Crypto exchange listing legal opinion checklist: what venues ask for

Is a legal opinion required to list a token?

Exchanges set their own listing terms by contract, and none is quoted here because none was verified. No enacted US rule requires a token classification opinion. Regulators require legal opinions from MiCA asset-referenced token issuers, VARA asset-referenced issuers and foreign payment token issuers registering with the Central Bank of the UAE, but those go to the regulator, not the exchange: see which regulators require a token legal opinion.

Since the MiCA transitional period for crypto-asset service providers (CASPs) ended across the EU on 1 July 2026, an EU listing venue must be an authorised CASP, and a CASP established outside the EU may not serve or solicit EU clients except under reverse solicitation (statements of 17 April and 23 June 2026 by ESMA, the European Securities and Markets Authority). Admission to trading carries its own Article 5 white-paper duty: the Article 4(2) and 4(3) exemptions fall away once an intention to seek admission on an EU CASP’s platform is made known (Article 4(4), read with ESMA Q&A 2671), and for a token admitted before 30 December 2024 the platform operator must ensure by 31 December 2027 that a white paper is drawn up, notified and published where MiCA requires one (Article 143(2)(b)). A DIFC venue runs its own suitability assessment, weighing the token’s regulatory status elsewhere, including whether any regulator has assessed or approved it (DFSA GEN 3A.2.1).

Law stated as at 24 September 2026. The texts relied on, and the date each was read, are listed under Sources below Schedule A. The US row of Schedule A is a classification test only. On 15 September 2026 the Senate vote to invoke cloture on the motion to proceed to H.R.3633, the Digital Asset Market Clarity Act, failed, short of the 60 votes required, and nothing in the bill is enacted. No exchange’s own listing form is described here; the questions follow from the venue’s regulatory duties, and each venue phrases them its own way.

Exchange listing legal opinion checklist: what documents exchanges need to list a token

Start from the venue, not the token. In each regime covered here the listing venue carries a duty to assess the asset before admitting it, and the diligence questionnaire a founder receives is that duty written out as questions. In India, an FIU-IND registered venue must run a documented risk assessment before launching any new product (Guidelines of 8 January 2026, para 3.6.1). In Dubai, a VARA-licensed exchange must set and apply VA Standards before and throughout any activity in an asset (Market Conduct Rulebook, Part VIII). In the DIFC, a firm may not carry on a financial service relating to a crypto token until it has concluded on reasonable grounds that the token is suitable (DFSA GEN 3A.2.1). In the United States, the question is whether the asset is offered as a security under Howey as the SEC now applies it. Under MiCA, an EU trading platform may not admit an asset without a required white paper and must assess its suitability (Article 76). A venue’s token legal opinion requirements start from these duties. The nine documents below are what those duties make a venue ask for, in the order they can sensibly be prepared; the opinion comes last because it is given on the rest. This is an exchange listing due diligence checklist, not a launch sequence. For the launch order, use the Web3 legal readiness checklist and Launching a token from India.

Assemble the entity and signatory evidence

Every regime with an admission rule starts with who is asking. The venue needs to know which legal person stands behind the token and who can bind it.

Under MiCA, a person may not seek admission to trading of a crypto-asset in the EU unless it is a legal person (Article 5(1)(a)); a group of founders, or a DAO (decentralised autonomous organisation) without a legal wrapper, cannot be the applicant. The white paper must identify the offeror or person seeking admission, and the issuer if different (Article 6(1)). For an EU admission, bring the identifiers ESMA’s register classifies white papers by: LEI (Legal Entity Identifier); DTI (Digital Token Identifier) if assigned (Delegated Regulation (EU) 2025/421).
VARA’s Issuance Rulebook Schedule 1 requires the Whitepaper to state the issuer’s regulatory authorisations (item A.vi), and the Market Conduct Rulebook requires a Dubai venue to weigh the issuer’s background as part of its VA Standards (Part VIII.A.4). Bring the certificate of incorporation, the register of directors, the board resolution approving the listing application and the authorised signatory list, all in the issuer’s name.
An Indian venue is an FIU-IND reporting entity under the Prevention of Money-laundering Act, 2002 (PMLA), and its own registration dossier includes a corporate-structure note with significant beneficial ownership and copies of all agreements with exchanges, brokers, custodians and other virtual digital asset (VDA) service providers (Guidelines of 8 January 2026, para 2.4). Expect it to ask the issuer for the mirror image: the ownership chain down to individuals, and the counterparty list. Where the issuer sits in the UAE above an Indian development company, that structure and its launch order are set out in Launching a token from India and the Web3 legal readiness checklist.

Write the classification memo, one section per venue regime

The opinion’s spine is a classification memo that answers a different legal question in each market where the venue admits buyers. The same token can be a digital commodity in one market and a financial instrument in the next, and the memo has to say so rather than pick the friendliest answer.

