Token legal classification: Legal Counsel for Digital-Asset Firms

A token issuer expanding from a working product into a public offering discovers, often too late, that the label printed on a whitepaper carries no legal weight. The question that matters – whether the token is a security, an e-money instrument, an asset-referenced token, or something outside regulated categories entirely – is answered by the substance of the rights it confers, not by the marketing language around it. Mis-classifying a token can convert a product launch into an unregistered securities offering, with enforcement, disgorgement and criminal exposure following. This page sets out how OBOLUS approaches token legal classification (the formal determination of what category of financial instrument or regulated asset a digital token constitutes under applicable law) as a professional engagement, the process it involves, and what the cross-border reality means for founders and general counsel who need a definitive answer before they commit.

The classification exercise sits at the intersection of securities law, payment-services regulation, and the emerging token-specific regimes now operative across the major licensing hubs. Getting it right – once, comprehensively, across every market where the token will be offered – is the single highest-leverage legal task in a token project's life cycle.

Why token classification is not a formality

Classification determines every downstream obligation – disclosure, licensing, marketing restrictions, investor eligibility, and ongoing reporting – so it is the first legal question, not a late-stage compliance check. Regulators across the EU under MiCA (the Markets in Crypto-Assets Regulation, supervised by ESMA and national competent authorities), in Dubai under VARA (the Virtual Assets Regulatory Authority), in Singapore under the MAS Payment Services Act regime, and in the United States under the SEC and CFTC frameworks each apply their own classification tests. A token that is outside the securities perimeter in one market may fall squarely within it in another.

The risk is asymmetric. An issuer who over-classifies – treating a utility token as a security – bears unnecessary regulatory cost and restricts distribution. An issuer who under-classifies – treating a security as a utility token – faces enforcement. In our practice, the enforcement risk is the one that ends projects. The common pattern we see is a founder who received informal guidance at incorporation and never updated the analysis as the token's rights evolved through development rounds. By the time a public sale is live, the facts have changed and the original opinion no longer reflects what the token actually does.

The AUDIENCE_PAIN is not theoretical. Several enforcement actions in the United States, EU member states and the United Kingdom have proceeded against issuers who relied on a utility label rather than a substantive legal analysis. A label does not bind a regulator.

What a classification analysis actually covers

A classification engagement at OBOLUS begins with the substance of the rights the token confers and works outward to the regulatory tests applicable in each target market. The analysis is not a checklist. It is a legal opinion built from first principles and documented for regulatory reliance.

The core questions are consistent across jurisdictions, even if the tests differ. Does the token carry an expectation of profit derived from the efforts of others – the functional equivalent of the Howey investment-contract analysis applied by the SEC? Does it represent a claim on an underlying asset or currency, placing it within the ART (asset-referenced token) or EMT (e-money token) categories under the MiCA regime? Does it confer governance rights, access rights, or hybrid rights that complicate classification? Does it function as a means of exchange or payment, triggering the MAS Digital Payment Token licensing obligations or analogous frameworks under VARA?

The analysis also covers the whitepaper (the primary disclosure document for a token offering, the form and content of which MiCA and other regimes regulate directly). A whitepaper that is filed without a preceding classification analysis is built on an unsecured foundation. We draft the legal opinion first and the whitepaper disclosure second.

In a recent matter, a DeFi protocol in the growth stage had published a draft whitepaper describing its governance token as a pure utility instrument. The rights structure – including a revenue-share mechanic embedded in the governance module – pointed toward a securities characterization in several target markets. We restructured the rights architecture before the public draft was released, and the reissued whitepaper was filed under the correct MiCA category without challenge. The restructure took several weeks and saved the issuer a mandatory withdrawal later.

To begin a scoped classification assessment, write to OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the rights architecture, the user base, the target markets – change the analysis.

How the leading regimes approach the classification test

Each major regime applies a distinct analytical framework, and a cross-border issuer must satisfy all of them simultaneously in any market where the token will be offered or traded. There is no universal safe harbour.

