Token Legal Opinions: What Exchanges Actually Want to See

Token legal opinions sit inside a documentation stack, not on a 24-hour PDF mill.

‍

What a listing desk is sampling in August 2026

Counsel writes to a defined addressee. The letter states the facts counsel has been given or has assumed, the documents reviewed, the law of named jurisdictions, the conclusions counsel is willing to express, and the people who may rely. The American Bar Association’s Statement of Opinion Practices and the 2024 cross-border closing-opinion principles treat that form as professional judgment, as of the date of the letter, with no standing duty to update. A token memo uses the same hygiene. Medici’s Digital Assets /02 line covers a classification opinion, jurisdiction-specific analysis, regulatory-risk review, listing and investor diligence support, and an update when token mechanics change.

The desk that asked for the letter will open the facts schedule before the conclusion. If the schedule is thin, the conclusion is theatre. If the schedule describes a token that no longer matches the contract, the whitepaper, or last week’s tweet, the letter is dead. Classification of a token as utility, payment, governance, or security is a prior mapping exercise. This article pins that mapping to a dated fact set.

Medici’s Digital Assets FAQ records that the firm prepares token non-security and utility opinions for listings and fundraises. Treat that line as a product description. Venues and regulators still decide on their own files.

‍

Four desks, four jobs

A centralised exchange, a launchpad, a market maker, and a bank legal desk can request the same PDF and still do different work with it. Public listing pages, as of 18 August 2026, do not publish one private checklist that every named venue must follow. Prefer the venue’s category: a US platform, an EU crypto-asset service provider (CASP) operating a trading platform, a Dubai issuer under VARA. A mill table that assigns “Binance wants X, Coinbase wants Y” as if those lines were law is a sales page. Cite a public listing or legal-docs page, or stay at the category.

A US platform that takes US persons runs an internal securities analysis. Coinbase’s issuer FAQ states that a third-party legal opinion is optional, and that the venue will consider one if you attach it. Legal still examines whether trading would be a securities transaction. Incomplete tokenomics, governance, or technical documentation delay that review. Superuser privileges, live versus roadmap utility, and UBO identity sit on the intake form.

An EU CASP that admits a crypto-asset other than an asset-referenced token or e-money token to trading sits in a different instrument. Regulation (EU) 2023/1114 (MiCA) requires a crypto-asset white paper, notified to a national competent authority, published, and kept current. Kraken’s EEA listing pages, updated 14 January 2026, require that white paper in iXBRL, an explanatory note, and evidence of NCA submission at least 20 business days before the intended listing date. A private memo neither notifies an NCA nor appears on ESMA’s interim register.

A launchpad and a market maker inherit the venue’s risk. They ask whether they can show the same fact set to the CEX, the CASP, or the bank behind the pair, and whether TGE marketing contradicts the opinion. A bank desk asks whether the institution can onboard the issuer, hold the treasury, or run the fiat rail without treating the token as an unregistered security in the bank’s home law. Ksenia Babochkina, Commercial Director at Medici Expert, puts the banking version in one line: “Crypto companies don't get rejected by banks for being crypto companies. They get rejected for not being able to explain themselves clearly.” The opinion is one of the documents that has to do that explaining. Keep AML/CFT policies and onboarding files in the same pack.

‍

The exhibit file a desk opens first

Opinion hygiene that holds in any jurisdiction the letter claims to cover. Date: 18 August 2026. Confirm the live intake form of the venue you are filing with. A public page that omits an exhibit is not a mandate to invent one.

Facts schedule and client certificates

Counsel’s conclusions rest on facts counsel does not know first-hand. ABA opinion practice lets counsel rely on an appropriate source unless counsel knows the source is wrong. Common fail: schedule copied from a pitch deck. Legal conclusions (“the token is a utility”) dressed as facts.

Token mechanics at a named contract, chain, and block or date

The legal object is the instrument as it exists. Coinbase’s intake separates live utility from expected utility. Kraken pre-TGE approval is contingent on the final contract matching the version reviewed. Common fail: opinion describes v1 after an upgrade. No bytecode hash. No admin-key list.

