Token Listing Due Diligence: The Venue Owns the Paper

• MiCA Article 5(2) hands the crypto-asset white paper obligations to any trading platform that admits a token on its own initiative.
• Article 15 extends civil liability to the operator and its management body, and contractual exclusions have no legal effect.
• Article 76 bars assets that hide holders behind an anonymization function.
• Gotbit’s founder forfeited around $23 million after admitting he wash traded to get tokens listed on data aggregators.
• Tokens launched in 2024 reached market at a 12.3% market cap to fully diluted value ratio, which leaves most of the supply arriving after listing.

A listing committee used to be answering a commercial question. Does the token bring volume worth the integration cost and the tail risk of unwinding it later. In the EU that question now sits behind a legal one. Article 5(2) of MiCA covers admission on the initiative of the platform operator. Where no crypto-asset white paper has been published in a case the regulation requires one, the operator has to satisfy the issuer’s obligations itself. Article 15 then makes the operator and the members of its management body liable to holders for a paper that is incomplete, unfair, unclear or misleading, and it strips legal effect from any contractual exclusion of that liability.

The listing file has an author now. The first finding on it is whether the token has an identifiable issuer, and that finding decides whether the venue is admitting someone else’s disclosure or writing its own.

Buy bitcoin and stocks. Signup to Coinbase today

Whether the token has an identifiable issuer

ESMA’s Q&A 2552 records the European Commission’s position that Article 5(2) does not reach crypto-assets without an identifiable issuer. Recital 22 keeps those assets outside Title II, and no white paper is required for them. The same answer is explicit that the platform still carries obligations. It has to obtain authorization, determine whether an identifiable issuer exists, and assess the suitability of what it admits.

That determination is the load-bearing step. A venue that decides wrongly that no issuer exists has admitted a token without the disclosure the regulation required, and Article 15 sits behind the error. Deciding wrongly in the other direction produces a white paper the token never needed, along with the Article 12 update duties that attach to it.

Two structures move the work around without removing it. Article 5(3) lets the issuer and the operator agree in writing that the operator will handle some or all of the notification, publication and marketing obligations. That agreement has to oblige the issuer to hand over the information the operator needs. Article 5(4) drops the white paper requirements where the asset already trades on another platform in the Union. The existing paper has to comply with Article 6, be updated under Article 12, and carry its author’s written consent, and a listing desk collects those documents before admission.

A trap sits in the exemptions. Article 4 lets an offer skip the white paper in several situations. The token is given away free, or created automatically as a reward for validating transactions. The offer reaches fewer than 150 people per member state, or stays under EUR 1,000,000 of consideration over 12 months, or goes only to qualified investors. Article 5 carries no parallel list. A token that reached the market through one of those routes and never published a paper arrives at a venue with the obligation unspent. The venue that admits it on its own initiative spends that obligation, and airdropped tokens and validator-reward tokens are the common cases.

The same Q&A makes a second point about authorization. A firm that admits crypto-assets to trading is operating a trading platform, and that is a distinct service under MiCA from exchange, execution or reception and transmission of orders. The permission has to be on the authorization before the first ticker goes live.

Where the edge of the definition sits is unsettled. A token issued by a named foundation that has since wound down does not answer the identifiable-issuer question cleanly. Neither does one whose development passed to a contributor collective, and no regulator has published a test. Venues are resolving it in their own files, and the first supervisory challenge will tell the market what the standard is.

What Article 76 puts in the operating rules

Article 76 requires an operator to publish operating rules that set out the approval process for admitting a crypto-asset to trading, the categories it will not admit, and its fees. Before admission the operator assesses the asset’s suitability, covering technical reliability and exposure to fraud or other illicit activity. Assets with an inbuilt anonymization function are excluded unless the operator or a competent authority can identify holders and their transaction histories.

The rest of the article shapes the venue around that decision. Operators cannot deal on own account. Matched principal trading requires the client’s explicit consent. Trading systems have to hold up at peak volume, reject erroneous orders, and block both market abuse and use of the platform for money laundering, with detected abuse reported. Transactions settle within 24 hours of execution, and order records are kept for five years. Transparency runs alongside all of it. Bid and ask prices and transaction details go out close to real time, and the same trade data becomes free and machine-readable after 15 minutes and stays available for two years. A venue that admits a pair with no trading in it publishes that fact continuously.

Operating rules are a published document, and a supervisor reads them against the file. A rule promising a technical assessment of every admitted asset creates an evidentiary expectation for every ticker on the board, including the ones admitted in a hurry during a listing race. Venues drafting these rules are choosing how much discretion to keep, and a loose rule is still a published commitment.

