Token Classification: Utility, Payment, Governance, Security

What does a classification test ask?

A reviewer who has to live with the answer (exchange counsel, a competent authority, a bank MLRO) starts with the holder, not the brand.

Can the holder demand a specified good or service from a named issuer, and does that good or service exist today? Can the holder transfer the unit to a stranger, or only back to the issuer? Can the holder redeem at par, against a reserve, or against an identified asset? Can the holder vote on corporate organs (board, merger, capital) or only on protocol parameters (fee, upgrade)? Can the holder claim profit from someone else’s managerial efforts, or from a contractual yield, a dividend, or a liquidation surplus?

Those answers sit in the token terms, the contract permissions, the issuer’s constitution, the sale, and the use after sale. Ksenia Babochkina puts the same demand on the banking side: crypto companies do not get rejected by banks for being crypto companies. They get rejected for not being able to explain themselves. Classification is that explanation, written as rights.

A VASP or CASP licence is a different product from token classification. The licence answers who may exchange, custody, transfer or advise as a business. Classification answers what the unit is. You can need both. UAE company formation and licensing maps the activity permission. Token legal structuring maps the unit.

FATF’s 2021 Updated Guidance, the definition the 2025 Targeted Update still works from, treats a virtual asset as a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes, and carves out digital representations of fiat, securities and other financial assets covered in the Recommendations. That is an AML overlay. It does not decide whether the unit is a transferable security under MiFID II.

‍

What rights does a utility token give the holder?

A utility token is a claim to use something the issuer supplies: a feature, a seat, a discount. Regulation (EU) 2023/1114 Article 3(1)(9) defines a utility token as a type of crypto-asset that is only intended to provide access to a good or a service supplied by its issuer. That sentence is a definition. Recital 18 of the same Regulation splits the crypto-assets that stay inside MiCA into three types: e-money tokens, asset-referenced tokens, and other crypto-assets. A live utility token that is not a financial instrument maps to the third type. ESMA’s March 2025 guidelines, applicable from 18 May 2025, tell competent authorities to finish the financial-instrument test first.

Access that already exists versus access still on a roadmap

Article 4(3)(c) of MiCA carves out an offer of a utility token that provides access to a good or service that exists or is in operation. Article 4(6) caps a public offer of a utility token for goods or services that do not yet exist at twelve months from the date the white paper is published. Recital 30 says that cap is about the offer, not about the date the product later goes live. Recital 26 keeps a limited-network exemption for tokens used only in a closed set of merchants under contract with the offeror.

Those are Title II offer rules for crypto-assets other than ARTs and EMTs. They are not a permit to promise yield or a claim on profits and keep the utility heading. ESMA paragraph 23 is the clean case: access, premium content or a discount, with no dividend or interest and no class-of-securities element, should not be qualified as transferable securities even if some buyers hoped the price would rise. If the holder’s enforceable right is a transferable claim that behaves like a pre-sale of equity while the product is a slide deck, the facts have left that case. Collect product status, delivery and refund mechanics, and classify those documents.

What the whitepaper heading does not decide

Issuers print “utility token” on page one and treat the heading as the analysis. ESMA Guideline 9 tells competent authorities to prioritise inherent attributes over labels, in particular where functions evolve after launch. MiCA Article 6 and Annex I still require a description of rights and of the risk that a utility token may not be exchangeable against the promised good or service if the project fails.

A heading that says utility, a public channel that sells price appreciation, and a term that lets the issuer change mint-and-burn without a holder vote, are three files. Classification follows the file a stranger can enforce. Token legal structuring starts there, not with a search-and-replace on the cover.

‍

When is a token a payment instrument?

Payment is a use, not a MiCA heading called “payment token.” Card-network payment tokens (a PAN substitute at checkout) are a different industry. Discard that sense.

Inside MiCA, a unit that purports to maintain a stable value by referencing one official currency is an e-money token (Article 3(1)(7)). A unit that purports to maintain a stable value by referencing another value or right, or a combination, including one or more official currencies, and that is not an EMT, is an asset-referenced token (Article 3(1)(6)). Titles III and IV then apply: authorisation, reserve, redemption. A unit used as a medium of exchange without a peg stays in “other crypto-assets” if it is not a financial instrument.

