What is a financial product?

The EU’s MiCA review consultation closed on September 30th, 2026. The consultation covers a wide range of issues: the treatment of tokens, the relationship between cryptoassets and the financial system, the operation of stablecoins in the EU, the use of international stablecoins in the bloc, and broader questions around staking, lending and DeFi. The review is an important moment to take stock of crypto regulation, not only in the EU but globally. Which parts of the regulatory framework are working, and which still need refinement? Beyond MiCA and the EU, we see these questions coming up again and again all around the world. In this article, we’re going to focus on two things that are top of our minds at the moment: what we think MiCA gets right about token classification, and how to treat DeFi.  Both issues turn on the same basic question: should regulation attach to the technology itself—the token or DeFi protocol—or to the underlying economic activity and risks? This distinction is important, because regulating the technological form rather than the economic activity risks creating different regulatory outcomes for activities that generate substantially the same risks - while potentially imposing financial regulation on technology that is not itself performing a financial function. MiCA was designed with this in mind. What the EU gets right on token classification It’s interesting that the MiCA review consultation starts off with a question essentially asking if MiCA was right all along or not. We think it was.  As a brief recap, MiCA says that if something based on a blockchain - e.g. an asset or a financial instrument - is already treated under existing rules, then it stays under those rules. Only if something based on a blockchain  is not already captured elsewhere, then will it be covered by MiCA. This means that MiCA’s scope predominantly captures unbacked cryptoassets and stablecoins (defined as e-money tokens and asset-referenced tokens - or EMTs/ARTs).  We think this clarity is one of MiCA’s most important contributions. It avoids confusion over the treatment of a financial instrument - a corporate bond for example - which is tokenized via a blockchain. This is important, because tokenization should not, in itself, change the regulatory character of an asset. A bond does not stop being a bond because ownership and transfer are recorded on blockchain-based market infrastructure rather than traditional database-based infrastructure. The relevant questions remain what rights the instrument represents, what economic function it performs and what risks arise from its issuance, trading and settlement. And this is what MiCA does: it fundamentally separates out the treatment of native  tokens issued and circulating on a blockchain from tokenized traditional financial instruments that are governed by the existing body of financial regulation. In practice, there remain some areas in which more clarity is needed. MiCA is a common EU framework for on-chain tokens, but a tokenised financial instrument remains under (potentially diverging) Member State national treatment of MiFID and other less harmonised EU rules. In tokenised asset markets, one of the biggest potential benefits is the ability for assets and liquidity to move more seamlessly across markets. Fragmentation in the legal and regulatory treatment of tokenized assets can therefore recreate some of the barriers that the technology is capable of removing operationally. This doesn’t necessarily cause intractable problems, but until there is clear direction on how to resolve this, the market for tokenised finance in the EU may be slower to develop. The EU is aiming to close some of these gaps via its DLT Pilot Regime update and its Market Integration and Supervision Package, as part of its goal to develop a Savings & Investment Union. So we support the core step of MiCA in how it classifies tokens, but as the market evolves there is always a need to look to see what new issues arise. DeFi in Europe: When Is It infrastructure, and When Is It intermediation? Regulating DeFi is a challenge for regulators globally. The EU decided to solve this challenge by explicitly carving it out of MiCA on the grounds of immateriality (the market just wasn’t that big at the time). It’s now looking at that decision again. Financial regulation typically operates by finding (or designating) someone responsible for a regulated activity, and then imposing requirements on them. In a fully decentralised protocol, there is by definition no ‘person’ who is responsible at all, so this approach is not workable. That’s why regulators often look to define ‘control’ over a DeFi protocol or a product using DeFi, to decide whether it is ‘really’ decentralised or not. In seeking to define and find ‘control’ they often create such laboured and detailed definitions, that one might come away under the impression that nothing is really decentralised at all. The operative theory is that if someone or some entity has enough ‘control’ over the protocol then they can be said to run it, so it isn’t truly decentralised, and thus the regulatory problem falls away as existing regulation can now apply. At first glance, this is a fairly reasonable approach to take, but in practice it has led to regulators spending a great deal of time trying to work out how to define ‘control’ and at what level this would give rise to regulatory accountability. This is not just an EU problem; it is also taking place in the US and elsewhere. We think a clearer way of looking at the issue is to separate out the instances in which a DeFi protocol is being used as infrastructure, and when it is acting as an intermediary (like a financial intermediary). What matters is who has control over the token, and the activity associated with it, and who has the ownership and ability to direct the token at any given time,  as opposed to the platform, protocol or interface that is being used to manage that activity. In this approach, regulation attaches to the owner, intermediary and activity - as it does in traditional finance - and not to the infrastructure ‘pipes’ that the activity runs through.  