Token classification is not a marketing decision. A regulated entity preparing a token launch faces a binary legal risk: get the classification right and the offering proceeds on the intended legal basis; get it wrong and the business has issued unregistered securities, triggered licensing obligations it cannot retrospectively satisfy, and created a regulatory event that compounds across every jurisdiction where the token circulates. A utility token legal opinion — a formal written analysis of how a token is characterised under the applicable regulatory regimes — is the instrument that resolves that binary before launch, not after it.
The core analysis turns on substance over label. Regulators across the EU under MiCA (Markets in Crypto-Assets Regulation), in Singapore under the Payment Services Act, and in the US before the SEC and CFTC have consistently held that calling a token "utility" settles nothing. The rights the token confers, the expectations it creates, and the economic relationship between issuer and holder determine classification. A legal opinion built on that principle provides the evidential record a regulated entity needs to satisfy its board, its exchange partners, and the regulators it already answers to.
This page sets out how OBOLUS constructs a utility token legal opinion for regulated entities: the regulatory basis that governs the analysis, the process we follow, the cross-border complications that most issuers underestimate, and the common errors that invalidate opinions before they are ever tested.
Why Token Classification Carries Greater Weight for Regulated Entities
A regulated entity — a licensed exchange, a payment institution, a custodian, or a fund — carries a prior licensing relationship with at least one regulator. Any token launch it conducts is therefore immediately scrutinised against that existing relationship. If the token is misclassified and enforcement follows, the consequences extend beyond the offering itself. The regulator may call the entity's fitness and propriety into question. Banking relationships, already difficult for digital-asset businesses, become fragile. And in multi-jurisdiction structures, one regulator's finding of misclassification circulates to peers through supervisory colleges and FATF mutual evaluation channels.
The risk profile is therefore asymmetric. A first-time issuer with no licence to protect faces penalties on the offering. A regulated entity faces those same penalties plus potential impairment of every other regulated activity it carries out.
In our practice we have seen entities that assumed their existing compliance programme covered a token launch discover — at secondary-market listing due diligence — that the opinion they held was jurisdiction-specific and did not address the regime of the exchange listing the token. The opinion was commercially useless. The listing was delayed by months.
Getting the opinion right at the outset is a commercial act, not only a legal one. Exchange listing, banking, investor onboarding, and cross-border marketing all require a credible, multi-jurisdictional classification record. OBOLUS structures the opinion with those downstream uses in mind from instruction.
For a scoped assessment of your token's classification risk, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts — the entity, the user base, the banking — change the analysis. Map your options.
What Legal Regime Governs the Classification Analysis?
Token classification is not governed by a single global standard; it is determined by the law of each jurisdiction where the token is offered, traded, or marketed — and, for regulated entities, also by the law of the jurisdiction where the issuer holds its licence.
Under MiCA, tokens fall into three categories: asset-referenced tokens (ARTs), e-money tokens (EMTs), and a residual "other crypto-assets" category. Tokens that qualify as financial instruments under the existing Markets in Financial Instruments Directive (MiFID II) framework fall outside MiCA and into the securities perimeter. The classification exercise under MiCA therefore has two steps: first, establish that the token is not a MiFID II financial instrument; second, identify the correct MiCA category. ESMA and national competent authorities (NCAs) have issued guidance on the boundary, but no binding bright-line test exists.
In Singapore, the MAS applies a capital-markets-products analysis under the Securities and Futures Act. Tokens that constitute units in a collective investment scheme, debentures, or shares trigger full securities regulation regardless of the "utility" framing in the whitepaper. DPT (digital payment token) classification applies where the token functions as a medium of exchange; a separate licensing track under the Payment Services Act follows.
In Hong Kong, the SFC VASP licensing regime, combined with the pre-existing securities regime, creates a layered classification environment. The SFC has published its own token-mapping guidance, but it applies a facts-and-circumstances test that turns on the same substance-over-label principle.
In the United States, the SEC's application of the Howey test to digital assets means that almost any token generating investor expectation of profit from a third party's efforts carries securities-law risk. The CFTC's jurisdiction over commodity derivatives adds a second layer for tokens that trade on margin or underlie derivative products.