Dubai Law No. (4) of 2022 defines a Virtual Asset as a digital representation of value that may be digitally traded, transferred, or used as an exchange or payment tool, or for investment purposes. VARA inherits that definition. It is wide. It does not sort EMT from ART from a bearer unit used at a till. VARA’s power to classify (Regulations Part II B) includes treating a Virtual Asset as regulated by the CBUAE. A unit whose job is “always one dirham, always redeemable” sits in a payment-issuer perimeter. Confirm the live CBUAE instrument before you file. This article does not map that licence.

If the same token pays a yield funded by the issuer’s treasury, you have a second nature. Read the hybrid section before you pick the lighter heading.

‍

What does a governance token let the holder vote on?

Governance is a bundle of voting rights. The legal question is which organ the vote moves.

ESMA paragraph 22 splits two families. Votes on a company’s decision-making (electing board members, approving mergers) track rights associated with shares. Votes on technical or operational matters (protocol upgrades, fee adjustments) that give the holder no influence over corporate governance do not confer rights equivalent to shares. Paragraph 62 repeats the point for utility tokens that also carry governance: the design is compatible with MiCA if the token does not replicate transferable-security rights in MiFID II Article 4(1)(44). A mere expectation of profit is not, on its own, enough to make the unit a financial instrument under that overlay.

Write down the proposal types, the quorum, who can table a proposal, and whether a passed vote binds a company with directors and a share register or only a protocol parameter. A “DAO” label does not answer this. If the token elects the issuer’s directors, approves a dividend, or blocks a sale of the operating company, you are in share-like territory in the EU analysis. If it adjusts a fee on a functioning protocol and cannot touch the issuer’s constitution, you remain inside other crypto-assets, subject to the rest of the facts.

US offers use a different overlay. The SEC’s 17 March 2026 interpretive release (Release 33-11412) treats some native units of a functional crypto system as digital commodities that may convey governance rights over that system without, on those facts, being securities in themselves. That is a US-offer perimeter. It does not rewrite MiFID.

‍

When does a token leave crypto-asset rules for securities rules?

A security token, in the sense this article uses, is a unit whose rights match an existing securities or investment-contract perimeter in the place you offer it. The chain, the ticker and the word “token” do not move that perimeter. MiCA Article 2(4)(a) puts crypto-assets that qualify as financial instruments, as defined in MiFID II, outside MiCA. ESMA’s guidelines exist because Article 2(5) told ESMA to specify that line by 30 December 2024. Official translations went up on 19 March 2025. The guidelines apply from 18 May 2025. The live reading in August 2026 is substance over form: same rights, same rules, whatever the ledger. Tokenisation of a share leaves you with a share.

EU transferable-security overlay under MiFID II

ESMA’s three-limb test for a transferable security is cumulative: not an instrument of payment; a class of securities; negotiable on the capital market. Classes include shares and equivalent, bonds and other securitised debt, and other securities giving a right to acquire or sell such instruments or a cash settlement determined by reference to them. A token that pays regular interest and promises repayment of principal tracks a bond. A token that tracks a share or is a right to acquire one is a strong indication of security-equivalence if it is a class and negotiable.

Negotiability is the abstract possibility of transfer, even with no venue yet and even with a temporary lock-up. A whitelist, on its own, does not kill the limb. Transfer only back to the issuer can. Take restrictions case by case.

If the unit is a financial instrument, MiCA’s Title II white-paper path is the wrong path. MiFID and, where an offer of securities to the public is in scope, the Prospectus Regulation apply. Venue and custody follow that perimeter. The classification question stops at whether these rights belong in that stack.