Transfer restrictions, lockups, vesting

Restrictions change whether a holder can exit and whether a “utility” claim survives Howey’s profits prong. Common fail: vesting in the whitepaper, unrestricted transfer on-chain.

Rights to profit, assets, or redemption

Profit share, a claim on issuer assets, and par redemption pull a token toward a security, an ART/EMT, or a VARA Category 1 FRVA/ARVA. Common fail: “No rights” in the opinion; Discord promises a buyback.

Issuer identity, capacity, and corporate authority

Someone has to be the client. MiCA Article 4 requires a legal person for a public offer of a Title II crypto-asset. A bank needs a KYB file. Common fail: opinion addressed to “the Protocol.” Directors have not resolved the issuance.

Change-control: proxy admin, pause, mint, blacklist

Superuser functions are facts. Coinbase asks whether the contract has them. A later mint can kill a fixed-supply conclusion. Common fail: “Decentralised” in the letter; a three-founder Safe can still mint.

Public statements and marketing

Howey and MiCA both read the offer. Coinbase’s listing guide flags whitepapers, websites, and “to the moon” copy. VARA Marketing Regulations 2024 cover social posts, airdrops, and “educational” content that solicits. Common fail: opinion ignores Telegram. UAE-targeted ads omit capital-loss language.

Reliance language and addressees

A third-party opinion is for named recipients. Banks and venues will not put a “to whom it may concern” letter in the credit file. Common fail: letter forbids reliance by any listing venue, or invites the whole internet to rely.

Governing law and jurisdiction limit

The letter speaks the law of the places named. A Delaware Howey analysis does not decide MiCA. A DIFC memo does not decide VARA. Common fail: one paragraph labelled “global non-security opinion.”

Date, signature, and counsel standing

Opinions speak as of their date. ABA practice: no duty to update. A 2024 letter on a 2026 contract will be discarded. Common fail: unsigned PDF. Counsel not admitted in the governing law.

Alignment with whitepaper, tokenomics, and website

The file has to be one story. Kraken EEA pages require the MiCA white paper and an explanatory note in addition to the listing form. Common fail: opinion says no profit right; whitepaper sells “yield.”

Update trigger / change memo

Medici’s Digital Assets /02 product includes opinion updates when token mechanics change. Coinbase asks for three to four weeks’ notice of an upgrade. Kraken asks for 30 days’ notice of contract migrations or significant tokenomic changes after listing. Common fail: no stated trigger. Team treats the PDF as perpetual.

‍

A desk that cannot match those rows will send questions. Questions are cheaper than a listing that later has to be unwound.

‍

US platforms still run Howey on the offer, not on the screenshot

US platforms that take US persons run a securities analysis on the token and on the way you sold it. Coinbase publishes that review: whether trading the token on that venue would be a securities transaction in the jurisdictions where the venue operates. The Supreme Court’s decision in SEC v. W.J. Howey Co., 328 U.S. 293 (1946), still binds. On 17 March 2026 the SEC issued an interpretation, Release Nos. 33-11412 and 34-105020, effective 23 March 2026, that supersedes the 2019 staff Framework for “Investment Contract” Analysis of Digital Assets. The interpretation states that Howey remains the test. An opinion that cites only the withdrawn 2019 staff page, and ignores the 2026 Commission interpretation, is stale on arrival.

The Howey elements as a US-offer perimeter

The 2026 interpretation restates Howey as an investment of money in a common enterprise with a reasonable expectation of profits derived from the efforts of others. The Commission confirms, citing SEC v. Barry, 146 F.4th 1242 (9th Cir. 2025), that common enterprise is an element. The focus is the transaction: the offer, the sale, the resale, the promises that travelled with the token. Forman’s economic-reality rule still applies. A letter that analyses the ERC-20 in isolation, and skips Telegram, the SAFT, and the founder’s listing-and-reprice Spaces recording, has not done the Howey work.

