Founders often describe a token by its label: a utility token, a governance token, a stablecoin, an NFT. Regulators look past the label. They ask what rights the holder gets, what the holder expects, how money moves and who is doing what for whom.
That gap explains many uncomfortable conversations with regulators and banking partners. A team calls its asset a utility token, builds a launch plan around that assumption and only later learns that the asset, or the services around it, falls inside a licensing regime in one or more markets.
The regulatory perimeter is the boundary that decides which activities need a licence, registration or other approval. This article explains how to work out where your product sits, using the EU, UK, US and several Asian and Middle Eastern markets as examples. It is a method, not a verdict: the answer always depends on the facts and on local advice.
Why the label does not decide the outcome
Most regimes classify an asset by its substance. If a token gives holders a share of profits, a claim on the issuer or a right to redeem for money, those features drive the result. Calling it “utility” or “community” in a white paper does not change them.
The same applies to words like “decentralised”. A project may run on a public blockchain while a single company controls upgrades, treasury funds and the main user interface. Regulators tend to look at who actually exercises control and who benefits economically.
Start, then, with an honest description of how the product works. Write it for a sceptical reader, not for investors.
Describe the asset and its economics
Before any legal analysis, document the facts. A perimeter review is only as good as the description it rests on, and gaps here produce confident answers to the wrong question.
Include the uncomfortable details, such as founder allocations, market-making arrangements and any promise to buy tokens back. These are often the facts that change the result.
- What rights the asset carries: access, voting, revenue share, redemption, or none
- How it is issued, to whom, at what price and with what lock-ups
- Whether it is pegged to, or redeemable for, a currency or other asset
- How it can be transferred, and whether it is listed or traded
- How the business earns money from the asset and the platform
- What marketing says about returns, price or future value
Separate the asset from the services around it
Even where the asset itself is lightly regulated, the services around it may not be. Issuing a token, holding customers’ assets (custody), running an exchange, executing orders, transferring assets, giving advice and managing portfolios can each be a regulated activity in its own right.
Map each activity to the entity that performs it and the customers it serves. A group may have one company issuing a token, another running the platform and a third holding reserves. Each may need its own analysis, licence or registration in each market.
Do not assume that settling the token’s status also settles the platform’s position. They are separate questions, and the second often carries more obligations.
The EU: MiCA and its boundaries
In the EU, the Markets in Crypto-Assets Regulation (MiCA) sets a single framework for issuers of crypto-assets and crypto-asset service providers, or CASPs. It distinguishes three categories: asset-referenced tokens, which reference a basket of assets; e-money tokens, which reference a single official currency; and other crypto-assets. Stablecoin rules have applied since June 2024 and the rest of the regime since December 2024.
MiCA also has important exclusions. Crypto-assets that qualify as financial instruments fall under existing financial services law, such as MiFID II, instead. ESMA, the EU securities regulator, has issued guidelines on how to draw that line. Crypto-assets that are unique and not fungible with other crypto-assets are generally excluded, though a large series of “NFTs” may not qualify for that exclusion.
The transitional period that let firms keep operating under national regimes ended on 1 July 2026 at the latest, and some member states ended it earlier. A CASP serving EU clients now generally needs MiCA authorisation in one member state, which it can then passport across the EU.
The UK and the US
The UK is building its own regime under its existing financial services legislation. The Financial Conduct Authority says the new cryptoasset regime is expected to come into force on 25 October 2027, bringing activities such as operating a trading platform, dealing, custody and staking within authorisation. Until then, firms carrying on certain cryptoasset activities must register with the FCA for anti-money laundering purposes, and strict financial promotion rules already apply.
In the US, the question of whether a token is a security still turns largely on the Howey test, from a 1946 Supreme Court case on investment contracts. The GENIUS Act, signed in July 2025, created a federal framework for payment stablecoins. A broader market structure bill, the CLARITY Act, passed the House in 2025 but, as of this review, has not become law. State money transmission licensing can also apply to custody and transfer services.
Asia, the Middle East and India
Asian hubs each have their own classifications. Singapore regulates digital payment token services under its Payment Services Act, with the Monetary Authority of Singapore as licensing authority. Hong Kong licenses virtual asset trading platforms through the Securities and Futures Commission, and its Stablecoins Ordinance took effect on 1 August 2025.
In the UAE, Dubai’s Virtual Assets Regulatory Authority (VARA) runs a dedicated licensing regime, while the ADGM and DIFC free zones have their own. The right regulator depends on your activities and where you are established.
India regulates virtual digital assets mainly through tax and anti-money laundering law rather than a dedicated statute. Service providers serving Indian users, including offshore platforms, must register with the Financial Intelligence Unit and meet reporting duties, and VDA income is taxed at 30%.
Anti-money laundering travels with you
Whatever the classification, financial crime rules usually follow the services. International standards set by the Financial Action Task Force (FATF) expect virtual asset service providers to be licensed or registered, to check customers and to apply the Travel Rule. The Travel Rule requires information about the sender and recipient to accompany transfers between providers.
These duties shape your product design: onboarding flows, wallet screening, transaction monitoring and data sharing with counterparties. They also affect banking relationships, because banks will ask how you meet them before opening accounts.
Connecting the perimeter to the launch plan
A perimeter review should end with a practical plan, not just a classification. For each market, list the authorisations you need, the disclosures you must publish, the marketing rules that apply and the financial crime obligations you take on. Note which dependencies, such as custodians or banking partners, must be in place first.
Then sequence your launch around the answers. It is often better to start in one market with a clear regime and expand once you have a licence, than to launch everywhere and unwind later. Revisit the analysis whenever the token’s rights, the services or the target markets change.
Checklist
- Write a plain description of the asset’s rights, issuance and economics.
- Map every service around the asset to the entity that performs it.
- Review marketing materials for claims about returns or future value.
- Identify each target market and the regulator responsible for each activity.
- Check whether the asset could be a financial instrument or security in each market.
- Confirm your EU authorisation status now that MiCA’s transitional period has ended.
- Plan for the UK regime expected to start in October 2027.
- Design onboarding, monitoring and Travel Rule compliance into the product.
- Revisit the analysis whenever rights, services or markets change.
FAQs
If our token is a “utility token”, are we outside regulation?
Not necessarily. Regulators look at the rights the token carries and how it is sold and marketed. The services around it, such as exchange or custody, may also be regulated whatever the token is called.
Does MiCA authorisation let us operate in the UK?
No. The UK is not part of the EU passporting system. UK activities need to be assessed under UK rules, including current registration and financial promotion requirements and the new regime expected from October 2027.
Are NFTs regulated?
It depends on the facts. MiCA generally excludes crypto-assets that are unique and not fungible, but large series or fractionalised NFTs may fall inside it. Other markets apply their own tests, and securities or consumer laws may still apply.
Is a stablecoin always regulated as e-money?
No. Under MiCA, a token referencing a single official currency is an e-money token, while one referencing a basket is an asset-referenced token. The US, Hong Kong and other markets have their own stablecoin frameworks with different definitions and licensing.
When should we bring in lawyers?
Before the token design, sale structure or launch markets are fixed. Changes are cheap at the whiteboard and expensive after a token sale. Bring the product description, money flows and custody arrangements to the first meeting.