On paper, labeling a token "utility" in a whitepaper feels like a legal answer. In practice, regulators across every major digital-asset regime look past the label to the substance of what the token actually does – and what rights it confers on holders. For an institutional client deploying capital into a token structure, or a protocol raising from institutional investors, the classification question is not a formality. A misstep converts a product launch into an unregistered securities offering.
Token legal classification is the process of determining, under the applicable regime, whether a digital asset constitutes a security token, an asset-referenced token, an e-money token, a utility token, or a payment instrument – each carrying a different regulatory burden. Under MiCA (the EU's Markets in Crypto-Assets Regulation, supervised by ESMA and national competent authorities), the classification drives the whitepaper obligation, the issuer authorisation track, and the cross-border passporting available. In the US, the SEC and CFTC apply overlapping but distinct standards that turn on the same economic substance question. This page sets out the regime basis, the analytical process, the cross-border complications, and how we work through them with institutional clients.
Why Classification Drives Every Subsequent Decision
Token classification is the upstream decision that determines every downstream obligation. Get it wrong, and the consequences compound quickly. An institutional participant – fund, exchange, custodian or issuer – faces enforcement risk, not just a re-filing.
The core question is whether a token represents an investment in a common enterprise with an expectation of profit derived from the efforts of others. That framing is the US formulation, most commonly associated with the SEC's reading of the Howey standard. But virtually every major regime applies an analogous substance-over-form test. MiCA separates asset-referenced tokens (ARTs), e-money tokens (EMTs) and "other crypto-assets," with ARTs and EMTs carrying the most demanding issuer obligations. The FCA in the UK distinguishes specified investments (which carry securities-law consequences) from e-money tokens and unregulated tokens. MAS in Singapore applies the capital markets services framework to tokens that constitute "capital markets products." Each test is different in structure; all of them look through the label to the economic reality.
For institutional clients, the stakes are highest because they operate at scale. A fund acquiring tokens in a private sale, or an exchange listing a new asset, must make a defensible classification determination before the transaction closes. In our practice, we see more compliance failures traced to inadequate classification work than to any other single cause.
Classification also governs the secondary market. A token classified as a security cannot generally be traded on an unlicensed venue. An institutional investor holding that token in a jurisdiction that treats it differently has a cross-border conflict it must manage from day one.
To map the classification implications for your specific token structure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard analytical path. Your facts – the rights conferred, the investor profile, the issuer entity, the distribution geography – change the analysis materially. Map your options
What Do the Major Regimes Actually Test?
Every significant regulatory regime applies a substance-based classification test, and no two tests are identical. An institutional client operating across jurisdictions cannot rely on a single opinion – it needs a comparative analysis that maps the token's rights profile against each applicable standard.
Under MiCA, the classification exercise begins with a binary question: does the token fall within the MiCA scope at all, or is it excluded as a financial instrument under MiFID II? Tokens that qualify as financial instruments – typically those conferring ownership, profit participation or voting rights – fall outside MiCA and inside the existing EU securities regime. That is not a lighter burden. It is a different and often more demanding one. Within MiCA's scope, the next question is whether the token stabilises its value by reference to another asset (ART), whether it functions as e-money (EMT), or whether it is neither (the residual category, subject to lighter but still real obligations including a whitepaper).
In the US, the SEC applies the investment contract analysis. The CFTC claims jurisdiction over tokens it classifies as commodities. The FinCEN overlay adds money-transmission considerations for tokens used as a medium of exchange. The three can apply simultaneously to the same token. NYDFS adds a further layer for any business touching New York users. An institutional client distributing tokens to US persons – even in a private placement – must work through all four.
The SFC in Hong Kong applies a "look-through" analysis: if a token represents interests in a collective investment scheme or constitutes a security under the Securities and Futures Ordinance, the SFC's securities regime applies regardless of how the token is described. The FCA takes a similar approach under its existing specified investments framework, now supplemented by its crypto-asset financial-promotion rules, which apply even to tokens that are not specified investments.