The interpretation classifies crypto assets by function (digital commodities, collectibles, tools, stablecoins, digital securities) and then addresses how a “non-security crypto asset” may become subject to an investment contract, and how that contract may end when the issuer fulfils, fails, or otherwise terminates the essential managerial promises. Date the facts. Describe which promises are still live. A 2024 SAFT sale still happened. A later “utility” rebrand does not erase it. If the issuer will not offer into the United States, say so, and name the geo-blocks and transfer restrictions that make that statement true.

What a “not a security” sentence cannot do after 17 March 2026

The Commission’s 17 March 2026 press release (2026-30) states that most crypto assets are not themselves securities, and that an investment contract can come to an end. That sentence is the Commission’s taxonomy. A listing desk at a US platform will still ask whether this offer, this marketing, and this set of managerial promises create an investment contract today. Coinbase’s public position remains that it does not list securities. The optional third-party opinion is colour on that internal review.

Write the covered law in the first two pages. A Howey conclusion leaves MiCA, VARA, ART/EMT analysis, and the bank’s home statute for other instruments. If the addressee is an EU CASP, the Howey paragraph is a side memo and the white paper is the statutory filing. The Commission said the 2026 interpretation does not replace Howey. Profit, pooling, and the team’s ongoing role remain the test.

‍

EU CASP listing: the white paper is a different instrument

MiCA’s Title II white paper and a private token legal opinion are two documents. The white paper is a statutory disclosure under Articles 6, 8, 9 and 12 of Regulation (EU) 2023/1114. A national competent authority does not pre-approve a Title II white paper the way a prospectus is approved. ESMA’s interim register, last updated 18 August 2026, states that the papers listed have not been reviewed or approved by any competent authority; the offeror and/or issuer is solely responsible for the content. A private opinion from counsel neither notifies an NCA nor populates the register. For CASP duties, start with what MiCA means for every company and treat the opinion as a side instrument.

White paper, notification, and iXBRL

Article 4 of Regulation (EU) 2023/1114 bars a public offer of a crypto-asset other than an ART or EMT in the Union unless the offeror is a legal person, has drawn up, notified, and published a white paper, has handled marketing under Article 7, and meets Article 14 duties. Narrow exemptions exist, including an offer to fewer than 150 persons per Member State acting on their own account, and an offer whose total consideration over 12 months does not exceed EUR 1 000 000. Article 15 attaches liability for information in the white paper. Where a white paper is required, Article 7 bars marketing communications before it is published.

Commission Implementing Regulation (EU) 2024/2984 sets forms and templates. ESMA’s MiCA hub states that iXBRL formatting entered into application on 23 December 2025, with the XBRL taxonomy published on 5 August 2025. Kraken’s support article of 14 January 2026 matches that date. Kraken’s marketing get-listed page still says “since 23 December 2024”; treat ESMA and the January 2026 support article as the dual source, and confirm the live NCA portal before you file. Delegated Regulation (EU) 2025/421 adds Legal Entity Identifier and Digital Token Identifier fields. The project team drafts and notifies. Kraken publishes Article 5(4)(b) consent language so the CASP can use the paper without drawing up a second one.

ESMA Q&A 2654 (answer dated 14 October 2025) covers Title II tokens admitted to trading before 30 December 2024: offerors face marketing rules for communications after that date; trading-platform operators must ensure a white paper by 31 December 2027 where the Regulation requires one. Other Article 66(3) CASPs publish hyperlinks to existing registered papers. A 2023 token already on an EU book carries different ESMA obligations than a 2026 admission; the grandfathering timeline governs which version of the whitepaper duty applies.

Where a private opinion still sits beside Title II

A CASP’s legal desk may still ask counsel whether the token is a financial instrument under MiFID II, which would take it out of MiCA. ESMA’s guidelines on the qualification of crypto-assets as financial instruments are the public reference for that fork. The private opinion can walk that fork on stated facts. Title II still needs the white paper.

The same desk may sample marketing against Article 7, the offeror’s legal personality, and any Article 4(2) exemption claimed. A two-page “MiCA-compliant” stamp with no annex of the notified white paper will not close those questions. Kraken’s get-listed page quotes about two to six weeks from internal green-light to trading for most EVM tokens. That is the venue’s engineering and legal window, separate from counsel’s drafting window, and separate from the NCA’s 20 business days.

