Is my token a security? The US, EU, UAE and India tests side by side

Is my token a security? It depends on the regime. In the US the test is Howey, as the SEC applies it in Release 33-11412 of 17 March 2026 (effective 23 March 2026), which superseded the withdrawn 2019 staff Framework. The EU asks whether it is a financial instrument, Dubai’s VARA assigns a category and India taxes it as a virtual digital asset. Calling it a utility token decides nothing.

The question often arrives as “is my token a security or a utility token?” Every regime below looks past the label to what the token does and what the issuer promises. Below: the tests in one table, each regime in turn, then one hypothetical token run through all of them. Start with the US section: the Commission replaced its staff’s 2019 reading of Howey in March 2026.

Four regimes at a glance

Dubai, ADGM and the DIFC each run their own token test, so the UAE takes three rows. Outside Dubai and the two financial free zones, the perimeter is federal: the Capital Market Authority (the former Securities and Commodities Authority, renamed on 1 January 2026) and, for a token used as a means of payment, the Central Bank of the UAE. None of this is a conclusion on your token. Confirm every point against current law for your facts.

United States: Howey, applied through the SEC’s March 2026 interpretation

In SEC v. W.J. Howey Co., decided on 27 May 1946, the Supreme Court defined an investment contract as a contract, transaction or scheme in which a person invests money in a common enterprise and is led to expect profits solely from the efforts of a promoter or third party. It called the definition a flexible principle, not a static one. That case is still the test. What changed in 2026 is how the SEC applies it.

The staff Framework of 3 April 2019 is marked withdrawn on sec.gov. In its place the Commission issued an interpretation, Release Nos. 33-11412 and 34-105020 (File No. S7-2026-09), on 17 March 2026, effective 23 March 2026, and the CFTC joined it with guidance under the Commodity Exchange Act. The release says it does not supersede or replace Howey, which it calls binding precedent. It does supersede the Framework, and its views supersede prior Commission or staff statements on the topics it covers, including the 2025 staff statements on meme coins, stablecoins, mining and staking. It is an interpretation, not a statute, and the Commission says it may refine, revise or expand it after public comment.

Two points in the release sharpen the test. The Commission says Howey’s common-enterprise element must be satisfied, stepping away from earlier statements that suggested otherwise, and because the test is conjunctive, failing any element means no investment contract. And the efforts that count are “essential managerial efforts”; administrative or ministerial activity does not.

The release sorts crypto assets into five categories by their characteristics, uses and functions.

• Digital commodity. Intrinsically linked to, and deriving its value from, the programmatic operation of a “functional” crypto system and from supply and demand, not from an expectation of profit from others’ essential managerial efforts. The system is functional when its native asset can be used on it the way the code intends; the release’s footnote 49 on that, and the choice between commodity and tool, are on the utility token page. A digital commodity carries no passive yield and no rights to the future income, profits or assets of a business. It may carry technical rights such as staking, and governance rights on certain technical or governance matters, such as software upgrades and treasury expenditures. The release names 16 in its text as of its date, including BTC, ETH, SOL, XRP, DOGE and SHIB, and two more, Algorand (ALGO) and LBRY Credits (LBC), in footnote 51.
• Digital collectible. Designed to be collected or used, representing things such as artwork, music, in-game items or references to internet memes, with no intrinsic economic rights. Creator royalties do not make one a security.
• Digital tool. Performs a practical function, such as a membership, ticket, credential, title instrument or identity badge, and is often non-transferable.
• Stablecoin. The GENIUS Act, enacted on 18 July 2025, will exclude a permitted issuer’s payment stablecoin from the definition of security once it takes effect, on the earlier of 18 January 2027 (18 months after enactment) or 120 days after final implementing regulations; it was not in effect on 24 September 2026 on the sources checked. Until then the Commission treats offers and sales of what it calls Covered Stablecoins as not involving securities, and other stablecoins may be securities on their facts. Issuance routes: where to issue a stablecoin.
• Digital security. A financial instrument within the statutory definition of security, formatted as or represented by a crypto asset. A security is a security on-chain or off.

Under US federal securities law, the first three are not themselves securities, stablecoins may or may not be, and digital securities are. Some assets fit none of the five, and a hybrid can fit more than one.

The investment contract sits on top of the category

The category is half the analysis. Any non-security crypto asset can be offered and sold subject to an investment contract, which is a security, although that does not make the asset itself one. An asset becomes subject to an investment contract when the issuer, its affiliates, its agents or a promoter induce an investment of money in a common enterprise with representations or promises to undertake essential managerial efforts from which buyers would reasonably expect profit.