Across all of these regimes, the operative principle is identical: the legal character of a token follows the rights it confers and the economic relationship it creates, not the name the issuer assigns it.
How OBOLUS Builds a Utility Token Legal Opinion
A utility token legal opinion is a structured written analysis — typically a formal memorandum or counsel's opinion letter — covering the token's characterisation under each relevant jurisdiction's law and concluding whether or not the token falls within the regulated securities or financial-instruments perimeter.
Our process has five stages.
First, we conduct a token-design review. We read the whitepaper, the token economics documentation, any technical specification, and the proposed distribution mechanics (sale, airdrop, staking, vesting). We map the rights the token confers: access rights, governance rights, economic rights, and hybrid rights. The presence of any economic right — a claim on revenue, a profit-share mechanism, a buyback commitment — materially elevates classification risk.
Second, we run a jurisdiction matrix. For regulated entities with an existing multi-jurisdiction footprint, the matrix covers at minimum the entity's home jurisdiction, the jurisdiction of any exchange where listing is planned, and any jurisdiction accounting for a material share of the anticipated user base. We apply the securities-characterisation test of each jurisdiction. Where allied counsel in a relevant jurisdiction is required for a local law conclusion, we coordinate that engagement.
Third, we issue a preliminary risk memo — an internal working paper identifying classification risk levels by jurisdiction, including "red" jurisdictions where utility characterisation is unlikely to hold and where structural changes to the token design or offering mechanics would be needed before we can issue a clean opinion.
Fourth, if the preliminary memo identifies structural issues, we work through a redesign cycle: adjusting token rights, distribution mechanics, or offering documents to remove or reduce the feature generating securities risk. This step is iterative. In our cross-border practice, two or three redesign iterations before a clean opinion is achievable are not unusual for a complex token structure.
Fifth, we issue the final opinion. The opinion states the applicable regime, the classification outcome, the basis for that conclusion, the assumptions on which it rests, and the jurisdictions covered. It is addressed to the entity and is structured to be sharable with regulators, exchange compliance teams, and institutional investors in the normal course of listing and distribution due diligence.
Why the Cross-Border Dimension Invalidates Single-Jurisdiction Opinions
A single-jurisdiction opinion is, in most real-world token launches, not fit for purpose. The token circulates globally once it reaches a secondary market. The issuer's regulatory risk follows the token.
Three cross-border complications arise with particular frequency in the matters we handle.
The first is user-base jurisdiction creep. An operator may design a token offering for EU users, relying on a MiCA-compliant analysis. But if US persons acquire the token — through a secondary market, an airdrop, or a referral chain — SEC jurisdiction attaches. The EU opinion provides no defence in a US enforcement action. The standard response is either geo-blocking supported by technical and contractual controls, combined with a US-specific opinion, or a deliberate US-resident exclusion with enforcement mechanics that satisfy FinCEN and the SEC.
The second complication is exchange-of-listing jurisdiction. Every major digital-asset exchange has its own legal due diligence process for token listings. That process typically requires a legal opinion addressing, at minimum, the exchange's home jurisdiction and the primary market jurisdictions of its users. A Cayman-focused opinion will not satisfy the listing requirements of an exchange regulated by the SFC in Hong Kong, the MAS in Singapore, or the FCA in the United Kingdom. Operators who discover this at the listing stage have already spent months and capital on an opinion that is commercially insufficient.
The third complication is the Travel Rule and AML interaction. Under FATF Recommendation 15, transfers of tokens that constitute virtual assets — including utility tokens meeting the value-transfer threshold — trigger Travel Rule obligations on VASPs handling the transfer. If the issuer's token is also the native asset of a platform operated by a VASP, the issuer's classification choice directly shapes the VASP's compliance obligations. A regulated entity that both issues the token and operates the platform has a structural conflict between its issuer interest in utility classification and its VASP obligation to comply with Travel Rule requirements, which the applicable regime imposes regardless of the token's classification.
A multi-jurisdiction opinion addresses all three complications at the design stage, when the cost of adjustment is a drafting exercise rather than a structural restructuring of a launched product.
Common Mistakes That Invalidate a Utility Token Legal Opinion
Opinion quality varies widely in the market. In our review of prior opinions obtained by clients seeking a second assessment, five recurring errors appear.
