Crypto Securities, ICOs & Funds

When a crypto project raises money by selling a token, or when a fund pools investor capital to buy digital assets, one question tends to decide how the whole thing is regulated: is it a security? The answer shapes who can market the product, what must be disclosed, which regulator has authority, and what penalties apply if the rules are broken. This guide explains how initial coin offerings (ICOs) and other token sales work, when a crypto asset is treated as a security, how the long-standing Howey test is applied to tokens, and how regulated crypto funds such as exchange-traded products fit in.

Rules differ sharply by country and continue to change quickly. This article is educational only and is not financial, legal, or tax advice. Treat every specific figure, deadline, or classification as something to confirm against official primary sources before you rely on it.

An initial coin offering (ICO) is a fundraising method in which a project creates a new token and sells it to the public, usually before the product is finished. The label varies, including token sale, initial token offering, and (for exchange-hosted versions) initial exchange offering (IEO), but the core idea is consistent: buyers send money or another cryptocurrency and receive newly issued tokens in return. The team uses the proceeds to fund development, and buyers hope the token will gain value or unlock future utility on the platform.

ICOs gained mainstream attention during 2017 and 2018, when many projects raised large sums on little more than a whitepaper. That era exposed the model's weaknesses: a whitepaper is a marketing document, not an audited prospectus, and there was often no working product, no independent oversight, and no recourse if the team disappeared. Outright scams and "rug pulls" were common, and even well-intentioned projects frequently failed to deliver.

Tokens sold in these offerings are not all the same. Analysts often distinguish between:

• Utility tokens meant to provide access to a product or service, such as paying network fees or unlocking features.
• Payment or currency tokens intended mainly as a medium of exchange.
• Security or investment tokens that represent an investment stake and an expectation of profit.
• Governance tokens that grant voting rights over a protocol's decisions.

These categories are descriptive, not legal definitions. A project can call its token a "utility token," but a regulator may still treat it as a security based on how it was sold and what buyers were promised. That gap between marketing labels and legal reality is exactly where most enforcement risk lives, and it is the reason the rest of this guide focuses on the security question.

Before joining any token sale, basic due diligence matters: read the whitepaper critically, verify the team's identity and track record, check whether the code has been independently audited, understand the token's supply schedule and what insiders hold, and be skeptical of guaranteed or outsized return promises. No amount of due diligence removes the risk that a token's price falls to zero.

Most legal systems regulate "securities" (instruments such as shares, bonds, and investment contracts) far more strictly than ordinary goods or currencies. Securities laws exist to protect investors through mandatory disclosure, registration, and anti-fraud rules. So whether a crypto asset is a security is not a technical detail; it determines the entire compliance regime that applies.

There is no single global answer, because each jurisdiction defines and applies the concept differently. A few broad patterns help:

• United States: The Securities and Exchange Commission (SEC) has historically used the Howey test (explained in the next section) to decide whether a token sale is an "investment contract" and therefore a security. Assets that are not securities may instead be treated as commodities, which fall under the Commodity Futures Trading Commission (CFTC).
• European Union: The Markets in Crypto-Assets Regulation (MiCA) created a dedicated framework for crypto-assets that are not already covered by existing financial-instrument rules, with distinct categories such as asset-referenced tokens and e-money tokens.
• Other major markets: Jurisdictions including the United Kingdom, Singapore, Switzerland, Japan, and the United Arab Emirates each maintain their own classifications and licensing regimes, and some are widely viewed as more accommodating to token issuers than others.

The U.S. picture has been unusually active recently. An SEC crypto task force was established in early 2025 to develop clearer standards, and in March 2026 the SEC and CFTC issued joint interpretive guidance on how several categories of crypto-assets should be analyzed. Separately, Congress has debated comprehensive market-structure legislation (often discussed under the name of the CLARITY Act) that would sort digital assets into defined buckets and split oversight between the SEC and CFTC. As of this writing that legislation had not been fully enacted and the precise rules continued to evolve, so confirm the current status directly with the SEC, CFTC, or qualified counsel.

The practical takeaway: the same token can be regulated differently depending on where it is sold and how the offering is structured. If a token is deemed a security and was sold without meeting registration or exemption requirements, both the issuer and certain intermediaries can face serious legal consequences.

In the United States, the central tool for deciding whether something is an "investment contract" (and therefore a security) comes from a 1946 Supreme Court case, SEC v. W.J. Howey Co. The resulting Howey test asks whether an arrangement involves four elements. All four generally must be present for the asset to be treated as a security:

Applied to tokens, the first prong is almost always met, because buyers exchange value to acquire the token. The decisive questions usually involve the last two. If a project is still being built and buyers are essentially betting that the founding team's ongoing efforts will increase the token's value, regulators are more likely to see a security. By contrast, where a network is genuinely decentralized and functional, and the token is bought to be used rather than to profit from someone else's managerial work, the case for treating it as a security weakens. This idea (that an asset's status can change as a network matures) has been influential, though it is an interpretive concept rather than a bright-line statutory rule.

