ESMA CAFI Guidelines: When a Crypto-Asset Is a Financial Instrument

On 17 December 2024 the European Securities and Markets Authority published its Final Report and, in Annex III, the Guidelines on the conditions and criteria for the qualification of crypto-assets as financial instruments, reference ESMA75453128700-1323. That document, often shortened to the CAFI Guidelines, addresses whether a crypto-asset qualifies as a financial instrument and is therefore excluded from MiCA under Article 2(4)(a). A crypto-asset that is not a financial instrument must still be tested against MiCA’s other scope exclusions before it is classified as an asset-referenced token, e-money token or other crypto-asset. Get it right and the reporting obligations follow a known path. Get it wrong and a firm can spend a year preparing MiCA documentation for a token that is instead a financial instrument and requires a separate assessment under the applicable securities laws, including prospectus and MiFIR transaction-reporting requirements where their respective scope conditions are met.

The guidelines were published in all EU official languages on 19 March 2025 and apply from 18 May 2025, 60 calendar days later. National competent authorities had to notify ESMA of their compliance position within two months of publication, making the notification deadline 19 May 2025. The guidelines apply from 18 May 2025, but national implementation is not uniform. ESMA’s compliance table dated 16 July 2026 records broad compliance while also recording intended compliance, non-compliance by default or not-applicable positions in some jurisdictions.

This article walks through how the boundary works in practice: the legal mechanism that sends a token to one regime or the other, the tests ESMA sets for each MiFID II category, the traps around NFTs and hybrid tokens, and what actually changes for a reporting team once a token lands on the financial-instrument side of the line.

Related reading: BaFin on tokenised securities and the MiCAR/MiFID perimeter.

The dates that matter

• 29 January 2024: ESMA opens the consultation (ESMA75-453128700-52), with comments due by 29 April 2024.
• 17 December 2024: ESMA publishes the Final Report and the CAFI Guidelines (ESMA75453128700-1323).
• 30 December 2024: MiCA (Regulation (EU) 2023/1114) becomes fully applicable across the EU.
• 19 March 2025: ESMA publishes the guidelines in all EU official languages.
• 18 May 2025: the guidelines apply. 19 May 2025: the two-month deadline for national competent authorities to notify ESMA of their compliance position.

Why classification decides the entire rulebook

MiCA does not apply to crypto-assets that qualify as financial instruments. Article 2(4) of MiCA carves them out, along with deposits, funds, securitisation positions and a short list of other already-regulated products. The financial-instrument boundary is exclusive, but MiCA scope is not an exhaustive binary choice. A crypto-asset that qualifies as a financial instrument is outside MiCA. If it does not qualify as a financial instrument, it must still be assessed against MiCA’s other scope exclusions and, where it remains within scope, against the relevant MiCA category. The securities-law requirements that follow depend on the instrument category, the activities performed and the circumstances in which it is offered or traded.

There is no dual-track. The same instrument cannot sit in both regimes at once, which is why the classification call is the gate that everything downstream depends on. A reporting team cannot map its obligations until someone has answered the qualification question and written down the reasoning. Firms that treat classification as a box-ticking afterthought tend to discover the problem when a supervisor asks for the analysis and there is none on file.

The order of operations also matters. The joint ESA guidelines under Article 97(1) of MiCA, reference JC 2024 28, include a standardised classification test that applies before an in-scope crypto-asset is categorised as an asset-referenced token, e-money token or other crypto-asset. For hybrid tokens, the CAFI Guidelines specifically say to evaluate financial-instrument status first.

What ESMA’s mandate covers, and what it leaves out

The guidelines are issued under Article 16(1) of the ESMA Regulation (Regulation (EU) No 1095/2010) and Article 2(5) of MiCA, which asked ESMA to specify the conditions and criteria for qualifying crypto-assets as financial instruments. That mandate is narrower than it first looks. ESMA’s task under Article 2(5) of MiCA covers the overlap zone: the products that fall within both the crypto-asset definition of MiCA and the financial-instrument definition in Article 4(1)(15) of MiFID II, which in turn points to the list in Section C of Annex I.

