Web3 Regulation: What to Check Before Launching a Token

Separate the token sale from the services your business provides

A token launch and the operation of a crypto business can require different legal assessments. Start with the rights a buyer receives, the activities your business performs and the markets where it operates or seeks customers. A project that issues a token may also run a trading platform, control customer assets or arrange transfers. Each activity needs its own assessment under the relevant regime. Company, tax, intellectual-property and privacy obligations require a separate local review.

Prepare a short description of the token’s rights, sale terms, redemption promises and use of proceeds. Separately, map who holds customer assets, controls private keys, executes transactions and markets the service. These facts make the classification and licensing checks below usable; a label such as “utility token”, “NFT” or “Web3 wallet” does not supply the answer.

Token rights and sale arrangements determine the securities analysis

Check both the asset and the transaction through which it is offered. In the United States, the investment-contract analysis under SEC v. Howey considers an investment of money in a common enterprise with an expectation of profits from others’ efforts. The SEC’s March 2026 interpretation, with accompanying CFTC guidance, distinguishes a crypto-asset from the investment-contract transaction involving it and expressly preserves binding Howey precedent. Calling the asset itself a non-security does not resolve whether a particular sale forms an investment contract.

In the EU, MiCA excludes crypto-assets that qualify as financial instruments. Those assets must be assessed under the applicable financial-services regime instead. The European Supervisory Authorities’ classification guidelines provide a structured starting point, including whether the asset is an asset-referenced token (ART), an e-money token (EMT) or another crypto-asset within MiCA.

Record the analysis for each target market. The US test does not replace the EU classification process or the separate rules in Hong Kong, Singapore and Taiwan.

Licence requirements depend on the service and its connection to the market

Exchange, custody and transfer services are not regulated through one universal VASP licence. The table summarises the entry routes for specified services, rather than treating every token project or wallet as a licensed business.

Market	Main route to check	What changes the answer
European Union	MiCA authorisation for crypto-asset service providers, or the permitted route for eligible existing financial institutions	The service must fit the authorisation or the institution’s Article 60 entitlement and notification requirements (Articles 59–60)
Hong Kong	SFC licensing for centralised virtual-asset trading platforms	Carrying on the covered platform business in Hong Kong or actively marketing it to Hong Kong investors can trigger the requirement (SFC)
Singapore	Payment Services Act licensing for covered digital payment token services, unless exempt	The domestic regime and the separate regime for Singapore-connected providers serving only overseas customers must be distinguished (MAS clarification)
Taiwan	AML registration for covered virtual-asset services under the current regime	A foreign-established business must first register a Taiwan company or branch. The enacted Virtual Asset Service Act awaits commencement (Money Laundering Control Act, Art. 6; new Act)

For Singapore-connected overseas-only providers, MAS says it will generally not issue licences under the separate digital-token service provider regime. That regime covers specified services involving digital payment tokens and tokens of capital-markets products; the clarification excludes services relating only to utility or governance tokens from that particular regime. Do not mistake this for an exemption from every other law, or a prohibition on overseas customers of providers licensed under Singapore’s domestic regimes (MAS).

Hong Kong’s platform rules should likewise not be extended automatically to every standalone custody or wallet service. The government’s 30 October 2026 statement described planned legislation for dealing, custody, advisory and management services. A legislative target is not a commencement date. Our Taiwan, Hong Kong and Singapore comparison gives the local service categories and current requirements in more detail.

MiCA white-paper exemptions and service authorisation are separate checks

For an EU public offer of a crypto-asset other than an ART or EMT, MiCA Article 4 sets the conditions, including white-paper requirements where applicable. The rule has exemptions. For example, certain white-paper-related requirements do not apply to an offer addressed to fewer than 150 persons per member state acting on their own account, or an offer whose total consideration does not exceed €1 million over 12 months. A separate exemption concerns offers solely to qualified investors where only such investors may hold the asset.

These are not blanket exemptions from MiCA. Other Article 4 exclusions have their own conditions. Communicating an intention to seek admission to trading prevents reliance on the exemptions listed in paragraphs 2 and 3. Check the intended distribution and trading arrangements before choosing the route.

Where a white paper is required, Article 8 provides for notification with an explanation of the asset’s classification. Competent authorities must not require prior approval of these white papers. Notification therefore does not amount to regulatory endorsement of the project.

Service-provider permission is a different question. Article 59 provides the general authorisation framework; Article 60 permits specified existing financial institutions to provide particular services subject to its conditions and notification procedure. A token issuer’s white paper does not itself authorise exchange or custody services.

The maximum grandfathering period for existing service providers ended on 1 July 2026. Member states could shorten or decline that period, and an earlier authorisation or refusal ended the protection sooner. A provider should no longer rely on that service-provider transition to operate, though MiCA contains other transitional provisions for different matters (Article 143).

