A token is treated as a security or investment when, in substance, holders buy it expecting a financial return generated by others, through profit sharing, revenue rights, redemption or similar features. A utility token gives access to a product or network function and is bought to be used. Labels do not decide it: regulators look at the rights, the economics and the marketing together.
Why classification comes first
Every downstream decision in a token launch inherits the classification. A security token needs a securities route: a prospectus or an exemption, distribution restrictions and, in many places, licensed intermediaries. A utility token can be sold far more freely, but only while its design and marketing stay consistent with what it is. Exchanges ask for a legal opinion on exactly this question before listing, which is why we treat classification as a design input rather than a box ticked at the end. See token legal opinions for exchange listings.
Features that pull toward security status
- Profit or revenue participation, whether paid in fiat, stablecoins or more tokens.
- Redemption rights or asset backing that let holders exchange tokens for a share of a pool of assets or cash.
- Fund-like or index-like economics, where the token's value tracks a managed portfolio.
- Buyback and burn programmes marketed as returns, rather than run as treasury policy.
- Staking yields framed as investment income rather than as payment for network services.
- Marketing that promises price appreciation, listings or returns, including what founders say in community channels.
Features that point toward utility
- The token is needed to use a product or network that exists, or will exist at a defined point, rather than an idea.
- Governance rights that steer the protocol without carrying a share of profits.
- Consumptive demand: holders buy to use, not to hold.
- Sale terms, whitepaper and website that consistently describe use, not returns.
No single feature is decisive. The analysis weighs the whole package, and one badly drafted clause or one founder's post can outweigh a carefully designed token.
How the BVI tests it
For a BVI issuer the question is whether the token falls within the investment definitions in the Securities and Investment Business Act, which were modernised for digital assets in January 2025. A token outside them is not an investment, and issuing it is outside the VASP Act's registrable perimeter. A token inside them brings SIBA's rules on offering and dealing. See why tokens launch from the BVI.
How the UAE tests it
In the UAE the classification decides which regulator is in charge. Virtual assets that are not securities sit with VARA in Dubai and, federally, with the Capital Markets Authority's virtual asset framework outside Dubai. Tokens that are securities belong with the securities regulators: the CMA federally, the DFSA in the DIFC and the FSRA in ADGM. Real-world asset tokens issued from Dubai under VARA's Category 1 have their own path: see the VARA Category 1 guide.
Investors' markets apply their own tests
A token sold globally is classified in every market where it is offered, under that market's own law. The issuer's jurisdiction does not export its answer. That is why sale terms restrict participation from markets where the token would be a security, and why those restrictions must actually be enforced at onboarding rather than only written down.
Doing it properly
The working document is a short classification memorandum written before the whitepaper and sale documents are drafted, so that the token's rights, the documents and the marketing all say the same thing. It then becomes the backbone of the listing opinion. Neo Legal prepares both as part of a token issuance engagement.
Frequently asked questions
What is the difference between a utility token and a security token?
A utility token gives access to a product or network function and is bought to be used. A security token gives holders a financial return generated by others, such as profit, revenue or redemption rights, and is regulated as a security or investment. The classification follows the token's substance and the way it is sold, not its label.
Can a utility token become a security?
Yes. Adding revenue sharing or redemption features, running buybacks marketed as returns, or promoting the token as an investment can move a token into securities territory even if it was designed as a utility token.
How is a token classified under BVI law?
The test is whether it falls within the investment definitions of the Securities and Investment Business Act, modernised for digital assets in January 2025. Tokens outside them are not investments; tokens inside them bring SIBA's offering and dealing rules.
Who regulates security tokens in the UAE?
The securities regulators: the Capital Markets Authority federally, the DFSA in the DIFC and the FSRA in ADGM. Virtual assets that are not securities sit with VARA in Dubai and the CMA's virtual asset framework elsewhere onshore.
Are governance tokens securities?
Not usually, where they carry governance rights only. Governance tokens that also carry a share of protocol revenue or other economic rights need careful analysis, because the economic rights, not the governance label, drive the classification.
When should a token's classification be settled?
Before the whitepaper and sale documents are drafted. Classification determines what the documents may say, and the exchange listing opinion will later analyse the same facts.
This article is general information on the position at the date shown and is not legal advice. Token classification and licensing turn on the specific facts of each project; speak to us before relying on it.