The CAFI Guidelines have been misread as a closed checklist of qualifying and disqualifying tokens; the actual structure is high-level criteria and general principles designed to push national authorities toward convergent practice while keeping every assessment case-by-case. Two tokens that look similar on a marketing page can land on different sides of the line once their actual rights are examined.

The CAFI Guidelines are not the only relevant ESA output on the crypto-asset boundary. The joint guidelines under Article 97(1) of MiCA, reference JC 2024 28, set the Article 8(4) template for the explanation accompanying a white paper for crypto-assets other than ARTs and EMTs, the legal-opinion templates required for ART notifications and authorisation applications under Articles 17(1)(b)(ii) and 18(2)(e), and a common classification test. These are different filing contexts and should not be described as one legal opinion accompanying every crypto-asset white paper.

Substance over the DLT wrapper

The organising principle of the guidelines is technology neutrality. ESMA states that the technological format of a crypto-asset should not be a determining factor when assessing whether it qualifies as a financial instrument. The assessment turns on the inherent characteristics of the instrument and the rights it confers on the holder, not on whether those rights happen to be recorded on a distributed ledger. A tokenised bond is a bond. Putting a share on-chain does not stop it being a share.

This is where the “utility token” label causes the most trouble. Calling a token a utility token in a white paper settles nothing. If the token in substance gives its holder a return linked to a pooled investment, or a right that behaves like securitised debt, the label is irrelevant and the financial-instrument analysis controls. ESMA’s response to consultation feedback made the same point about staking and similar features: the marketing framing does not change the underlying rights.

Hybrid tokens make the substance test harder. ESMA notes that their functions or attributes might evolve during their lifecycle and says the assessment should prioritise inherent attributes over issuer labels. The guidelines recommend a periodic reassessment of hybrid tokens to determine whether their classification needs to be updated, recognising that their features or functions may evolve over their lifecycle. No specific cadence is prescribed; firms should define a change-triggered review control so that any material evolution in a token’s attributes triggers a reassessment.

Transferable securities: the widest gate

The guidelines set out specific criteria for classifying crypto-assets as transferable securities under Article 4(1)(44) of MiFID II. Article 4(1)(44) of MiFID II defines transferable securities as classes of securities that are negotiable on the capital market, with instruments of payment excluded. ESMA identifies three cumulative conditions: the crypto-asset must not be an instrument of payment; it must form part of a class of securities; and it must be negotiable on the capital market. Where a crypto-asset has several components, including a payment component, ESMA requires a case-by-case assessment.

The class limb is the one teams underweight. A single, bespoke, non-interchangeable token is not a class of securities. But a token minted in a series where each unit confers the same rights and trades against the others looks exactly like a class, whatever the project calls it. The definition then reaches beyond plain shares and bonds. Article 4(1)(44) also captures “any other securities” that give a right to acquire or sell a transferable security, or that give rise to a cash settlement determined by reference to securities, currencies, interest rates, commodities or other indices. A token that tracks and cash-settles against an index of listed shares is a good example of something that never touches the underlying yet still qualifies.

The payment-instrument exclusion is one limb of the transferable-securities test. If a token is used as a medium of exchange, ESMA requires a case-by-case assessment, particularly where it has multiple components. If it is not a financial instrument, classification as an e-money token or asset-referenced token depends on MiCA’s statutory stable-value definitions, not on payment use alone.

Money-market instruments, fund units and the deposit line

Section C of Annex I lists more than transferable securities, and three of the remaining buckets catch a meaningful share of tokenised products. Money-market instruments are short-maturity debt instruments comparable to treasury bills, certificates of deposit and commercial paper. ESMA asks firms to look at whether the token behaves like one of those, and to be careful about the border with a bank deposit. A token that represents a credit balance repayable by a credit institution can look like a money-market instrument but may instead be a deposit within the meaning of the Deposit Guarantee Schemes Directive (Directive 2014/49/EU), which is carved out of MiCA on its own separate footing under Article 2(4).

