The Web3 founder’s legal-readiness checklist
The legal checklist for launching a token across India, the UAE and the US has eight items, done in this order: entity and jurisdiction, token classification, licensing and registration, AML and KYC, fiat and banking, tax, data protection, and IP and governance. Each is answered separately in every jurisdiction your buyers sit in, and all eight are settled before the token generation event. The jurisdiction table gives the India, Dubai and US answers side by side.
You cannot reclassify a token after the sale, or undo a fiat flow after it has happened. The legal structure of a Web3 build has to be set in the right order, before the launch, not after. This is the checklist we run with founders building across India, the UAE and the US.
Work through it in order. Each item is a decision that gates the next one. The aim is to find the gaps while they are still cheap to fix, before a token sale, a banking application, or an investor’s diligence makes them expensive.
Entity and jurisdiction
Where the development company, the foundation, and the token issuer each sit.
- Where do your users, buyers and investors actually sit, and does your home jurisdiction permit the activity? Some jurisdictions are DeFi-unfriendly by default, which forces the question early.
- Is the structure built before the token, not after? A foundation-plus-devco split (for example a Cayman or UAE foundation with a Delaware or BVI development company) is hard to retrofit once tokens are live.
- Is the UAE leg a regulated free zone (DMCC, ADGM, or RAK / Innovation City) with real substance, or a mailbox? Substance is now the test, not the address.
- Where does the India leg sit, and how does value move between the entities under FEMA?
- Deciding where the issuer sits? Launching a token from India sets out the sequence and the usual issuer seat, and the five questions before you incorporate cover the jurisdiction choice. If the development company is a US company formed from India, the FEMA side is in registering a US company from India.
Token classification
What your token is in law, which is answered separately in every jurisdiction you touch.
- Have you classified the token in each place your buyers sit? The same token can be a security in the US under the investment-contract test, a regulated virtual asset under VARA or ADGM in the UAE, a crypto-asset under MiCA in the EU, and a taxable VDA in India.
- Do the documents match what the token actually does? Writing “utility token” does not change an economic reality that reads like a security.
- Have you fixed the classification before the sale? You cannot reclassify after buyers have paid. A sample token legal opinion letter shows what counsel’s written classification contains.
- Run the test regime by regime with is my token a security in the US, the EU, the UAE and India. The jurisdiction table below shows what each answer means for the launch.
Licensing and registration
The authorisations your specific activity triggers, by jurisdiction.
- Does your activity (exchange, custody, broker-dealer, token issuance) require a VARA licence in Dubai, or an ADGM / FSRA authorisation in Abu Dhabi?
- If you serve Indian users, do you need FIU-IND registration as a VDA Service Provider, with the AML obligations that follow?
- If US persons can transact, have you checked money-transmitter / MSB and the SEC and CFTC posture?
- Do you have a named Compliance Officer or MLRO, and a pre-application gap analysis before you file?
- Which entity in your chain needs which licence: crypto licence requirements by country. Before you sign with a Dubai launchpad, distributor or exchange, check its licence on the VARA register.
AML, KYC and the Travel Rule
The programme a regulator, an auditor, or a bank will ask to see.
- Is there a written AML/CFT policy with a named person responsible? A tool you bought is not a policy.
- KYC on users, sanctions screening, and a suspicious-transaction reporting process that actually runs?
- Are you ready for the FATF Travel Rule on transfers between service providers? Market by market: the crypto Travel Rule in India, the UAE, the EU and the US.
Taking fiat, and getting banked
The compliance layer that appears the moment real money touches the product.
- Who holds the fiat? Taking card or bank payments adds a compliance layer that usually runs through a regulated banking or payments partner, not your own entity.
- Can you show a clean source of funds? A bank needs the off-chain documents that explain your on-chain flows; “trust the chain” is not a paper trail.
- Does the structure read as coherent? A token issued in one place, a company in another, and a bank in a third, with no story connecting them, reads as structuring and gets declined.
Tax
The liability that does not wait for you to be ready.
- Where is your taxable nexus, and is there permanent-establishment risk from where your team actually works?
- India exposure: the 30% flat VDA tax with no loss set-off, plus 1% TDS on transfers materially changes a business model. Has it been modelled, not assumed?
- UAE corporate tax, US tax, and VAT / GST treatment of your fees and token flows?
- Is transfer pricing between the foundation, the devco and the India entity defensible?
Data protection
Your KYC and user data are personal data, governed wherever your users live.
