← Back to guides

Token Classification: Security vs. Utility

2026-04-18 · Web3 Compliance AI

Why Classification Matters

Token classification determines which regulatory regime applies to your token and your business. A token classified as a security triggers securities law requirements: registration or exemption, prospectus or offering document obligations, trading venue licensing, investor protection measures, and ongoing disclosure requirements. Getting classification wrong can result in enforcement actions, disgorgement of all proceeds raised, personal liability for founders and officers, and criminal charges.

The stakes are high. The SEC has brought over 100 enforcement actions against crypto projects for unregistered securities offerings, with penalties ranging from millions to hundreds of millions of dollars. In the EU, a token classified as a financial instrument under MiFID II falls outside MiCA and into the full weight of securities regulation. Classification is not an academic exercise — it is a foundational business decision.

Regulatory Frameworks by Jurisdiction

United States — The Howey Test

The SEC applies the Howey Test, derived from the 1946 Supreme Court decision in SEC v. W.J. Howey Co., to determine whether a token constitutes a security (specifically, an "investment contract").

A token is a security if it involves:

Prong Test How It Applies to Tokens
1. Investment of money Broadly interpreted — includes crypto, fiat, and other consideration Almost always met when tokens are purchased for value
2. Common enterprise Purchasers' fortunes tied together or to the issuer's efforts Usually met — token holders share in the project's success or failure
3. Reasonable expectation of profits Includes capital appreciation, not just dividends Marketing materials promising returns, listing on exchanges for speculation
4. Derived from the efforts of others Value depends primarily on a centralized team's work The critical prong — if a core team drives development and value, this is met

SEC Framework for "Investment Contract" Analysis (April 2019) provides additional factors:

Factors suggesting a security:

  • Token purchasers have a reasonable expectation of profit from the issuer's efforts
  • The issuer retains a meaningful stake or interest in the project
  • Funds raised are used to develop the platform (buyers are funding development)
  • The token is marketed with emphasis on potential returns or price appreciation
  • Trading on secondary markets is facilitated or encouraged
  • The network is not yet functional at the time of sale
  • Transferability and trading are key features of the token

Factors suggesting NOT a security:

  • The network is fully functional and the token has consumptive utility
  • Holders acquire the token to use it (access a service, pay fees), not to profit
  • The token's value is tied to the cost of the underlying service, not speculative appreciation
  • No centralized party whose efforts are key to the token's value
  • Token design discourages speculative trading (transfer restrictions, usage-based distribution)
  • Decentralization is sufficient that no single party is the essential driver of value

The "Sufficiently Decentralized" Concept

In a June 2018 speech, former SEC Division of Corporation Finance Director William Hinman stated that a token may not be a security if the network is "sufficiently decentralized" — meaning no central party whose efforts are key to the token's value. This was applied to Ethereum, with the implication that ETH was not a security at that point in time.

Key implications:

  • A token may start as a security (during fundraising and development) and later become a non-security as the network decentralizes
  • There is no bright-line test for "sufficient decentralization"
  • Factors include: number and distribution of node operators, independence of development teams, community governance, absence of a controlling entity
  • The path from security to non-security through progressive decentralization remains legally uncertain and has not been formally adopted as SEC policy

Practical reality: Until the SEC provides clearer guidance or Congress legislates, the safest assumption for any token with a core development team and expectation of appreciation is that it may be treated as a security.

European Union — MiFID II and MiCA

The EU distinguishes between financial instruments and crypto-assets through a two-step classification:

Step 1: Is the token a financial instrument under MiFID II?

If the token represents or provides rights equivalent to:

  • Transferable securities (equity tokens, debt tokens, revenue-share tokens)
  • Derivatives (tokens that derive value from an underlying asset)
  • Units in collective investment schemes (fund tokens, index tokens)

Then it is a financial instrument regulated under MiFID II, the Prospectus Regulation, and the Market Abuse Regulation. MiCA does not apply — full securities regulation applies instead.