Units in collective investment undertakings are listed at point (3) of Section C. ESMA’s criteria include capital pooled from a number of investors, investment under a defined investment policy and a pooled return for those investors. The assessment must also consider whether investors collectively retain day-to-day discretion or control and whether the project has a general commercial or industrial purpose. A token that merely funds access to a service is not a CIU unit on that basis alone, while a pooled-return token still requires the complete case-by-case assessment.

The reason this matters for reporting is that fund units and money-market instruments pull in different disclosure and, for funds, different manager-level obligations than a MiCA other-crypto-asset would. Our guide to MiCAR token classification and the reporting that follows traces where each MiCA category lands once the financial-instrument question has been ruled out.

Derivatives, emission allowances and voluntary carbon credits

The derivative categories sit at points (4) to (10) of Section C and cover options, futures, swaps and other contracts whose value derives from an underlying, or that embed a future commitment to buy or sell. A crypto-asset that gives its holder exposure to the price of an underlying without a direct holding, or that settles in cash by reference to that underlying, can fall into these categories. ESMA’s approach is the same as elsewhere: look at the economic function of the contract the token represents, whatever its on-chain form.

Emission allowances are the narrow one, and the guidelines draw a hard edge around them. A crypto-asset qualifies as an emission allowance only where it is recognised for compliance with the EU Emissions Trading Scheme and confers the right to emit greenhouse gases under Directive 2003/87/EC. ESMA added this precisely to stop a category error that the market was already making: tokenised voluntary carbon credits are not emission allowances and do not become financial instruments simply because they trade on a venue. A voluntary credit that carries no EU ETS compliance right sits outside the emission-allowance category, and its classification then has to be worked through on the ordinary substance test.

NFTs and hybrid tokens: fungibility and function

Article 2(3) of MiCA excludes crypto-assets that are unique and not fungible with other crypto-assets from MiCA’s scope; it does not remove them from the financial-instrument analysis. ESMA states that, regardless of the MiCA exclusion, an NFT that meets the criteria of a financial instrument is subject to MiFID II and other relevant EU rules. The exposure hides in the exceptions. Where NFTs are issued in a large series or collection, or where an asset is fractionalised into interchangeable units, the “non-fungible” label starts to break down. A fractionalised NFT can behave like a class of interchangeable securities, and ESMA points authorities to the actual economic function of the units, whatever the NFT badge suggests.

Hybrid tokens are the category most likely to trip a reporting team, because they carry features from more than one classification at once. The guidelines resolve the tension in one direction: where a token combines financial-instrument features with utility features, the financial-instrument classification takes precedence. A project cannot dilute a security into a MiCA crypto-asset by bolting a governance vote or a discount coupon onto it. If the security characteristics are present, MiFID II applies to the whole instrument.

What changes once a token is a financial instrument

Crossing the line changes the applicable regulatory perimeter, but it does not make every securities-law obligation apply automatically. The Prospectus Regulation applies to securities offered to the public or admitted to trading on an EU regulated market, subject to its scope and exemptions. MAR applies where the conditions in Article 2 are met. MiFIR Article 26 transaction reporting applies to investment firms executing transactions in instruments within that provision’s scope, with trading-venue operators reporting certain transactions by members, participants or users that are not subject to MiFIR. Post-trade and settlement requirements depend on the instrument and infrastructure used.

For eligible DLT financial instruments, the EU DLT Pilot Regime (Regulation (EU) 2022/858) provides a temporary framework for authorised DLT market infrastructures, subject to instrument and aggregate-value limits and possible exemptions from specified MiFID II, MiFIR and CSDR requirements. For a reporting officer, the task is to map the instrument and infrastructure to the underlying securities rules and any DLT Pilot exemptions, conditions and compensatory measures that apply. Our overview of MiFIR, EMIR and SFTR transaction-reporting simplification sets out the reporting surface a security attracts.

