Cryptocurrencies, such as bitcoin and ethereum, have not only risen to public attention as novel means of payments. Rather, the current hype is fueled by financial applications built on top of these currencies that stand to potentially upend consumer and investment markets. The most remarkable and economically relevant of these applications are tokens sold via initial coin offerings (ICOs, also called token sales). In 2017 alone, the equivalent of about $5 billion have been raised through ICOs, and in the first quarter of 2018 already more than $6 billion. In these entirely online-mediated offerings, startup entrepreneurs sell tokens registered on a blockchain in exchange for cryptocoins traded on that blockchain (typically bitcoins or ethers). Investors receive tokens that can be understood as cryptographically-secured coupons which embody a bundle of rights and obligations. In July 2017, the SEC released an investigative report that highlighted that such tokens can be subject to the full scope of US securities regulation. As a result, issuers increasingly structure ICOs such as to prevent US citizens and residents from obtaining tokens in order to exclude the reach of US securities regulation. However, for the time being, EU citizens and residents are free to invest in tokens. This raises the question to what extent EU securities regulation is applicable to ICOs and, particularly, whether issuers have to publish and register a prospectus in order to avoid criminal and civil prospectus liability in the EU. In conceptual terms, this depends on whether tokens are considered “securities” under the EU prospectus regulation regime. The question is of great practical relevance since, despite the high stakes involving several $100 million in some ICOs, to our knowledge, up to now not a single token issuer has published or registered any such prospectus. Against this background, this paper develops a nuanced approach that distinguishes between three archetypes of tokens: currency, investment, and utility tokens. It analyzes the differential implications of each of these types, and their hybrid forms, for EU securities regulation. While the variety of tokens offered necessitates a case-by-case analysis, the discussion reveals that at least some types and hybrid forms of tokens are subject to EU securities regulation. By and large, pure investment tokens typically must be considered securities, while pure currency and utility tokens are exempted from securities regulation in the EU. In identifying these archetypes, regulation and market oversight will have to put substance over form. Finally, we spell out criteria for the application of EU securities regulation to hybrid token types. The paper closes by offering two policy proposals to mitigate legal uncertainty concerning token sales. First, we suggest tailoring disclosure requirements to the code-driven nature of token sales. Such an ICO-specific safe harbor would offer a clear and less burdensome path to EU law compliance for token sellers who suspect that their tokens may qualify as securities. This only requires the Commission to amend its delegated 2004 Commission Prospectus Regulation. Second, we propose that, on an international level, governments form a compact to bestow certainty about the application of their respective securities regulation regimes to token sales. This is, first, to avoid regulatory overkill on the one and regulatory lacunae on the other hand in online-mediated, global token sales. Second, overlapping, and partially contradicting, securities regulation regimes can even undermine each other. In the end, only a joint international regulatory regime can efficiently balance investor protection and investor access in the face of the novel generation of decentralized blockchain applications.