Token Launch Legal Checklist 2026 with Medici Expert: What Your Marketing Can Say Before TGE
Sooner or later, every founder preparing a TGE brings us a legal question. It is almost always one of three: where is incorporation cheapest, how much an opinion letter runs, and is it fine to just call the thing a utility token.
None of the three is the right place to start. Each one frames legal as a fee you pay once to collect a stamp, and then you get on with the launch.
The question worth asking first is less comfortable: is your planned campaign allowed to say what it says, to the audience it is aimed at?
To answer it properly, we sat down with the lawyers of Medici Expert and walked through the checks they run before a launch goes live. For each one, we added what it changes for whoever runs your content, KOLs and community.
Some context on why this matters more now. A 2017 ICO needed little beyond a whitepaper, a Telegram group and a page to send funds to. Public sales are popular again in 2026: MegaETH's $49.95M hardcap filled in roughly 5 minutes, and Monad raised around $269M through Coinbase. Today that sale page rests on a legal entity, a chosen jurisdiction, identity checks, sanctions filters and an assessment of whether the token could be classed as a security.
Your token is issued from somewhere. Every post that promotes it lands somewhere too.
This article explains process and risk. It is not legal advice. For your specific structure, talk to a licensed lawyer.
Most Teams Arrive Without a Legal Setup
We meet projects at every point of the journey. Some have only a pitch deck and a pre-seed round. Some are halfway through a raise. Some reach out a fortnight ahead of TGE, with the date public and the KOL budget already spent.
Whatever the stage, the legal picture tends to look the same. Roughly 70% of the teams that contact us have nothing in place: no company issuing the token, no opinion letter, and no decision on who is allowed to buy.
Here is the uncomfortable part. Where legal and marketing overlap, the usual mistakes come from the marketing side, and that includes crypto marketing teams like ours.
The sequence repeats. A story is chosen in the first month. The round closes on that story. KOLs receive briefs built on it, and a hundred threads go out. Only after all that does anyone check with a lawyer whether those claims were allowed in the countries where they were published.
At that stage nothing can be edited quietly. The copy sits on thousands of feeds across dozens of countries, and screenshots last forever.
Medici Expert watches this play out from the other desk:
"The biggest mistake is treating the token launch as a marketing event with a legal review attached to it. The legal structure, compliance, KYC and AML, token economics and public narrative need to be built as one model, because changing one of them can affect the risk assessment of the others. Holding an ICO and TGE is not as easy as it used to be, but no crying in the casino!"
We see it from our seat every single week:
"Nobody in crypto marketing sets out to break the law. They set out to hit a mindshare target. The problem is that the copy that hits it fastest (yield, buybacks, “get in early”) is exactly the copy a lawyer cuts first. Fix it before the final brief, not after you’re already live."
Takeaway: legal work comes before the story. It defines which stories are available to you at all.
The Issuer's Country and the Buyer's Country Are Different Questions
A token needs a company that issues it.
For most of the launches Medici handles, that company sits in Panama or in the BVI. When a governance token comes with a DAO, the DAO can get a separate wrapper: a Cayman Islands entity, a Swiss Foundation, or a Panama structure.
Medici advises against an American, European or Emirati issuer unless the team holds a dedicated license or a regulator's sign-off. Companies based there face stricter obligations and a compliance workload that usually exceeds what a project needs on launch day.
Incorporation answers one question: where the token originates. Distribution is decided by who you market to, and X reaches every country at once. Regulators generally follow the buyer:
- The UK controls crypto promotions that target UK consumers, no matter where the promoter is based.
- Inside the EU, actively courting retail buyers can bring an offshore issuer under MiCA. Our reading of MiCA is that it restricts how you promote far more than which tokens exist.
- Sanctioned countries are excluded everywhere. That exclusion has to reach who qualifies for airdrops and who sees your quests, as well as the legal terms.