The difficulty is that control over different technical aspects of a system does not necessarily amount to control over the financial activity taking place through it. A developer may be able to update software, a governance body may be able to change protocol parameters, and an interface provider may determine how users access a protocol. None of those things necessarily means that they take custody of users’ assets, make decisions about how those assets are deployed, or intermediate a transaction between financial counterparties. Where an intermediary takes control of customer assets or exercises discretion over how they are deployed, there is a much clearer basis for regulatory accountability. Where software merely provides infrastructure through which users transact, the case for treating that infrastructure itself as a financial intermediary is much weaker. To give an analogy: just because someone is sending money from the banking app on their phone doesn’t mean that the telephone network provider needs to be regulated as a financial intermediary. We think this logic also holds for tokenised finance and DeFi. This doesn’t mean that activity taking place through DeFi shouldn’t be regulated. The question is where that regulation should apply. If a regulated firm uses a decentralised protocol to provide a financial service to its customers, it should still be responsible for that service. And if an intermediary takes custody of customer assets or makes decisions about how those assets are used, it should be regulated accordingly. But that doesn’t mean the underlying protocol or infrastructure should itself be treated as a financial intermediary. Conclusion The MiCA Review consultation has been a good opportunity for both the ecosystem and regulators to take stock of the approach to crypto regulation more generally. It is an exercise that has been initiated in the EU,because the EU was first to regulate this space, and hence the first to launch a formal review process. This is a good step, and helpful in a more global context, as other countries finalise their own cryptoasset regulatory frameworks, or similarly take stock of how it is working out in practice. We continue to support MiCA, and the Review, and look forward to seeing how it develops. As the market develops, regulation will need to continue to develop alongside it. That doesn’t necessarily mean bringing every new technology or activity within the regulatory perimeter. The important thing is to look at what an activity actually does, what risks it creates, and where regulatory responsibility should sit. This is the approach that sits at the heart of MiCA, and we think it remains the right one as tokenisation and DeFi become a more established part of financial markets.

Last year we explained why token is the most useful general term for the things that live on blockchains: more precise than "cryptoasset," less loaded than "cryptocurrency" and flexible enough to cover everything from a stablecoin to a digital concert ticket. We also promised to come back and explain how tokens themselves can be classified from a regulatory point of view.  Tokenization of real-world assets is no longer a proof-of-concept. Money market funds, government bonds, trade receivables, and real estate are being tokenized and settled on-chain across multiple jurisdictions. That is genuinely good news for the efficiency and accessibility of financial markets. But it creates a regulatory question that existing frameworks have not fully answered: when a blockchain network hosts both its own native token and a tokenized security or fund, are those two things the same kind of thing? The answer is obviously no. Yet much existing regulation treats them as if they might be. That ambiguity is becoming increasingly difficult. What Actually Changed: Two Kinds of Tokenization Before getting to the classification problem, it is worth being precise about what tokenization actually means in 2026, because the word covers two distinct phenomena with very different implications. The first is off-chain assets that are tokenized: an existing bond, fund unit, or claim that is represented on a blockchain. The underlying asset exists independently of the chain; the token is a digital wrapper or record of title. The second is assets that are natively tokenized: something that only ever existed on-chain, with no off-chain counterpart. A protocol token - the native token of a blockchain network - falls into this second category. It was not created to represent something else. It is something in its own right. But it can also apply to traditional assets like stocks and bonds, which can either exist natively in tokenized form or through a “digital twin” on chain that represents the offchain asset. This dichotomy is highlighted by these two SEC no-action letters: HQLAx, which uses digital twins, and DTC, which wants to tokenize natively. This distinction matters technically, because the custody and settlement mechanics differ. It matters commercially, because the valuation logic differs when comparing a stock and a protocol token. And it matters legally, because the rights and obligations differ. Regulation that