A token launch looks, from a fund's data room, like a single event: a generation event, a listing date, a circulating-supply number. It is actually several separate legal acts stacked on top of each other, each with its own consideration, its own counterparty and, increasingly, its own regulator. Treating the launch as one event is how diligence misses the risk that sits inside it. None of what follows is legal, tax or investment advice.
How a token launch is structured
Private sales and SAFTs
Most projects still raise before a token exists, using a Simple Agreement for Future Tokens or an equivalent forward purchase contract: cash today for tokens delivered on a future generation event. The structure was built on the theory that the SAFT is a security sold under a private-placement exemption, while the tokens delivered later, once a network is "functional", are not. Two federal courts in the Southern District of New York declined to treat the stages separately: in SEC v. Telegram Group Inc. in March 2020, and on 30 September 2020 in SEC v. Kik Interactive Inc., where the court held that Kik's private presale and its public distribution of Kin formed a single unregistered securities offering. The SEC's 2026 interpretation, discussed below, reaches a related result by a different route: a SAFT sale takes place when the agreement is signed, and the tokens are subject to an investment contract from that moment, whenever they are delivered. Where that early capital comes from, and which projects can still raise it, is covered in our review of what still gets funded in web3.
Public sales
A public sale offers tokens for cash to a general audience, on the project's own site, through an exchange's launch platform or at the point of listing. Because a public sale that looks like an investment contract is the fact pattern regulators have already litigated, those that do take place are commonly capped and geo-restricted. That is a compliance response to the analysis below, not a separate legal category.
Airdrops and points programmes
An airdrop distributes tokens for no cash consideration, commonly by snapshotting past activity, an on-chain balance, a testnet interaction or a "points" score, and allocating tokens against it after the fact. Points programmes run the same mechanic before the token exists: users accrue an off-chain score for using a product, with an implicit or explicit expectation that a future token will be distributed against it. Whether the terms were announced before or after users acted is the feature the US interpretation now turns on.
Market-maker arrangements at launch
Listed launches are commonly accompanied by a market-maker agreement, typically either a retainer or a token loan paired with a call option struck against the loaned tokens. The strike, the loan size as a share of circulating supply, and whether the same firm is also paid by the exchange belong on a diligence checklist rather than in a side letter. How these arrangements are priced and structured is covered separately and is not repeated here.
Vesting and unlock schedules
Team, investor and foundation allocations are released on a schedule, commonly a cliff followed by linear vesting. Research published by the market maker Keyrock in December 2024, covering more than 16,000 unlock events across 40 tokens, found that 90% of unlocks produced negative price pressure, with the effect typically beginning around 30 days before the unlock date. The size of an unlock relative to circulating supply, and whether it is a cliff or a linear release, are the variables that determine how much of that pressure a holder faces.
Listing on an exchange
Listing converts a privately or thinly traded token into one with continuous public pricing. It is where the market-maker agreement, the unlock schedule and any unresolved securities question become visible at once, and in the EU it is also the point at which the white paper exemptions described below stop applying.
What regulators have said, and when it applies
The EU: MiCA's white paper duty is in force
Title II of Regulation (EU) 2023/1114 (MiCA) has applied since 30 December 2024. Article 4 prohibits a public offer of a crypto-asset, other than an asset-referenced or e-money token, in the EU unless the offeror has drawn up, notified and published a crypto-asset white paper meeting the content rules in Article 6. Article 4(2) exempts offers to fewer than 150 persons per member state, offers with total consideration under €1,000,000 over twelve months, and offers made solely to qualified investors. Article 4(3) takes free offers, validation rewards, certain utility tokens and limited-network tokens outside Title II altogether. Article 4(4) switches all of those exemptions off where the offeror makes known in any communication an intention to seek admission to trading, which is the moment most launches reach an exchange. Unlike a securities prospectus, the white paper is notified to a national regulator rather than approved by one.