US Howey as a perimeter for US offers

For an offer into the United States, start with SEC v. W.J. Howey Co., 328 U.S. 293 (1946): an investment of money in a common enterprise with a reasonable expectation of profits from the efforts of others. Release 33-11412, issued 17 March 2026 and published in the Federal Register on 23 March 2026, is the Commission’s live interpretation of how that test meets crypto assets. It does not replace Howey. It supersedes the staff’s 2019 Framework. The Commission groups crypto assets as digital commodities, digital collectibles, digital tools, stablecoins, and digital securities, then asks when a non-security crypto asset is offered as part of an investment contract.

That is a US-offer screen. A token that is “other crypto-assets” under MiCA can still be offered in the United States as part of an investment contract if the sale is sold that way. A US commodity characterisation does not pull a share-like token out of MiFID. Classify per offer path.

‍

Four legal natures compared, 18 August 2026

Working map, dated 18 August 2026. Each nature is a product-design label: the rights a holder can enforce, the perimeter those rights meet this year, and the fail that collapses the nature. Confirm the live instrument before you file. A hybrid takes the stricter nature.

Utility

The holder can demand access to a specified good or service the issuer supplies. No dividend, interest, or claim on profits, capital or liquidation. Transfer may exist; transfer alone does not create the security nature. Perimeter: MiCA Art. 3(1)(9) definition; maps to “other crypto-assets” (Recital 18, Title II) after the financial-instrument test fails. ESMA para 23. Offer caps: Art. 4(3)(c) existing product; Art. 4(6) twelve months if not live. US: may align with a “digital tool” in Release 33-11412 if there is no investment-contract sale. Common fail: cover says utility; sale promises profit from the team’s work; product is a slide deck.

Payment

Transfer as a medium of exchange. Where the statute gives it, redeem at par or against a named reserve. No equity claim. Perimeter: MiCA EMT if pegged to one official currency (Art. 3(1)(7), Title IV); ART if pegged to another value or basket (Art. 3(1)(6), Title III); otherwise “other crypto-assets” if used as pay without a peg. Dubai Law 4/2022: VA may be an exchange or payment tool. VARA may point a unit to CBUAE. Common fail: whitepaper says “payment token”; yield paid from issuer treasury; no testable redemption.

Governance

Vote on listed proposal types. Protocol-parameter votes stay off the share limb. Votes that elect directors, approve mergers or move capital track share-like rights. Perimeter: MiCA “other crypto-assets” if the vote is technical (ESMA para 22 and 62). Share-equivalent votes enter the MiFID transferable-security test. US: governance over a functional crypto system can sit on a digital commodity (33-11412); corporate votes are a different fact pattern. Common fail: token named “gov”; snapshot vote can replace the issuer’s board; no share register.

Security

Claim on profits, capital, liquidation surplus, or repayment of principal plus yield; or a right to acquire or cash-settle against such an instrument; offered as an investment contract in a US path. Perimeter: EU financial instrument under MiFID II; out of MiCA (Art. 2(4)(a)). ESMA three-limb test; bond-like and share-like examples in the 2025 guidelines. UAE: DFSA Investment Tokens / Security Tokens in DIFC, FSRA Digital Securities in ADGM, or the federal capital-markets supervisor. US: Howey plus Release 33-11412. Common fail: “Security token” as a badge on a unit with no economic right; or a share-like token sold as Title II MiCA.

‍

A fifth informal heading, “hybrid,” is not a statutory class. Two natures can be live at once. ESMA Guideline 9 tells you to finish the financial-instrument test first.

‍

A token that is more than one thing

Most live designs mix functions: access plus a vote, a peg plus a discount, a vote plus a claim on fees. Founders want a single word for the slide. A reviewer who has to sign an opinion, a listing memo or a bank file will not give them one if the rights conflict. ESMA’s hybrid guideline is the cleanest official statement of the rule this article started with. You classify the combination as it exists in the terms and in the way the unit is sold. Then you apply the heavier overlay to the whole unit until the rights that created that overlay are gone from the design. A later change of mechanics is a new classification, not a footnote.

