What is a governance token?

A governance token confers voting rights in a decentralised protocol, DAO, or blockchain-based system. Holders use governance tokens to vote on parameter changes, protocol upgrades, treasury allocations, and the general direction of a project. The phrase ‘governance token’ originates within the web3 community, as a way to distinguish these tokens from those with other uses. Most would simply lump these tokens in with the wither category of utility tokens. In theory, governance tokens are the mechanism through which decentralised communities exercise collective control. Practically speaking, founders must be careful that they are not creating a security token by accident.

Why governance tokens are a distinct and tricky category

Governance tokens were conceived as a way to implement decentralised decision-making - giving token holders meaningful control over a protocol without any central authority. Governance tokens predate 2020 - MakerDAO's MKR token, which gives holders voting rights over the DAI stablecoin system, has existed since 2017, and DigixDAO's DGD token was sold as early as 2016. What Compound's COMP token did in June 2020 was something different: it combined governance rights with liquidity mining, distributing tokens as rewards to protocol users and triggering the "DeFi Summer" that made governance tokens a standard feature of the ecosystem. The template it established - holders vote on protocol parameters, outcomes are binding, tokens are distributed to active participants - was rapidly adopted by Uniswap's UNI, Aave's AAVE, Curve's CRV, and dozens of others.

The legal complication is that governance tokens - especially in DeFi - rarely exist in isolation from economic rights. A token that gives you a vote on how protocol fees are distributed also, in effect, gives you a financial interest in the protocol's revenue. A token that controls a DAO treasury gives holders indirect control over a pool of assets with real economic value. This creates two distinct but overlapping regulatory questions that run in parallel, not as alternatives.

The first issue: securities. You need to consider whether the token is a security - does it represent an investment contract conferring financial rights derived from the efforts of others, or otherwise fall into the securities rules of a relevant regulator?

The second issue: collective investments. The second, and often more pointed question, is whether the token constitutes an interest in a collective investment scheme. For that, you need to consider what the token actually does. . Do the token holders have some sort of rights over the value of the treasury? Is the pooled treasury structure a managed collective vehicle in which participants share profits without individual day-to-day control over the assets? A DAO where token holders vote episodically on treasury allocation but none individually manages the assets may satisfy the CIS definition in multiple jurisdictions regardless of whether the token is also a security. In the UK, the FCA's CIS definition under FSMA is broad enough to capture arrangements that don't look like conventional funds. In the EU, AIFMD may apply to DAO treasury structures that resemble alternative investment vehicles. In the US, the equivalent framework is the Investment Company Act of 1940: a DAO whose treasury consists primarily of securities may constitute an unregistered investment company, with severe consequences - contracts become voidable and the SEC can seek disgorgement and injunctive relief.

The CIS risk is not symmetric across the decentralisation spectrum. For something to be a CIS, it requires not just an absence of day-to-day control by participants, but also the presence of an identifiable manager making discretionary decisions about the pooled assets on their behalf. Protocols that describe themselves as decentralised but retain a core team with effective discretion over treasury management face more CIS exposure than genuinely algorithmic structures

Regulators and courts have been grappling with web3 securities and CIS questions for years, and founders will also need to do so. It pays to get into the weeds on these points - EntityLayer will happily introduce teams to our legal network.

How governance tokens are classified

A ‘governance token’ is an industry category, one used to describe the form and function of a token. It is not a legal concept - no major jurisdiction has created a regulatory category called "governance token." Regulators are concerned with the underlying economic substance of a token.

In every jurisdiction covered here, the legal analysis focuses on (a) whether a token is a security and (b) whether or not it governs an asset in such a way that it constitutes an interest in a collective investment scheme. If a token is held to be a security,, securities law applies in full. If it is not, the token falls into the residual non-security crypto-asset category in that jurisdiction - "other crypto-assets" under MiCA, "digital tools" under the SEC's 2026 taxonomy, outside the specified investments perimeter in the UK, not an "investment" under BVI's SIBA, not a security under Panama's Decree Law 1. The governance characteristics of the token are relevant only insofar as they inform whether it crosses into security or CIS territory - they do not create a separate regulatory track of their own.