‍

Dubai issuers: VARA whitepapers and marketing overlays

A token issued in, or marketed into, Dubai sits under VARA on top of the issuer’s commercial licence. DIFC is carved out; the rest of the Emirate, including free zones, is in. Law No. (4) of 2022 established VARA. The issuance and marketing overlays are in the rulebooks. A private legal opinion can help a Licensed Distributor, a VASP counterparty, or a bank read the file. Category 1 still needs a licence and Whitepaper approval. The Marketing Regulations still bind copy that targets the UAE. Keep VARA licence categories and application timelines on the licensing pages; this section is the overlay that kills an opinion that pretends Dubai is “unregulated if the PDF is offshore.”

Issuance categories versus a counsel memo

The Virtual Asset Issuance Rulebook, current version effective 19 June 2025, splits issuance into Category 1, Category 2, and Exempt VAs. Category 1 covers fiat-referenced and asset-referenced virtual assets, plus others VARA designates, and is a VA Activity: licence plus, for each FRVA or ARVA, prior approval of that asset. Category 2 is any issuance that is not Category 1 and not Exempt. Category 2 needs no VARA issuance licence; placement must run through a Licensed Distributor; a Whitepaper and Risk Disclosure Statement still apply. Exempt VAs (non-transferable, redeemable closed-loop, and others VARA names) need no Whitepaper. If a change would move the asset into a heavier category, meet the new category’s requirements before the change takes effect.

Issuers other than Exempt VA issuers must publish the Whitepaper before making the asset available to the public, including any offer or Marketing. Updates must show the date. Prior versions stay accessible. Records run eight years from the date the asset leaves circulation. The ARVA Rules add a specific opinion hook: VASPs licensed to issue ARVAs shall provide VARA with a legal opinion from a duly registered practising lawyer confirming that reserve assets are legally segregated from the issuer’s estate, are not rehypothecated, and will not be subject to third-party recourse (Rules III.C.3 and III.C.4). The addressee is VARA. The facts are the reserve arrangements. An English-law “non-security” letter does not satisfy Category 1, does not legalise an unlicensed Category 2 distribution, and does not convert an FRVA marketing claim into a licensed product.

Marketing rules an opinion cannot paper over

The Regulations on the Marketing of Virtual Assets and Related Activities 2024 apply to all Marketing of Virtual Assets or VA Activities in or targeting the UAE, including by foreign entities. “Marketing” includes advertisements, social posts, events, airdrops, and educational content that solicits. Marketing of a VA Activity in or targeting the UAE may be carried out only by a VASP licensed by VARA for that activity, or on behalf of and approved by such a VASP. Anonymity-enhanced cryptocurrencies may not be marketed into the UAE. Marketing must be fair, clear, and not misleading, and must state that the owner can lose all money invested and does not benefit from financial protection.

A token legal opinion that ignores Telegram, the TGE landing page, and the KOL script is incomplete for a Dubai-targeted raise. A letter that concludes “utility, therefore market in the UAE without a VASP” contradicts the Marketing Regulations. If the issuer is outside the Emirate, conducts no VA Activity there, and does not market into the UAE, the overlay does not apply. Geo-targeting, Arabic copy, Dubai events, and UAE influencers are facts. Put them in the schedule or leave Dubai out of the covered jurisdictions.

UAE company formation and licensing is the entity and licence route when Category 1 or a VASP permission is in scope. The opinion is a later exhibit. Do not reverse the order.

‍

When the opinion dies

The letter dies when the facts change, the law named in the letter changes, or the addressee was never entitled to rely. ABA opinion practice is blunt: the opinion speaks as of its date; counsel has no duty to update. Listing desks treat that custom as a kill switch. Coinbase asks for notice of an upgrade at least three to four weeks in advance. Kraken’s get-listed FAQ asks for 30 days’ notice of contract migrations or significant tokenomic changes after listing, and reserves the right to pause or delist. A memo dated 12 March on a contract upgraded on 1 April is history. File a new letter.