Getting the classification wrong is the issuer’s exposure

ESMA states that offerors or persons seeking admission to trading are primarily responsible for correct classification. Crypto-asset service providers are within the guidelines’ scope and may need to assess classification for their activities, but the final report does not transfer the primary responsibility from the offeror or person seeking admission. The relevant national authority may challenge the classification before publication of the offer or at any time thereafter. That is the auditor’s-eye view worth internalising: the classification is a decision the firm owns and has to defend, and a supervisor can reopen it at any time.

The practical control is documentation. A firm that can show a reasoned, dated assessment against each MiFID II category, refreshed when the token’s features change, is in a defensible position even if a supervisor ultimately disagrees. A firm that classified by assertion has nothing to point to. A one-line assertion that a token is a utility token is not a reasoned classification assessment and does not evidence application of ESMA’s case-by-case substance test.

The boundary does not travel: an EU classification does not bind UK authorities, and MiCA does not apply in the UK. As at July 2026, firms must assess the existing UK perimeter, including security-token and e-money rules, while preparing for the expanded FSMA cryptoasset regime. The FCA application window is scheduled to open on 30 September 2026, and the expanded regime is due to commence on 25 October 2027. For firms still working through the end of the MiCA transitional window, the interaction with the CASP transitional period and client-asset wind-down is a related timing question worth mapping in parallel.

Frequently Asked Questions

Does the ESMA guideline change the definition of a financial instrument?

No. The definition remains the one in Article 4(1)(15) and Annex I Section C of MiFID II. The CAFI Guidelines supply conditions and criteria for applying that existing definition to crypto-assets so that national authorities reach convergent decisions. They add interpretive guidance and stop short of creating a new legal category.

If a token is a financial instrument, do we still file anything under MiCA?

Not under MiCA for that token: Article 2(4)(a) excludes crypto-assets that qualify as financial instruments. The firm must then assess which securities-law requirements apply to the instrument and its activities; MiFID II, MiFIR, the Prospectus Regulation, MAR and settlement rules do not all apply automatically. A firm with a mixed book can still have MiCA obligations for crypto-assets that remain within MiCA’s scope.

Who decides whether our token is a financial instrument?

The offeror or the person seeking admission to trading makes the classification, sometimes together with the crypto-asset service provider handling the asset. National competent authorities can challenge that classification before or after publication, so the decision has to be documented and defensible rather than assumed.

Are stablecoins caught by these guidelines?

‘Stablecoin’ is not itself a MiCA legal category. The token must first be tested against the financial-instrument criteria. If it is not a financial instrument, an e-money token is a crypto-asset that purports to maintain stable value by referencing one official currency, while an asset-referenced token references another value or right, or a combination of them. Payment use alone does not determine either category.

How do the guidelines treat fractionalised NFTs?

A genuinely unique and non-fungible crypto-asset is outside MiCA under Article 2(3), but it must still be assessed against the financial-instrument criteria. Fractionalisation is one factor that can undermine uniqueness and non-fungibility. Once an asset is split into interchangeable units that trade against each other, it can look like a class of transferable securities. ESMA directs authorities to the economic function of the fractionalised units, whatever the label attached to them.

When did the guidelines take effect, and what did our supervisor have to do?

ESMA published the translations on 19 March 2025 and the guidelines apply from 18 May 2025. Each national competent authority had to notify ESMA of its compliance position within two months of publication, by 19 May 2025, under the Article 16 comply-or-explain process.

Does a classification made in the EU hold in the UK?

No. The UK sits outside MiCA and runs its own cryptoasset perimeter through the FCA. A token treated as a financial instrument in the EU may be characterised differently under the UK framework, so firms active in both markets should classify separately against each regime.