Under MiCA, tokens are categorized as ARTs, EMTs, or "other crypto-assets" (a residual category that still carries whitepaper and disclosure obligations). The categorization is not voluntary: the issuer states the category in the whitepaper, and ESMA and the relevant national competent authority review it. A misstatement in the whitepaper is a regulatory breach. The framework explicitly addresses the boundary between a crypto-asset and a financial instrument under MiFID II – if a token meets the MiFID II definition of a transferable security, MiCA does not apply and the full securities regime does.

In Dubai, VARA's activity-based licensing regime means that the classification of the token affects which VARA licence the operator requires. A token offered or traded through a platform may trigger broker-dealer, exchange, or advisory permissions depending on its nature. Operators in the DIFC financial free zone are outside VARA's scope and subject to the DFSA regime, which has its own investment token classification.

In Singapore, the MAS applies a substance-based analysis under the Payment Services Act for payment tokens and under the Securities and Futures Act for capital markets products. The two analyses run in parallel: a token that is both a DPT and a security faces dual obligations.

The United Kingdom's FCA applies its existing regulated-activities framework to determine whether a token is a specified investment, an e-money instrument, or an unregulated cryptoasset. The financial-promotion rules, which the FCA actively enforces, apply to communications about tokens that are qualifying cryptoassets regardless of whether the token itself is a security.

In Switzerland, FINMA's token taxonomy – distinguishing payment tokens, utility tokens, and asset tokens – provides a relatively structured starting point, but the analysis is still fact-specific and the boundaries between categories are contested in practice.

The utility label: why it does not resolve classification

A common assumption in the market is that calling a token a "utility token" in the whitepaper, or structuring rights as "access" rather than "investment," settles the legal classification. It does not. Every major regulator applies a substance-over-form test. The label the issuer chooses is the starting point of the regulator's inquiry, not the end of it.

The MiCA framework is explicit: a token is classified by the rights it confers, not the name the issuer assigns it. The SEC's application of the investment-contract test is similarly indifferent to labels. VARA's rulebooks and the MAS's guidance each state that economic substance governs. An access right that appreciates in value, can be traded on a secondary market, and is marketed with reference to a project's growth is likely to be scrutinised as a security in most major markets regardless of what the whitepaper calls it.

We assess classification against the substance of rights, not the marketing label. That discipline – going to the rights architecture before the documentation – is what distinguishes a defensible opinion from a document that looks like legal advice but will not withstand regulatory review.

The restructuring work is real. We regularly advise issuers mid-development to change the rights architecture of a token before a public sale, because the current structure would not survive a securities analysis in one or more target markets. That work is less expensive than an enforcement response. It is considerably less expensive than a mandatory redemption.

What the engagement process looks like

A standard token classification engagement follows a defined sequence. The timeline varies by complexity, the number of target jurisdictions, and the completeness of the materials the issuer provides at intake. In straightforward single-jurisdiction matters, an initial opinion can typically be delivered within a matter of weeks. Multi-jurisdiction analysis takes longer.

The sequence runs as follows. First, we conduct an intake review: the token's technical architecture, the rights conferred, the tokenomics, the intended distribution mechanics (including any airdrop, private sale, or public sale structure), and the target markets. Second, we apply the classification tests of each relevant regime and document the analysis, noting where the outcome is clear and where it is contested. Third, we deliver a written opinion covering each jurisdiction, including the consequence of each classification – what licence the issuer needs, what disclosure obligations apply, and what distribution restrictions follow. Fourth, for issuers proceeding to a public offering, we translate the opinion into whitepaper disclosure and, where required, prepare the regulatory filing.

Where the rights architecture creates a classification risk, we identify the restructuring options before the opinion is finalised. A restructure at the opinion stage costs a fraction of a restructure after a regulatory challenge.

Airdrops present a distinct classification question. A free distribution of tokens to wallet addresses is not inherently exempt from securities analysis. The relevant question is whether the airdrop constitutes a public offer of securities in any target jurisdiction – a fact-specific analysis that depends on the value of the tokens distributed, the eligibility criteria, whether marketing was directed at a jurisdiction, and the rights the airdropped tokens carry. We address airdrop structuring as part of the classification engagement or as a standalone scoped matter.