Important caveats apply. The Howey test is fact-specific; outcomes turn on how a token was marketed and sold, not on what it is called. It is also U.S.-specific, so passing or failing Howey says nothing about how the EU, the UK, or other jurisdictions would classify the same asset. Regulators' interpretations shift over time as well, and recent U.S. guidance has refined how these prongs apply to particular categories of crypto-assets. Anyone issuing a token, or building a product around one, should obtain current legal advice rather than self-diagnosing from a checklist.

Not everyone who wants crypto exposure buys and stores tokens directly. Crypto funds pool investor capital, or track an underlying asset, so that participants gain exposure without managing private keys, exchange accounts, or self-custody themselves. They range from regulated, publicly listed products to lightly overseen private vehicles, and the differences matter enormously for investor protection.

Common structures include:

• Exchange-traded products (ETPs), including spot bitcoin ETFs: In January 2024 the SEC permitted the first spot bitcoin exchange-traded products to list on U.S. national exchanges, and the regulated ETP market has since broadened. These products trade like shares, hold or track the underlying asset, and come with disclosure obligations and exchange-level rules designed to deter fraud. They are generally the most accessible and transparent route for ordinary investors, though they still carry the full price risk of the underlying asset and charge fees.
• Private crypto hedge funds and venture funds: Typically open only to institutional or accredited investors, these pursue active strategies with lighter public disclosure. They can offer broader exposure but involve higher fees, lock-ups, and counterparty risk.
• Index and basket funds: Vehicles that track a defined set of assets for diversified exposure rather than a single token.

Whatever the structure, the same diligence questions apply to any fund:

• Regulatory status: Is the fund registered or authorized, and by which regulator? A listed ETP on a major exchange sits under a very different regime than an unregistered offshore vehicle.
• Transparency: Review the prospectus or offering documents, the fee schedule, how often holdings are disclosed, and whether assets are independently verified.
• Custody and security: Find out who holds the underlying assets, whether a qualified custodian is used, and what protections exist against hacks or insider theft.
• Manager accountability: Examine the managers' track record, conflicts of interest, audit arrangements, and how decisions are governed.
• Risk and liquidity: Understand volatility, redemption terms, lock-up periods, and concentration in any single asset.

A regulated wrapper reduces certain operational and disclosure risks, but not market risk: if the underlying cryptocurrency falls, the fund falls with it. None of this is a recommendation to invest in any particular product, and tax treatment of crypto funds varies by jurisdiction, so confirm the rules that apply to you with a qualified professional.

No. Whether a token is a security depends on how it was sold and what buyers were promised, analyzed under the law of the relevant country. In the United States, regulators apply the Howey test to decide whether a token sale is an investment contract. Some assets are treated as commodities instead, and other jurisdictions use entirely different definitions. A project calling its token a "utility token" does not settle the question.

Token sales are not illegal in themselves, but they must comply with the securities and financial-promotion laws of the places where they are offered. If a token is deemed a security and is sold without meeting registration or exemption requirements, the issuer and certain intermediaries can face enforcement action. Rules vary widely by jurisdiction, so issuers should obtain qualified legal advice before launching.

A utility token is meant to provide access to a product or service, while a security token represents an investment stake with an expectation of profit. The distinction is about substance, not labels. Regulators look at how the token was marketed and whether buyers expect returns from the efforts of a central team, so a token marketed as "utility" can still be treated as a security.

A regulated exchange-traded product offers transparency, disclosure, and custody arrangements that an unregulated vehicle may lack, which reduces certain operational risks. It does not reduce market risk: if bitcoin's price falls, the product's value falls with it, and fees still apply. "Regulated" means oversight of the structure, not a guarantee against losses.

Confirm its regulatory status and which authority oversees it, read the offering documents and fee schedule, find out who custodies the underlying assets, review the managers' track record and audit arrangements, and understand the redemption terms and risks. Be wary of guaranteed returns. When in doubt, verify registration details with the relevant regulator and consult an independent professional. This is educational information, not investment advice.

Last updated: 2026-06.

• Bitcoin Security: Risks & How to Stay Safe
• Crypto Compliance, AML, KYC & Licensing
• Crypto in Your 401(k): The New 2026 Rules Explained
• Crypto Regulation: a Global Overview
• Crypto Taxes Explained
• Bitcoin (BTC): the Complete Guide
• Crypto Regulation by Country