Social platforms behave like jurisdictions of their own.
Some countries restrict marketing activity of any kind. For those markets, Medici applies three rules:
- No country-specific accounts. Handles like ProjectAirdrop_US or ProjectAirdrop_UK are out, on X, and the same applies to Meta's apps and any other network.
- No paid campaigns pointed at restricted countries.
- One neutral global account is acceptable. When someone in a restricted country discovers it independently, they sought you out. You did not pursue them.
We would add one more safeguard: block access to the presale page from sanctioned states and from FATF blacklisted jurisdictions.
In practice, US users on X can still see you. You simply cannot aim campaigns at it.
Dependence on one platform carries its own risk. In January 2026, X revoked API access for InfoFi apps, and Kaito closed Yaps within the same day. A channel many teams considered essential vanished because a single company changed its rules.
Takeaway: your company's address sets the origin of the token. Your ad targeting decides which regulators are watching.
The Howey Test Reads Your KOL Threads Too
Calling a token "utility" protects nothing by itself.
Two things count: the token's real function, and the way the project talks about it.
Lawyers cover the function: what rights, access, incentives and economic mechanics the token carries. The way it is talked about belongs to marketing, and that is usually where the structure cracks.
The Howey Test comes from a 1946 US securities case. Over time it became the global yardstick for judging whether a token resembles a security. Its core question: do buyers expect to profit from the efforts of others?
Compare that with what X celebrated through 2025 and 2026. Buybacks dominated.
Tokenomist tracked $19B spent on buybacks and burns, and the promise of revenue flowing to holders turned into the most powerful story in the market.
It is also the story that most closely resembles an expectation of profit.
Picture a whitepaper that promises "governance and fee discounts" while a KOL thread for the same token tells followers that each trade pumps their bags. One asset now carries two incompatible legal descriptions.
Medici reports the same from legal practice. Teams overpromise in pursuit of virality, and that makes the utility argument much harder to defend, especially once the price fails to deliver on those promises.
A Howey opinion from an attorney licensed in the US helps evaluate the risk of security classification. Medici stresses that it guarantees no result. It also only covers the token as described to the attorney. Last night's KOL thread was never part of that description.
Takeaway: the opinion reviews your documents, and regulators review your feed.
Stress-Test the Tokenomics Before Traders Do It Live
Reviewing how the token is described is only half the job.
Medici also stress-tests the token economics: the intended utility, how supply behaves, and where buying and selling pressure could come from.
When a token has several utilities, each is examined separately: what it does, how it fits the financial model, and how it shifts buying and selling.
The goal is to expose weak points while the model can still be changed. Medici says the test frequently ends with tokenomics rebuilt from zero, and on several occasions that rebuild produced a strong chart after launch.
Teams that skip the test get it anyway, run publicly by the market on the very first candle. According to Medici, traders on X check three things before anything else:
- Unlocks and cliffs. A large cliff followed by an unlock soon after TGE signals the purpose of the token to everyone, and that mood alone accelerates selling.
- Team holdings. Confidence in ICOs is weak, so traders will look up the team's share and assume the true figure is 1.5x what is disclosed.
- Circulating supply against FDV. A thin float moves on small orders, and once unlocks are layered on, sharp candles become a direct risk.
FUD is only part of the exposure. Published tokenomics count as a formal project disclosure, so a team that departs from them can face misrepresentation claims.
This cycle, the median token trades 71% below its TGE level (we covered the data here). Falcon Finance shows clearly how tokenomics can sink a launch that no campaign could rescue:
- TGE on September 29, 2025, with a 10B total supply and 23.4% circulating at launch
- a 76% drop within hours from an all-time high of $0.7708
- an expanded KOL and influencer allocation sent directly to KOL wallets
- claim delays that let early recipients sell before everyone else
Market makers took much of the blame. In our view, the order book simply priced in what it received while retail buyers were still stuck waiting to claim.