India: an Indian venue asks whether the asset is a virtual digital asset as defined in section 2(111) of the Income-tax Act 2025 (formerly section 2(47A) of the 1961 Act, the definition FIU-IND’s guidelines still quote), and which of the five activities notified under the PMLA the issuer’s own services fall into (para 1.2.2). India has no token-offering regime and no regulator that approves an issuance; the absence is not permission.
UAE: a Dubai venue’s VA Standards must consider the asset’s regulatory treatment by VARA and by authorities outside the Emirate, whether the issuance received any regulatory approvals, and whether the asset is prohibited in any jurisdiction where the venue operates (Market Conduct Rulebook, Part VIII.A.4). A DIFC firm first asks what the token is under the DFSA’s definitions: a Crypto Token, an Investment Token, or an Excluded Token such as a Utility Token or NFT (non-fungible token) (GEN App2 A2.1.1 and A2.5). A token its white paper calls a utility token but that shares in the issuer’s profits is likely an Investment Token (DFSA guidance, Example 4), and a DFSA Authorised Person may provide no service for a Utility Token or NFT, custody aside where its licence permits (GEN 3A.2.4). How a utility conclusion is reached market by market is in the utility token legal opinion.
United States: the test is Howey, applied through the SEC’s interpretive release of 17 March 2026 (Release Nos. 33-11412 and 34-105020, effective 23 March 2026), which sorts crypto assets into digital commodities, digital collectibles, digital tools, stablecoins and digital securities. The first three are not themselves securities, but any of them can be offered and sold subject to an investment contract, which is a security. The memo must therefore answer two questions: which category the asset falls in, and whether a live investment contract still attaches to it. The staff’s 2019 Framework is marked withdrawn on sec.gov and must not be cited as current. The analysis itself is in Is my token a security?
European Union: MiCA does not apply to crypto-assets that qualify as financial instruments (Article 2(4)(a)), and the white paper notification must be accompanied by an explanation of why the asset should not be considered excluded under Article 2(4), an e-money token or an asset-referenced token (Article 8(4)). That explanation is a mandatory classification statement for every white paper under MiCA Title II, which covers crypto-assets other than asset-referenced and e-money tokens, and the Joint Guidelines JC 2024 28 of the European Supervisory Authorities (the ESAs) give an Annex A template for it. Write the memo’s EU section so it can be lifted into that template.

Align the white paper with MiCA Article 6 and VARA Schedule 1

Listing teams read the white paper against a statutory table. MiCA and VARA prescribe its minimum contents and put every line on the people who draw it up, never on the regulator: under MiCA, the person seeking admission (or the platform operator, where it takes the duties on under Article 5(2) or 5(3)) and its management body (Articles 6(3) and 15); under VARA, the issuer and its Licensed Distributor (Schedule 1.A).

MiCA Article 6(1) requires information on the person seeking admission, the issuer if different, the project, the admission, the crypto-asset, the rights and obligations attached, the underlying technology, the risks, and the climate and environmental impact of the consensus mechanism. Article 6(3) to (6) prescribe the statements: on the first page, that the paper has not been approved by any competent authority in any Member State and that the person seeking admission is solely responsible for its content; no assertion of future value; a warning that the asset may lose value, may not be transferable or liquid and is not covered by investor-compensation or deposit-guarantee schemes; and a management-body statement that the paper is fair, clear and not misleading.
VARA’s Issuance Rulebook Schedule 1 requires every issuer in the Emirate other than of Exempt VAs to publish a Whitepaper covering, among other items, the name of any trading platform where admission to trading is or will be sought and how investors access it (B.v), any material legal or regulatory considerations applicable to owning, storing, transferring or using the asset (C.xv), the governing law and competent court (C.xvi), restrictions on transferability and the steps that give legal effect to a transfer (C.vii), and the climate impact statement (D.v). The table is the minimum: omitting an item later found applicable makes the Whitepaper non-compliant, and VARA will not confirm whether any item applies (Schedule 1.A).
Sequence, format and identity matter as much as content. Under MiCA the white paper is notified to the home competent authority at least 20 working days before publication (Article 8(5)), competent authorities give no prior approval of it (Article 8(3)), the paper is published on the website of the person seeking admission before trading starts and stays available while the asset is held by the public, and the published version must be identical to the version notified (Article 9). Since 23 December 2025 the paper is drawn up as a single XHTML file with Inline XBRL mark-up (Implementing Regulation (EU) 2024/2984). Draft the opinion against the notified text, and freeze that text before the opinion is dated.