The consistent principle across all of these: the name on the tin is irrelevant. The rights, the structure, the economics – those are what regulators read.
How Does the Classification Process Work in Practice?
A defensible classification opinion for an institutional client follows a structured analytical sequence, not a checkbox. The sequence must be documented, because regulators and counterparties will ask for the work product.
The first step is a rights-and-mechanics audit. We examine the token's smart contract, the whitepaper or offering document, the governance structure, and any side agreements between the issuer and investors. The question at this stage is not "what does the issuer call this?" but "what can a holder actually do with this token, and what does the issuer owe them?" Profit-sharing mechanisms, buyback commitments, voting rights and revenue-share provisions are all classification signals. So are the absence of those features.
The second step is the jurisdictional matrix. We identify every jurisdiction where the token will be issued, where investors are located, where the token will trade or be custodied, and where the issuer entity is domiciled. Each of those creates a classification obligation under the local regime. A token that is a utility token under MiCA may simultaneously constitute a security in the US if US persons participate. The matrix makes the conflicts visible before they become enforcement problems.
The third step is the opinion itself: a written analysis, jurisdiction by jurisdiction, mapping the token's features against each applicable test. For institutional clients, this document serves multiple purposes – it is the basis for board-level approval, it is disclosed to counterparties in a private placement, and it is the defense document if a regulator later queries the offering.
The fourth step is remediation, where needed. If the classification analysis reveals that the token structure, as designed, triggers a securities regime, the client has a choice: restructure the token economics to alter the classification outcome, or proceed on a securities-compliant track. We advise on both paths. We do not advise on one to the exclusion of the other.
Why Does the Cross-Border Dimension Matter for Institutional Clients?
Institutional token transactions are almost always cross-border. The issuer may be domiciled in one jurisdiction, the lead investors in another, the trading venue in a third. Each of those connections creates an independent classification obligation under local law – and those obligations do not align by default.
The clearest tension in our current practice sits between the EU's MiCA regime and the US securities framework. MiCA creates a passportable authorisation regime for CASPs (crypto-asset service providers) across the EU and EEA. It also creates whitepaper obligations for token issuers. But MiCA's scope is territorial: it does not resolve the US question. An issuer that obtains a MiCA-compliant whitepaper for a token offered to EU investors has not thereby addressed its obligations to US investors. If any US persons participate – even inadvertently – the SEC's analysis applies in parallel.
The Singapore – Hong Kong axis creates a different complexity. Both MAS and the SFC apply substance-based tests, but the line between a utility token and a capital markets product is drawn differently by each regulator. A token structured to fall outside MAS's payment services framework may nonetheless trigger the SFC's look-through analysis if distributed to Hong Kong investors. Institutional clients with a pan-Asian investor base need a consolidated analysis that covers both, not two separate opinions that do not speak to each other.
The cross-border banking dimension compounds the problem. Banks servicing institutional token issuers will conduct their own classification assessment. A token that the issuer has classified as a utility token, but that the bank's compliance team reads as a security, will cause account closure. We have seen this in practice repeatedly. Aligning the classification opinion with the banking relationship is not a formality – it is a prerequisite for the deal to function operationally.
If you are managing a cross-border token structure where prior legal work has not resolved the US, EU or Asian classification questions consistently, contact OBOLUS at info@oboluslaw.com. A second read of the existing analysis often surfaces the conflict before it becomes an enforcement or banking problem. Map your options
What Are the Most Common Classification Mistakes Institutional Clients Make?
The most consequential classification errors in institutional token transactions are structural, not labeling errors. By the time a whitepaper describes the token as a utility token, the economic structure has already determined the answer – and the label cannot override it.