• Promises and channels. Promises count when they reach the buyer before or at the sale, through channels such as the issuer’s agreements, website, official social media, direct private communications, filings or whitepaper. Statements by unaffiliated proponents or holders count only if the issuer authorised them or colluded. A detailed business plan with milestones, a timeline, personnel, funding sources and an account of how holders will profit likely creates the expectation; vague promises with no actionable plan likely do not.
• Secondary sales. Where buyers would reasonably expect the issuer’s promises to stay attached to the asset, secondary-market sales remain securities transactions that must be registered or exempt.
• SAFTs and ICOs. For a simple agreement for future tokens (SAFT) or an initial coin offering (ICO), the sale happens, and the tokens become subject to the investment contract, when the agreement is entered into, whenever they are delivered; on delivery they cease to be subject to it only if buyers would no longer reasonably expect profit from the issuer’s efforts, for example because the issuer has publicly disclosed that it completed them.
• Separation. The contract ends when the issuer fulfils its promised essential managerial efforts, judged by how the issuer itself defined them, or when buyers can no longer expect performance, for example after a widely disseminated and unambiguous public abandonment.
• Past violations survive. Separation does not cure an unregistered offering, investors keep their rights, and misstatements made while the contract existed can still create anti-fraud liability.

The Commission encourages issuers to set out promised efforts clearly, with milestones, a timeline, the resources needed and public disclosure on completion. Write them precisely. Your own definitions later decide when the contract ends.

Congress, the SEC’s August 2026 proposal and FinCEN

Legislation has not displaced any of this. On 15 September 2026 the Senate vote to invoke cloture on the motion to proceed to H.R.3633, the Digital Asset Market Clarity Act, failed, short of the 60 votes required, and nothing in the bill is enacted. Congress.gov records the vote as 49 to 50 (Record Vote No. 234), with a motion to reconsider entered the same day. On 18 August 2026 the SEC proposed Regulation Crypto Assets, with comments due 20 October 2026; it is a proposal, not law, and its terms are summarised under what changed in 2026. As at 24 September 2026 the SEC’s investment-contract analysis under Howey stands, as the Commission applies it in Release 33-11412, and guidance FIN-2019-G001 of 9 May 2019 from the Financial Crimes Enforcement Network (FinCEN) remains the operative federal money-transmission position. The release leaves the Bank Secrecy Act and federal tax law outside its scope, so each is a separate question.

European Union: financial instrument, or a crypto-asset under MiCA

MiCA Article 2(4) takes out of its scope crypto-assets that qualify as financial instruments, deposits, funds and several other regulated products, so the financial-instrument question comes first. Only if the answer is no does the Article 3(1) taxonomy apply. ESMA’s guidelines on qualifying crypto-assets as financial instruments (ESMA75453128700-1323, dated 19 March 2025) draw the line. Tokenisation changes nothing: a tokenised financial instrument remains one for every regulatory purpose. A crypto-asset is a transferable security when, cumulatively, it is not an instrument of payment, belongs to a class of securities and is negotiable on the capital market. Negotiability is easy to meet. The abstract possibility of transfer is enough, even with no market or a temporary lock-up.

• Governance rights. Votes on the company’s decisions, such as electing board members or approving mergers and acquisitions, confer voting rights equivalent to shares. Governance solely on technical or operational matters, such as protocol upgrades and fee adjustments, with no influence over corporate governance, does not.
• Bond-like returns. A token that pays regular interest or promises repayment of principal should be treated as a class of securities similar to bonds. A token that tracks underlying assets, with rights comparable to buying or selling transferable securities, is a strong indication of security-equivalent rights.
• Pooled investment. A token is a unit in a collective investment undertaking only where the project pools investors’ capital to invest under a defined investment policy for a pooled return. A project with a general commercial or industrial purpose is not one, and a liquid-staking token whose holders keep day-to-day control and trade freely typically is not either.
• Hybrids. Assess the financial-instrument criteria first. If the token shows features of a financial instrument, that nature takes precedence over a utility classification, and inherent attributes outweigh the issuer’s label, especially where functions may change over the token’s life.

ESMA says its examples are illustrative and do not replace a case-by-case analysis. A token that clears the question and is not an asset-referenced or e-money token falls under Title II, where Article 4(1) requires a crypto-asset white paper before an offer to the public. A token that purports to keep a stable value against one official currency is an e-money token, and against any other value or right an asset-referenced token; each has its own regime, Title IV for e-money tokens and Title III for asset-referenced tokens. Unique, non-fungible crypto-assets and tokens that cannot be transferred and are accepted only by their issuer sit outside MiCA altogether.