Draft the information undertaking to the platform

Two regimes let the venue or its distributor carry part of the issuer’s paperwork. MiCA makes the person seeking admission promise in writing to feed the platform everything it needs; VARA puts the diligence on the Licensed Distributor, whose written client agreement with the issuer (Broker-Dealer Services Rulebook IV.C.1) is where the same promise belongs. Either way the promise is a document you will be asked to sign, so draft it before the other side does.

MiCA Article 5(3): the person seeking admission and the trading-platform operator may agree in writing that the operator complies with all or part of the white paper, notification, publication and marketing duties in Article 5(1)(b) to (g), and the agreement must state that the person seeking admission must give the operator all information necessary to satisfy them. Where a venue admits an asset on its own initiative and no required white paper has been published, the operator itself must comply with Article 5(1) (Article 5(2)); where the asset is already admitted on another EU platform with a compliant, updated white paper, no new paper is needed if the person responsible for it consents in writing to its use (Article 5(4)).
VARA: a Category 2 Virtual Asset needs no VARA licence and no prior VARA approval, but all placement and distribution must run through a Licensed Distributor, and that distributor assumes responsibility for assuring and validating the issuer’s compliance with the Issuance Rulebook (Rules I.C.1, I.E.2 and I.E.3). Under the Broker-Dealer Services Rulebook the distributor must ensure “beyond all reasonable doubt” the quality of every issuer and asset it distributes, and its diligence on each asset covers the VA Standards, the Whitepaper, the Risk Disclosure Statement, investor classification and audits of all smart contracts with findings remediated (Rules IV.B.1 to IV.B.3). Its request list is the practical equivalent of the Article 5(3) undertaking, and the venue’s own VA Standards due diligence runs before and throughout the activity (Market Conduct Rulebook, Part VIII.A.2).
Write the undertaking as a schedule of documents with owners and dates, and carry the venue’s operating rules into it. Under MiCA Article 76(1) a trading platform must lay down clear and transparent operating rules that set the approval process and due diligence it applies before admission, its excluded categories, its admission policies, procedures and fees, the liquidity thresholds and periodic disclosure conditions for continued trading, and its suspension conditions, and those rules must state that no asset is admitted where a required white paper has not been published. Get them before the first call; the venue’s questions follow from them.

Fix the tokenomics and the allocation schedule as disclosure, not marketing

Supply, allocations, lock-ups and use of proceeds are the numbers a venue tests for manipulation risk and a US analyst tests for a live investment contract. Both readers want the same table.

VARA’s Whitepaper table calls for the issuance structure, schedule and the allocations retained by the issuer, investors and advisers, and for the use of proceeds (Schedule 1.B, items B.vii and B.viii). A Dubai venue’s VA Standards must consider market capitalisation, fully diluted value and liquidity trends, the roadmap, and susceptibility to price manipulation (Market Conduct Rulebook, Part VIII.A.4); a DIFC firm weighs the size, liquidity and trading history of the token’s global market (GEN 3A.2.1(3)). Present the allocation schedule with unlock dates and the wallets that hold each tranche.
MiCA Article 6(1) requires information on the admission and on the rights and obligations attached to the crypto-asset, and a paper that asserts future value breaches Article 6(4). An EU platform must set liquidity thresholds and periodic disclosure conditions for continued trading in its operating rules (Article 76(1)), so the schedule you disclose at admission is the one you will be measured against afterwards.
For the United States, the allocation schedule is evidence in the investment-contract analysis. Under Release 33-11412, a non-security crypto asset sold under an investment contract, including a SAFT (simple agreement for future tokens), becomes subject to it when the agreement is entered into, and ceases to be subject to it on delivery only where a purchaser would no longer reasonably expect profit from the issuer’s efforts, for example where the issuer has publicly disclosed that it completed the essential managerial efforts it promised. Where the issuer continues those efforts or has not disclosed completion, the assets remain subject to the contract. Record, with dates, what was promised, what was completed and what was disclosed.

Evidence the technology, the audits and the anonymisation check

Every regime with an admission rule asks the venue to test the code and to refuse assets that hide their holders. Bring the evidence the venue is required to look for.

