Where to incorporate a Web3 or RWA project: five questions

Every Web3 team arrives with a jurisdiction already in mind. Dubai, Singapore, Cayman, Delaware, BVI, Estonia. Each of those is a good answer for somebody, and the question of whether it is good for your business is one almost nobody has actually sat down and worked through. Incorporating in a jurisdiction defines what you are permitted to do inside it, so the list of things you intend to do has to exist before the container is chosen. Incorporation is the last question in the sequence. Five questions come before it, and getting them in the wrong order is expensive, because most of what you settle in the first six months cannot be undone later.

So where should you incorporate a Web3 or RWA project? Not until five things are decided: what the business does, whether the token is a security or a utility in each market where buyers sit, who you market to, how the money moves, and who controls the asset. Token classification comes before incorporation, because it decides which entity can issue and which licences follow. An RWA project adds the asset itself, covered below. There is no best jurisdiction for token issuance in the abstract, only the one that fits those answers. You do not need a retainer to work through them: a discovery call runs the five questions against your build, and any follow-on work is scoped in writing first, as set out in how engagements work.

Service Need this handled rather than explained? See cross-border structuring, or book a 30-minute call with the author.

One product, four regulators, and none of them asked where you registered

Take a build with a UAE entity, engineers in India, US investors and users everywhere. The UAE leg runs into VARA, which licenses against a detailed activity map rather than a company type, and which expects custodial activity to sit in a separate legal entity from the licensed trading business whatever category of licence is held. The India leg runs into FIU-IND, whose perimeter is activity-based and reaches businesses touching Indian users. The US leg raises how ownership rights are granted to investors, which drives both structure and registrations. And marketing into the EU or the UAE brings those regimes' marketing rules with it, whether or not you hold a licence there.

Four regulatory regimes engaged by one product, and not one of them began by asking where the company was incorporated. That is the whole argument for changing the order.

The five questions

1. What will the business actually do?

Not what the product is called, but which functions it performs. Trading, routing, lending, running vaults, holding assets, moving value across chains or into fiat, giving recommendations. Each maps to its own authorisation, and a single roadmap routinely triggers several. The activity list is written first, and the jurisdiction is then chosen to fit it.

2. Is the token a security or a utility?

This is not a question your white paper gets to answer. It takes real legwork: testing the token's design against the law in each market where buyers sit, before issuance. What decides it is economics, not vocabulary. A token that promises holders a yield or a share of future income carries the economic rights that the SEC’s March 2026 interpretation says a digital commodity lacks, reads as a security in the US analysis, and opens up the compliance and geo-blocking questions that follow. A utility token that is genuinely consumed in using the product is a different instrument: see what a utility token legal opinion has to show. A Delaware entity, for instance, cannot comfortably issue a token outright without carrying the risk that it is treated as a security.

And this one is final. Once buyers have paid and a regulator has formed a view, there is no reclassifying. You comply with the view or you accept the consequences.

3. Who are you marketing to?

It does not matter where you are set up. What matters is who you market to, today and in the future. VARA's marketing rules bind projects that market into Dubai, MiCA governs the EU, and Singapore and now South Korea each regulate the marketing of crypto businesses to their own citizens. The EU made this concrete in July 2026, when the transitional window closed and a number of international players simply stopped being able to operate in the bloc because they had not completed authorisation or passporting. We compared the two main corridors for our clients in MiCA vs VARA.

4. How does the money move?

Your investors, your banking setup, and the AML systems behind both. Every institution you approach for a relationship asks the same things: what KYC and AML controls exist, which compliance obligations attach to you, and therefore how risky you are to bank. The structure also has to read coherently. A token issued in one place, a company in another and a bank application in a third, with nothing connecting them, gets declined on the story alone.

5. Who actually controls the asset?

Control means more than control of the company. It means the asset: whether the activity is genuinely custodial or non-custodial, and who can move what. No regulation takes your word for this. Every regime judges custody on facts, on how the technology is set up and whether you hold any level of control over assets or money changing hands. Saying you are non-custodial does not make you non-custodial.