The future of finance is here. Trade crypto and more

The number of firms this binds is small. Twenty CASPs held trading-platform permissions out of roughly 330 authorizations on ESMA’s register in August 2026, against 194 carrying custody and administration. Most trading happens outside that perimeter. Coincub’s Crypto Exchange Report 2026 put Binance’s share of users in licensed markets at 36.3% and OKX’s at 27.1%, against 88.3% for Robinhood and 80.7% for Coinbase.

Contract permissions, upgradeability, and audit scope

Technical reliability starts with who can change the token after it lists. Mint, pause, blacklist or freeze, and upgrade are the powers that decide it. Confirming they exist in the code is a third of the work. The review also records who holds the key, how many signatures move it, and what timelock sits in front of it. Public statements by the issuer about using those powers belong in the file alongside the code.

OWASP’s Smart Contract Top 10 for 2026 ranks access control first and proxy and upgradeability tenth, drawn from 122 deduplicated incidents and around $905.4 million of losses in 2025. Both entries describe one listing risk from opposite ends. A privileged function in the wrong hands moves balances, and an upgradeable proxy replaces the contract the venue reviewed.

Dependencies extend the review past the token contract. A token that prices through an oracle inherits that oracle’s failure modes, and price oracle manipulation ranks third on the same list. A token deployed on several chains behind one bridge is several contracts under a single ticker, and the venue has to know which deployment its hot wallets hold. The chain itself is part of the assessment. For a new network the questions are validator count, finality, client diversity, and what happens to withdrawals during a halt.

A verified badge on a block explorer confirms that the published source compiles to the deployed bytecode. Safety is a separate review with a separate output. Coinbase’s listing guide, published on 10 September 2025, describes a security review covering contract code, design and operational risks, and for new chains an assessment of technical design, consensus, network resilience and governance. Third-party audits sit inside that review as one input. An audit reports on a commit, and the address a venue integrates can be a later deployment. The file records the bytecode hash of the contract being listed and the date that contract went live.

Reported volume and the market maker contract

Volume is the figure most listing applications lead with, and it is the cheapest one to buy. Cong, Li, Tang and Yangestimated that unregulated exchanges inflated reported volumes by more than 70% on average, against under 5% on regulated venues. Their sample runs from 2019 and the venue mix has changed a great deal since then. The incentive to inflate a volume chart ahead of a listing application has not changed at all.

Chainalysis counted more than 2 million tokens launched in 2024, around 42.35% of them reaching a DEX pool. It flagged 3.59% of the year’s launches, 74,037 tokens, as showing patterns consistent with a pump and dump. Around 94% of the pools involved were drained by the address that created them, after an average of 6.23 days.

Aleksei Andriunin, the founder of Gotbit, pleaded guilty on 21 March 2025 to wire fraud and conspiracy to commit market manipulation and wire fraud, and forfeited around $23 million in cryptocurrency. The indictment said he developed code to wash trade cryptocurrencies to inflate trading volume for the purpose of getting them listed on CoinMarketCap. Gotbit ran those trades for clients including Robo Inu and Saitama and took tens of millions of dollars in payments. He was arrested in Portugal on 8 October 2024 and extradited on 25 February 2025. The same district brought related cases against MyTrade in October 2024 and CLS Global in January 2025, both out of undercover operations.

The volume chart in an application can be a purchased input, and the contract that produced it is a document a listing desk is entitled to ask for. Loan-and-option market making agreements, the standard structure behind a new listing, set out the borrowed inventory, the strike prices and the exercise windows. Those terms, set against the unlock calendar, give a venue a dated picture of post-listing supply that no holder table reproduces.

Buy bitcoin and stocks. Signup to Coinbase today

Article 92 requires any person professionally arranging or executing transactions in crypto-assets to keep effective arrangements, systems and procedures to prevent and detect market abuse. Any reasonable suspicion goes to the competent authority without delay. ESMA’s final guidelines of 29 April 2025 tell national authorities to keep those systems under ongoing risk-based supervision and to grade the suspicious order and transaction reports they receive. Evidencing a reasonable suspicion takes order-level data retained across venues, an alert set calibrated for layering, spoofing and wash patterns, and an analyst who can write a report a supervisor will act on. Thin, concentrated pairs generate most of that alert volume, and surveillance becomes a running cost attached to every pair the desk admits.

Float, unlock schedules, and holder concentration

Binance Research measured the 2024 launch cohort at a market cap to fully diluted value ratio of 12.3%, the lowest of the 2022 to 2024 cohorts. Individual launches ran as low as 6% and none exceeded 20%. Working from Token Unlocks data, the May 2024 report put around $155 billion of scheduled unlocks between 2024 and 2030.