MiCA Article 76(2): before admitting a crypto-asset the platform operator must assess its suitability, evaluating in particular the reliability of the technical solutions used and the potential association with illicit or fraudulent activity, and it must assess suitability even for assets whose offer was exempt under Article 4(3)(a) to (d). Article 76(3): the platform’s rules must prevent admission of crypto-assets with an inbuilt anonymisation function unless the holders and their transaction history can be identified by the operator. The white paper itself must describe the underlying technology and the risks (Article 6(1)).
UAE: the VARA Whitepaper must describe the technology and the consensus mechanism and, where the issuer or someone acting for it operates the ledger, the outcome of any audit of that ledger and who carried it out (Schedule 1.B, items D.i, D.ii and D.iv). Where a Licensed Distributor places the asset, as every Category 2 asset requires, its due diligence must confirm that all smart contracts used for the asset were comprehensively audited and the findings remediated (Broker-Dealer Services Rulebook IV.B.3(e)). Anonymity-Enhanced Cryptocurrencies, defined as Virtual Assets that prevent tracing of transactions or ownership on public ledgers and for which the VASP (the licensed virtual asset service provider) has no mitigating traceability technology, may not be issued in the Emirate, and no VA Activity may relate to them (Regulations 2023, Part II.C.1 and Schedule 4). A Dubai venue’s VA Standards must consider the security and immutability of the ledger and any features affecting anti-money laundering and counter-terrorist financing (AML/CFT), sanctions, securities or IP compliance (Market Conduct Rulebook, Part VIII.A.4). In the DIFC, the suitability assessment weighs the token’s technology, and Financial Services, Financial Promotions and Offers to the Public involving Privacy Tokens, Privacy Devices or Algorithmic Tokens are prohibited in or from the DIFC (GEN 3A.2.1(3), 3A.2.2 and 3A.2.3).
India: FIU-IND treats transactions in Anonymity-Enhancing Crypto Tokens as unacceptably high risk; reporting entities shall refrain from permitting deposits or withdrawals of such tokens or of VDAs designed to conceal origin, ownership or value, and shall not facilitate tumbler or mixer transactions (Guidelines of 8 January 2026, paras 7.4 and 7.5). A privacy-token listing is unavailable on an FIU-IND registered venue, and the venue must carry out a documented risk assessment before launching any new product (para 3.6.1). Attach the smart-contract audit reports, the auditor’s engagement letter and a statement of the asset’s traceability features.

Disclose the issuer and key-person background, including the uncomfortable parts

MiCA, VARA and the DFSA put the founders’ record into the venue’s admission test, and VARA puts it into the whitepaper as well. A listing team that finds an undisclosed proceeding after the fact reads the whole file differently.

VARA’s Whitepaper table requires a statement of whether any individual involved in the issuance has been convicted of dishonesty, fraud, financial crime, company, banking, insolvency, money-laundering or insider-dealing offences, or is under investigation (Schedule 1.B, item A.v). The venue’s VA Standards must consider the issuer’s background, including any fraud investigations or claims, and conflicts of interest (Market Conduct Rulebook, Part VIII.A.4).
MiCA Article 76(2) directs the platform operator to take into account the experience, track record and reputation of the issuer and its development team when assessing suitability, and a DIFC firm weighs the token’s governance arrangements and founders (GEN 3A.2.1(3)). Prepare short biographies, prior-project outcomes and a signed confirmation on litigation and regulatory history for each director and each named team member, dated to the opinion.
An FIU-IND registered venue has itself given FIU-IND a self-declaration that no proceedings or criminal cases are pending against it or its directors (para 2.4), and must identify where a new product could expose it to money laundering, terrorist financing and proliferation financing (ML/TF/PF) risk (para 3.6.1). Expect the same declaration to be asked of the issuer. Under Release 33-11412, an issuer that made material misstatements in connection with an investment contract remains exposed under the anti-fraud provisions even after the asset later separates from that contract. Disclose the record once, accurately, in every document that repeats it.

Show the issuer’s own AML posture: counterparty agreements and Travel Rule readiness

The venue is a regulated entity, and the issuer may not be. The listing team’s AML questions are about whether the issuer’s side of the flow will put the venue’s registration or licence at risk.

India: participation in and provision of financial services related to an issuer’s offer or sale of a VDA is a notified PMLA activity (para 1.2.2(v)); persons offering services relating to issuance, market making, placement, distribution or ongoing circulation of a VDA are reporting entities in their own right, a smart contract performing those functions does not relieve the parties controlling it, and ICO-related activities are strongly discouraged (para 7.1). The obligations are activity-based and apply irrespective of physical presence in India (paras 1.4 and 7.3). The memo must state whether the issuer or any launch-service provider is inside that perimeter and, if so, its FIU-IND status; the route is in the FIU-IND registration checklist.
Counterparty paper: an Indian venue’s own dossier includes copies of all agreements with exchanges, brokers, custodians, intermediaries and other VDA service providers, and what the guidelines call a PACT certificate from FIU-registered counterparties (para 2.4). Bring the market-maker, custodian and distributor agreements in signed form. Under MiCA Article 76(2) the platform must evaluate the asset’s potential association with illicit or fraudulent activity; under VARA’s VA Standards, features affecting AML/CFT and sanctions compliance are a listed factor (Part VIII.A.4).
Travel Rule and onboarding: India’s Travel Rule under Rule 4 of the Prevention of Money-laundering (Maintenance of Records) Rules, 2005 requires originator and beneficiary information, including the originator’s Permanent Account Number (PAN) and identity-document number, to be submitted before or when a VDA transfer is conducted, with no post-facto submission and no monetary threshold stated (para 5.3), and PAN is mandatory for onboarding any client for VDA activity (para 4.1.4(c)). If the issuer will run treasury transfers to or from the venue, its wallets and its custodian must be able to carry that data. The venue keeps client-identification and transaction records for at least five years (para 6.2), so the issuer’s counterparty file will outlive the listing.