ESMA hybrid precedence

Guideline 9, in the March 2025 ESMA text applicable from 18 May 2025, tells competent authorities and market participants to evaluate first whether a crypto-asset with hybrid characteristics meets the criteria of a financial instrument. If it does, that nature takes precedence, before alternative classifications such as utility tokens. Recital 9 of MiCA is the statutory hook: crypto-assets that qualify as financial instruments stay under the existing financial-services acts.

The same guideline tells you to look at inherent attributes over issuer labels, and to watch functions that change during the life of the token. A unit that launches as access-only and later pays a protocol fee to holders as if it were a coupon has changed class in fact. Update the file when the mechanics change.

Payment plus utility, governance plus profit

A token that opens a feature and also purports to hold a euro peg is an EMT analysis first. A token that votes on a fee and also distributes that fee to holders as a yield needs the security-limb questions in the Security nature above. ESMA paragraph 62 is limited: a utility token may carry governance, and a profit expectation is not in itself enough for MiFID. “Not in itself enough” is not a free pass. If the token’s design pays that profit as a right against the issuer, you have left paragraph 62’s example.

US Release 33-11412 draws a similar line in different words. A non-security crypto asset becomes subject to an investment contract when the issuer offers it by inducing an investment of money in a common enterprise with representations or promises of essential managerial efforts from which a purchaser would reasonably expect profits.

‍

How MiCA’s three types sit next to the four natures

Recital 18 of Regulation (EU) 2023/1114 lists three types inside MiCA, based on whether the unit seeks to stabilise its value: e-money tokens, asset-referenced tokens, and other crypto-assets. Utility token is a defined subset of crypto-asset (Article 3(1)(9)). Governance is not a MiCA heading. Security, in the MiFID sense, is outside MiCA.

Payment-nature with a single-currency peg maps to EMT. Payment-nature with a basket or other referenced value maps to ART. Utility-nature and protocol-governance-nature, after the financial-instrument test fails, map to other crypto-assets. Security-nature leaves MiCA for MiFID.

What MiCA means for every company is the firm’s live explainer of the Regulation as a whole. This page is the classification fork in front of that explainer.

‍

UAE: VARA activity licence versus token rights

VARA licenses Virtual Asset activities in Dubai, including free zones, excluding DIFC. The Virtual Assets and Related Activities Regulations 2023, HTML in force 19 June 2025, list those activities in Schedule 1, among them Advisory, Broker-Dealer, Category 1 VA Issuance, Custody, Exchange, Lending and Borrowing, VA Management and Investment, and VA Transfer and Settlement. Law No. (4) of 2022 gives VARA power to classify types of Virtual Assets. The Regulations Part II B restates that power: prohibited, regulated by the CBUAE, or an interpretation.

None of that is a four-box statute labelled utility / payment / governance / security. You still do the rights test. Then you ask which VA Activity, if any, you will carry on in the Emirate.

A security-nature token leaves that room. In DIFC, a Token that falls inside the definition of an Investment (a Security or a Derivative) is an Investment Token under the DFSA Rulebook. A Security Token is an Investment Token whose rights are substantially similar in nature, purpose or effect to Securities. The DFSA Crypto Token regime (rules in force 12 January 2026) is a separate track: firms that use Crypto Tokens in Financial Services must document suitability under GEN 3A.2.1. A suitability memo is not a substitute for the Investment Token analysis.

In ADGM, the FSRA deems a digital token that exhibits the characteristics of a Security to be a Security. Digital Securities are deemed Securities under section 58(2)(b) of the Financial Services and Markets Regulations 2015. The June 2025 Virtual Asset Activities guidance (VER07.100625) tells you to read that together with the Digital Securities guidance.

Federal AML law lists VASP activities in Cabinet Resolution No. (134) of 2025 Article 4: exchange between virtual assets and fiat, exchange between virtual assets, transfer, safekeeping or administration, financial services related to an issuer’s offer or sale, plus a residual. That list is an activity list. Crypto compliance in 2026 is the operating AML map. This page does not retell it.

‍

What belongs in the file before anyone classifies

Nataly Medici tells clients that entering a regulated market is not a company registration plus a licence application. The entity, the business model, the banking setup, the compliance framework and the jurisdictional logic have to work together from day one. Classification is one piece of that stack. It fails if the token terms, the company constitution and the sale process tell three stories.