Utility tokens get their own treatment: ESMA’s paragraph 23, the Article 4(3) exemption and when Article 4(4) removes it are covered in our utility token legal opinion guide. How the EU and Dubai compare as a base: MiCA vs VARA.

The UAE and India: VARA Category 1 and Category 2, and India’s VDA label

Dubai runs a category test. VARA regulates virtual assets across Dubai’s mainland and free zones, except the DIFC. Its Virtual Asset Issuance Rulebook (version dated 19 May 2025, effective 19 June 2025) binds every entity in the Emirate that wants to issue a virtual asset, and sorts each issuance into three categories. VARA decides the category on the nature of the asset, the rights or value it represents and the business model. A change that could move a token out of its category means meeting the new category’s requirements before the change takes effect.

• Category 1. Fiat-Referenced Virtual Assets, Asset-Referenced Virtual Assets (ARVAs) and any other virtual asset VARA determines. Under the definitions, an ARVA is a token that represents ownership of a real-world asset, an entitlement to receive or share income deriving from one, a stable value or reference to one, an entitlement to value backed by one, or a wrapped or fractionalised version of another ARVA. A real-world asset includes an interest in any financial instrument, scheme or arrangement, a physical asset, or an intangible asset or right other than the token itself or an item that exists in digital form only. The issuer needs a VARA licence for the issuance, then VARA approval of each token before it is issued. A token referenced to the dirham will not be approved under VARA’s rules and belongs to the Central Bank of the UAE.
• Category 2. Any virtual asset that is neither Category 1 nor exempt. No licence and no prior VARA approval, but all placement and distribution must run through a Licensed Distributor, a VARA-licensed broker-dealer that assumes responsibility for validating the issuer’s compliance. Before placement, the distributor files the Whitepaper, the Risk Disclosure Statement, a signed compliance declaration and its due-diligence reports with VARA, and cannot place the token until a 15 working day submission period ends and any VARA comments or objections are resolved. No Category 2 asset is deemed approved by VARA.
• Exempt VAs. A Non-Transferable Virtual Asset, which cannot be sold for or converted into money, virtual assets or value in kind, redeemed for goods, services or discounts, or moved between wallets; a Redeemable Closed-Loop Virtual Asset, redeemable only with the issuer or its designated merchants, which cannot be converted into money or virtual assets, used as payment outside that loop, or moved between wallets except for redemption; or another virtual asset VARA determines. No requirement before issuance, provided Part II of the rulebook is complied with at all times, and VARA supervision continues.

Every non-exempt issuer publishes a Whitepaper and a Risk Disclosure Statement, the Whitepaper before the token is made available to the public, and cannot exclude civil liability for anything in it. VARA is not the only UAE door. In ADGM, the FSRA treats a token with the features of a Security, such as shares, debentures or fund units, as a Digital Security, deemed a Security under section 58(2)(b) FSMR, treats utility tokens and other virtual assets as commodities, and assesses a token offering case by case. In the DIFC, the DFSA’s General Module sorts tokens into Investment Tokens, Crypto Tokens and Excluded Tokens, which include utility tokens and NFTs; its guidance Example 4 says a token its white paper calls a utility token that also shares in the issuer’s profits is likely an Investment Token. The regulators compared: VARA vs ADGM vs DIFC.

No Indian regulator runs a process to approve a token issuance, and the government describes crypto products as unregulated (PIB, 9 September 2026). That absence is not permission. What applies is a tax definition and an anti-money-laundering perimeter.

Section 2(111) of the Income-tax Act 2025, in force from 1 April 2026, defines a virtual digital asset as any information, code, number or token, not being currency, “called by any name”, that gives a digital representation of value exchanged with or without consideration, promises or represents inherent value or works as a store of value or unit of account, and can be transferred, stored or traded electronically. Non-fungible tokens are included, and so is any crypto-asset on a cryptographically secured distributed ledger, whether or not it meets that first limb. The Government can exclude assets by notification, and Central Board of Direct Taxes (CBDT) Notification 74/2022, which continues under section 536(2)(j), excludes gift cards and vouchers, reward and loyalty points given without direct monetary consideration, and subscriptions. Under section 194(1), Table Sl. No. 4 (formerly section 115BBH of the 1961 Act), income from transferring a VDA is taxed at 30%, before any surcharge and cess, with no deduction beyond the cost of acquisition and no set-off or carry-forward of losses. Under section 393(1), Table Sl. No. 8(vi) (formerly section 194S), anyone paying a resident for a VDA deducts 1% tax at source. Section 393(4), Table Sl. No. 12 switches that off below a yearly threshold that turns on who pays, not on who holds the token. Where the payer is an individual or Hindu undivided family within the turnover and receipts limits, or with no business or professional income, nothing is deducted if the consideration in the tax year does not exceed Rs 50,000. For any other payer, the limit is Rs 10,000. The former sections were inserted by the Finance Act 2022.