The CIS analysis is a separate overlay that can apply regardless of whether the token itself is a security - but again, there is no governance-specific CIS category. It is the general CIS test applied to the arrangement behind the token.

This means the practical question for any governance token project is identical to the question for any other token project: does this token, on its actual economic substance and the circumstances of its issuance, meet the definition of a security or a CIS interest in the jurisdictions where it will be offered? If not, it is treated as a utility token - or whatever the local equivalent label is - for regulatory purposes.

United States

The operative test is Howey: investment of money in a common enterprise with an expectation of profits from the efforts of others. A governance token that passes this test is a security. One that does not maps most closely in the joint SEC-CFTC Interpretive Release of March 2026 to "digital tools" — tokens providing access to or participation in a functional system — and sits outside securities law. No licence or registration is required for issuance of a non-security token.

The difficulty is achieving non-security status in practice. A governance token sold in a fundraise creates profit expectations at the point of sale regardless of its subsequent pure-governance function. The 2026 Interpretive Release provides a pathway out: a token that was a security at issuance can separate from that status once the issuer fulfils its promises and the system becomes functional. But that pathway applies after the fact - at launch, the Howey analysis applies to the facts at issuance. The Investment Company Act of 1940 adds a second layer where the token governs a treasury: a DAO whose assets are managed collectively for token holders' economic benefit may constitute an unregistered investment company regardless of whether the token itself is a security.

United Kingdom

Under the current framework, a governance token that is not a specified investment under FSMA 2000 sits outside the regulated perimeter for the token itself - treated, in regulatory terms, the same as a utility token. No FCA authorisation is required for issuance. Two obligations still apply regardless: the financial promotions regime under PS23/6 for marketing transferable tokens to UK consumers, and AML registration for firms in the distribution chain.

From October 2027, the FSMA (Cryptoassets) Regulations 2026 introduce a comprehensive regime under which public offers of qualifying cryptoassets will be prohibited unless an exemption applies. The FCA has explicitly deferred its DeFi guidance - the operative question under the new regime is whether there is an "identifiable controlling entity" carrying on regulated cryptoasset activities. For a genuinely decentralised protocol, the perimeter may not be engaged, but the FCA has flagged further consultation is needed and the position remains uncertain. The CIS analysis under FSMA runs independently of the security question: a DAO treasury governed by token holder votes, with no individual managing assets continuously, maps closely to the FCA's broad CIS definition regardless of the token's own classification.

European Union

Under MiCA, a governance token that is not a financial instrument under MiFID II is an "other crypto-asset" - the same category as a utility token, with the same whitepaper and notification requirements and no issuer-level licence. The classification question is therefore whether the token crosses into MiFID II territory. ESMA's March 2025 guidelines are the operative test: voting rights that lead holders to participate in economically significant decisions — profit distribution, capital allocation, treasury management — may constitute financial instrument characteristics under MiFID II. A token with no economic dimension and no influence over financial outcomes should remain within MiCA's lighter regime; demonstrating that in practice requires careful factual analysis before the whitepaper is filed. AIFMD adds the CIS overlay independently: a DAO treasury functioning as a collective pool of any assets managed on behalf of token holders for economic return may qualify as an Alternative Investment Fund regardless of the token's own classification.

Cayman Islands & BVI for governance tokens

The BVI lacks a specific ‘governance token’ category, and enables license-fee token issuance for any token that is not a security. As a result, governance tokens are often issued here, and their associated treasury - if there is one - managed through the Cayman Islands The Cayman Islands is the most widely used jurisdiction for DAO treasury structures precisely because its regulatory framework does not sweep them in. The Cayman Foundation Company - the vehicle used by Uniswap, dYdX, and most major DeFi protocols - has no shareholders and issues no investment interests. It holds assets for a defined purpose under a private charter, governed by a supervisor rather than investors. This structure sidesteps the CIS analysis: there is no pooling of investor capital in exchange for interests in a collective vehicle, and the Cayman regulatory framework for mutual and private funds is triggered by the issuance of "investment interests" to investors - a condition a properly structured foundation does not meet. Cayman's Private Funds Act 2020 and Mutual Funds Act are defined narrowly enough that a DAO foundation holding a treasury of digital assets for a defined protocol purpose falls outside their scope.

