ICO Regulation - Regulation of Initial Coin Offerings

This article was posted on by White & Case LLP on the 15th of December 2017

With cryptocurrencies on the rise, start-up companies increasingly pursue a novel path to raise capital: the Initial Coin Offering ("ICO"). The frequent notion that ICOs are unregulated is misleading. Regulators have been making an effort to communicate regulatory guidance to issuers and investors. Determining an ICOs' feasibility and offering structure require conclusive consideration of various regulatory requirements across several regulatory environments on a case-by-case basis. Following a respective analysis, an ICO might also be a valuable add-on in the financing mix of larger companies.

What is an ICO?

ICOs are an increasingly popular method of start-up and other companies to raise capital. Investors participate in the fundraising by transferring fiat currencies, such as US dollar, Euro or Renminbi, or cryptocurrencies, such as Bitcoin or Ether, to the issuer in exchange for digital tokens ("Tokens"). Tokens represent a holder’s right of benefit or performance vis-à-vis the issuer. Tokens may also be used (exclusively) for payment to the issuing company for its services or products. Contrary to a traditional initial public offering ("IPO"), Tokens typically do not represent an ownership interest or dividend right in an entity. ICO investors seek to directly benefit from the issuing company’s future business, while investors in IPOs tend to pursue a long-term interest in the value-creation of the IPO entity.

The underlying technology of the Tokens is based on blockchain (an electronic distributed and therefore in general fraud-resistant ledger, in which transactions are protocolled in a documented and reproducible way without a central authority) which is maintained by a network of participants and computers. Utilising cryptography to record transactions, blockchains such as Bitcoin and Ethereum process, verify and track the trade of the relevant virtual currency (Bitcoin or Ether) securely across independent network components.

Similarly to IPOs, the issuer can use the proceeds of the ICO to finance its business operations and future growth. In the event that Tokens are exchanged for other cryptocurrencies, the issuing company can exchange them for fiat currencies like US dollar, Euro or Renminbi, as required. As the features of Tokens issued in ICOs can widely vary, every Token has to be assessed individually. Investors seem to place less emphasis on the individual features of the Tokens, but rather focus on the potential future upside. Tokens are typically tradable on virtual currency exchanges, creating a secondary Token market, which makes them fungible in the same way as shares.

To market an ICO, it is currently market practice that the issuing company publishes a whitepaper ("Whitepaper") on its website and certain virtual platforms. In the Whitepaper, the issuing company typically describes its business operations as well as the structure and features of the Tokens. The ICO documentation may also include a Token purchase agreement stipulating the terms and conditions pursuant to which investors can purchase the Tokens. While initially most ICOs were marketed globally, more and more ICOs are more restrictive and are only marketed to investors in certain jurisdictions or exclude investors in certain jurisdictions.1 While there is currently only limited reliable information available on the investors in ICOs, market participants suggest that many of these investors are in fact retail investors.

The international ICO market is operating at its highest levels. In 2016, more than USD 100 million were raised through ICOs globally.2 In November 2017 alone, ICOs yielded an estimated USD 740 million,3 with a 2017 global issuance volume exceeding USD 3 billion.4 The estimates for 2018 vary greatly, but the market is anticipated to continue the increase, despite rising regulatory pressure. This significant market growth and the fact that ICOs offer limited investor protection have caught the attention of regulators all over the world. Although an ICO-specific regulatory framework does not yet exist, this does not mean that the market for ICOs is entirely unregulated. Regulators are progressively applying existing securities and financial market regulations to ICOs. Regulators in some jurisdictions, such as France, are in the process of drafting specific ICO regulation on the basis of a public consultation paper.5 An effort is being made to provide regulatory guidance to issuers, investors and financial markets as a whole.

For an ICO to be in compliance with regulatory requirements, potential ICO issuers should seek qualified securities’ counsel advice to conclusively analyse the applicable legal framework.

Legal Classification of Cryptocurrencies and Tokens

The regulatory status of cryptocurrencies, including Tokens, largely depends on the jurisdiction of the issuance and the rights associated with the cryptocurrency.

For example, the US Commodity Futures Trading Commission qualified Bitcoin, one of the most popular cryptocurrencies, as a commodity in 2015.6 However, this qualification is limited to Bitcoin only and does not apply to other cryptocurrencies or Tokens, which therefore have to be analysed individually on the basis of their individual structure and features. The US Securities and Exchange Commission ("SEC"), for the first time, took a distinct approach in determining the nature of a Token in July 2017 during an investigation into an unincorporated organisation called The DAO.7 Conclusively, Tokens of The DAO were qualified as securities as the result of the application of a test pattern by the SEC (see below "Financial Regulation of ICOs – United States").