Separately, notification S.O. 1072(E) of 7 March 2023 makes participation in, and provision of, financial services related to an issuer’s offer and sale of a VDA a notified activity under the PMLA, when carried out for another person in the course of business. FIU-IND’s guidelines updated 8 January 2026 treat launch-service providers as Reporting Entities, apply that duty whatever the provider’s location, and say ICO and initial token offering (ITO) activity is strongly discouraged. FIU-IND registration is an anti-money-laundering obligation, not an approval of the token.

Is my token a security? Run the tests in order, with a worked example

Classification is decided by economics, not vocabulary: see five questions before you incorporate.

1. Write down what the token does: every right it carries, what the network does on the day of sale, and every promise the issuer makes, in every channel buyers will read.
2. Run the US analysis in two steps: which of the five categories the asset falls in, then whether it is sold subject to an investment contract while the issuer’s promised essential managerial efforts continue.
3. Run the EU financial-instrument question, then MiCA: Article 2(4) first, then the Title II, asset-referenced or e-money track.
4. Place the token in the UAE: a VARA category, or an ADGM or DIFC classification if that is where the issuer or the offer sits.
5. Assume VDA treatment in India unless a notified exclusion fits, and model the 30% and 1% figures into the token economics.
6. Record the answer before the sale. Promises that reach buyers before or at the sale fix the US analysis, and a later change does not cure an earlier unregistered offering.

A hypothetical, on invented facts: a protocol team plans a governance token. Holders vote on fee parameters and upgrades, a share of protocol fees goes to holders who lock the token, the team controls the roadmap, and the deck calls the token “upside in the network”.

• United States. The technical votes are consistent with a digital commodity, but a digital commodity carries no passive yield and no right to an enterprise’s income, so the fee share is the first feature US securities counsel would test for the category. The team-controlled roadmap and the deck are what they would test for a live investment contract, because an investment contract arises when the issuer induces an investment of money in a common enterprise with promises of essential managerial efforts that reach buyers before or at the sale.
• European Union. The technical votes are the governance ESMA says does not confer share-like rights. The fee share is what EU local counsel would test against the line on rights to profits.
• Dubai. The fee share is the feature to test against VARA’s Asset-Referenced Virtual Asset definition, which covers an entitlement to receive or share income deriving from a real-world asset. Whether a share of protocol fees is Income from a real-world asset, for example from an interest in a scheme or arrangement, is the question to test on the facts. Inside the definition, the issuance is Category 1 and needs a VARA licence; outside it, Category 2 through a Licensed Distributor. VARA can determine the category either way.
• ADGM. The question is whether the fee share gives the token the features of a Security, such as shares or debentures. If it does, the FSRA may deem the token a Security; if not, it is treated as a commodity, not a Specified Investment. The FSRA assesses a token offering case by case.
• DIFC. The question is whether the fee share makes the token substantially similar to a Security; the DFSA’s Example 4 treats a profit-sharing “utility token” as likely an Investment Token.
• India. It is a VDA, whatever it is called: a crypto-asset on a cryptographically secured distributed ledger falls within section 2(111)(d), and no notified exclusion fits a fee-sharing governance token.

Changing those features before the sale changes the inputs. It does not guarantee any regulator’s view.

We run this analysis across the regimes and build the fact record. When the answer has to be written down for an exchange, an investor or a regulator, record it in a token legal opinion: Infinilex counsel sign the India, UAE and US legs, and local counsel qualified in any other jurisdiction sign theirs, named to you before they act; the sample token legal opinion letter shows the structure of one. The launch sequence that follows the test is in launching a token from India.

Frequently asked questions

Further reading

Token legal opinions: what they conclude · Utility token legal opinion · Sample token legal opinion letter · The exchange listing legal opinion checklist · Launching a token from India: the legal sequence · The Web3 legal-readiness checklist · Where should you issue a stablecoin? · VARA vs ADGM vs DIFC · MiCA vs VARA · FIU-IND registration

Sources

Every source below was checked on 24 September 2026, the date the law on this page is stated as at.