conflates the two kinds will produce the wrong outcome across all of these metrics, as this paper from Wharton recognizes. From "Native DLT Token" to "Protocol Token": Why the Language Shift Matters Traditional labels such as “Native DLT Token” emphasize the technology of a token: the token originated on a distributed ledger. That framing made sense in an earlier era, when regulators were primarily concerned with "is this crypto or not?". But this simplistic terminology is no longer adequate. The Avalanche Policy Coalition prefers the term protocol token. While this term still clearly delineates the technology, it also  emphasises the function: these are tokens that are integral to the operation of a blockchain protocol. They are used for staking, validation, governance, and transaction fees. Their value derives from utility within the protocol, not from a claim on an external issuer or an underlying asset. That makes them a fundamentally different economic and legal animal from a tokenized share, a tokenized bond, or a stablecoin - even if they all exist and transact along the same blockchain. This specificity matters enormously for how regulation applies, and indeed, whether that regulation is effective. In the EU, MiCA recognizes what it calls “other cryptoassets” - “other” because they are not a form of stablecoin (EMT or ART) defined by MiCA - which would include what we call protocol tokens. It provides a category for these tokens by carving them out of its scope, but a carve-out is not the same as a definition. It tells you what something is not; it does not tell you what it is. As the tokenized economy matures and regulators return to fill gaps in MiCA's architecture,- through ESMA guidance, European Commission consultation, and the next phase of EU digital finance legislation, an affirmative, function-based definition of protocol token is essential. In the UK, the implementation of the Financial Services and Markets Act 2023 is still underway, and the Treasury and FCA are actively consulting on the perimeter for cryptoasset regulation. This is a genuine opportunity to build protocol token classification into the framework from the start, rather than inheriting the ambiguity of earlier approaches. UK regulators have shown willingness to move pragmatically; they should use that flexibility to establish that protocol tokens - defined by their function within a network, not by their technological form - sit outside the regulatory perimeter for financial instruments. In the United States, the stakes are especially high because the classification question has direct legal consequences for whether a token is subject to SEC jurisdiction as a security, or CFTC jurisdiction as a commodity, or neither. The "investment contract" test under Howey has proven difficult to apply to protocol tokens in a consistent way, and market structure legislation currently moving through Congress represents a critical opportunity to create a cleaner statutory definition. APC's position is clear: a well-drawn definition of protocol token should make explicit that these tokens do not meet the definition of investment contract, that tokenized RWA are treated according to the nature of the underlying asset, and that protocol staking and delegation rewards are not investment returns in the securities law sense. Getting the definition of "issuer" or “originator” right is equally important: it should mean something closer to “creator”, not simply anyone who operates infrastructure that a token runs on. Why This Matters: Three Concrete Stakes There are three reasons why everyone should care about this. Regulatory consistency. Regulators frequently invoke the principle of "same activity, same risk, same regulatory outcome." That principle actually supports treating protocol tokens differently — precisely because their functions and features plus risk profile are genuinely different from those of tokenized financial instruments. A staking reward is not an investment return. A validator is not a custodian. A technology provider is not an intermediary. Consistency does not mean treating everything on a blockchain the same way; it means applying the right rules to the right things, based on the nature of the asset and the nature of the activity. The infrastructure question. If protocol tokens are treated as financial instruments, it is still important to correctly categorize the activities that make blockchain networks function — staking, validation, delegation. This is one that APC's broader 2026 work directly addresses through the principle that infrastructure providers are not regulated intermediaries. Token classification and the infrastructure/intermediary distinction are two sides of the same coin: get the first wrong and you misapply the second. Legal certainty. Without a workable, affirmative definition of protocol tokens, cryptoassets risk being swept into financial instrument frameworks designed for assets that are fundamentally different. Compliance becomes guesswork, and guesswork has a chilling effect on innovation. Builders need to know what rules apply before they deploy, not after. Getting token classification right is not a technicality. It is the foundation on which everything else ultimately rests, including sensible stablecoin rules, workable DeFi regulation, and a functioning tokenized securities market. APC will be tracking these developments closely across all three jurisdictions throughout 2026, and will be publishing an inventory of frameworks and guidance that get classification right, or at least get meaningfully closer. If you are working on this in a regulatory, legal, or policy capacity, we want to hear from you.

