I've worked in crypto for 12 years, talking to builders and founders weekly. A recurring issue is the lack of legal/regulatory clarity. This uncertainty keeps many top web2 devs from building onchain -- it’s just easier to stay in web2.

Here are the tough questions people are asking:

1. What defines a centralized vs. decentralized project?

2. Best jurisdiction to incorporate a crypto startup?

3. Does D&O insurance cover crypto startups? Other must-have policies?

4. How to minimize legal fees as a pre-revenue startup without cutting the wrong corners?

5. Key traits in a legal advisor for crypto?

6. Beyond securities risk, what legal pitfalls should founders watch?

7. Is a foundation required to launch a governance token?

8. What makes an ERC-20 or ERC-721 a security?

9. What makes someone a token issuer? Do all tokens have one?

10. What should I do?

We need risk-averse standards and answers to these questions to bring the world onchain.

First, no legal advice. Second, it depends. Now legalese aside, let’s dive into your questions 👇

1. What defines a centralized vs. decentralized project?

No one really knows. An important SEC official dropped the term “sufficiently decentralized” in a 2018 speech, and ever since, law firms have been using it to sell legal opinions to token issuers.

I do recommend reading this memo on the YFI token launch by a brilliant US lawyer. It dives deep into the concept of decentralization:

First, no legal advice. Second, it depends. Now legalese aside, let’s dive into your questions 👇

1. What defines a centralized vs. decentralized project?

No one really knows. An important SEC official dropped the term “sufficiently decentralized” in a 2018 speech, and ever since, law firms have been using it to sell legal opinions to token issuers.

I do recommend reading this memo on the YFI token launch by a brilliant US lawyer. It dives deep into the concept of decentralization:

https://metalex.substack.com/p/why-yfi-are-not-investment-contracts

2. Best jurisdiction to incorporate a crypto startup?

It depends on what your startup actually does. The most common choices:

🇺🇸 US — ideal for startups not engaging in regulated activities (e.g., blockchain scanners like Dune).

🇻🇬 BVI — the go-to jurisdiction for token issuers due to its permissive legal framework.

🇰🇾 Cayman Islands — popular for their flexible Foundation Companies.

🇵🇦 Panama — the Wild West of crypto, with zero regulations. Polymarket and many others are based there.

You can set up most of these entities via Skala:

🔗 Skala.io/crypto-startups

Founder at Skala.io, partner at buzko.legal

3. Does D&O insurance cover crypto startups? Other must-have policies?

Not my area, but yes, crypto is high-risk for D&O underwriters. That said, the market is evolving, and more insurers now cover crypto risks.

4. How to minimize legal fees as a pre-revenue startup without cutting the wrong corners?

Do not issue tokens or set up foundations until you have clear product-market fit. Unless, of course, the token is the product (e.g., memecoins).

Also, geoblock US & EU, see this guide on the topic:

5. Key traits in a legal advisor for crypto?

Beyond crypto experience and technical know-how, look for lawyers with non-zero risk tolerance. Everything in crypto is risky. If Ethereum had listened to their lawyers, they would have never issued ETH.

Pump[.]fun, a popular Solana-based memepad, was hit with a second class action lawsuit yesterday.

The lawsuit claims that Pump[.]fun acted as both the issuer and statutory seller of tokens under Section 12(a)(1) of the Securities Act.

You can read the full 215-page lawsuit, including all exhibits, here: https://aboutblaw.com/bg4F.

It looks like this US class action could have been avoided if the project had proper Terms of Use with an Arbitration Clause and Class Action Waiver. But they didn’t—at least not until the end of 2024, when the lawsuit was already imminent.

6. Beyond securities risk, what legal pitfalls should founders watch?

Three major risks:

1/ Sanctions violations — see the 2019 arrest of Virgil Griffith after speaking at a North Korean crypto conference.
2/ AML/KYC compliance — if you run an exchange or money service business, you need to comply.
3/ Class actions & private lawsuits — see the recent Pump[.]fun lawsuit. Don’t be lazy with Terms of Use.

6. Beyond securities risk, what legal pitfalls should founders watch?

Three major risks:

1/ Sanctions violations — see the 2019 arrest of Virgil Griffith after speaking at a North Korean crypto conference.
2/ AML/KYC compliance — if you run an exchange or money service business, you need to comply.
3/ Class actions & private lawsuits — see the recent Pump[.]fun lawsuit. Don’t be lazy with Terms of Use.

https://warpcast.com/buzko/0xb80c9219

7. Is a foundation required to launch a governance token?

For large, mature projects, yes, it’s market practice. But for anything outside the top-100 on CMC, it’s probably overkill.

More on this:

7. Is a foundation required to launch a governance token?

For large, mature projects, yes, it’s market practice. But for anything outside the top-100 on CMC, it’s probably overkill.

More on this: https://x.com/wassielawyer/status/1850551931393151123

8. What makes an ERC-20 or ERC-721 a security?

Gary Gensler. Kidding.

The Howey test (1946) or Reves test (1990). Everyone in crypto hates Howey, but it’s the defining test for “investment contracts” and hence securities. Until we get a safe harbor for tokens [1] or a change in the accredited investor regime, it’s not going anywhere.

[1] Hester Peirce proposed one in 2021:

8. What makes an ERC-20 or ERC-721 a security?

Gary Gensler. Kidding.

The Howey test (1946) or Reves test (1990). Everyone in crypto hates Howey, but it’s the defining test for “investment contracts” and hence securities. Until we get a safe harbor for tokens [1] or a change in the accredited investor regime, it’s not going anywhere.

[1] Hester Peirce proposed one in 2021: https://github.com/CommissionerPeirce/SafeHarbor2.0

9. What makes someone a token issuer? Do all tokens have one?

This is where can get very tricky. But a simple rule of thumb: the issuer is whoever benefits the most from deploying the token issuing contract.

10. What should I do?

Keep Calm and Carry On.

Check out Skala.io, where we’re building the legal platform for technology startups, including a suite of tools and templates for crypto startups.

4. How to minimize legal fees as a pre-revenue startup without cutting the wrong corners?

Do not issue tokens or set up foundations until you have clear product-market fit. Unless, of course, the token is the product (e.g., memecoins).

Also, geoblock US & EU, see this guide on the topic:

https://variant.fund/articles/practical-guide-to-geofencing/