- Lawful basis and consent for the personal data you collect, under DPDP (India), GDPR (EU) and the UAE PDPL as applicable?
- A breach-notification process that exists before there is a breach?
- Cross-border transfer of user data handled lawfully between your entities?
- India’s DPDP Rules 2025 phase in on fixed dates; the DPDP compliance checklist for startups sets out which duties apply when.
IP, contracts and governance
Who owns what, who can bind the entity, and who controls the treasury.
- Is the IP assigned to the right entity, with contributor and contractor agreements that actually transfer it, including anonymous contributors?
- Clear token-holder terms, and a privacy and risk-disclosure set that matches the classification?
- If there is a DAO, does it have a legal wrapper? Without one, members can be treated as partners and carry personal liability.
- Treasury and multisig controls that map to the charter, so the on-chain governance and the entity agree?
- Choosing the wrapper: DAO legal wrappers for India-founded protocols. Launch marketing and its disclaimers follow separate rules in each market: crypto marketing rules in India, Dubai and the EU.
The token launch checklist by jurisdiction
The eight items are the same everywhere. The answers are not. This is how the first questions resolve for a launch with buyers in India, Dubai and the US.
| Question | India | UAE: Dubai, outside the DIFC | US |
|---|---|---|---|
| What the token is in law | A virtual digital asset under section 2(111) of the Income-tax Act 2025, in force from 1 April 2026, whatever the token is called | Category 1 (fiat-referenced, asset-referenced, or others VARA names), Category 2 or an Exempt VA under VARA’s Virtual Asset Issuance Rulebook. ADGM (FSRA) and the DIFC (DFSA) run their own regimes | An investment contract or not, under the analysis in the SEC’s interpretive release of 17 March 2026 (Release 33-11412), which superseded the 2019 staff Framework. Regulation Crypto Assets (File S7-2026-27) is a proposal, with comments due 20 October 2026 |
| What the launch needs | Financial services related to an issuer’s offer and sale of a virtual digital asset are activity (v) under the PMLA notification S.O. 1072(E) of 7 March 2023; whoever provides them for others in the course of business registers with FIU-IND | Category 1: a VARA licence. Category 2: no VARA licence and no prior approval, but all placement and distribution through a Licensed Distributor; VARA does not approve the token | If the token is offered as a security, the sale is registered or fits an exemption |
| Taking fiat | Exchange between virtual digital assets and fiat currencies is activity (i) under the same notification, with the AML duties in the FIU-IND guidelines updated 8 January 2026 | Check that the on-ramp, exchange or custodian holds the VARA licence for that activity on the public register | FinCEN guidance FIN-2019-G001 of 9 May 2019 (section 5.2) treats the seller in a preferential token sale as a money transmitter acting as administrator; state money-transmitter laws need a separate check |
| Tax | 30 percent on income from a transfer, with no deduction beyond cost and no set-off of losses (section 194(1), Table Sl. 4); 1 percent TDS on the consideration (section 393(1), Table Sl. 8(vi)), subject to the Act’s thresholds | Corporate tax and VAT on the issuing entity and its fees, modelled before the sale | Tax on the selling entity and any US nexus, modelled before the sale |
| Read next | Launching a token from India; FIU-IND registration; crypto tax for India operators | VARA, ADGM or DIFC; VARA licensing; the VARA register | Is my token a security?; our comment letter on Regulation Crypto Assets |
Primary texts, read on 6 October 2026: the Income-tax Act 2025 (assented 21 August 2025; sections 2(111), 194(1) and 393(1)); S.O. 1072(E) of 7 March 2023 under the PMLA; the FIU-IND AML and CFT guidelines updated 8 January 2026; VARA’s Virtual Asset Issuance Rulebook, version of 19 May 2025, effective 19 June 2025, and its issuance categories and prior requirements; the SEC’s interpretive Release Nos. 33-11412 and 34-105020 of 17 March 2026 and proposed Regulation Crypto Assets, Release Nos. 33-11434 and 34-106150 of 18 August 2026; and FinCEN’s FIN-2019-G001 of 9 May 2019.
Frequently asked questions
What is the legal checklist for launching a token across India, the UAE and the US?