If a prior classification opinion has become stale or a regulatory challenge has been received, contact OBOLUS at info@oboluslaw.com. If a prior application stalled or a filing was questioned, a second read can surface the structural reason and the route forward.

The cross-border reality: one token, many regulators

No token issuer operates in a single jurisdiction. The entity may be in the Cayman Islands or BVI under the VASP registration regimes of the BVI FSC or CIMA. The development team may be in Europe, triggering MiCA analysis for any EU-resident users. The token may trade on a Singapore-regulated platform, invoking MAS scrutiny. US persons may hold the token, placing the SEC's long-arm jurisdiction in play. Each of these creates independent legal exposure.

The cross-border question is not only about where the issuer is based. It is about where the token is offered, where it is traded, and where the users are. A token that is exempt from securities regulation in Switzerland may be a security in the United States. A token cleared under the MiCA residual category in the EU may require a VASP licence in the UAE if it is offered on a platform operating under VARA supervision.

The entity structure matters. An issuer domiciled in a common-law jurisdiction with a well-developed VASP framework – the BVI, the Cayman Islands, Malta, or Singapore – may have a cleaner path to a multi-jurisdiction opinion because the primary licensing and disclosure obligations are centralized. An issuer operating from a jurisdiction with no digital-asset regime relies on a patchwork of general financial-services law, which increases classification uncertainty in every market it touches.

We structure licensing, banking, and tax as one mandate rather than three disconnected workstreams. A classification opinion that does not account for the tax treatment of the token in the issuer's home jurisdiction, or the banking consequences of being classified as a payment-service provider in a target market, is an incomplete opinion. We identify those intersections and advise on them as part of the same engagement, or hand off to allied counsel in the relevant jurisdiction where specialist local law is required.

Which profile needs what: a decision matrix

The right classification engagement depends on the issuer's stage, the token's rights structure, and the target markets. The following profiles describe the most common situations we encounter.

Profile A – Early-stage protocol with a governance token. The token has not yet launched. The rights are governance-only or governance with a treasury-yield component. The primary target markets are the EU and Singapore. The recommended engagement is a full classification analysis covering MiCA and the MAS framework, delivered as a written opinion, followed by whitepaper drafting. Timeline: typically several weeks from complete intake materials. Key risk: the treasury-yield component may tip the token into a security in one or more markets. Resolution: restructure the rights before the whitepaper is filed.

Profile B – Exchange or protocol expanding into the US market. The token is live and trading outside the United States. The issuer wants to open US-resident access. The primary classification question is the SEC's investment-contract analysis. The recommended engagement is a US-focused legal opinion, reviewed against the existing rights architecture. Timeline: depends on the complexity of the rights structure and the issuer's existing disclosure record. Key risk: secondary-market trading history is used by the SEC as evidence of investment intent. Resolution: the opinion must address the full trading history and the current rights architecture together.

Profile C – Stablecoin or payment-linked token. The token is pegged to a fiat currency or basket of assets. The primary classification questions are MiCA (ART or EMT designation), the MAS DPT analysis, and the FCA e-money and payment-services framework. The recommended engagement is a multi-regime analysis with explicit attention to the issuer-authorisation obligations under MiCA for ARTs and EMTs, which are more demanding than for other crypto-assets. Timeline: allow additional time for the reserve-structure and redemption-rights analysis. Key risk: partial peg mechanics (where redemption is discretionary or conditional) complicate the EMT analysis.

Profile D – Airdrop ahead of a public sale. The issuer plans to distribute tokens to existing community members before a public sale. The classification question is whether the airdrop constitutes a public offer in any target jurisdiction. The recommended engagement is a scoped airdrop-structuring opinion covering the target markets, with explicit analysis of the marketing-direction test and the eligibility criteria. Timeline: typically faster than a full classification opinion. Key risk: eligibility criteria that de facto restrict distribution to certain jurisdictions may not be sufficient to exclude those jurisdictions' securities laws if marketing was directed at residents.