The first and most common error is treating a profit-sharing or revenue-distribution mechanism as compatible with a utility classification. It is not. Any token that entitles a holder to a share of issuer revenues, to a buyback at a predetermined formula, or to a distribution tied to issuer performance is exhibiting the economic characteristics that regulators treat as securities markers. The label in the whitepaper does not resolve this. Operators we advise routinely arrive with structures that have embedded these features without appreciating the classification consequence.
The second error is conducting the classification analysis only for the primary offering jurisdiction and assuming it carries through. A UK-only classification opinion does not answer the MiCA question. A MiCA whitepaper does not answer the SEC question. Each regime requires its own analysis. For institutional clients, where the investor base is international by definition, a single-jurisdiction opinion is a false assurance.
The third error is timing. Classification should be the first legal question addressed, before the token economics are locked, before the investor roadshow begins, and before the smart contract is deployed. In our cross-border practice, we regularly see mandates where the classification question arrives after the token economics are already designed. At that point, restructuring is possible but more expensive and more disruptive than it would have been at the design stage.
A fourth error, specific to institutional secondary-market participants, is relying on a classification opinion prepared for the issuer. An exchange listing a token, or a fund acquiring it in the secondary market, should commission an independent classification assessment. The issuer's opinion was prepared for the issuer's purpose, with the issuer's facts. It may not reflect the analysis a regulator would apply to a different participant's role.
Which Classification Path Fits Which Institutional Profile?
Institutional token clients arrive with very different profiles, and the right classification approach – and the urgency of the analysis – varies by profile.
A protocol issuing governance tokens to institutional investors faces the sharpest security-token risk. Governance rights that influence issuer operations, combined with a secondary market where the token trades, closely parallel the economic relationship that securities law was designed to regulate. This profile requires the most detailed Howey analysis in the US, the most careful MiFID II / MiCA boundary analysis in the EU, and an explicit decision on whether to proceed on a restricted basis (excluding US persons) or to structure a compliant securities offering. The timeline from initial analysis to a defensible opinion is measured in weeks, not days.
A fund tokenizing a real-world asset – real estate, private credit, commodities – will almost always produce a token that constitutes a security in most major jurisdictions. The classification question is less open; the structural question is which securities regime to use and in which jurisdiction. Here the analysis moves quickly to the licensed-offering track: which exemption applies, which jurisdiction's securities law is most efficient for the investor base, and how the token's transferability is restricted post-issuance.
An exchange listing an institutional-grade token has a different profile again. Its obligation is to conduct an independent classification analysis on each token it proposes to list. In the EU, operating as a CASP under MiCA requires the exchange to apply a classification methodology across its listed assets. In Hong Kong, the SFC's VASP licensing framework imposes similar obligations. The exchange's classification process needs to be documented, consistent, and defensible – not ad hoc.
A stablecoin issuer faces the most constrained classification environment. Under MiCA, a stablecoin referencing a basket of assets is an ART, requiring a specific issuer authorisation. A stablecoin backed by a single fiat currency is an EMT, subject to the e-money framework. Neither can be issued to the public in the EU without a MiCA-compliant authorisation. The classification is typically not in dispute – the issue is which authorisation track applies and how quickly the issuer can reach compliance.
A Classification Problem in Practice
In a recent matter, an institutional fund had completed a token acquisition in a private sale structured under a SAFT (Simple Agreement for Future Tokens). The issuer had provided a legal opinion classifying the token as a utility token under its home jurisdiction's regime. When the fund's prime broker reviewed the structure before onboarding, its compliance team flagged that the token's vesting mechanics and the issuer's public statements about anticipated token appreciation pointed toward a different conclusion under the applicable US analysis. We were instructed to conduct an independent classification review. The analysis confirmed that the token, as structured, exhibited investment contract characteristics that the issuer's single-jurisdiction opinion had not addressed. We worked with the issuer's counsel to restructure the vesting mechanics and remove the problematic secondary features, producing a revised opinion that the prime broker accepted. The fund completed the onboarding. The work was completed within a matter of weeks of instruction.
