Crypto Securities, ICOs & Funds

An initial coin offering (ICO) is a fundraising method in which a project creates a new token and sells it to the public, usually before the product is finished. The label varies, including token sale, initial token offering, and (for exchange-hosted versions) initial exchange offering (IEO), but the core idea is consistent: buyers send money or another cryptocurrency and receive newly issued tokens in return. The team uses the proceeds to fund development, and buyers hope the token will gain value or unlock future utility on the platform.

ICOs gained mainstream attention during 2017 and 2018, when many projects raised large sums on little more than a whitepaper. That era exposed the model's weaknesses: a whitepaper is a marketing document, not an audited prospectus, and there was often no working product, no independent oversight, and no recourse if the team disappeared. Outright scams and "rug pulls" were common, and even well-intentioned projects frequently failed to deliver.

Tokens sold in these offerings are not all the same. Analysts often distinguish between:

• Utility tokens meant to provide access to a product or service, such as paying network fees or unlocking features.
• Payment or currency tokens intended mainly as a medium of exchange.
• Security or investment tokens that represent an investment stake and an expectation of profit.
• Governance tokens that grant voting rights over a protocol's decisions.

These categories are descriptive, not legal definitions. A project can call its token a "utility token," but a regulator may still treat it as a security based on how it was sold and what buyers were promised. That gap between marketing labels and legal reality is exactly where most enforcement risk lives, and it is the reason the rest of this guide focuses on the security question.

Before joining any token sale, basic due diligence matters: read the whitepaper critically, verify the team's identity and track record, check whether the code has been independently audited, understand the token's supply schedule and what insiders hold, and be skeptical of guaranteed or outsized return promises. No amount of due diligence removes the risk that a token's price falls to zero.

Most legal systems regulate "securities" (instruments such as shares, bonds, and investment contracts) far more strictly than ordinary goods or currencies. Securities laws exist to protect investors through mandatory disclosure, registration, and anti-fraud rules. So whether a crypto asset is a security is not a technical detail; it determines the entire compliance regime that applies.

There is no single global answer, because each jurisdiction defines and applies the concept differently. A few broad patterns help:

• United States: The Securities and Exchange Commission (SEC) has historically used the Howey test (explained in the next section) to decide whether a token sale is an "investment contract" and therefore a security. Assets that are not securities may instead be treated as commodities, which fall under the Commodity Futures Trading Commission (CFTC).
• European Union: The Markets in Crypto-Assets Regulation (MiCA) created a dedicated framework for crypto-assets that are not already covered by existing financial-instrument rules, with distinct categories such as asset-referenced tokens and e-money tokens.
• Other major markets: Jurisdictions including the United Kingdom, Singapore, Switzerland, Japan, and the United Arab Emirates each maintain their own classifications and licensing regimes, and some are widely viewed as more accommodating to token issuers than others.

The U.S. picture has been unusually active recently. An SEC crypto task force was established in early 2025 to develop clearer standards, and in March 2026 the SEC and CFTC issued joint interpretive guidance on how several categories of crypto-assets should be analyzed. Separately, Congress has debated comprehensive market-structure legislation (often discussed under the name of the CLARITY Act) that would sort digital assets into defined buckets and split oversight between the SEC and CFTC. As of this writing that legislation had not been fully enacted and the precise rules continued to evolve, so confirm the current status directly with the SEC, CFTC, or qualified counsel.

The practical takeaway: the same token can be regulated differently depending on where it is sold and how the offering is structured. If a token is deemed a security and was sold without meeting registration or exemption requirements, both the issuer and certain intermediaries can face serious legal consequences.

In the United States, the central tool for deciding whether something is an "investment contract" (and therefore a security) comes from a 1946 Supreme Court case, SEC v. W.J. Howey Co. The resulting Howey test asks whether an arrangement involves four elements. All four generally must be present for the asset to be treated as a security:

Applied to tokens, the first prong is almost always met, because buyers exchange value to acquire the token. The decisive questions usually involve the last two. If a project is still being built and buyers are essentially betting that the founding team's ongoing efforts will increase the token's value, regulators are more likely to see a security. By contrast, where a network is genuinely decentralized and functional, and the token is bought to be used rather than to profit from someone else's managerial work, the case for treating it as a security weakens. This idea (that an asset's status can change as a network matures) has been influential, though it is an interpretive concept rather than a bright-line statutory rule.

Important caveats apply. The Howey test is fact-specific; outcomes turn on how a token was marketed and sold, not on what it is called. It is also U.S.-specific, so passing or failing Howey says nothing about how the EU, the UK, or other jurisdictions would classify the same asset. Regulators' interpretations shift over time as well, and recent U.S. guidance has refined how these prongs apply to particular categories of crypto-assets. Anyone issuing a token, or building a product around one, should obtain current legal advice rather than self-diagnosing from a checklist.

Not everyone who wants crypto exposure buys and stores tokens directly. Crypto funds pool investor capital, or track an underlying asset, so that participants gain exposure without managing private keys, exchange accounts, or self-custody themselves. They range from regulated, publicly listed products to lightly overseen private vehicles, and the differences matter enormously for investor protection.

Common structures include:

• Exchange-traded products (ETPs), including spot bitcoin ETFs: In January 2024 the SEC permitted the first spot bitcoin exchange-traded products to list on U.S. national exchanges, and the regulated ETP market has since broadened. These products trade like shares, hold or track the underlying asset, and come with disclosure obligations and exchange-level rules designed to deter fraud. They are generally the most accessible and transparent route for ordinary investors, though they still carry the full price risk of the underlying asset and charge fees.
• Private crypto hedge funds and venture funds: Typically open only to institutional or accredited investors, these pursue active strategies with lighter public disclosure. They can offer broader exposure but involve higher fees, lock-ups, and counterparty risk.
• Index and basket funds: Vehicles that track a defined set of assets for diversified exposure rather than a single token.

Whatever the structure, the same diligence questions apply to any fund:

• Regulatory status: Is the fund registered or authorized, and by which regulator? A listed ETP on a major exchange sits under a very different regime than an unregistered offshore vehicle.
• Transparency: Review the prospectus or offering documents, the fee schedule, how often holdings are disclosed, and whether assets are independently verified.
• Custody and security: Find out who holds the underlying assets, whether a qualified custodian is used, and what protections exist against hacks or insider theft.
• Manager accountability: Examine the managers' track record, conflicts of interest, audit arrangements, and how decisions are governed.
• Risk and liquidity: Understand volatility, redemption terms, lock-up periods, and concentration in any single asset.

A regulated wrapper reduces certain operational and disclosure risks, but not market risk: if the underlying cryptocurrency falls, the fund falls with it. None of this is a recommendation to invest in any particular product, and tax treatment of crypto funds varies by jurisdiction, so confirm the rules that apply to you with a qualified professional.

Is every crypto token a security?

Are ICOs legal?

What is the difference between a security token and a utility token?

Are spot bitcoin ETFs safe?

How can I check whether a crypto fund is legitimate?