A 12% float means the listing price is set by a twelfth of the supply while the other eleven twelfths arrive on a published calendar. The file needs that calendar with dates and tranche sizes, mapped to the wallets that receive each tranche. Cliff dates get marked against the venue’s own liquidity commitments and against the date any lock-up on the market maker’s inventory expires.

Listing-day liquidity is the other half of the same arrangement. A venue that requires a market maker to quote a minimum size at a maximum spread has bought depth with the issuer’s borrowed inventory. The terms of that loan decide what happens once the quoting obligation lapses. The file should name the market maker, state the inventory borrowed, and record the date the obligation ends.

Thin books and leverage finish the job. OM fell from above $6 to just over $0.40 on 13 April 2025, during low-liquidity hours. More than $50 million of futures positions liquidated, open interest dropped from $345 million to just over $130 million, and more than $220 million of tokens had moved onto exchanges before the fall. MANTRA’s co-founder attributed the move to reckless forced closures by centralized exchanges. Regulators have published no finding on the cause, and the deposit flow was readable on-chain before the price moved.

Holder counts are the weakest metric in a listing pack. Addresses are cheap, and a thousand of them funded from one source is one holder. Resolve the top of the table to entities, and treat a table that cannot be resolved as a finding in its own right. Then watch what those entities do. Exchange deposits from top-table wallets, days ahead of a cliff, describe intent more accurately than any document the issuer files.

Suspension, white paper updates, and the file after admission

Admission starts a maintenance obligation. Article 12 requires offerors, persons seeking admission to trading and operators of a trading platform to modify a published white paper. The trigger is a significant new factor, material mistake or material inaccuracy capable of affecting the assessment of the crypto-asset. The modified paper goes to the competent authority at least seven working days before publication, with a summary of the reasons, and the public gets it on the website on the publication date.

For a venue that took on the paper under Article 5(2), that duty runs for as long as the token trades. A treasury reallocation, a change of control at the issuer, a chain migration or a new mint authority is a candidate trigger, and each one needs a decision recorded at the time it happens. No party is obliged to tell the venue that a trigger has occurred, so the monitoring sits with the desk that admitted the asset.

Article 76 pushes from the trading side. Operating rules have to state the conditions under which the platform suspends trading, alongside the approval process and the excluded categories. A venue that halts a pair on suspicion of market abuse has formed the view that a reasonable suspicion exists, and Article 92 attaches a reporting obligation to that view. The sequencing of a halt, a report and a public statement belongs in the procedure before any of the three is needed.

The future of finance is here. Trade crypto and more

Classification in the US after the CLARITY vote

The Senate rejected cloture on the motion to proceed to H.R. 3633 on 15 September 2026, by 49 yeas to 50 nays with one senator not voting, against the 60 needed. The House had passed the bill on 17 July 2025. Market structure legislation is finished for this Congress, and the classification question behind every US listing decision stays where it was.

H.R. 3633 would have set up a system of regulation for the offer and sale of digital commodities divided between the SEC and the CFTC. Without a statutory category, a venue decides on its own analysis which regime a token sits under, and the answer moves when the facts move. A token that reads as a commodity at listing can read differently once the issuer resumes development, restarts a treasury program, or turns on a revenue-sharing mechanism.

The SEC has moved on its own. Regulation Crypto Assets, proposed on 18 August 2026, would create two exemptions from Securities Act registration. One covers up to $5 million over four years with principles-based narrative disclosure. The other covers up to $75 million in any 12-month period and carries financial statements and ongoing reporting. The proposal also offers a conditional safe harbor from the term investment contract, available once an issuer has completed or permanently ceased all essential managerial efforts. Comments run for 60 days from Federal Register publication, and the proposal stays a proposal until the Commission adopts a final rule.

The safe harbor is the operative piece for a venue and the hardest to verify. Whether essential managerial efforts have permanently ceased is a claim about an issuer’s future conduct, and the platform that lists on the strength of it holds the position if the claim fails. Chairman Atkins has said the exemptions will not be durable without a statute underneath them, and the September vote took the statute off this year’s calendar. Coinbase’s published process still turns on whether trading the token would be a securities transaction in the relevant jurisdictions, and the firm says it does not list securities.

Venues serving both perimeters run the analysis twice. Article 5(2) puts an EU operator on the white paper for any token it admitted on its own initiative. Offering that same ticker to US users adds a securities analysis the venue performs and owns. One integration then carries two files, two sets of update triggers, and deadlines that do not line up.

None of this collapses into a single score. A supervisor reading the file two years later wants six findings in writing. The first three cover who the issuer is, what approval process the operating rules required, and what the code lets the issuer do after listing. The other three cover where the volume came from, what unlocks and when, and which securities analysis the venue relied on. Venues that keep those findings can defend a listing long after the pair stops trading.