In April 2017, the United Kingdom Financial Conduct Authority ("FCA") launched a consultation on virtual currencies. Following this consultation, the FCA held that, depending on the structure of the individual cryptocurrency, it may fall into the regulatory perimeter. In December 2017, it has been revealed that the UK Treasury will consider extending the applicability of anti-money laundering regulations to cryptocurrencies in 2018. This may cause an obstacle to, if not deteriorate, the degree of anonymity among participants in the cryptocurrency market.

Despite a high level of harmonisation of financial markets regulation in the EU, the legal qualification of cryptocurrencies differs among EU member states. The European Securities and Markets Authority ("ESMA") has recently issued statements regarding investor risks and firms involved in ICOs. Investors are explicitly alerted of the high risk of investment default, market volatility, insufficient information availability and vulnerability of technology.8 In addition, ESMA concluded that Tokens may, depending on their structure, fall within the definition of a transferable security or a financial instrument. 9 It is expected that ESMA will continue to monitor market developments and issue a regulatory statement when required.

France, among others, is trying to regulate cryptocurrencies by adjustments to their payment services legislation.10 The Swedish central bank is evaluating the feasibility of a regulated, national e-currency.11 In Germany, cryptocurrencies are qualified as units of account by the German Financial Supervisory Authority ("BaFin") and are thus considered a financial instrument.12

Regulators in the United Arab Emirates have backed the commodity-categorisation of cryptocurrencies, while individual Tokens, issued in connection with an ICO, may be regarded as securities, depending on the specific structure and characteristics of such Tokens.13

Canadian regulators concluded that many cryptocurrency offerings, including Token sales through ICOs, are to be qualified as securities, while not distinguishing between commodities and securities.14 In Singapore and Australia, Tokens are qualified as securities provided that the Tokens feature certain additional rights, such as ownership or voting rights.15 The regulatory guidance by the Australian Securities & Investments Commission is extensive, providing a thorough analysis on the applicability of national legislation, based on attributes of typical forms of offerings.16

Financial Regulation of ICOs

Existing legal uncertainties in relation to cryptocurrencies equally extend to ICOs. The specific crowd-lending regulation cannot be applied to ICOs as investors in an ICO do not grant a loan to the issuer. The purchase of Tokens issued in connection with an ICO can be qualified as a purchase of commodities, a purchase of rights or a purchase of securities which may ultimately subject ICOs and Whitepapers to prospectus or other disclosure requirements.

Some issuing companies are launching their ICOs in what are perceived as "ICO friendly" jurisdictions, including Singapore and Switzerland. Such companies register their office in these jurisdictions and include a governing law clause in their ICO documentation, trying to limit the applicable regulatory regimes to the potentially ICO friendly regime. Uncertainty exists, however, whether this is a viable approach.

Applicable regulations are not necessarily limited to those of the jurisdiction governing the ICO. When marketed to investors residing or domiciled in another jurisdiction, financial regulatory rules of such jurisdiction may equally apply to the ICO. A governing law clause does not dispense the ICO issuing company from compliance with such financial regulation. Publishing the Whitepaper in a certain language may already be presumed as marketing of an ICO and consequently cause regulatory exposure. For example, a Whitepaper in German is likely to be considered as targeting investors in Germany, regardless of the issuers' residence, and would consequently subject the ICO to full-width German regulation. Existing investor-targeting regulation, for example in relation to market sounding, should be considered to reduce the risk of incompliance until further guidance becomes available.

Issuers of ICOs will be required to limit accessibility of ICO information and documentation to those residents of those jurisdictions that were pre-determined prior to launching the ICO on the basis of a regulatory feasibility analysis. Failure to do so is likely to increase regulatory scrutiny by competent regulators.

Regulatory environments for ICOs differ globally. The below outlines the current regulatory environment for certain jurisdictions:


The BaFin will determine the applicability of certain national legislation including the German Banking Act (Kreditwesengesetz), the German Securities Prospectus Act (Wertpapierprospektgesetz), the German Capital Investment Code (Kapitalanlagegesetzbuch), the German Capital Investment Act (Vermögensanlagengesetz) and the Payment Services Supervisory Act (Zahlungsdiensteaufsichtsgesetz) on an individual basis. The application of such legislation will therefore depend on the contractual arrangements of each ICO.17 Where Tokens resemble participations rights which might be classified as securities under the German Securities Prospectus Act (Wertpapierprospektgesetz) or capital investments under the German Capital Investment Act (Vermögensanlagengesetz), a prospectus for the marketing of the Tokens may be required. Any act of trading, including an arrangement for acquisition, sale or purchase of Tokens, when qualified as units of account, would, as a general rule, require a license by the BaFin.