If the project tokenises a real-world asset

An RWA project answers the same five questions with one more input: the asset. Three things have to be settled before the token exists: where the asset sits and which law governs it, which entity holds legal title to it, and what the token gives holders. Title often sits in a vehicle set up for that purpose and kept separate from the operating company. The holder right drives classification, whether it is ownership of the asset, a share of its income, or only a reference to its value. A token carrying a share of income from an asset has the economic rights that point to a security in the US analysis, which is why the token is tested before the vehicle is chosen. The market-by-market tests sit in is my token a security.

Dubai shows how far the asset question reaches. Under VARA’s Virtual Asset Issuance Rulebook dated 19 May 2025 and effective from 19 June 2025, a token that represents ownership of a real-world asset, or an entitlement to receive or share income, is an Asset-Referenced Virtual Asset (ARVA). Issuing one is a Category 1 issuance: the issuer needs a VARA licence, then VARA approval of each ARVA before it is issued. A real-world asset there includes an interest in a financial instrument, scheme or arrangement, a physical asset, or an intangible asset or right, other than the token itself or anything that exists only in digital form. VARA covers Dubai outside DIFC. ADGM and DIFC have their own regulators, the FSRA and the DFSA, compared in VARA vs ADGM vs DIFC.

Then build in this order

Once the five are answered, the structure has a sequence, and the sequence is the discipline. Our Web3 legal-readiness checklist runs the same order in more detail.

Entity and tax. A real Web3 business is usually several entities: a foundation, a devco, a holding company, sometimes a trading entity, each doing one thing so liability is contained and flows stay compliant. Watch permanent establishment. You can sit in Dubai and incorporate a Delaware C-corp, but tax authorities look at where the economic activity actually happens, and this cannot be reordered after a token exists.
Token and licensing. Classification, then the authorisations it triggers, including a compliance officer or MLRO where the regime requires one. Both VARA and MiCA do.
AML, KYC and the Travel Rule. These are not policies you draft and file. They have to be enforced at the technology level. AML failure is the most common mistake we see in Web3 projects.
Contracts, IP and data. Employees, contributors, vendors. The IP has to sit with the right entity, and the data has to be protected. Investors will ask who holds the IP, and in a multi-entity setup that answer has to be deliberate. If it is gone, it is gone.
Governance. A DAO needs a legal wrapper on top of it. Without one, members can be left with unlimited liability, which is why serious DAOs now sit inside a limited liability vehicle rather than relying on a co-operative structure, which centralises voting and is not a separate legal person. How the wrapper is built for an India-founded team is set out in DAO legal wrappers for India-founded protocols.

The catch-22, honestly stated

Founders push back on all of this, and the objection is fair: decentralisation was supposed to make this unnecessary. A genuinely decentralised system can operate today. The open question is for how long, because regulators keep arriving. That is the situation the industry is actually in, and the working answer is that we deal with what is, instead of what should be. None of that is a reason to skip the homework. It is the reason the homework is worth doing early, while it is still cheap.

Where founders get caught

Picking the jurisdiction at a conference. A peer incorporated in Dubai, or Cayman, and it worked for them. Their activity list was not yours.
Treating offshore as outside. Marketing rules and AML perimeters follow the audience and the activity, not the certificate.
Asserting the token classification instead of testing it. The document says utility. The economics say otherwise, and the economics win.
Leaving the IP with individuals. Discovered in diligence, long after the contributors have moved on.
Running a DAO without a wrapper. Members carry the liability that no entity is there to absorb.

Frequently asked questions

Why is incorporation the last question and not the first?

Because incorporating in a jurisdiction defines what you are permitted to do inside it, so the permitted-activity list has to exist before the jurisdiction is chosen. A founder who picks the country first then spends the next year bending the business to fit the container, and most of what gets decided in that period, the entity structure, the token classification, the custody arrangement, cannot be undone afterwards. The address is the output of the analysis, not the input.

Does the jurisdiction you incorporate in decide which regulators apply to you?