Commission the opinion last and date it to the listing file

The opinion is the ninth document because it is given on the first eight. Written earlier, it rests on a file that has not yet been assembled. See a sample token legal opinion letter for how the finished document reads.

Who signs: Infinilex counsel sign the India, UAE and US legs; local counsel qualified in any other jurisdiction sign theirs, brought into the engagement explicitly and named to you before they act. Which professional can give each conclusion is set out in who can sign a token legal opinion an exchange will accept.
Addressees and date: in US closing-opinion practice, an opinion speaks as of its date and may be relied on only by its addressee and anyone the opinion giver expressly authorises (Core Opinion Principles 4.1 and 4.2); an opinion from EU, UAE or Indian counsel carries the reliance terms its letter states. Settle whether the venue is an addressee before the opinion is signed, and date it after the white paper text is frozen and notified and the other eight documents are final, so that every fact the opinion recites is in the file the venue receives. Reliance and reuse across venues are answered under can the exchange rely on the legal opinion below; the events that make an older opinion stale are set out in when a token legal opinion goes stale.
What it cannot say: no opinion guarantees admission, because the venue decides under its own rules and its own assessment. Schedule A below lists, regime by regime, the approvals and conclusions the opinion may not assert. An approval the rules do provide for, such as a MiCA asset-referenced token’s white paper or a VARA Category 1 token, is evidence the file carries, not a conclusion the opinion supplies.

Schedule A: what the exchange listing legal opinion must address, and cannot say, by venue regime

The table reads across: the duty the venue is under, what the opinion must therefore address, what it may not assert, and the primary text. The US row has no venue-side admission rule; it is the classification test a US-facing venue applies. Dubai means VARA’s remit, which covers Dubai’s mainland and free zones but not the DIFC; the DIFC row covers firms the DFSA regulates. ADGM (Abu Dhabi Global Market) is not covered here; the three UAE regimes are compared in VARA vs ADGM vs DIFC. All references are as at 24 September 2026.