Self-Assessment Checklist for Institutional Token Participants
Before committing to a token structure or position, an institutional client should be able to answer each of these questions with documented support.
- Has the token been classified independently under the regime of every jurisdiction where it will be issued, where investors are located, and where it will trade?
- Does the classification analysis address the token's smart-contract mechanics and any governance or economic rights, not only the whitepaper description?
- If the token has profit-sharing, buyback or revenue-distribution features, has the investment contract / specified investment analysis been conducted and documented?
- Has the US person question been addressed explicitly, including the scope of any Regulation S or other exemption relied upon?
- Has the token's classification been discussed with the proposed banking and prime brokerage relationships before the transaction closes?
- Is there a MiCA whitepaper on file, or a documented analysis of why one is not required?
- If a prior classification opinion exists, was it prepared within the last twelve months and does it account for any changes to the token's economic features since issuance?
A "no" or "unsure" answer to any of these questions is a signal that the classification work is incomplete.
A Common Assumption: The Utility Label Settles the Question
A common assumption among institutional clients new to token transactions is that labeling a token "utility" in the whitepaper, and designing it to confer access rights rather than financial returns, is sufficient to resolve the classification question in favor of a non-securities outcome. It is not.
The utility label is a starting point for the analysis, not its conclusion. Regulators across every major regime look at the substance of the rights, the marketing of the token, the reasonable expectations of buyers, and the economic structure of the offering – not the category name on the cover of the whitepaper. A token designed to provide platform access can nonetheless constitute a security if it is marketed on the basis of anticipated appreciation, if the issuer retains a significant allocation with market incentive to support the price, or if the access rights are meaningless in the absence of a functioning platform that the issuer has not yet built.
The ESMA guidance under MiCA, the FCA's published statements on the classification of crypto-assets, and the SEC's own enforcement record all illustrate that regulators are not bound by the issuer's characterization. In our practice, we assess classification against the substance of rights, not the marketing label. That is the only analysis a regulator will accept, and it is the only analysis that protects the institutional client when the question is later asked.
Related at OBOLUS
- Token Offerings & Securities Practice – full-scope legal counsel on token issuance, securities compliance and cross-border offering structures
- Token Sale Agreement Drafting in Panama – structuring and drafting token sale agreements under Panamanian law for cross-border offerings
- Token Legal Classification for Early-Stage Founders – classification analysis and structuring guidance for founders at the design stage
FAQ
Is my token a security?
Whether a token constitutes a security depends on the regime and the substance of the rights it confers, not its label. In the US, the investment contract analysis applied by the SEC is the primary test. Under MiCA, the relevant question is whether the token constitutes a financial instrument under MiFID II. In Singapore and Hong Kong, the MAS and SFC each apply their own capital markets frameworks. A defensible answer requires a written analysis under each applicable regime. We provide that analysis as a formal opinion.
Do I need a MiCA whitepaper?
Under MiCA, a whitepaper is required for public offers of crypto-assets within the EU and EEA, subject to limited exemptions – including for tokens offered only to qualified investors, for small-scale offers, and for tokens that qualify as financial instruments and fall outside MiCA's scope entirely. Whether an exemption applies is itself a classification question. An issuer targeting EU institutional investors only is not automatically exempt; the qualified-investor carve-out has conditions that must be satisfied and documented.
How should an airdrop be structured legally?
An airdrop is not automatically exempt from classification analysis simply because no payment is received. Regulators look at whether the airdrop recipient acquires a token with investment-contract characteristics, whether the airdrop is conditional on actions that give it an economic substance (such as completing a task in exchange for value), and whether the distribution mechanism constitutes a public offer. Airdrops to US persons, and public airdrops in the EU, each carry specific classification and securities-law risks that must be addressed before the airdrop is executed.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess token classification against the substance of rights, not the marketing label – and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. To discuss your situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in token classification, smart-contract legal analysis and cross-border digital-asset regulatory structures for institutional clients.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.