authority before the offer is made. Narrow exemptions exist – for offers exclusively to qualified investors, for offers below a defined threshold or for offers to a limited number of persons – but each exemption carries conditions that must be assessed against your specific facts. A whitepaper filed in one EU member state is effective across the EU once notified, making accurate initial content critical. Operators with a pre-MiCA whitepaper should have it reviewed for compliance with the current content requirements.
How should an airdrop be structured legally?
An airdrop is not automatically exempt from securities law or token-offering regulations. If the underlying token would be characterized as a security or a regulated crypto-asset in the relevant jurisdiction, distributing it without consideration does not change that characterization. The structure of the airdrop – whether it is unconditional, conditional on holding other tokens or conditional on performing tasks – is relevant to the analysis but is not determinative. Operators planning an airdrop should first confirm the classification of the underlying token in each distribution jurisdiction, then structure the airdrop mechanics and communications to comply with the applicable requirements in each.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess classification against the substance of rights, not the marketing label – and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. To discuss your situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specializing in token architecture, classification analysis and the regulatory treatment of smart-contract-based instruments across US, EU and Asia-Pacific regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.