Schedule A · Exchange listing legal opinion by regime: venue duty, coverage, exclusions and source, as at 24 September 2026
Regime	The venue’s duty	What the opinion must address	What it cannot say	Source
India (FIU-IND)	The venue is an FIU-IND reporting entity: documented ML/TF/PF risk assessment before launching a new product, repeated at intervals not exceeding one year, outcome to the Board (para 3.6.1); no deposits or withdrawals of anonymity-enhancing tokens, no mixers (paras 7.4 to 7.5); Travel Rule data before or at transfer (para 5.3); records at least five years (para 6.2). Registration is an AML registration under the PMLA, not a licence or product approval	Whether the asset is a VDA as defined in section 2(111) of the Income-tax Act 2025 (formerly 2(47A) of the 1961 Act, the definition the guidelines still quote); which notified activities (para 1.2.2) the issuer and its launch-service providers perform, and their FIU-IND status; the counterparty agreements and PACT certificates the venue must itself hold (para 2.4); traceability features; PAN-based onboarding and Travel Rule data capability	That India has a token-offering regime or that any Indian regulator approved the issuance (none exists, and the absence is not permission); that FIU-IND registration of the venue or the issuer is an endorsement or investor-protection mark; that a privacy token can be listed on a registered venue	FIU-IND AML and CFT Guidelines for VDA reporting entities, updated 8 January 2026, paras 1.1, 1.2, 1.4, 2.1 to 2.5, 3.6.1, 4.1.4, 5.3, 6.2, 7.1 and 7.3 to 7.5; Income-tax Act 2025, section 2(111). Registration route: FIU-IND registration
Dubai (VARA, outside the DIFC)	Market Conduct Rulebook Part VIII.A: establish VA Standards, conduct due diligence before and throughout the activity, publish the standards on its website; Part VIII.A.4 lists the factors; Part VIII.B: ongoing reassessment, records kept eight years, suspension where an asset no longer meets the standards, notification to VARA as soon as possible. The Exchange Services Rulebook (version 31 March 2026) contains no rule headed admission or listing. Separately, where the asset is a Category 2 issuance being placed through a Licensed Distributor, the distributor files the Whitepaper, the Risk Disclosure Statement, its signed declaration of compliance with Rule IV.B.1 and its due-diligence reports with VARA before placement, and nothing is placed until a 15 Working Day Submission Period ends and, if VARA comments or objects, until every point is resolved to its satisfaction (Broker-Dealer Services Rulebook IV.D.1 to IV.D.6)	Issuance category (Category 1, Category 2 or Exempt) and, for Category 2, the Licensed Distributor and its Part IV diligence, including the smart-contract audits and their remediation (IV.B.3(e)); the Schedule 1 Whitepaper items, including the named trading platform (B.v), material legal or regulatory considerations (C.xv), governing law (C.xvi), background disclosures (A.v) and the technology, the consensus mechanism and, where the issuer or someone acting for it operates the ledger, any audit of that ledger (D.i, D.ii and D.iv); Anonymity-Enhanced Cryptocurrency status; regulatory treatment inside and outside the Emirate	That VARA approved a Category 2 asset or made any representation about its fitness for purpose, its suitability or its regulatory status outside Dubai (Issuance Rulebook Rule I.E.5 and the rulebook’s disclaimer), including because the distributor’s submission period lapsed without comment (Broker-Dealer Services Rulebook IV.D.7); that VARA confirmed the applicability of any Whitepaper item (Schedule 1.A); that a Category 1 token is approved before VARA has approved it, since each Fiat-Referenced or Asset-Referenced Virtual Asset needs VARA approval before issue (Annex 1 and Annex 2, Rule I.B.2); that a VARA licence covers the DIFC, or that any ADGM or DIFC treatment follows from a VARA conclusion	Virtual Assets and Related Activities Regulations 2023 (portal version effective 19 June 2025), Part II and Schedule 4; Market Conduct Rulebook Part VIII (version dated 19 May 2025); Virtual Asset Issuance Rulebook Rule I.C.1, Part I.E, Schedule 1, Annex 1 and Annex 2 (version dated 19 May 2025, effective 19 June 2025); Broker-Dealer Services Rulebook Part IV (version dated 19 May 2025, effective 19 June 2025); Exchange Services Rulebook (version dated 31 March 2026). Licensing route: VARA licensing
DIFC (DFSA)	GEN 3A.2.1: no financial service, financial promotion or offer to the public relating to a Crypto Token in or from the DIFC unless the firm has made a prior assessment and concluded on reasonable grounds that the token is suitable (for a Fiat Crypto Token, the DFSA must be satisfied that it is suitable); 3A.2.1(3) lists the matters, including purpose, governance and founders, regulatory status elsewhere and any regulator’s assessment or approval, market size, liquidity and trading history, and technology. GEN 3A.2.1A: publish a current list of tokens assessed as suitable, review each assessment (DFSA guidance expects at least every six months), cease where a token stops being suitable, demonstrate the grounds to the DFSA and, for an Authorised Person, file a monthly Crypto Token return within 14 days of the following month	Whether the token is a Crypto Token, an Investment Token or an Excluded Token such as a Utility Token or NFT (GEN App2 A2.1.1 and A2.5); its regulatory status, and any assessment or approval, in each other jurisdiction; purpose, governance arrangements and founders; technology; whether it is a Privacy Token or an Algorithmic Token	That the DFSA approved a non-fiat token: the suitability conclusion is the firm’s own (GEN 3A.2.1(2)); that a DFSA Authorised Person may provide services for a Utility Token or NFT (GEN 3A.2.4 bars it, custody aside where the licence permits); that a Privacy Token or Algorithmic Token may be offered, promoted or serviced in or from the DIFC (GEN 3A.2.2 and 3A.2.3)	DFSA Rulebook, General Module (GEN) VER72/07-26, Rules 3A.2.1 to 3A.2.4 and App2 A2.1.1 and A2.5 (a consolidated documentation text; the authentic rule-making instruments are on the DFSA website). Comparison: VARA vs ADGM vs DIFC
United States (federal)	No federal venue-side admission rule is cited here. The question a US-facing venue asks is whether the asset is a security, or is offered subject to an investment contract, under Howey as applied through SEC Release 33-11412 (effective 23 March 2026), with guidance from the Commodity Futures Trading Commission (CFTC) that it will administer the Commodity Exchange Act consistently with that interpretation	Which of the five categories the asset falls in (digital commodity, collectible, tool, stablecoin, digital security), noting that some assets fall outside all five and hybrids may fall in more than one; whether an investment contract, SAFT or otherwise, still attaches; whether the issuer has publicly disclosed completion of the promised managerial efforts; the registration or exemption used for any prior sale	That the 2019 staff Framework governs (it is withdrawn and superseded); that offers and sales of the asset are not securities transactions while an investment contract still attaches (the asset itself is not turned into a security, footnote 47, but offers and sales subject to the contract, including secondary sales while purchasers reasonably expect the issuer’s promises to remain connected, are securities transactions, section IV.A); that anti-fraud exposure ended when the contract did; that proposed Regulation Crypto Assets (Release 33-11434, 18 August 2026) is in force; anything treating H.R.3633 as law: on 15 September 2026 the Senate vote to invoke cloture on the motion to proceed to H.R.3633, the Digital Asset Market Clarity Act, failed, short of the 60 votes required, and nothing in the bill is enacted.	Release Nos. 33-11412 and 34-105020, sections I, III and IV and footnotes 21 and 47; sec.gov Framework page (withdrawn); Release No. 33-11434 (proposed); Congress.gov, H.R.3633 actions
European Union (MiCA)	Art 76(1): clear and transparent operating rules on the approval process and due diligence before admission, excluded categories, admission policies and fees, liquidity thresholds and disclosure conditions for continued trading, suspension; no admission without a required white paper. Art 76(2): suitability assessment covering technical reliability, illicit-activity association, and the issuer and development team’s track record, including for assets whose offer was exempt under Art 4(3). Art 76(3): no anonymisation-function assets unless holders and history are identifiable. Since 1 July 2026 the venue must be an authorised CASP	Legal-person status (Art 5(1)(a)); the Art 8(4) explanation of why the asset is not excluded under Art 2(4) (a financial instrument, deposit, fund or other listed product), not an e-money token and not an asset-referenced token, in the JC 2024 28 Annex A template; Art 6(1) contents and the Art 6(3) to (6) statements; notification at least 20 working days before publication (Art 8(5)); publication identical to the notified version (Art 9); the XHTML and Inline XBRL format and the register identifiers: LEI; DTI if assigned; any Art 5(3) written agreement with the platform or Art 5(4) reuse consent	Any approval the rules do not provide for: competent authorities give no prior approval of a Title II white paper (Art 8(3)), while an asset-referenced token’s white paper is approved (Arts 17(1)(a) and 21); that the venue’s opinion stands in for an asset-referenced token’s Art 17(1)(b)(ii) or 18(2)(e) opinion, which goes to the competent authority and, for an Art 18(2)(e) opinion, may be evaluated by the European Banking Authority (EBA) and ESMA at its request (Art 20(5)); anything asserting future value (Art 6(4)); that the Art 4(2) and 4(3) offer exemptions (for example, offers to fewer than 150 persons per Member State, or whose total consideration does not exceed EUR 1,000,000 over 12 months) dispense with the admission white paper: they concern offers to the public, and Art 5 carries its own duty	Regulation (EU) 2023/1114, Arts 2(4), 4, 5, 6, 8, 9, 15, 17(1)(a) and (b)(ii), 18(2)(e), 20(5), 21, 76 and 143; Implementing Regulation (EU) 2024/2984; Delegated Regulation (EU) 2025/421; ESMA Q&A 2671; Joint Guidelines JC 2024 28. Authorisation route: MiCA authorisation and MiCA vs VARA