‍

Put in the file, as of August 2026:

The token terms and any later amendment log: who can mint, burn, pause, upgrade, seize, and who can change those permissions.

The holder rights in one table: access, transfer, redeem, vote (proposal types), economic claim, each tied to a clause. A right that exists only in a blog post does not exist.

The issuer entity: share register, directors, who signs the white paper, which company holds the treasury wallet.

The sale process: who was solicited, in which country, with which promises, for which consideration. Howey and MiCA both care about the offer.

The product status: live good or service, a twelve-month MiCA offer clock, or a security-offer path.

The transfer design: negotiable, whitelist, lock-up, transfer only back to issuer. ESMA treats these as facts for the negotiability limb.

A jurisdiction map for the offer, the issuer seat, and any UAE activity. List the overlays that can attach (VARA activity, DFSA Investment Token, FSRA Digital Security, MiCA Title II or III/IV, MiFID, US investment-contract analysis) with a one-line reason.

A Medici Web3 documentation package (tokenomics, white paper, policies) lands in two to six weeks. Basic packs sit at the short end. Full fundraising and listing packs sit at the long end. That is a documentation clock from the live Digital Assets page, not a regulator SLA.

‍

FAQ

Can a token be both a utility token and a security token?

Yes. Access to a service can sit next to a claim on profits, a bond-like yield, or a US investment-contract sale. ESMA Guideline 9 tells you to finish the financial-instrument test first. The lighter heading does not cancel the heavier overlay.

Is “utility token” a separate class under MiCA?

No. Recital 18 of Regulation (EU) 2023/1114 lists three types inside MiCA: e-money tokens, asset-referenced tokens, and other crypto-assets. Article 3(1)(9) defines a utility token as a crypto-asset intended only to provide access to a good or a service of the issuer. That definition sits inside “other crypto-assets” once the unit is not a financial instrument.

Does a VARA licence tell me what my token is?

No. VARA licenses Virtual Asset activities (Schedule 1 of the 2023 Regulations) and may classify a Virtual Asset as prohibited, as CBUAE-regulated, or by interpretation. The licence is an activity permission. Token classification is a rights test. A security-nature token is a DFSA Investment Token question in DIFC or an FSRA Digital Securities question in ADGM, not a VARA category picker.

What is an example of a security token?

A token that pays holders a contractual yield and promises repayment of principal tracks ESMA’s bond-like example. A token that confers votes on the issuer’s board and a claim on profits tracks share-like rights. A US offer of a non-security unit sold on explicit promises of the team’s essential managerial efforts can still be an investment contract under Howey and Release 33-11412. Hardware MFA fobs are a different meaning of “security token.”

Does a governance token make holders shareholders?

Only if the vote moves corporate organs: directors, mergers, capital, liquidation. ESMA paragraph 22 treats protocol-upgrade and fee votes, with no influence over corporate governance, as distinct from share-equivalent voting. Read the proposal catalogue and the company constitution. A “DAO” label does not create or destroy share rights.

Does FATF classify my token as a security?

No. FATF’s virtual-asset definition is an AML/CFT overlay. It covers units used for payment or investment and excludes digital representations of securities already covered elsewhere in the Recommendations. Use it to design CDD, Travel Rule and VASP registration. Use MiFID, Howey or the UAE capital-markets supervisor for the securities question.

How long does a classification file take to assemble?

A basic Web3 documentation pack (tokenomics, white paper, policies) sits at the short end of a two-to-six-week window. A full fundraising and listing pack sits at the long end. Those figures are documentation clocks from Medici’s Digital Assets page as of 18 August 2026. They are not a regulator’s service level.

Is a CASP authorisation under MiCA the same as classifying the token?

No. CASP authorisation is a service permission (custody, exchange, trading platform, advice). Token classification decides whether the unit is an EMT, an ART, another crypto-asset, or a financial instrument outside MiCA. You can hold a CASP licence and still offer a unit that needs a prospectus.