Takeaway: the first candle tests your tokenomics whether you prepared or not, so run the test while you can still change the answer.
Token Sales Run on Verified Buyers
We have argued before that sales beat airdrops, because a launch needs people who buy and hold, and airdrop farmers mostly sell.
Every buyer, though, has to be identified first.
The error Medici keeps encountering is treating KYC and AML as an add-on that gets attached once the sale mechanics are finished.
Who may take part, how they are checked, and which sanctions controls apply all need to be designed together with the sale itself.
Screening wallets and transactions is the step young teams drop most often.
The risk goes well beyond paperwork. ICOs have become a channel for laundering criminal proceeds, and Medici warns that a team without compliance controls can be seen as a participant in the laundering, in addition to violating AML requirements.
Modern sale platforms are built around this. Platforms such as Legion, Echo/Sonar and Buidlpad revived ICOs with KYC and geoblocking as core features. Monad's sale on Coinbase raised around $269M from about 85,820 participants, each one a verified account.
A launchpad still leaves three responsibilities with you:
- It checks buyers. Your claims stay yours. Every claim you made ahead of the sale remains your responsibility, and so does the launchpad's own description. Check how the platform describes you and what pitch it wraps around the sale.
- It covers the sale page only. Airdrops, points programs and quests must block exactly the countries your sale blocks.
- You remain the issuer. Many teams believe a launchpad sale transfers responsibility to the platform. It does not. The team still issues the token, and marketing published on the launchpad is held to the same legal standard as marketing on your own website.
Hosting the sale yourself takes more effort, but Medici notes it gives the team tighter compliance control and a longer runway to prepare.
Screening pays off across the whole funnel. When ZachXBT examined the geodata of more than 70,000 InfoFi accounts, only 26% were located in developed countries.
So a funnel with no screening carries legal exposure and also wastes budget on reach among people who are unable to buy.
Takeaway: KYC shows you who your real community is, which makes it a filter worth having.
Mods, KOLs and Translations Are Legal Documents
Medici reviews the site, the whitepaper, the tokenomics and the marketing materials as one package, since wording alone can create risk even for a carefully structured token. Around them sit the T&Cs, privacy terms, internal compliance rules, disclaimers and risk notices.
On X, though, "public materials" means far more than a handful of PDFs. A project publishes hundreds of items a week, and lawyers see almost none of them:
- pinned posts, plus whatever gets said live on X Spaces
- automated Telegram replies and messages from moderators
- KOL scripts, raid templates and memes
- local-language translations, where "utility" can quietly become "guaranteed 10x"
KOL rounds need particular attention.
In these deals, influencers receive tokens at a discount, with short vesting or an unlock ahead of others, and in return they post and host AMAs. CoinDesk reported that KOLs accept discounted valuations, or the right to sell before other investors, in place of a service fee.
Legally, that is payment. Paid promotion that goes undisclosed is a classic regulatory target. (For how we structure KOL campaigns and what they cost, see our breakdown.)
Around a TGE, one principle covers it: everybody who speaks about the token works from a single shared brief.
Medici's practical tool is a list of all launch documents, along with a brief internal glossary of banned words for the pre-TGE period, led by "passive income". Moderators, KOLs and copywriters all receive the identical list.
Takeaway: moderators and KOLs are speaking for the project, and every post they make joins the model your lawyer approved.
What a Market Maker Can and Cannot Do for You
Launch mechanics, how the sale is set up, vesting and market making are evaluated together as a single model.
The team needs clear answers on who may participate, what each participant gets, under which conditions, and how utility gets presented.
Medici is direct here. A market maker cannot replace lawyers or compliance, and the legal review is not a last box to tick on the eve of TGE.
The boundary between coordinating a launch and manipulating a market is equally clear. Marketing is free to respond to price movement. A market maker must never engineer the chart to match the marketing calendar.
For marketers, vesting is part of the message.