Related Articles

• BaFin on tokenised securities and the MiCAR/MiFID perimeter – How a national supervisor applies the same boundary to tokenised securities in Germany.
• MiCAR token classification and reporting obligations – Where each MiCA category lands once the financial-instrument question is ruled out.
• EBA MiCA statement on ARTs and EMTs – Issuer takeaways for the asset-referenced and e-money token side of the perimeter.
• MiFIR, EMIR and SFTR transaction-reporting simplification – The reporting surface a financial instrument attracts once it leaves MiCA.
• The FCA’s UK cryptoasset regime and authorisation gateway – The UK perimeter that firms must classify against separately.
• The MiCA CASP transitional period and client-asset wind-down – The related timing question for firms completing the MiCA transition.

Key Takeaways

• ESMA published the CAFI Guidelines (ESMA75453128700-1323) on 17 December 2024; they apply from 18 May 2025 after translation on 19 March 2025.
• A crypto-asset that qualifies as a financial instrument is excluded from MiCA by Article 2(4)(a). The securities-law obligations that follow depend on the instrument category, the firm’s activities and the instrument’s offering or trading circumstances.
• ESMA’s mandate under Article 2(5) of MiCA covers only the overlap between the MiCA crypto-asset definition and the Article 4(1)(15) MiFID II financial-instrument definition, and the assessment stays case-by-case.
• The test is economic substance under technology neutrality; a “utility token” label and on-chain form do not settle classification, and hybrid tokens need reassessment over their lifecycle.
• Transferable securities are the widest gate: not a means of payment, part of an interchangeable class, and tradable in a capital-market context under Article 4(1)(44).
• Emission-allowance status is limited to EU ETS compliance instruments under Directive 2003/87/EC; tokenised voluntary carbon credits do not qualify on that basis.
• Offerors or persons seeking admission to trading are primarily responsible for correct classification; the relevant national authority may challenge it, and an EU classification does not bind UK authorities.

Sources and References

• ESMA, Final Report – Guidelines on the conditions and criteria for the qualification of crypto-assets as financial instruments, ESMA75453128700-1323, 17 December 2024: esma.europa.eu (PDF).
• ESMA, Guidelines (official-language version), ESMA75453128700-1323, published 19 March 2025: esma.europa.eu (PDF).
• ESMA, Compliance Table, ESMA75-113276571-1626, Guidelines on the conditions and criteria for the qualification of crypto-assets as financial instruments: esma.europa.eu (PDF).
• ESMA, Consultation Paper on the draft Guidelines, ESMA75-453128700-52, 29 January 2024 (comments to 29 April 2024): esma.europa.eu (PDF).
• ESMA document landing page for the Final Report and Guidelines: esma.europa.eu.
• Regulation (EU) 2023/1114 (MiCA), Articles 2(3), 2(4) and 2(5): eur-lex.europa.eu.
• Directive 2014/65/EU (MiFID II), Article 4(1)(15), Article 4(1)(44) and Annex I Section C: eur-lex.europa.eu.
• Joint ESMA/EBA/EIOPA Guidelines under Article 97(1) of MiCA (templates for explanations and legal opinions and the standardised test), JC 2024 28, 10 December 2024: esma.europa.eu (PDF).
• Directive 2003/87/EC establishing the EU Emissions Trading Scheme (emission allowances): eur-lex.europa.eu.
• Directive 2014/49/EU on Deposit Guarantee Schemes (definition of deposit): eur-lex.europa.eu.
• Regulation (EU) 2022/858 on a pilot regime for market infrastructures based on distributed ledger technology (DLT Pilot Regime): eur-lex.europa.eu.
• FCA, New regime for cryptoasset regulation (application window 30 September 2026; regime commencement 25 October 2027): fca.org.uk.

Running the classification before you build

The CAFI Guidelines reward firms that answer the financial-instrument question first and in writing. A dated assessment against each MiFID II category, refreshed as a token’s features change, is what turns a classification into a control a supervisor can accept. The projects that struggle are the ones that build a MiCA white paper on the assumption that everything on a ledger is a crypto-asset, then meet a national authority that reads the substance test exactly as ESMA drafted it. Decide the regime before the build, not after the launch.

Last updated: July 2026

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.