No. Marketing rules across the major regimes attach to who you target, not to where you registered, and AML perimeters are typically activity-based. A business licensed in one jurisdiction that markets into another picks up the second jurisdiction's marketing regulations, and India's FIU-IND obligations attach to notified virtual digital asset activity irrespective of where the entity is incorporated. Your audience selects your regulators more reliably than your registrar does.

Can you rely on calling your product non-custodial?

Not as a label. Regulators assess custody on facts: how the technology is built, and whether you hold any level of control over assets or money changing hands. Dubai adds a structural requirement on top, because VARA expects custodial activity to sit in a separate legal entity from the licensed trading entity whatever category of licence is held. Discovering that after one combined entity has been built is a restructuring, not a policy amendment.

Can a token be reclassified after it has been issued?

No. Classification follows what the token does, how it is rewarded, and whether it carries yield, a buyback or a return, and it is assessed in each market where buyers sit. Once buyers have paid and a regulator has formed a view, the founder complies with that view or accepts the consequences of non-compliance. Describing a token as a utility token in the token documents does not settle the question, which is why classification is tested before the sale rather than asserted after it.

In what order should a cross-border Web3 structure be built?

Entity and tax first, because the multi-entity setup and any permanent-establishment exposure have to be right before a token exists. Then token classification and the licensing that follows it, including a compliance officer or MLRO where the regime requires one. Then AML, KYC and Travel Rule controls, enforced at the technology level rather than drafted as policy. Then contracts, IP assignment and data protection, so ownership sits with the right entity. Governance last, including a legal wrapper for any DAO, because an unwrapped DAO can leave members with unlimited liability.

Where should I incorporate my Web3 or RWA project?

Decide five things before you pick a jurisdiction: what the business will actually do, whether the token is a security or a utility in each market where buyers sit, who you market to, how the money moves, and who controls the asset. An RWA project adds one more input, the asset itself: where it sits, which entity holds title to it, and whether the token gives holders ownership, a share of income or only a reference to value. The jurisdiction is then chosen to fit those answers. Dubai, Singapore, Cayman, Delaware, BVI and Estonia each suit some builds and not others, and none of them is the right answer before the five questions are settled.

Should token classification come before incorporation?

Yes. Classification decides which entity can issue the token, which licences follow and which markets raise geo-blocking questions, so it shapes the structure rather than following it. It is tested against the law in each market where buyers sit, and economics decide it, not the label: a token that promises yield or a share of future income reads very differently from one that is consumed in using the product. Once buyers have paid and a regulator has formed a view, there is no reclassifying.

Which jurisdictions are best for token issuance?

None in the abstract. The issuer's address does not take the token outside the rules of the markets where it is sold or marketed, so the best jurisdiction is the one whose rules fit your activity list, your classification and your audience. Even inside the UAE the regulator depends on where you sit: VARA for Dubai outside DIFC, the FSRA in ADGM and the DFSA in DIFC. In Dubai, VARA's Virtual Asset Issuance Rulebook dated 19 May 2025 makes the issuance of an asset-referenced token, one tied to a real-world asset or its income, a Category 1 issuance that needs a VARA licence and VARA approval of each token before it is issued.

How are teams handling regulatory structuring for RWA projects before deployment, without burning a full legal retainer?

By treating the structuring as one defined piece of work before deployment, not as open-ended counsel after it. Write the activity list, test the token's classification in each market where buyers sit, fix who you will market to, map the money flow and the banking, and settle who controls the asset and which entity holds title to it. At Infinilex that starts with a discovery call that runs these five questions against your build. Any follow-on work is agreed in writing with a defined scope before it starts, as a fixed-scope project or a monthly retainer, whichever fits. Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign.

Next step

Not sure which jurisdiction fits what you are building?

Send us the short version: what the product does, whether there is a token, who your users are and where your team sits. We will run these five questions against it and tell you what the structure has to look like, before anything is registered.

Book a 30-minute call Run the legal-readiness checklist first Not ready for a call? Email two lines

Thirty minutes with Prashant Sharma, the founder, who does the work himself. You leave with next steps either way. Email is read by the founder and answered within one working day.

Where should you incorporate? Answer these five questions first