Our rule has not changed: KOLs get short vesting and small unlocks at TGE, every time.
Once the token is live, each unlock, each buyback announcement and each movement from a team wallet functions as a public statement. It either matches the model that was reviewed or contradicts it.
We regularly tell founders to keep marketing running past TGE day, because attention fades within 72 hours. Legal obligations keep running past that day as well.
Unlock schedules, treasury sales and buyback communications should be mapped out before trading opens, so nobody has to explain them after the fact.
Mapped out does not mean broadcast. Medici's view is that informing holders is fine, but communication should stay minimal, particularly when the treasury or team wallets move, where extra commentary can invite manipulation accusations.
When X starts shouting that the team is dumping, skip the debate and skip the justifications. Medici's position: the team follows the published tokenomics, and nothing else. That defense holds only if it is actually true.
Takeaway: attention resets after 72 hours, and your structure has to survive every unlock that follows.
A Pivot Restarts the Legal Review
The most valuable legal work is finished before the market ever sees the token. Three cases from Medici's practice:
- a major OTC broker whose token went live with more than 8 utilities, each assessed individually, modeled, and plugged into the financial projections together with its effect on buy and sell pressure
- a utility token connected to tokenized mining hashrate
- a team whose pre-launch review made it rethink utility from scratch and redesign the token before going further
The sooner legal structure and token design are examined side by side, the more freedom the team keeps to adjust.
There is one condition. "Legal is done" holds only while the launched version matches the reviewed version.
Changing utility, sale terms, allocations, website copy or positioning can mean the analysis has to be done again.
On X, that happens constantly.
Narratives move through AI, then RWA, then perps, then whatever comes next, and projects reposition to follow. From a legal standpoint, each repositioning counts as a change to the product.
Takeaway: a new narrative means a token no lawyer has seen, so repeat the review after every pivot.
The Memecoin Minimum
Plenty of launches are not structured utility tokens sold to investors. Most memecoins on Solana, BNB, Base and similar chains launch without any presale.
That works in their favor. Medici considers a fair launch the safest route to market, since skipping the presale makes a securities classification less likely.
Lower risk still leaves some risk. Medici sees memecoins get into trouble in three ways: onchain data that contradicts the published tokenomics, roadmap promises nobody plans to deliver, and a story centered on getting rich, where buying the coin is pitched as an investment with returns ahead.
Medici's baseline for any memecoin:
- a website disclaimer saying the coin is no investment product, no payment token, and nothing to hold in hope of profit
- published usage terms plus a privacy and cookie policy
- geoblocking for sanctioned countries
- great caution with trademarks owned by others
Takeaway: a memecoin can launch without a presale, but it still needs a disclaimer.
Twelve Questions to Answer Before Launch
Everything above comes down to twelve questions. Medici wrote the legal six, and we wrote the marketing six.
Legal
- Which entity issues the token?
- What is the reason for choosing this jurisdiction?
- What does the token actually do?
- Has the risk of security classification been evaluated?
- Who is eligible to join the sale?
- Do public materials match how the token is structured legally and economically?
Marketing
- Does each channel describe utility the same way the whitepaper does?
- Do campaigns, quests and airdrops block restricted countries, beyond just the sale page?
- Is every KOL allocation, vesting term and paid post written down and disclosed?
- Who approves launch day copy, and within what time?
- Is there a schedule for unlocks, buybacks and treasury activity before trading opens?
- When the narrative shifts, who contacts legal?
If any answer is still vague, the launch likely needs more time, both for regulators and for the market.
Medici sums it up this way: legal work cannot promise a successful launch, but it removes regulatory failure from the list of ways a launch can go wrong.
Attention is something you can pay for. Price is something you cannot. And once a story that was never allowed has been published, it stays published.
Design the structure and the story together from the first day, so the market has no gap to find when trading opens.
Need a launch campaign built around what you are actually allowed to say? Talk to us.