An ICO today is a token sale run through smart contracts, usually alongside a launchpad, a liquidity bootstrapping pool or a DEX listing. The code is a small part of the project. The parts that decide whether it succeeds, or ends in enforcement action, are the legal structure, the token design and the honesty of the disclosures.
The regulatory picture, briefly
The 2017–2018 ICO wave ended largely because most sales were unregistered securities offerings. In the US, the SEC applies the Howey test: if buyers invest money in a common enterprise expecting profits from others' efforts, the token is likely a security. Compliant routes include Regulation D (accredited investors), Regulation S (offshore buyers), Regulation A+ and Regulation Crowdfunding. US policy toward crypto has shifted since 2025, but no general safe harbor that makes retail token sales simple exists, so do not plan around one.
In the EU, MiCA requires an issuer offering crypto-assets to the public to publish a white paper meeting specific content requirements and notify the national authority, with liability for misleading statements. Stablecoins and tokens referencing assets have stricter regimes. Many other jurisdictions, including the UK, Singapore and the UAE, have their own rules for promotions and offerings. If your token is plainly a security, look at a security token offering instead.
What gets built
| Component | Purpose | Key risks |
|---|---|---|
| Token contract | ERC-20 or equivalent, fixed or capped supply | Hidden mint or blacklist functions, admin keys |
| Sale contract | Accepts payment, allocates tokens | Price or cap bugs, reentrancy, rounding |
| Allowlist and KYC | Restricts eligible buyers | Data leakage, easy bypass |
| Vesting contracts | Locks team, investor and buyer tokens | Revocation abuse, wrong cliff math |
| Claim contract | Distributes purchased tokens, often via Merkle proofs | Double claims, incorrect roots |
| Liquidity setup | Seeds a DEX pool at launch | Sniping bots, unlocked LP tokens |
Sale formats
- Fixed price with caps. Simple, but often leads to gas wars or bot-dominated allocation when demand is high.
- Dutch auction. Price starts high and falls until demand meets supply. Better price discovery, though buyers must understand the mechanism.
- Liquidity bootstrapping pool. A weighted pool, as offered by Balancer, that shifts weights over time so the price falls unless buyers step in. Discourages bots front-running the start.
- Launchpad allocation. A third-party platform handles KYC and allocates based on staking or lottery. See the launchpad guide and the Ethereum IDO launchpad walkthrough.
- Exchange-run sale. An exchange vets and sells the token, covered under IEO services.
Tokenomics that will not collapse
Most failed sales did not fail because of contract bugs. They failed because tokens unlocked faster than demand grew, or because the token had no role beyond speculation. Model circulating supply month by month, including every vesting schedule, and compare it to realistic usage. Be wary of anyone promising price support, listings or returns; those promises are also exactly what regulators look for. The DeFi token development guide goes deeper into utility and supply design.
How to evaluate a development team
- Ask for prior contracts on-chain. Verified source code you can read is worth more than a portfolio page.
- Check that they use audited libraries such as OpenZeppelin rather than custom token code.
- Ask who audits the work. The developer should never audit their own sale contracts; budget for an independent firm.
- Clarify key management. Who holds admin keys and treasury multisig signers, and when are admin roles renounced or put behind a timelock?
- Confirm they will not handle legal structuring. A dev shop that offers "compliance included" without named lawyers is a red flag.
- Avoid anyone selling guaranteed listings, market making for price support or "marketing packages" that promise returns.
Cost and timeline drivers
A standard token, vesting and sale contract built on audited libraries is a few weeks of engineering for one or two developers, plus an audit. Custom auction mechanics, multichain sales or integrated KYC add time. Legal work, white paper preparation and exchange or launchpad onboarding often cost more and take longer than the code.
Frequently asked questions
Is an ICO legal in 2026?
It can be, if structured under an applicable exemption or regime such as US securities exemptions or MiCA's white-paper process. Unregistered public sales of investment-like tokens remain high-risk.
What is the difference between an ICO, IDO and IEO?
An ICO is sold directly by the issuer, an IDO through a decentralized launchpad or DEX, and an IEO by a centralized exchange that vets the project.
Do I need an audit for a simple sale contract?
Yes. Sale contracts hold buyer funds during the most attacked moment of a project's life.
Can geoblocking keep US buyers out?
It reduces risk but is not a full defense. Regulators look at who actually bought and how the sale was marketed.