Sources

Each primary text was read on 24 September 2026 unless another date is given. United States: SEC Release Nos. 33-11412 and 34-105020 (17 March 2026); CFTC Press Release 9198-26 (17 March 2026); the withdrawn 2019 staff Framework; proposed Regulation Crypto Assets, Release No. 33-11434 (18 August 2026); Congress.gov, H.R.3633 all actions (Congress.gov records the vote as 49 to 50, Record Vote No. 234, with a motion to reconsider entered the same day); the Core Opinion Principles, Principles 4.1 and 4.2; District of Columbia Rule of Professional Conduct 2.3. European Union: Regulation (EU) 2023/1114; Implementing Regulation (EU) 2024/2984; Delegated Regulation (EU) 2025/421; ESMA Q&A 2671 (answer of 21 May 2026); ESMA’s statement of 17 April 2026 and public statement of 23 June 2026; the ESAs’ Joint Guidelines JC 2024 28. UAE: VARA’s Virtual Assets and Related Activities Regulations 2023, Market Conduct Rulebook, Virtual Asset Issuance Rulebook, Broker-Dealer Services Rulebook and Exchange Services Rulebook (the Market Conduct Rulebook Part VIII, the Exchange Services Rulebook and the Regulations’ Part II.C and Schedule 4 read on 20 September 2026 and re-checked on 25 September 2026); the DFSA General Module, VER72/07-26; the CBUAE Payment Token Services Regulation, Article 9. India: the FIU-IND Guidelines of 8 January 2026 (paragraph references verified on 20 September 2026 against the same version and re-checked on 25 September 2026); the Income-tax Act 2025, section 2(111). No regulator or venue fee is quoted here. MiCA Article 76(1)(c) requires an EU platform’s operating rules to set out the level of any admission fees, and Article 76(13) requires its fee structures to be transparent, fair and non-discriminatory.

Frequently asked questions

Do crypto exchanges require a legal opinion to list a token?