Over the past year, U.S. regulators have taken important steps toward clarifying how tokenized assets fit within existing legal and regulatory frameworks. While these efforts come from different agencies and address different use cases, a consistent theme has emerged: The nature of the asset, not the technology used to represent it, should determine its regulatory treatment. This principle sits at the core of the Avalanche Policy Coalition’s (APC) work on token classification. Encouragingly, recent guidance from the SEC, federal banking agencies, and the CFTC reflects a growing convergence toward this approach. The Guiding Principle for Token Classification At APC, we have consistently emphasized that effective policy and regulation begins with a simple but powerful idea: The nature of the asset matters.  The functions and features of the asset, regardless of how it is represented, are paramount for determining utilization, valuation, risk profile, and legal classification. This is not just a regulatory concept—it reflects how markets, businesses, and individuals already understand and interact with assets in every other context. When we think about how an asset is used, what its value is, or what risks it presents, we naturally focus on the bundle of rights that make up the asset. Tokenized assets should be no different. Our work has highlighted concrete examples that illustrate why classification must follow function and substance, not technology. For example: A tokenized share of stock, whether held through traditional infrastructure or represented on a blockchain, remains an equity security. It reflects ownership in a legal entity and should be regulated as such. A tokenized money market fund, such as those issued by major financial institutions and deployed on blockchain infrastructure, is still a fund product. Its risk profile, investor protections, and regulatory treatment should derive from that underlying reality, rather than from the fact that it settles on-chain. A concert or sporting event ticket represented as an NFT is fundamentally a consumer item, not a financial instrument. Treating it like a security simply because it exists on a blockchain is a category error. A loyalty reward or in-game asset, such as points or digital items used within a platform, functions as part of a closed ecosystem. These are not investments in a business enterprise or part of a company’s capital stack and should not be regulated as such. We discuss these concepts in more detail here, here, and here. This is exactly how markets already operate. The utilization of an asset depends on its nature—a stock conveys ownership rights, a ticket grants access, and a loyalty point provides benefits within a program. The same is true for valuation: investors value equities based on earnings and growth prospects, while collectibles or tickets derive value from scarcity, demand, or utility. When policymakers fail to make these distinctions, the result is overbroad definitions, regulatory confusion, and unintended consequences. When they get it right, the result is a framework that is easier to understand, easier to apply, and better aligned with actual risks. The common thread is simple: Tokenization does not change what an asset is. Recent regulatory developments suggest that U.S. agencies are increasingly adopting this same paradigm. Recent Regulatory Guidance Applies the Nature of the Asset Principle 1. CFTC Guidance on Tokenized Collateral In December 2025, the CFTC issued staff guidance on the use of tokenized assets as collateral in derivatives markets. The guidance addresses how futures commission merchants (FCMs), clearinghouses, and other market participants should evaluate tokenized collateral under existing margin and risk management rules. The CFTC emphasizes that tokenization is simply a technological wrapper: The use of distributed ledger technology does not, by itself, change the fundamental characteristics of an asset. As a result, the key considerations are familiar ones: Does the tokenized asset provide legal and economic rights equivalent to the underlying asset? Is the asset liquid and reliable enough to serve as collateral? Can the collateral be safely held, controlled, and transferred? The guidance encourages firms to focus on assets that are already eligible as collateral in traditional form, such as high-quality government securities, and to evaluate tokenized versions within existing risk frameworks. It also highlights several operational and legal issues that must be addressed, including: Custody and segregation of tokenized collateral Legal enforceability of claims Cybersecurity and access controls Settlement timing and operational resilience Finally, the CFTC notes that standard margin haircuts and risk assessments can be applied, with adjustments only where the tokenized format introduces new or different risks. 