A bank can run an NFT or tokenized loyalty initiative inside its regulatory perimeter, provided it treats the work as a regulated product launch rather than a marketing campaign. The design choices that decide the legal treatment are made in the first weeks: what the token is, who can claim it and whether it can be resold. In the case this guide draws on, a national banking association brought a climate-positive NFT initiative to market, live and compliant inside a regulated financial environment.
Who decides this
The head of digital assets or innovation owns the initiative, and is accountable for one outcome: a live programme that compliance, security and the brand team can all sign off. Marketing may sponsor the project while legal holds it back. The owner’s job is to make both work from the same design.
The owner also decides what the initiative is for. In the banking association case, the purpose was a climate-positive, sustainability-focused NFT initiative. A clear purpose like that makes the later trade-offs easier to settle.
Is it an NFT, a loyalty point or a security?
Design the token so its legal character is obvious before anyone writes a contract: a unique collectible, a points-style token usable only with named merchants, or neither. Ambiguity here is what turns a loyalty project into a securities question.
In the EU, MiCA (opens in new tab) does not apply to crypto-assets that are unique and not fungible with other crypto-assets. The recitals narrow that exclusion. Fractions of an NFT are not unique; issuing tokens in a large series or collection is an indicator of fungibility; and a unique identifier alone is not enough. The exclusion also does not stop an NFT from being a financial instrument.
Points-style tokens have their own route. MiCA’s offer rules in Title II do not apply where a token is offered free, though an offer is not free if recipients must provide personal data in exchange, or where the holder can use it only for goods and services from a limited network of merchants under contract with the offeror. Above EUR 1,000,000 of consideration in a 12-month period, a limited-network offeror must notify its regulator and explain why the exemption applies.
In the US, marketing can create the problem. In August 2023 the SEC found that NFTs sold by Impact Theory (opens in new tab) were investment contracts. The order cited statements encouraging buyers to see a purchase as an investment in the business. Impact Theory had raised about $30 million and, without admitting or denying the findings, agreed to pay more than $6.1 million in total. The order predates the SEC’s March 2026 interpretive release on crypto assets, so counsel should read it against current guidance.
The common designs compare as follows.
| Design | EU treatment to check | US exposure to check | Fit for a bank programme |
|---|---|---|---|
| Free, unique commemorative NFT | Possibly outside MiCA if truly unique and not part of a large series; a claim that collects personal data is not a free offer | Low, if never sold or promoted as an investment | Good for a one-off campaign |
| Claimable membership NFT in a large series | Large series is an indicator of fungibility; treat as in scope until counsel says otherwise | Depends on rights attached and how it is marketed | Workable with careful design |
| Points token usable only with named merchants | Limited-network exemption from Title II; notification above EUR 1,000,000 | Closer to a conventional loyalty scheme if not transferable for profit | Strongest fit for loyalty |
| Tradable token with resale value | Likely in scope | Highest; resale value plus promotion invites the investment-contract test | Hard to defend inside a bank |
Our view: for a bank, the free commemorative NFT or the limited-network points token is usually right. Avoid anything whose appeal depends on resale value.
Who can claim it, and how?
Make claiming as easy as logging into the bank’s own channels, and decide early whether holders keep tokens in their own wallets or in one the bank operates. Every step between eligibility and a claimed token loses members.
In the banking association case, the advisory work covered the campaign structure as well as the infrastructure. Claim design is the part programmes tend to underestimate. Eligibility rules, identity checks and wallet set-up all need owners.
If the claim runs through a mobile app, the app store sets limits too. Apple’s App Review Guidelines (opens in new tab) let apps show users their own NFTs, but owning an NFT may not unlock features or functionality inside the app. Apps may use in-app purchase to sell NFT-related services such as minting and transfer. A programme that gates app features behind an NFT needs a different design on iOS.
Which chain fits a sustainability brief?
If the programme carries a climate message, choose a chain whose energy use you can state and defend in public, and say where the estimate comes from. A sustainability NFT on a chain the press can call wasteful undoes its own purpose.
Proof-of-stake networks make this easier. ethereum.org (opens in new tab) cites a Crypto Carbon Ratings Institute estimate of about 2,601 MWh a year for the network, about 870 tonnes of CO2e. The same page warns that per-transaction energy figures can mislead, because a block’s energy cost does not depend on how many transactions it holds.
What we would do: publish the chain choice, the source of the energy estimate and the date, and avoid per-NFT carbon claims. A claim you cannot audit is a reputational risk the compliance team will rightly reject.
Who builds it, and to what standard?
Hold one partner accountable for the whole build, from concept and smart contracts through minting and distribution, and require it to meet the bank’s own security and compliance standards. Splitting the build across an agency, a developer and a wallet vendor leaves the joins unowned.
That was the shape of the banking association engagement. The NFT infrastructure was built end to end, from concept through smart contract set-up, minting and distribution. It was delivered to the security and compliance standards a regulated financial-sector client requires.
If the programme ever holds assets on behalf of members or backs tokens with reserves, custody becomes its own decision. Treat that as a change of product, with a new legal review, not as a feature added to a loyalty scheme.
How do you measure an institutional NFT programme?
Measure claims and repeat engagement by eligible members, and report them against the purpose the board approved; mint counts and secondary-market prices measure the wrong thing. A loyalty or sustainability programme succeeds when members use it, not when tokens trade.
Set three measures before launch. The claim rate shows what share of eligible members actually took the token. Repeat engagement shows how many returned to use it, redeem it or take part in a later campaign. Purpose measures tie the programme back to its brief: for a sustainability initiative, the actions members took that the roadmap counts.
Agree the reporting line too. If the programme sits inside a sustainability roadmap, its results belong in that reporting rather than in a marketing dashboard. That placement also keeps the programme honest about what it claims.
Decide in advance what happens at the end. A campaign NFT can simply stay in members’ wallets; a points token needs a wind-down plan and a statement on what members can still redeem. Write that down before launch, while nobody is under pressure.
What goes wrong: five advisers, one blind spot each
A bank NFT programme can hire well in each lane. A creative agency designs the collection, a developer writes the contracts, counsel reviews the terms, a wallet vendor handles claims and the security team runs its review. Each does its part properly.
Nobody owns the joins. The agency promotes the collection as something that will grow in value, which counsel never saw. The developer issues a large series that counsel assumed were unique. The wallet vendor’s claim flow fails the bank’s identity checks, and security finds the issue after launch.
When the problem surfaces, every adviser is right about its own work, and the programme is still wrong. The fix is one accountable owner who has seen every lane and reviews each decision against the others before it is made.
How Alcyone approaches it
Alcyone runs institutional NFT work as one engagement, with one team across its service areas. For a national banking association, its partners built the NFT infrastructure end to end and advised on the campaign structure. The result was a live, compliant NFT initiative with a climate-positive purpose. The engagement is described in Alcyone’s institutional advisory case studies (opens in new tab). There is no obligation to use TrustSwap products.
If a programme grows into a reserve-backed token, Panthea’s solutions for issuers (opens in new tab) provide reserve tooling, while the reserves are held in segregated accounts at Blockfort AG, a Swiss-regulated financial intermediary and VQF member.