The first error is relying on the whitepaper's own characterisation. Some opinions are drafted to confirm the issuer's label rather than to analyse the token's legal substance. An opinion that assumes utility classification without independently testing the token's economic rights against the securities-characterisation tests of each relevant jurisdiction is not a legal opinion in any meaningful sense.
The second error is jurisdiction gaps. An opinion covering only the issuer's home jurisdiction is materially incomplete for any token with anticipated global distribution. Exchange listing requirements, in particular, will expose the gap immediately.
The third error is failure to address the whitepaper as a regulated document. Under MiCA, a crypto-asset whitepaper for "other crypto-assets" is a regulated document subject to notification requirements and liability exposure for the issuer. An opinion that addresses classification but does not address whitepaper compliance leaves a separate regulated risk unexamined.
The fourth error is treating airdrop mechanics as classification-neutral. An airdrop — the free distribution of tokens — is not automatically exempt from securities analysis. Where an airdrop is linked to a prior investment, a pre-sale, or a lock-up mechanism, the airdrop tranche may carry the securities characterisation of the transaction to which it is attached. Opinions that ignore airdrop mechanics are structurally incomplete.
The fifth error is outdated analysis. Token classification law is evolving. A MiCA opinion drafted before the full application of MiCA's CASP provisions, or a US analysis that does not account for the current SEC enforcement posture, may not reflect the operative legal environment at the time of launch. Opinions should carry an effective date and a statement of the assumptions on which currency of the analysis rests.
If a prior opinion stalled a listing or was rejected by an exchange compliance team, a second read can identify the structural gap and the route to a serviceable opinion. Write to OBOLUS at info@oboluslaw.com. If a prior application stalled or a critical document was returned, a second assessment can surface the specific reason and the path forward. Map your options.
Decision Matrix: Which Opinion Scope Does Your Profile Require?
Not every token launch requires the same opinion scope. The appropriate scope follows the issuer's profile, the token's distribution geography, and the downstream uses of the opinion.
Profile A — Single-jurisdiction regulated entity, EU market, token with no economic rights. A standard MiCA classification opinion addressing the "other crypto-assets" category under MiCA, combined with a whitepaper-compliance review, will typically suffice. The timeline for this scope — assuming a clean token design — is a matter of weeks from instruction to final opinion. The primary risk is reclassification as a MiFID II financial instrument if governance rights are drafted broadly enough to resemble a profit-participation mechanism.
Profile B — Multi-jurisdiction operator, token with global secondary-market circulation anticipated. The required scope extends to all primary distribution jurisdictions and all material exchange-listing jurisdictions. The opinion takes the form of a consolidated multi-jurisdiction memorandum, with supplementary country annexes. Allied counsel in relevant jurisdictions who are not covered by the OBOLUS team's own analysis contribute local-law sections. The timeline extends relative to Profile A, depending on the number of jurisdictions. The primary risk at this profile is US-person exposure if geo-blocking controls are not implemented and technically enforced before distribution begins.
Profile C — Regulated entity that also operates a VASP platform (exchange or custodian) and issues a native token. The opinion must address classification, VASP licensing interaction, Travel Rule implications for the native token, and any MiCA CASP conditions triggered by the token's characteristics. This is the most complex scope. It requires coordination between the licensing and token-offerings practice areas and, where the entity holds licences in multiple hubs — Dubai under VARA, Singapore under MAS, Hong Kong under the SFC regime — it requires local counsel coordination across each hub. The timeline is commensurately longer, and the opinion output is typically a suite of documents rather than a single letter.
Profile D — Token with a governance function (DAO-adjacent structure). Governance tokens present a distinct risk. A token that carries a material vote over protocol economics, fee distribution, or treasury deployment may be characterised as conferring an equity-adjacent interest in some jurisdictions. The opinion must address that specific risk vector and, where the risk is material, recommend structural changes to the governance mechanics before the opinion can be issued on a utility basis.
Self-Assessment: Do You Need a Formal Opinion Now?
A regulated entity approaching a token launch should work through the following questions before instruction. If the answer to any of them is "yes" or "unclear", a formal opinion is not optional.