A second constraint bites on access rather than content. A firm outside the EU may serve an EU client without MiCA authorisation only where the client approached it entirely on its own initiative. ESMA's guidelines on this reverse-solicitation exemption, published on 17 December 2024, say it must be understood as very narrowly framed. The transitional periods for firms operating under national regimes ended on 1 July 2026, and ESMA has stated that unauthorised firms may no longer serve EU clients.
The US: an enforcement-led area now has an interpretation
US token analysis rests on the Supreme Court's 1946 Howey test and, until this year, was built largely from enforcement actions, speeches and the SEC staff's 2019 investment-contract framework. On 17 March 2026 the SEC issued an interpretation, Release No. 33-11412, in which the CFTC provided accompanying guidance; it took effect on 23 March 2026 on publication in the Federal Register. It expressly supersedes the 2019 staff framework and sorts crypto assets into five categories: digital commodities, digital collectibles, digital tools, stablecoins and digital securities. It is an interpretation, not a statute: it does not replace the Howey test, it does not bind a court, and the SEC has invited comment and said it may refine, revise or expand it.
On airdrops, the release says that where recipients give the issuer no money, goods, services or other consideration in exchange for a non-security token, the "investment of money" element of Howey is not met, and the issuer need not register the distribution. Activity completed before the airdrop was announced does not count as consideration. If recipients must meet further conditions after the announcement, such as buying an asset, buying a product or performing a task, the interpretation does not cover that airdrop, which leaves an announced points programme outside its protection. The release also notes that an airdropped token can later become subject to an investment contract created by other transactions, in which case a recipient's secondary sale is a securities transaction needing registration or an exemption.
On SAFTs, the release treats the sale as occurring when the agreement is signed. The tokens stay subject to the investment contract after delivery until purchasers would no longer reasonably expect profit from the issuer's promised efforts, for example once the issuer has publicly disclosed that it has completed them. The release also addresses protocol mining and protocol staking, but it does not address vesting schedules or market-maker agreements, so those still depend on the general analysis.
Enforcement, as the record shows it
The clearest sale-versus-venue distinction in US case law came from SEC v. Ripple Labs. In 2023 the district court held that Ripple's institutional sales of XRP were unregistered securities offerings while its programmatic sales on exchanges were not, because exchange buyers could not know whether their money went to Ripple. The court later imposed a $125 million civil penalty and an injunction on institutional sales. In 2025 the parties sought to reduce the penalty to $50 million and lift the injunction; the court declined, and on 7 August 2025 both sides dismissed their appeals, leaving the $125 million penalty and the injunction in place.
Geofencing, and its cost
Because the US analysis has turned on who is buying and how, many issuers exclude US persons from airdrops and sales, combining IP blocking with a terms-of-service attestation that the claimant is not a US person. Legal guidance reported by Cointelegraph in October 2024 recommended layering IP blocking, attestations and VPN monitoring, and described geofencing as an extreme and costly way to comply. A report by the venture firm Dragonfly, published in March 2025 and filed with the SEC, estimated that US users lost between $1.84 billion and $2.64 billion across eleven geoblocked airdrops from 2020–2024.
What a fund or treasury should check before participating
A diligence checklist for a token allocation, private or public, should at minimum establish: which jurisdiction's white paper or exemption the offer relies on, and whether that exemption survives a later listing; whether the instrument is a SAFT-style forward purchase and, if so, what happens to the claim if the network is delayed or never launches; the full unlock schedule against circulating and fully diluted supply, not just headline allocation percentages; whether a market maker holds a loan and option position that could be exercised into the same unlock window; and, for a US-facing recipient, whether an airdrop or points allocation required action after its terms were announced. Tax and reporting on receipt of an airdrop or unlock is a separate question from securities status and is addressed on its own terms elsewhere; a staking-linked distribution carries the further considerations in our review of institutional staking risk. Where any of these points is undocumented rather than merely unfavourable, that absence is itself the finding.