1. SEC v. W.J. Howey Co., 328 U.S. 293 (1946), at 298 to 299. Checked 24 September 2026.
2. SEC and CFTC, Application of the Federal Securities Laws to Certain Types of Crypto Assets and Certain Transactions Involving Crypto Assets, Release Nos. 33-11412; 34-105020 (17 March 2026), 91 FR 13714, sections I to VIII and footnotes 7, 21, 49 to 51, 60, 62, 79, 80, 89, 96, 98 to 100, 107, 123 to 126, 131 and 140 to 148. Checked 24 September 2026.
3. SEC rule page, File No. S7-2026-09, issue and effective dates. Checked 24 September 2026.
4. SEC, Framework for “Investment Contract” Analysis of Digital Assets (Withdrawn), page title. Checked 24 September 2026.
5. SEC, Regulation Crypto Assets (proposed), File No. S7-2026-27, Release Nos. 33-11434; 34-106150 (18 August 2026), comment date. Checked 24 September 2026.
6. Congress.gov, H.R.3633, Digital Asset Market Clarity Act, all actions, action of 15 September 2026 (Record Vote No. 234). Checked 24 September 2026.
7. FinCEN, FIN-2019-G001 (9 May 2019), p.1. Checked 24 September 2026.
8. Regulation (EU) 2023/1114 (MiCA), Articles 2(3), 2(4), 3(1), 4(1), 4(3) and 4(4). Checked 24 September 2026.
9. ESMA, Guidelines on the conditions and criteria for the qualification of crypto-assets as financial instruments, ESMA75453128700-1323 (19 March 2025), paragraphs 5, 11 to 15, 22 to 24, 26, 28 to 29, 37 to 43, 62 (with footnote 34), 63 and 74 to 76. Checked 24 September 2026.
10. ESMA Q&A 2671 (answer of 21 May 2026), admission to trading under Article 4(4). Checked 24 September 2026.
11. VARA, Virtual Asset Issuance Rulebook (version dated 19 May 2025, effective 19 June 2025), Rules I.C, I.D, I.E, I.F and III, Schedule 2 definitions and Annexes 1 and 2. Checked 24 September 2026.
12. VARA, Broker-Dealer Services Rulebook (version dated 19 May 2025, effective 19 June 2025), Rules IV.D.1 to IV.D.7. Checked 24 September 2026.
13. FSRA, Guidance on Regulation of Virtual Asset Activities in ADGM (version from 10 June 2025), paragraphs 10 to 12; FSRA guidance on Digital Security Offerings and Virtual Assets (24 February 2020), paragraphs 3.3 to 3.6. Checked 24 September 2026.
14. DFSA, General Module (GEN), consolidated version VER72/07-26, Rule 3A.2.1 and Appendix 2, A2.1.1 and A2.5 with guidance Example 4. Checked 24 September 2026.
15. UAE Capital Market Authority, announcement of Federal Decree-Laws No. 32 and 33 of 2025, in effect from 1 January 2026, renaming the Securities and Commodities Authority. Checked 24 September 2026.
16. CBUAE Rulebook, Federal Decree-Law No. (6) of 2025, Articles 61(1)(f), 62 and 187(2) to (3). Checked 24 September 2026.
17. Income-tax Act 2025 (Act No. 30 of 2025), sections 1(3), 2(111), 194(1) Table Sl. No. 4, 393(1) Table Sl. No. 8(vi), 393(4) Table Sl. No. 12 and 536(2)(j). Checked 24 September 2026.
18. Finance Act 2022 (Act No. 6 of 2022), sections 28 and 60, inserting former sections 115BBH and 194S. Checked 24 September 2026.
19. CBDT Notification No. 74/2022, S.O. 2958(E) (30 June 2022), paragraph 1(i) to (iii). Checked 24 September 2026.
20. Ministry of Finance notification S.O. 1072(E) (7 March 2023), clause (v). Checked 24 September 2026.
21. FIU-IND, AML and CFT Guidelines for Reporting Entities Providing Services Related to Virtual Digital Assets (updated 8 January 2026), paragraphs 1.4 and 7.1. Checked 24 September 2026.
22. Press Information Bureau release of 9 September 2026 on FIU-IND notices to VDA service providers. Checked 24 September 2026.

This article is general information for founders, not legal advice and not an opinion on any token. Law is stated as at 24 September 2026, and the page is re-verified quarterly. The SEC release is an interpretation the Commission may revise, ESMA’s examples are not a definitive classification, Regulation Crypto Assets is a proposal and H.R.3633 is not enacted. Classification depends on your facts, market by market. Have the analysis reviewed by jurisdiction-qualified counsel before anything is sold.