Eight items, in this order: (1) entity and jurisdiction, so the issuer, the development company and any foundation sit where the activity is permitted; (2) token classification in each place your buyers sit; (3) the licences and registrations the launch triggers; (4) a written AML, KYC and Travel Rule programme; (5) a regulated route for fiat and a bank that understands the flows; (6) tax modelled in each jurisdiction; (7) data protection for the KYC data you collect; and (8) IP, token-holder terms, any DAO wrapper and treasury controls. The answers differ by jurisdiction. In India the token is a virtual digital asset under section 2(111) of the Income-tax Act 2025, in force from 1 April 2026, and financial services related to an issuer's offer and sale of a virtual digital asset are a notified activity under the PMLA (S.O. 1072(E) of 7 March 2023), so the providers register with FIU-IND. In Dubai outside the DIFC, VARA's Virtual Asset Issuance Rulebook requires a VARA licence for Category 1 issuance (fiat-referenced and asset-referenced tokens, and others VARA names); Category 2 issuance needs no VARA licence, but all placement and distribution must go through a Licensed Distributor. In the US, the SEC applies the investment-contract analysis in its interpretive release of 17 March 2026 (Release 33-11412), which superseded the 2019 staff Framework, and FinCEN guidance FIN-2019-G001 decides when the seller is a money transmitter.
What are the legal steps before a token generation event?
Settle them in this order, before the token generation event and before any money is taken. First fix where the issuer, the development company and any foundation or DAO wrapper sit, get a written classification of the token in each market where buyers sit, and confirm which licences and registrations the sale and its distribution trigger and which entity must hold each one. Then put the AML, KYC and Travel Rule programme in place, agree the fiat route and the bank before the sale, and model tax in each entity, including India's 30 percent tax on income from transferring a virtual digital asset and the 1 percent TDS on the consideration. Finish the token-holder terms, risk disclosures, IP assignments and treasury controls so they match the classification. Marketing comes last, once the classification is fixed, because launch promotions follow their own rules in each market. For a team based in India, the Infinilex guide Launching a token from India sets out the sequence and the choice of issuer seat.
What is on the legal checklist when a token sale takes fiat?
Fiat adds a regulated layer in every market. In India, exchange between virtual digital assets and fiat currencies is activity (i) under S.O. 1072(E) of 7 March 2023, so a business that does it for others in the course of business registers with FIU-IND and runs the AML programme set by the FIU-IND guidelines updated 8 January 2026. In Dubai, check that the on-ramp, exchange or custodian you use holds the VARA licence for that activity on VARA's public register; for a Category 2 token, placement and distribution run through a Licensed Distributor. In the US, FinCEN guidance FIN-2019-G001 of 9 May 2019 (section 5.2) treats the seller in a preferential token sale as a money transmitter acting as administrator, with the Bank Secrecy Act duties that follow; state money-transmitter laws need a separate check. In every market the bank will ask for source-of-funds documents that explain the on-chain flows, and a structure with the token, the company and the bank in three places needs a written account of how they connect.
Who signs the legal opinions for a token launch, and what does Infinilex do?
Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign. On a token launch Infinilex runs this checklist against your structure, sequences the entity, classification, licensing, AML, banking, tax, data and IP work, and drafts the documents each step needs. Infinilex's in-house chartered accountant and company secretary capacity covers the Indian tax and corporate filings. Where the launch also reaches EU buyers and needs MiCA work, Infinilex quarterbacks, EU local counsel files. Email is answered within one working day.
Sequence the structure before you launch. Jurisdiction decides what you can do; classification decides what the token is; licensing, AML, banking and tax decide whether you can take real money for it. Get them in that order, before the token sale and before the data room, because almost none of it can be undone cleanly after the fact. The legal homework is not the afterthought to a Web3 build. It decides where the build is allowed to exist.
Building across India, the UAE or the US?
Send us your structure and we will map the gaps against this checklist, in one call, before they cost you a licence or a banking relationship.
Thirty minutes with Prashant Sharma, the founder, who does the work himself. You leave with next steps either way. Email is read by the founder and answered within one working day.
Want this as a PDF in your inbox?
Email us and we will send the current version, and the updated one each time the law moves. Or print the page: it is built for paper.
This checklist is general information for founders, not legal advice for your specific company, token, or transaction. Regulatory positions across India, the UAE, the EU and the US change; confirm every point against current law before relying on it. The right structure depends on your activity, your users, and the jurisdictions you touch. Have your setup reviewed before launch.
Prepared by Infinilex Consultancy · infinilex.io · Verified as of 6 October 2026. Printed copies date; check infinilex.io/resources/ for the current version.