Facts that kill a token memo in 2026: a new mint function or a raised cap; a pause or blacklist used in anger; a buyback or revenue-share announced after the date; a change of issuer without a new engagement; TGE marketing that re-opens Howey or MiCA Article 7; a US offer the letter assumed would not happen. VARA’s issuance rulebook requires the issuer to meet a heavier category before a change that would trigger it. Write the trigger list into the engagement. Medici’s Digital Assets /02 line includes opinion updates when token mechanics change because the first PDF is the dated file, and the dated file goes stale.

Law can kill the letter without a code change. The SEC’s 17 March 2026 interpretation superseded the 2019 staff Framework. A US-offer opinion that still leads with the withdrawn Framework tells the desk that counsel stopped reading in 2019. Counsel should confirm that the covered-law section still names the instruments in force.

Reliance language kills letters in the credit file. A bank will not hold a letter that forbids the bank to rely. A venue will not treat a letter addressed only to the issuer as a third-party opinion. Name the addressees in the engagement. If the launchpad, the market maker, and the CEX all need to rely, say so before counsel writes, or expect three letters.

‍

Clock, stack, and who should wait

Medici’s Digital Assets page times a full Web3 documentation package at two to six weeks, depending on complexity. A basic package of tokenomics, whitepaper, and policies is faster. Full fundraising and listing support takes longer. The token legal opinion sits inside that stack. The Compliance page’s “legal opinion, usually one to two weeks” is a different product line. Keep those clocks separate. Keep “20+ licenses secured” separate from “100+ licenses delivered”; they are different marketing figures on different blocks.

Counsel needs an issuer that exists, a contract frozen enough to hash, tokenomics that match the bytecode, marketing that can be collected, and a decision on covered jurisdictions. Nataly Medici, Managing Partner and CEO, states the grouping on the Digital Assets page: “Entering a regulated market is not just about registering a company or applying for a license. Your entity, business model, banking setup, compliance framework and jurisdictional logic must work together from day one.” An opinion written before the issuer exists, or after marketing has contradicted the facts schedule, wastes the weeks.

Wait if you have not chosen the issuer vehicle, if mint authority still moves every sprint, or if you want one “global non-security certificate” for a US offer, an EEA admission, and Dubai marketing. The product fits a project that has a legal person, a frozen contract candidate, written tokenomics, and a named addressee. The query token legal opinion buys that file.

‍

FAQ

Does a token legal opinion get the token listed?

Coinbase’s issuer FAQ treats a third-party opinion as optional colour on an internal legal, compliance, and security review. Kraken’s EEA pages require a MiCA white paper for admission in the EEA; filing that paper still leaves the listing decision with the venue. A private memo is one exhibit.

Does a MiCA white paper replace a legal opinion?

The white paper is a statutory disclosure under Articles 6, 8 and 9 of Regulation (EU) 2023/1114, notified to an NCA and, from 23 December 2025, filed in iXBRL. A private opinion is counsel’s judgment on stated facts and named law. An EU CASP may want both.

When does a token legal opinion stop being usable?

On a change to the facts the letter assumed: mint, pause, new rights, new issuer, new marketing, a US offer the letter excluded. On a change to the covered law that the letter’s conclusions rest on. ABA opinion practice treats the letter as speaking as of its date. Listing desks treat a stale letter as dead. Budget an update.

Can one letter be reused for every venue?

Only if every addressee is named, every covered law is the law that venue cares about, and the facts have not moved. A Delaware Howey memo does not notify an EU NCA. A MiCA white paper does not decide a US-platform securities review. Name the addressees before drafting.

How much does a token legal opinion cost?

Search pages still ask “how much is a legal opinion.” Mills advertise cheap PDFs. Medici does not publish a menu price for this SKU. The Digital Assets page times a full Web3 documentation package at two to six weeks, with a basic tokenomics-whitepaper-policies set faster. Price follows scope and covered jurisdictions.

What if we already sold the token and now want a “non-security” letter?

The opinion has to describe the sale that already happened. The SEC’s 2026 interpretation allows an investment contract to end when essential promises are fulfilled, fail, or terminate. That end-point leaves a completed US offer on the record. Counsel who writes “never a security” over a 2024 SAFT book is not helping the desk.