Where an exchange asks for one, the requirement is the exchange's own, set by contract; no exchange's terms are quoted here because none was verified. What a venue asks for follows from its own duty to assess the asset before admitting it: MiCA Article 76, VARA's VA Standards, DFSA GEN 3A.2.1 and an Indian venue's pre-launch risk assessment under FIU-IND's guidelines. Opinions that regulators themselves require go to the regulator, not the exchange.

Can the exchange rely on the legal opinion, and can it be reused for another listing?

Only if the opinion letter lets it: as an addressee, or with the signer's express authorisation. In US closing-opinion practice, an opinion speaks as of its date and may be relied on only by its addressee and anyone the opinion giver expressly authorises (Core Opinion Principles 4.1 and 4.2); an opinion from EU, UAE or Indian counsel carries the reliance terms its letter states. US conduct rules such as District of Columbia Rule 2.3 let a lawyer give an evaluation for a third party's use where that is compatible with the client relationship. None of the regulatory texts cited here sets reliance terms. Reuse follows from the same principles: a second venue needs a reliance letter from the signer naming it, or a new opinion dated for that listing. The white paper travels more easily: where the asset is already admitted on another EU platform, MiCA lets the existing white paper serve if the person responsible for drawing it up consents in writing (Article 5(4)).

Does a listing team set its own date limit for the opinion?

It may, by contract, and none is quoted here because no venue policy was verified. None of the regulatory texts cited here sets a validity period for a token opinion. In US closing-opinion practice an opinion speaks as of its date, and its signer has no duty to update it for later events or legal developments (Core Opinion Principle 4.1); elsewhere, the letter's own terms govern. What matters is what has changed between that date and the listing file. The triggers that make an opinion stale are listed on the token legal opinion page.

What happens if the whitepaper contradicts the legal opinion?

The contradiction is a disclosure problem before it is an opinion problem, and each regime has a rule on point. Under MiCA the published white paper must be identical to the version notified to the competent authority (Article 9), and the person seeking admission and the members of its management body are liable to holders for incomplete, unclear or misleading information, with any contractual exclusion of that liability void (Article 15). Under VARA, omitting a Schedule 1 item later found applicable makes the Whitepaper non-compliant, and issuers and Licensed Distributors are fully responsible for its accuracy and completeness (Schedule 1.A). In the United States, material misstatements or omissions made while an investment contract existed can still create anti-fraud liability after the asset separates from that contract (Release 33-11412, section IV.B.3). Fix the document first, then re-date the opinion.

Does listing only on a non-EU exchange trigger MiCA white-paper duties?

Not by itself. Article 4(4) switches off the Article 4(2) and 4(3) exemptions when the offeror makes known an intention to seek admission to trading, and the European Commission's answer to ESMA Q&A 2671 (21 May 2026) reads that as admission on a trading platform operated by a crypto-asset service provider (CASP) established in the Union. A listing only on platforms outside the EU therefore leaves the exemptions available if their own conditions are met. Three limits apply. An offer to the public in the EU that falls outside the exemptions still needs a legal person, a white paper, notification with the Article 8(4) explanation and publication (Article 4(1)). Listing on a decentralised exchange in the Union could itself amount to an offer to the public, assessed case by case. And any later admission to trading by an EU CASP carries its own Article 5 white-paper duty.

The events that make a dated opinion stale, and how the date interacts with a listing, are set out in when a token legal opinion goes stale. Which regulators require an opinion of their own is in which regulators require a token legal opinion.

The one principle under all nine

An opinion is given on a file. It does not replace the file, and it cannot supply an approval the rules do not provide for. MiCA gives no prior approval of a Title II white paper; VARA deems no Category 2 asset approved (Rule I.E.5), and its rulebook disclaimer treats a representation that a VARA licence endorses an issuer or asset as a breach of its Regulations; a DIFC firm reaches its own suitability conclusion on a non-fiat token; India has no approving regulator; and the SEC’s interpretation classifies assets without approving any of them. Where an approval does exist, as for a MiCA asset-referenced token’s white paper or each VARA Category 1 token, it sits in the file as evidence. What the venue examines is the file: a legal person, a classification memo per market, a white paper that matches the statutory table and the notified text, an information undertaking, a disclosed allocation schedule, audited code that can be traced, honest backgrounds, an AML posture that does not endanger the venue’s registration and, last, an opinion from jurisdiction-qualified counsel, dated to that file.

Next step

Has a listing team asked you for a legal opinion?

Send us the venue, the markets its buyers sit in, the white paper as it stands and the token’s sale history. Infinilex maps the venue’s regime to the nine documents above and tells you which are missing. Infinilex counsel sign the India, UAE and US legs of the opinion; local counsel qualified in any other jurisdiction sign theirs, named to you before they act. How an engagement is scoped is described in how engagements work.

Book a discovery call Token legal opinions

The crypto exchange listing legal opinion checklist