United Kingdom

The FCA issued a statement in September 2017 which established that many ICOs fall outside the scope of existing regulations without indicating specific reasons, although the FCA seems to generally require a case-by-case analysis of facts.18 Consequently, an ICO could be considered as deposit-taking, e-money issuance, contract for difference, derivative or a collective investment scheme.


The French Financial Market Authority ("AMF") recently issued a public consultation paper indicating that ICO regulations will be drafted after the end of the consultation period in late December 2017.19 An anticipated regulation of ICOs is facilitated by certain framework propositions pursuant to which ICOs could be regulated. While the AMF neither defines ICOs or Tokens under French law in its consultation paper, the forthcoming definition of Tokens will determine their qualification under national legislation in the future.

European Union

The ESMA has explicitly set out the potential applicability of various regulatory frameworks in connection with ICOs. An ICO with Tokens that are considered to be transferable securities would be submitted to applicable EU regulations. In particular, compliance with the following regimes and obligations would be required:

  • Prospectus Directive: publication of an approved prospectus when securities are offered to the public with exceptions for offers (i) to qualified investors (as defined in the Prospectus Directive), (ii) to fewer than 150 natural or legal persons, (iii) of at least EUR 100,000 per investor and (iv) with a minimum denomination of EUR 100,000.
  • Markets in Financial Instruments Directive, as amended: licensing requirements, product governance rules, pre- and post-trading transparency requirements, requirements for adequate systems and controls, organisational requirements for trading platforms, requirements for companies active in algorithmic and/or high frequency trading, among others.
  • Alternative Investment Fund Manager Directive: licensing requirements, conduct of business and transparency requirements, prospectus and disclosure requirements, mandatory appointment of depositories and custodians, restrictions on the use of leverage, among others.
  • The 4th Anti-Money Laundering Directive: due diligence on customers and ongoing monitoring of customer relationships, requirements regarding systems and controls and record-keeping, reporting on suspicious activities and co-operation with any investigations by relevant public authorities.


The Swiss Financial Market Supervisory Authority has published market guidance in late September 2017. Depending on the structure of an ICO, the Swiss regulator determined, among others, that supervisory regulations, collective investment scheme legislation and banking law provisions may be applicable to specific ICOs.20 Accordingly, issuers should carefully asses these recent regulatory changes when structuring an ICO and marketing ICOs, particularly in Switzerland, may no longer be advantageous.

United States

The applicability of federal securities laws to ICOs depends on the classification of the Tokens. The SEC determined in a first evaluation that Tokens may be qualified as securities as a result of the Howey21 test. The DAO investigation report indicates that the SEC will conclude that Tokens offered in connection with an ICO will be classified as securities if the ICO is, implicitly or explicitly, presented to purchasers as an investment opportunity. Accordingly, Tokens may not be lawfully sold without SEC registration or an exemption therefrom, such as under Regulation S, which in itself requires registration. The public offering of Tokens that qualify as securities necessitates a registration statement and a SEC-approved prospectus to comply with US securities laws.22


In September 2017, the Chinese government declared ICOs to be illegal in China and asked all related fundraising activities to be halted immediately.23 Shortly thereafter, cryptocurrency exchange platforms were ordered to discontinue operations. However, the ban of virtual currencies and ICOs may only be temporary until the Chinese government passes specific regulation, which is currently being discussed.

South Korea

In late September 2017, the South Korean Financial Services Commission has determined that ICOs shall be prohibited.24 South Korea will follow the Chinese model and formally introduce legislation regarding the ban, though the enforceability of the current ban has been scrutinised by some.25 The operation and participation in cryptocurrency exchanges is expected to be regulated as well and the associated regulation drafts are in their final stages. Subject to stringent compliance with certain standards for consumer protection, these measures are also triggered by the growing international trading significance of cryptocurrency. 26

Documentation Requirements

Even when Tokens are not qualified as securities (or otherwise to legislation triggering prospectus requirements), ICOs and Whitepapers have to conform to generic anti-fraud and information requirements. Information requirements may apply to the issuer and any other party involved in the sale and marketing of Tokens. Going forward, determinations by the FCA, ESMA or SEC may provide more detailed regulatory guidance (see "Recent Developments and Market Overview" below).

Generally, transaction documentation must include all necessary information to permit an average investor to make a reasonable investment decision. The documentation must be accurate and not misleading, comprehensive, transparent and include potential risk factors as well as a description of the characteristics of the Tokens and the business of the issuer. Statements on future developments must be reasonable and disclosure on the use of proceeds is required. If qualified as general terms and conditions, the terms of the sales documentation must comply with specific local requirements.

