Token Sales and ICOs: Planning, Regulation and Platform Engineering

An initial coin offering (ICO), also called a token sale or token generation event, raises money by selling newly created blockchain tokens to the public. ICOs peaked in 2017 and 2018, when a white paper and an ERC-20 contract were often enough to raise large sums from anyone with an Ethereum wallet.

That era is over. Regulators in most major markets now treat many token sales as securities offerings or regulated crypto-asset offerings, and many projects from that period failed or were shut down. Token sales still happen, but through more structured routes and with far more compliance work.

This post covers both sides of a token sale as it works today: the planning questions, the regulatory situation in general terms, and the engineering behind a sale platform. It is not legal or investment advice.

Start with the token, not the raise

Most failed token projects had a token that the product did not need. Before anything else, answer three questions honestly:

1. What does the token do in the product? Paying for a service, governing a protocol and representing a share of an asset are very different things, technically and legally.
2. Could the product work without it? If a normal payment or a database entry would do the same job, the token adds risk and cost without benefit.
3. How does value reach the token? If usage of the product does not create demand for the token, the token has no lasting purpose.

The answers also shape the legal analysis, because regulators look at what buyers expect to receive.

Then set the funding goals: how much you need, what it pays for, and over what period. A clear use-of-funds plan disciplines the team and is now a disclosure requirement in several jurisdictions.

The regulatory situation

Rules differ by country and change often, so treat this as orientation, not a checklist.

• Securities law. In many jurisdictions, a token sold to raise money for a project, with buyers expecting profit from the team’s work, can be a security. In the United States, regulators apply long-standing tests for investment contracts, such as the Howey test, and have brought enforcement actions against many 2017-era sales. Selling securities to the public requires registration or a valid exemption.
• Dedicated crypto-asset rules. Some regions now have specific regimes. The European Union’s Markets in Crypto-Assets Regulation (MiCA), for example, requires a published crypto-asset white paper and sets duties for issuers and service providers.
• KYC and AML. Know-your-customer and anti-money-laundering checks are expected for almost any sale that takes funds from the public: identity verification, sanctions screening, and monitoring of where contributions come from.
• Restricted jurisdictions. Many sales exclude buyers from certain countries entirely, which the platform must enforce, not just state in its terms.
• Tax and accounting. Proceeds, token allocations and vesting all have tax consequences for the issuer and buyers.

Engage lawyers in each target market before design work, not after. The legal structure decides who may buy, what you must disclose, and which features the platform needs.

For recent developments, see our notes on crypto regulation and web3 in 2025 and on tokenized real-world assets, where regulated token offerings have grown.

Routes to market today

• Registered or exempt securities offerings (often called security token offerings) sell tokens under securities rules, usually to verified or accredited investors.
• Exchange or launchpad offerings run the sale through an exchange or platform that handles KYC and listing, at the cost of fees and the platform’s own requirements.
• Airdrops and community distributions give tokens to users rather than selling them, though these can carry their own legal questions.
• Private sales to a small group of professional investors under applicable exemptions.

What buyers and regulators look for

The practical checklist from 2017 still applies, with higher standards:

• White paper. Problem, market, product, token design, use of funds, roadmap, team and risks. Accurate disclosure matters more than persuasion; misleading claims create liability.
• Working product. A public repository with real activity or a live product shows progress better than any roadmap.
• Roadmap. A short, dated view of goals and milestones for stakeholders, not a detailed project plan.
• Named team. Real people with verifiable backgrounds in key roles.
• Token distribution and vesting. How many tokens the team, investors and community receive, and when the team’s tokens unlock.
• Audits. Independent smart contract audits, published before the sale opens.

Bounty campaigns that paid people to promote a sale on social media were common in 2017. Paid promotion of a token sale can now trigger disclosure and marketing rules, so check with counsel before running one.

Engineering a token-sale platform

In 2017 Lightrains built an investor dashboard for token sales covering pre-sale and public sale phases. The parts of that design that hold up are below, updated for current practice.

Core features

• Investor onboarding and KYC. Identity checks through a specialist provider, sanctions screening, and a jurisdiction gate. Store as little personal data as possible and keep it off-chain.
• Allowlisting. Only verified addresses can buy. The contract or the backend checks each purchase against the list.
• Contribution handling. Accept a small set of assets, record each contribution against a verified investor, and enforce per-investor and total caps.
• Pre-sale and private allocations. Separate tranches with their own prices, limits and vesting.
• Investor dashboard. Contribution history, token allocation, vesting schedule and claim status, with multilingual support if you sell across markets.
• Admin analytics. Totals by tranche, asset and country, plus an audit trail of every manual action.

Smart contracts

Our original platform used an ERC-20 token and a crowdsale contract based on OpenZeppelin. OpenZeppelin has since removed its Crowdsale contracts, and current practice is different:

• Use a standard, audited token implementation such as OpenZeppelin’s ERC-20, with as little custom logic as possible.
• Keep sale logic separate from the token. A common pattern is to record allocations during the sale and let investors claim tokens later, which simplifies refunds and vesting.
• Put vesting in its own contract with clear, tested schedules.
• Control admin functions with a multisig wallet and time locks, not a single key.
• Write thorough tests, run static analysis, and get an external audit. See our guides to smart contract security best practices and Solidity static analysis tools.

Backend and payments

The original stack was Node.js with Express and MongoDB. Any mainstream stack works; what matters is how it handles money and identity:

• Treat the blockchain as the source of truth for payments. Watch for confirmed transactions to your sale addresses and reconcile them against investor records, allowing for chain reorganizations.
• Avoid accepting assets through third-party conversion services you cannot audit. If you accept several currencies, convert through a regulated provider and record the rate used.
• Keep sale and treasury funds in multisig or institutional custody, never in a hot wallet on the application server.

Security

The web application is attacked as often as the contracts. Phishing sites that copy the sale page and swap in a different deposit address were a common way to lose investor funds. Basic controls:

• TLS everywhere, strict security headers (Helmet on Express), secure cookies and CSRF protection.
• Dependency scanning and pinned versions, with no deprecated framework releases in production.
• Show the official contract address in one place, sign announcements, and never change deposit addresses during a sale.
• Rate limiting and queueing for the opening minutes, when traffic spikes.
• Two-factor authentication for every admin account, and logs of every admin action.

Is a token sale the right tool?

For most companies today, no. Equity, grants or revenue fund most products more simply. A token sale makes sense when the token is necessary to the product, the legal route is clear in each market you sell to, and the team can carry the compliance work for years after the sale.

If that describes your project, Lightrains can help design and build the contracts and the platform through our blockchain development services. Talk to qualified lawyers about the legal structure first.

This article originally appeared on lightrains.com