EU transfer information applies to covered transfers at any amount

The EU transfer-of-funds regime covers crypto-asset transfers where the originator’s or beneficiary’s crypto-asset service provider, or an intermediary provider, has its registered office in the EU. It excludes person-to-person transfers without a crypto-asset service provider. Within scope, originator and beneficiary information is required without a general small-transfer exemption (Regulation (EU) 2023/1113, Arts. 2, 14 and 16).

For a transfer exceeding €1,000 to or from a self-hosted address, the relevant provider must also take adequate measures to assess whether the address is owned or controlled by its customer. The threshold is above €1,000, not €1,000 or more, and it is an additional ownership-or-control check rather than the point at which all information duties begin (EBA Travel Rule Guidelines, paragraph 82).

For a covered service, plan how to obtain and transmit the required data, assess counterparties and handle missing information before enabling transfers. Hong Kong, Singapore and Taiwan use different thresholds, fields and implementation scopes; the regional comparison sets those out separately.

Stablecoin issuance has separate permissions and different start dates

EU ARTs and EMTs use different issuer routes

MiCA’s ART provisions provide an authorisation route for eligible EU-established issuers and a separate route for credit institutions, with limited exemptions. EMT issuance generally requires a credit institution or electronic-money institution, together with the relevant white-paper requirements and subject to specified exemptions. Check the relevant route under Article 16 or Article 48; CASP authorisation does not itself permit stablecoin issuance.

The US GENIUS Act has a general effective date of 18 January 2027

The GENIUS Act, Public Law 119-27, was enacted on 18 July 2025. Section 20 uses the earlier of 18 months after enactment or 120 days after final implementing regulations are issued. The OCC’s 21 October 2026 final-rule bulletin identifies 18 January 2027 as the Act’s effective date. As of this review, enactment and the rule’s publication therefore should not be described as a stablecoin regime already in operation. Check the Act’s separate deadlines and the applicable issuer pathway when planning a launch.

Hong Kong separates regulated issuance from permission to offer stablecoins

The Stablecoins Ordinance took effect on 1 August 2025. Its licensing requirement concerns issuing specified fiat-referenced stablecoins in Hong Kong in the course of business, and issuing Hong Kong-dollar-referenced stablecoins outside Hong Kong in the course of business, subject to statutory exclusions and exemptions (HKMA licensing explanatory note).

Offering is a separate test. Subject to statutory conditions, permitted offerors may offer to retail investors only specified stablecoins whose issuance is authorised by an HKMA licence; other specified stablecoins may be offered only to professional investors (government explanation).

Taiwan awaits commencement; Singapore’s implementing legislation remains proposed

Taiwan’s Virtual Asset Service Act has been promulgated but has not commenced. Its stablecoin issuer licence will require FSC approval with central bank consent. The FSC’s 3 November 2026 announcement of stablecoin implementing drafts does not bring that regime into force.

Singapore’s 1 September 2026 consultation proposed legislation for its stablecoin framework, including single-currency stablecoins issued in Singapore and pegged to the Singapore dollar or a G10 currency. The comment period closed on 16 October 2026. The cited proposal does not provide a commencement date; it should not be presented as an open consultation or an operative issuer-licensing regime.

Resolve five launch decisions before choosing the company structure

Use this practical checklist to organise the legal and operational work:

1. Document what buyers receive. Record rights, redemption terms, profit claims and marketing statements; assess the asset and its offering in each target market.
2. Map each service and who controls it. Separate issuance, dealing, platform operation, custody and transfers. Identify the entity responsible for each activity.
3. Map the territorial connections. Record incorporation, operating locations, customer solicitation and distribution channels. Customer residence alone is not a complete licensing test.
4. Identify the required permission and controls. Distinguish white-paper notification, service authorisation, AML registration and issuer licensing. Check exemptions and effective dates, then plan the relevant customer checks, asset safeguards and transfer-data processes.
5. Choose the entity and banking arrangements. Use the regulatory map to decide where the operating and holding companies belong. Our offshore and holding-company service explains the entity-formation work.

Frequently asked questions

Does notifying a MiCA white paper mean the token is approved?

No. For crypto-assets other than ARTs and EMTs, Article 8 provides for notification and prohibits a prior-approval requirement for the white paper. The issuer or offeror must still meet the applicable obligations; the notification does not authorise separate crypto-asset services.

Do NFTs fall under MiCA?

Genuinely unique and non-fungible crypto-assets are excluded, but the label or a unique identifier alone is insufficient. Fractional interests and issuance as a large series or collection require closer analysis. A token may instead qualify as a financial instrument. Apply the substance-based assessment in ESMA’s final classification guidelines, Guideline 8.

Can a company outside the EU serve EU customers after 1 July 2026?

Do not rely on the expired service-provider grandfathering period. MiCA’s Article 61 has a narrow rule for a service initiated at the client’s own exclusive initiative. Solicitation of EU clients is inconsistent with that basis, and contract wording alone cannot turn solicited business into client-initiated service. Assess the actual acquisition process and permitted scope before relying on this route.