Panama

Panama does not have a VASP law, and so it has definition of a ‘governance token’, Instead, the emphasis is on working out if ti si a security or a CIS. The SMV's jurisdiction under Decree Law 1 of 1999 covers collective investment schemes offered to the Panamanian public - it does not extend to privately-held asset pools that are not publicly offered and not targeted at Panamanian residents. A Panama Private Interest Foundation holding a DAO treasury sits outside this perimeter: the PIF holds assets as its own property for a defined purpose, issues no investment interests to the public, and has private beneficiaries rather than investing members. Panama has no general regulatory sweep equivalent to the UK's FSMA CIS definition or the EU's AIFMD that would capture a privately-held asset pool regardless of its legal form. The caveat that applies here - as it does to Cayman - is that this analysis addresses Panamanian law only. Token holders located in the UK or EU may still be participating in a CIS under their own jurisdiction's law regardless of how the structure is characterised in Panama.

Switzerland

FINMA does not have a "governance token" category. Like every other major jurisdiction, it applies its existing three-part taxonomy - payment tokens, utility tokens, and asset tokens - on a substance-over-form basis, as established in its ICO Guidelines of February 2018 and maintained in subsequent guidance. A governance token that confers only voting rights over protocol parameters, with no financial claim against an issuer, maps most naturally to the utility token category: tokens intended to provide digital access to an application or service by means of DLT infrastructure. Utility tokens in Switzerland fall only within the scope of the Anti-Money Laundering Act (AMLA) - no FINMA licence is required for issuance, and no prospectus obligation arises. A governance token that also confers financial rights — profit participation, a share in protocol revenues, or a claim against the issuer — will be assessed as an asset token, which FINMA treats as a security, engaging the prospectus requirements of the Code of Obligations for public issuances.

The Collective Investment Schemes Act (CISA) analysis runs separately for treasury-linked governance structures. FINMA's ICO guidelines note that while Banking Act and CISA requirements are "not typical" for token issuances, the analysis must be conducted on a case-by-case basis - and the CISA definition of a collective investment scheme is broad: assets raised from investors for collective management with a view to generating returns, where investors do not have day-to-day control. A DAO treasury managed collectively by token holders on a voting basis can engage this analysis regardless of the token's own classification. The Swiss Association used as a governance wrapper mitigates this risk structurally because it does not itself manage the treasury: the treasury typically sits on-chain in a multisig, with the Association's governance decisions directing what happens to those assets without holding them directly. This separation between the governance layer and the asset layer is therefore not just administratively convenient - in Switzerland, it is substantively important for keeping the structure outside CISA's scope.

The decentralisation defence

An important concept for governance token projects which do govern some sort of financial value is the decentralisation defence: the argument that a sufficiently decentralised protocol is no longer subject to securities regulation because there is no longer a central enterprise or central team whose efforts token holders are relying upon.

The US SEC has acknowledged this principle - most notably in its position on ETH, which it has treated as a commodity rather than a security on the basis that the Ethereum network is sufficiently decentralised. In the UK and EU, by contrast, decentralization is not an independent defence but matters only insofar as it contributes to a wider analysis regarding whether or not the token meets their definition of a security.

What constitutes "sufficient" decentralisation is not defined with precision anywhere. The factors that regulators have pointed to include:

Whether the founding team retains operational control over the protocol
Whether token holders can genuinely change protocol parameters without the founding team's involvement
Whether the information asymmetry between insiders and token holders has diminished
Whether the protocol's utility is the primary driver of token value, rather than the founding team's future efforts

Most governance token projects at the time of their initial token distribution are not sufficiently decentralised to rely on this defence. The typical progression is: centralised founding team builds protocol → governance token is distributed → over time, governance and operational control migrate to the community → decentralisation defence becomes available. The legal risk is highest at the beginning of that journey.