Whitepapers relating to many previous ICOs may not always have complied with the above standards. Transparency and comprehensiveness of a Whitepaper are currently not examined by regulatory authorities in the above jurisdictions. Risk factors, if included at all, are frequently limited to vaguely standardised descriptions of potential conflicts. It is also doubtful to what extent a reasonable investment decision can be made in the absence of (audited) historic financial information, but conversely, ICOs frequently occur in the early stages of launching a business.

There is currently no established case law available in respect of inaccurate, incomplete or misleading ICO documentation. This may change as a result of recent SEC investigations (such as outlined below) or when investors are seeking damages for ICO investment losses.

Recent Developments and Market Overview

On 1 December 2017, the SEC filed charges against two Canadians, determined to be the individuals behind PlexCorp, who had issued an ICO in August 2017.27 For the first time, the newly established SEC Cyber Unit created to, among others, monitor ICOs more closely, filed a complaint. It was alleged that the individuals had made false statements to prospective investors prior to the ICO, and to have intentionally hidden the involvement of one individual, who, in the complaint, is referred to as a recidivist securities law violator in Canada. Québec authorities have allegedly asked a court to sentence this individual to a six-month prison sentence following investor solicitation. The SEC is investigating movement of the ICO funds to track funds flow and to, ultimately, step in to protect retail investors. It has summarised in its complaint that such ICO was in itself an illegal offering of securities due to a lack of registration. The developments must be monitored closely. Depending on the circumstances, findings of similar significance to The DAO investigation may follow and will set guidelines, presumably of explicit relevance in terms of documentation requirements.

With the United Kingdoms' push for applicability of anti-money laundering laws on cryptocurrencies described above and other regulators pursuing similar plans, a potential shift in jurisdiction of ICOs may occur in the near future. Due to a lack of international uniformity, it is unlikely, however, that ICO activity will decrease substantially for that particular reason.

On 30 November 2017, PricewaterhouseCoopers Hong Kong has announced that it will be accepting Bitcoin and other established cryptocurrencies as a satisfactory method of payment. An increasing number of customers in the digital-asset and cryptocurrency space have led to this decision, which it believes will evolve into a regular practice going forward.28

On 10 December 2017, Bitcoin futures contracts trading commenced on the Chicago Board Options Exchange, adding credibility to one of the most popular cryptocurrencies. The Chicago Mercantile Exchange has communicated it will follow on 18 December 2017.29 Futures contracts allow for hedging against currency-fluctuation risks.

Outlook on Future ICO Regulation

Regulatory authorities around the globe appear to pursue different approaches in the regulation of ICOs.

Some attempt to regulate ICOs by applying existing securities and other regulation. This approach is, for example, pursued by the SEC, the Canadian Securities Administrators, ESMA and regulators in Australia and Singapore.

Regulating ICOs under the securities legislation certainly has advantages. It will provide investors with a strong level of protection and could help establishing ICOs as an alternative way to raise funds. Considering The DAO investigation and the PlexCorp investigation by the SEC, it remains to be seen what impact these investigations will have on the ICO market as a whole. Some ICOs already exclude US citizens from an investment. In the EU, ESMA took the view that existing regulation should be sufficient to regulate blockchain technology. As the views of national regulators regarding the regulatory qualification of ICOs can differ, and as there is no uniform ICO or cryptocurrency regulation, launching an ICO can be very challenging.

It is primarily Asian regulators who seem to follow a different approach in their process by drafting and establishing ICO-specific regulation.

Despite these differences, nearly all jurisdictions do currently apply anti-money laundering laws to cryptocurrencies or the applicability is at least intended in the nearest future.


ICOs are an innovative and appealing method for companies to raise capital. The assumption of some market participants that ICOs were unregulated is misleading. Although there is currently no specific ICO regulation in place, blockchain technology does not liberate users from the need to comply with the existing regulatory framework. A diligent analysis of the regulatory framework is necessary to identify and ensure legal compliance with all applicable laws prior to launching an ICO. Legal challenges arise especially if an ICO targets investors globally. Regardless of the Token structure and their qualification, the issuing company needs to provide investors with sufficient and accurate information and disclose such information comprehensively and transparently to permit an average investor to make a reasonable investment decision.

Non-compliance with any of the above may impose a range of severe legal consequences for an ICO issuer. It is highly advisable to seek legal advice and guidance at all stages of an ICO, beginning with its structuring throughout its completion, including documentation thereof. With such a thorough analysis, structuring and documentation, an ICO might be a valuable add-on in the financing mix of corporate companies.