Step 2: If NOT a financial instrument, MiCA applies. Three MiCA categories:

MiCA Category Description Key Requirements
Asset-Referenced Token (ART) Token maintaining a stable value by referencing multiple assets, fiat currencies, commodities, or crypto-assets White paper approval by NCA, reserve requirements, EBA supervision if "significant"
E-Money Token (EMT) Token referencing a single official fiat currency (stablecoins like USDC, EURC) E-money institution or credit institution authorization required, funds safeguarding, redemption at par
Other crypto-assets Utility tokens and all other tokens that are not ARTs, EMTs, or financial instruments White paper notification, lighter requirements, but still subject to MiCA rules

Classification determination: Member state NCAs make the final classification decision. ESMA provides guidance to promote consistent classification across the EU. A token classified as a financial instrument in one member state should be treated consistently across all member states.

Key test: Does the token confer financial rights (ownership, profit-sharing, debt claims, redemption rights)? If yes, likely a MiFID II financial instrument. If the token provides access to a service or utility, likely falls under MiCA's "other crypto-assets" category.

United Kingdom

The UK is developing its own classification framework:

  • Security tokens — Tokens that meet the definition of "specified investments" under the Regulated Activities Order (RAO) are regulated as securities by the FCA.
  • E-money tokens — Tokens pegged to fiat currency fall under existing e-money regulations.
  • Unregulated tokens — Utility and exchange tokens that do not qualify as securities or e-money. However, the Financial Services and Markets Act 2023 is bringing crypto-assets into the regulatory perimeter, and further classification rules are expected.
  • FCA guidance: The FCA's Guidance on Cryptoassets (PS19/22) provides a decision tree for classifying tokens, but the framework is evolving.

Singapore

MAS classifies digital tokens under a functional approach:

  • Capital markets products — Tokens that constitute securities, units in collective investment schemes, or derivatives under the Securities and Futures Act (SFA). Subject to prospectus requirements and licensing.
  • Digital Payment Tokens (DPTs) — Tokens used as a medium of exchange, regulated under the Payment Services Act 2019. Requires MPI or SPI license.
  • E-money — Tokens representing fiat currency, regulated as stored value facilities under the Payment Services Act.

MAS guidance: "A Guide to Digital Token Offerings" (updated 2020) provides MAS's approach to token classification. The substance-over-form principle applies — MAS looks at the rights and features of the token, not just the label given by the issuer.

Japan

The JFSA classifies tokens into:

  • Crypto-assets (Kasou Tsuka) — Payment and utility tokens regulated under the Payment Services Act. Require CAESP registration for exchange/custody services.
  • Electronically Recorded Transferable Rights (ERTRs) — Security tokens classified as "Type I" securities under the Financial Instruments and Exchange Act (FIEA). Subject to securities registration and disclosure requirements.
  • Stablecoins — Classified based on structure. Fiat-backed stablecoins may be regulated as "digital money" under the amended Payment Services Act (2023).

JVCEA (Japan Virtual Currency Exchange Association) maintains a green list (pre-approved tokens) and white list (tokens requiring individual review) that governs which tokens can be listed on Japanese exchanges.

Hong Kong

The SFC applies a substance-over-form approach:

  • Securities — Tokens that constitute "securities" under the Securities and Futures Ordinance (SFO), including shares, debentures, and interests in collective investment schemes. Type 1 and Type 7 SFC licenses required for dealing and platform operations.
  • Virtual assets — Non-security tokens regulated under AMLO Part 5B. VATP license required for exchange platforms.

Practical Classification Framework

When analyzing a token, evaluate these factors systematically. Document your analysis — a well-reasoned legal opinion demonstrates good faith even if the classification is later challenged.

Step 1: Rights Analysis

Question If Yes, Points Toward If No, Points Toward
Does the token provide ownership in an entity? Security Utility/other
Does the token provide profit-sharing or dividend rights? Security Utility/other
Does the token represent debt or a right to repayment? Security Utility/other
Does the token provide governance/voting rights in a corporate entity? Security (may be) Neutral
Does the token provide access to a service or platform? Utility Neutral
Does the token function as a medium of exchange? Payment token Neutral
Does the token maintain a stable value against fiat? ART/EMT (EU), stablecoin Neutral

Step 2: Economic Reality

  • Primary use: investment or utility? If most holders buy to sell at a higher price rather than to use the service, this points toward security classification.
  • Functional product? Is there a working product at launch, or are buyers funding development? Pre-functional tokens are much more likely to be classified as securities.
  • Price correlation: Does the token price correlate with the project team's development efforts? If so, the "efforts of others" prong is likely met.