2. SEC Guidance on Tokenized Securities In January 2026, the SEC’s Division of Corporation Finance issued a statement addressing how federal securities laws apply to tokenized securities—that is, traditional securities represented using distributed ledger technology. The statement begins by clarifying that tokenization can take multiple forms. In some cases, an issuer may issue a security directly on a blockchain, recording ownership and transfers on-chain. In others, a third party may create a tokenized representation of an existing security, such as a token backed by shares held in custody or a synthetic instrument linked to the value of the underlying asset. Despite these structural differences, the SEC’s core message is clear: Tokenization does not alter the legal nature of the underlying instrument. Whether a security is recorded in a traditional book-entry system or on a blockchain, it remains subject to the same securities-law framework. The analysis turns on the rights conveyed, the structure of the product, and the obligations of the parties involved, not on the technology used to implement it. The statement also highlights important practical considerations, including: The need for clear disclosure around how tokenized products are structured The role of custodians and intermediaries in holding underlying assets The potential differences between issuer-sponsored tokenization and third-party tokenization models In short, the SEC is signaling that tokenization is permissible—but must fit within existing securities-law principles. 3. Federal Banking Agencies’ Capital Treatment of Tokenized Securities In March 2026, the Federal Reserve, OCC, and FDIC jointly issued guidance on how bank capital rules apply to tokenized securities. The guidance is framed as a set of FAQs. It addresses how banks should treat tokenized securities for purposes of: Risk-based capital requirements Market risk capital rules Collateral eligibility The agencies explicitly take a technology-neutral approach. They state that the use of distributed ledger technology to issue or represent a security does not, in itself, change how that asset should be treated under bank capital rules. Instead, the key question is whether the tokenized instrument: Confers legal rights identical (or substantively equivalent) to those of the traditional security, and Exposes the institution to the same underlying risks Where those conditions are met, the agencies conclude that: Tokenized securities should generally receive the same capital treatment as their non-tokenized equivalents They may qualify as financial collateral under existing rules Standard haircuts and risk weights can be applied The guidance also makes clear that banks must still consider: Operational risks, including settlement and custody mechanisms Legal enforceability of tokenized claims Liquidity characteristics of the tokenized asset Importantly, the agencies do not distinguish between permissioned and permissionless blockchains, reinforcing the principle that the focus should be on risk and rights—not infrastructure design. The banking agencies agree with the SEC: tokenization does not alter the legal nature of the underlying instrument. 4. SEC Broker-Dealer Capital Treatment of Stablecoins In February 2026, the SEC’s Division of Trading and Markets updated its FAQs addressing how broker-dealers may treat certain stablecoins under the net capital rule (Rule 15c3-1), specifically in FAQ 5. The guidance focuses on payment stablecoins—stablecoins designed for use as a medium of exchange and backed by high-quality reserves. Under the FAQ, the staff states that it will not object if a broker-dealer: Treats a proprietary position in a qualifying payment stablecoin as having a “ready market,” and Applies a 2% haircut, consistent with certain low-risk, liquid assets However, this treatment is not automatic. It is conditioned on the stablecoin meeting specific criteria, including: Backing by high-quality, liquid reserves Clear and enforceable redemption rights at par Regular public disclosures and independent attestations Alignment, where applicable, with the statutory framework under the GENIUS Act The guidance is intentionally narrow. It does not apply to all stablecoins, and it does not attempt to classify stablecoins more broadly under securities laws. Instead, it addresses a practical issue: how broker-dealers can incorporate certain stablecoins into their operations without facing disproportionate capital charges. At a broader level, the guidance reflects a willingness to integrate blockchain-based payment instruments into existing regulatory frameworks, provided their structure and risk profile support it.  Conclusion: Convergence Around a Workable Framework Taken together, these four regulatory interpretations reveal a clear and consistent direction in U.S. regulatory thinking. First, they reinforce technology neutrality. Blockchain is not the regulatory trigger. Second, they embrace a “same asset, same treatment” approach. Equivalent rights and risks should lead to equivalent regulatory outcomes, regardless of technology used. Third, because the nature of the asset is unchanged, they rely on existing regulatory frameworks rather than creating new regimes. Finally, they focus on real risks—legal, custody, liquidity, and operational—not labels or technological form. These themes closely align with an APC core principle: The nature of the asset matters. By focusing on what an asset is—rather than how it is represented—regulators can promote clarity, support innovation, and ensure that regulation remains targeted and effective. They also avoid reregulation and confusion around how to evaluate an asset. All of this supports robust, competitive markets. APC is pleased to see regulators aligning around this principle. Grounding regulation in the nature of the asset lays the foundation for frameworks that reflect existing law, avoid unnecessary complexity, and are ultimately workable and durable.