Related at OBOLUS

• Token Offerings & Securities – Practice Overview – the full scope of OBOLUS services for token issuers, from structuring to compliance
• Utility Token Legal Opinion for Early-Stage Founders – a scoped opinion service for founders at the pre-launch stage
• Payment Institution Licensing for Early-Stage Founders – licensing guidance where a token triggers payment-services obligations

Common mistakes in token classification

The most frequent errors we encounter are structural, not drafting failures. They happen upstream of the whitepaper, in the rights design and the business model.

The first is relying on a classification opinion obtained at an early stage of development and never updating it. Token rights evolve as the project develops. A governance token that initially conferred only voting rights may have acquired a fee-sharing mechanic in a later protocol upgrade. The earlier opinion does not cover the upgraded rights, and the issuer may not have noticed the classification exposure the upgrade created.

The second is conflating the absence of a securities regime with a positive classification. An issuer who bases a public sale on the fact that a particular jurisdiction has no digital-asset-specific law has not received a classification opinion; they have received a silence. The general securities law of most developed markets is broad enough to capture token offerings that confer investment returns, and a silence from a local regulator is not a clearance.

The third is treating a legal opinion as a one-jurisdiction exercise. Operators we advise routinely discover that a token cleared in the primary listing jurisdiction faces a securities analysis in a secondary market where the token subsequently trades. The resolution – restricting access, obtaining additional opinions, or restructuring distribution – is more expensive at that stage than it would have been at the outset.

The fourth is airdrop structuring without classification analysis. We have seen airdrops structured as "community rewards" that, on analysis, constituted public offers of unregistered securities in jurisdictions where recipients were active. The eligibility criteria were geographic, but the marketing was not geo-restricted. The discrepancy created exposure that required remediation after the distribution had already occurred.

About OBOLUS

OBOLUS is an independent digital-asset law boutique acting exclusively for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance obligations that sit alongside them. Digital assets are the whole of our practice. We assess token classification against the substance of rights across every market where a token will be offered or traded, and we structure the licensing, banking and tax consequences as a single integrated engagement. To discuss your token's classification, contact info@oboluslaw.com or reach us via t.me/oboluslaw.

To pressure-test your token structure before you commit, message us via t.me/oboluslaw or write to info@oboluslaw.com.

FAQ

Is my token a security?

Whether a token is a security depends on the rights it confers and the jurisdiction in which it is offered, not the label in the whitepaper. The SEC applies an investment-contract test focused on profit expectation derived from others' efforts. MiCA uses a separate MiFID II transferable-security analysis. Most other major regimes apply substance-over-form tests. A written classification opinion, reviewed against the current rights architecture and each target market, is the only reliable answer. We provide that analysis as a scoped engagement.

Do I need a MiCA whitepaper?

Under the MiCA regime, most public offers of crypto-assets in the EU require a whitepaper filed with the relevant national competent authority, unless a specific exemption applies. The exemption categories include offers directed solely at qualified investors, offers below a defined threshold of addressees, and certain small-scale offers. Whether an exemption applies is a fact-specific question. If no exemption applies, the whitepaper must state the token's category – ART, EMT, or other crypto-asset – and that classification must be defensible on the underlying rights structure.

How should an airdrop be structured legally?

An airdrop is not automatically exempt from securities or public-offer analysis. The relevant questions are whether the distribution constitutes a public offer in any target jurisdiction, whether eligibility criteria effectively exclude regulated markets, and whether any value was given in exchange for the tokens. A free distribution to wallet addresses may still be a regulated offer if the tokens carry investment rights and marketing was directed at residents of a regulated market. Structuring an airdrop correctly requires a scoped classification opinion covering each market where recipients are located or marketing is visible.

By Roman Levitt, Technology & DeFi Counsel – specialising in token rights architecture, DeFi protocol classification, and cross-border regulatory analysis for digital-asset issuers.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.