Structuring a governance token launch

The structural decisions that most affect a governance token's legal risk are:

The DAO wrapper. Governance token projects use a variety of structures - foundation, DAO LLCs, associations. Foundations are often used. The foundation holds the treasury, owns the IP, and provides the governance framework. The absence of shareholders is deliberately chosen to avoid the "common enterprise" element of the Howey test. See our DAO and protocol wrappers use case page for a detailed comparison of foundation options.

The token distribution mechanics. How the token is distributed matters as much as what it does. A sale to the public for investment purposes is a much harder argument than a distribution to active users, protocol participants, or contributors for their participation. Many projects combine a small private sale (to qualified investors, under applicable exemptions) with a broad community distribution (to users who have earned tokens through protocol participation).

The economic rights question. Before launching, be explicit about whether the governance token will also generate economic returns. If it will — through staking rewards, protocol fee distributions, or treasury access — that economic dimension needs to be part of the classification analysis, not treated as separate from the governance dimension.

The jurisdiction for issuance. The BVI and Panama are the most common offshore choices for governance token issuances. The BVI's flexibility and zero-tax environment, combined with the structural cleanness of the foundation + token issuer approach, make it a natural fit. Panama offers a faster, cheaper alternative with the SMV's explicit non-securities position on tokens. See our token issuance use case page for the full structural breakdown.

FAQ

Is a governance token a security? It depends on the specific token and the specific jurisdiction. A pure governance token for a genuinely decentralised protocol, with no economic rights attached, may avoid securities classification in many jurisdictions. A governance token sold in a public offering by a centralised founding team, with the promise that token holders will benefit from the team's future efforts, is likely to be treated as a security in the US under the Howey test and may engage MiFID II in the EU if it effectively functions like an equity instrument. The honest answer is that governance token classification requires specific legal analysis on the specific facts.

Can I distribute governance tokens for free to avoid securities law? Not reliably. Regulators have taken the position that "free" distributions - airdrops, community rewards - can still constitute investment contracts if they were used to create value expectations or compensate people for prior investment of money, time, or assets. The form of the distribution matters less than the economic substance.

What is the difference between a governance token and a share? A share in a company confers ownership, voting rights in corporate governance, and typically economic rights (dividends, liquidation preference). A governance token in a decentralised protocol confers voting rights in protocol governance but does not confer ownership of the protocol or the issuing entity. In practice, when a governance token also gives effective control over a treasury or protocol fee revenues, the economic distinction from a share narrows considerably — which is why the classification analysis becomes difficult.

Do governance tokens need a MiCA whitepaper? If they are offered to the public in the EU and classified as "other crypto-assets" under MiCA, yes - a compliant whitepaper must be notified to the relevant national competent authority at least 20 working days before the offer. If they are classified as financial instruments under MiFID II (because they function like transferable securities), MiCA does not apply and EU securities law governs instead. The whitepaper obligation is a MiCA-specific requirement; the securities law prospectus obligation is a separate and heavier one.

How much of my governance token supply can I sell without triggering securities issues? There is no safe percentage. The classification analysis is about the nature of the token and the circumstances of the offering, not about what proportion of the supply changes hands. That said, restricting sales to qualified investors under applicable private placement exemptions - rather than offering to the public — significantly reduces regulatory exposure regardless of the proportion sold.

This article is for informational purposes only and does not constitute legal or financial advice. Governance token classification involves complex, jurisdiction-specific legal analysis. Always seek qualified legal advice before structuring or distributing a governance token.

EntityLayer advises web3 founders and international counsel on governance token structuring, DAO wrappers, and entity formation across the BVI, Panama, UAE, and EU.

Launching a governance token or DAO? Book a consultation with our team — the structural decisions you make before the token launch are the ones that matter most.