Does the token confer any right to a share of revenue, a buyback, or a redemption at a value linked to the issuer's performance? Does the whitepaper contain language that a reasonable investor could read as a promise of return? Is the token being sold before the platform it accesses is operational? Is the offering marketed to persons in the United States, regardless of the issuer's home jurisdiction? Will the token be listed on a regulated exchange in Singapore, Hong Kong, or the United Kingdom? Does the entity hold a VASP licence in a jurisdiction where the token will also be traded? Is the token associated with a prior investment round that used a SAFE, a SAFT, or a convertible note?
A "yes" to any one of these questions introduces a classification risk that a formal legal opinion is designed to document, manage, and — where the design permits — resolve.
A Representative Engagement
In a recent classification matter, a licensed payment institution in an EU member state was preparing to issue a loyalty and access token tied to a new product vertical. The token's initial design included a tiered discount mechanism that the issuer's internal team had characterised as a pure utility feature. On review, we identified that the top tier of the discount structure was priced as a function of platform revenue — a feature that, under a MiFID II financial-instruments analysis, carried a non-trivial profit-participation argument. We flagged this in the preliminary risk memo, recommended a redesign of the tier-pricing formula to decouple it from revenue, and coordinated a supplementary country-annex opinion covering the three exchange-listing jurisdictions the issuer was targeting. The final opinion was delivered ahead of the planned listing timeline, and the issuer's compliance team used it successfully in due diligence with two exchange partners. No enforcement action resulted.
Related practice: in a second matter, handled in the same period, a token issuer operating cross-border between a Gulf hub and an EU entity sought a utility opinion for a governance token that carried treasury-vote rights. The opinion process identified that the treasury-vote mechanism — which directed allocation of a stablecoin reserve — created a rights profile that could not be characterised as utility under MiCA in its current form. We advised a structural separation of the governance function from the reserve mechanism, which allowed the governance token to proceed on a utility basis. The reserve-linked instrument was separately structured as an ART under MiCA, with a different issuance timeline and a distinct regulatory notification path.
Related at OBOLUS
- Token Offerings & Securities practice – Full-scope counsel on token issuance, classification and distribution for digital-asset businesses.
- How to prepare a MiCA-compliant whitepaper – Step-by-step guide to whitepaper structure, content obligations and notification mechanics under MiCA.
- Crypto fraud and asset recovery in South Korea – Recovery options, forums and process for digital-asset misappropriation involving South Korean entities.
FAQ
Is my token a security?
Whether a token is a security depends on the law of each jurisdiction where it is offered or traded — not on the label in the whitepaper. Most major regimes apply a substance-over-form test: the SEC uses the Howey criteria; MiCA distinguishes utility tokens from MiFID II financial instruments by reference to the rights conferred; MAS and the SFC apply equivalent capital-markets analyses. A formal legal opinion, covering each relevant jurisdiction, is the only reliable way to document a non-security conclusion that will withstand regulatory scrutiny and exchange due diligence.
Do I need a MiCA whitepaper?
Under MiCA, issuers of "other crypto-assets" — the residual category covering most utility tokens — must prepare and notify a whitepaper to the competent authority of the member state of issuance before offering the token to the public in the EU. The whitepaper must meet defined content requirements and carries civil liability for the issuer if it contains misleading information. Tokens offered exclusively to qualified investors, or in limited tranches below specified thresholds, may qualify for an exemption. Whether your offering meets an exemption is a fact-specific analysis that should be addressed in the classification opinion.
How should an airdrop be structured legally?
An airdrop — a distribution of tokens without direct payment — is not automatically exempt from securities or AML analysis. Where the airdrop is linked to a prior investment, a pre-sale commitment, or a lock-up, the distributed tokens may carry the securities characterisation of the underlying transaction. Under MiCA, airdropped tokens that form part of a broader public offer may still trigger whitepaper obligations. The Travel Rule may apply to VASP-facilitated airdrop transfers above applicable thresholds. Proper airdrop structuring requires a classification analysis of the distributed token and a review of each distribution mechanism against the applicable AML and securities regimes.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess token classification against the substance of rights, not the marketing label — the approach that has made our opinions commercially serviceable with exchange partners and regulators across more than seventy licensing jurisdictions. To discuss your situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel — specialising in token classification, smart-contract legal analysis and cross-border DeFi regulatory risk for issuers and regulated platform operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.