Step 3: Marketing and Distribution Analysis

  • How was it marketed? Promises of returns, price appreciation, or investment potential push strongly toward security classification. The SEC has cited social media posts, blog articles, and promotional materials as evidence.
  • Who bought it? If the primary purchasers are speculators rather than service users, this supports security classification.
  • Distribution method: ICO/IEO with broad public sale looks more like a securities offering. Airdrop to existing users of a functional platform looks more like utility distribution.

Step 4: Decentralization Assessment

  • Core team dependency: Is there an identifiable team whose continued efforts are essential to the token's value?
  • Governance: Is governance decentralized (DAO, on-chain voting) or centralized (foundation, company)?
  • Development: Is development conducted by a single team or by a distributed community?
  • Treasury: Does the project control a significant treasury of tokens? Large team/foundation token allocations suggest centralization.

Comparison: Security Token vs. Utility Token Obligations

Obligation Security Token Utility Token (MiCA) Utility Token (US)
Registration/authorization Securities registration or exemption MiCA CASP authorization for service providers No federal registration (but state MTL may apply)
Offering document Prospectus (EU) or registration statement (US) MiCA white paper (notification to NCA) No SEC registration required
Trading venues Regulated securities exchange or ATS MiCA-authorized trading platform State-regulated exchanges
Investor protection Full investor protection rules MiCA consumer protection Limited
Ongoing disclosure Periodic financial reporting Limited ongoing obligations Minimal
Transfer restrictions May apply (lock-up periods, accredited investor limits) Generally freely transferable Generally freely transferable

Risk Mitigation Strategies

Strategy 1: Comply with Securities Laws

If classification is uncertain, the safest path is to comply with securities laws from the start.

  • US: Conduct the offering under an exemption (Regulation D for accredited investors, Regulation S for offshore, Regulation A+ for smaller public offerings).
  • EU: Prepare a prospectus under the Prospectus Regulation or use an exemption.
  • This is expensive and time-consuming but eliminates enforcement risk.

Strategy 2: Seek Regulatory Determination

  • US: Request an SEC no-action letter (limited success historically, but some precedent).
  • EU: Engage with your NCA for a classification determination before launch.
  • Singapore: Submit a pre-consultation inquiry to MAS.
  • UK: Apply for FCA determination through the regulatory perimeter inquiry process.

Strategy 3: Design for Utility

Structure the token to minimize security characteristics:

  1. Launch only when the platform is fully functional — buyers can immediately use the token
  2. Price the token relative to the cost of the service, not as a speculative instrument
  3. Do not market potential returns or price appreciation
  4. Distribute tokens through usage and participation, not investment-style sales
  5. Decentralize governance and development as quickly as possible
  6. Limit team token allocations and impose long vesting schedules
  7. Discourage speculative trading (consider transfer restrictions or usage incentives)

Strategy 4: Document Everything

A thorough, well-reasoned legal opinion on token classification — even if ultimately wrong — demonstrates good faith and can significantly mitigate penalties in enforcement proceedings. Document:

  • The analysis framework used
  • All factors considered (for and against each classification)
  • Comparable tokens and their regulatory treatment
  • Legal counsel opinions
  • Any regulatory guidance relied upon

Common Pitfalls

  1. Classification by label, not substance — Calling a token a "utility token" does not make it one. Regulators look at economic substance and actual use.
  2. Ignoring the marketing — Even a well-designed utility token can be classified as a security if it is marketed as an investment opportunity.
  3. Assuming decentralization protects you — "Sufficiently decentralized" is not a defense during the initial fundraising phase. The token may be a security at launch even if it becomes a non-security later.
  4. Relying on offshore structuring — US securities laws apply to offerings targeted at US investors regardless of where the issuer is located. The SEC has pursued enforcement against offshore entities.
  5. No legal opinion — Launching a token without a formal classification analysis is reckless. Get a legal opinion before launch.
  6. Ignoring jurisdiction-specific rules — A token may be a utility token in one jurisdiction and a security in another. Analyze classification in every jurisdiction where you distribute.

Resources