Introduction
A DAO has no boss, no office, and no company behind it. So when something goes wrong, who gets sued?
Be careful with that question. The honest answer may be everyone.
We work with Web3 projects every day, and one question keeps arriving in our inbox: are DAOs even legal in the EU? The short answer is yes. Starting one breaks no law. But there is a catch, and it is a big one. The law does not know what a DAO is. And when the law does not recognise something, it does not leave it alone. It reaches for the oldest box on the shelf and puts you in that one instead.
This article explains which box that is, why you will not like it, and what serious projects do about it.
Part One: The Law Does Not See a DAO. It Sees a Partnership.
Here is the uncomfortable starting point.
In most European legal systems, when a group of people work together toward a shared goal, share the profits, and never register a company, the law treats them as a partnership. Not the modern kind you register at a company registry. The old kind that exists automatically, simply because people are working together. Slovenia has this. Germany has it. France has it. The names are different in each country, but the result is the same.
And that result is the problem. This kind of partnership gives you no protection for your personal assets. If the project owes money or causes damage, the members can be held responsible personally, out of their own pockets. In many countries each member can be held responsible for the full amount, not just their share. Someone bringing a claim can simply choose the member who looks easiest to reach and best able to pay.
Now put the DAO dream next to that. Thousands of anonymous token holders. No company anywhere. If a court looks at that and sees an old-style partnership, then “anonymous” does not protect anyone. It just means the visible people get sued first. The core contributors. The people holding the keys to the multisig wallet. The person running the marketing account with their real name on it.
This is not only a theory. In the United States, a regulator took a DAO to court and won. In June 2023 a court in California entered judgment against Ooki DAO, holding that it was an unincorporated association that could be sued, ordering it to shut down, and imposing a large penalty. Crucially, Ooki DAO is the exact same entity as bZx DAO, which rebranded after a name change in late 2021. This meant the same community was forced to defend itself against two entirely different legal theories at the same time. In a separate case in March 2023, another California court decided that a claim describing bZx DAO as a general partnership was strong enough to go forward. That was an early stage decision rather than a final ruling that every DAO is a partnership, but the direction of travel was clear enough to make a lot of founders nervous.
Europe has not had its landmark DAO case yet. You do not want to be the one that provides it.
Part Two: Your Governance Token Is Still a Token
Here is the second trap.
MiCA, the EU rulebook for crypto, does not regulate DAOs. It regulates tokens. And your governance token is a token.
If you offer it to the public in the EU, you are in the same position as any other token project. Most governance tokens fall into MiCA’s general category, which covers everything that is not a stablecoin. That means no licence is needed to launch. But it does mean three things. You need a white paper, which is a plain document describing the project and the token, filed with your national regulator and published before you start selling. Your marketing must be honest and must match that document. And there must be a named legal person behind the offer, who carries the responsibility if the document turns out to be misleading.
The same exemptions apply as for any other token. You may not need the white paper if you offer to fewer than 150 people per country, or raise under one million euros over twelve months, or sell only to professional investors who are also the only ones allowed to hold the token, or give the token away genuinely for free. And the same trapdoor applies too. As soon as you announce that you intend to list the token on a trading platform, those exemptions stop applying.
Now the extra twist that DAOs love to ignore. If you attach money rights to that governance token, a share of protocol fees, dividend-style payments, or a claim on the treasury, it can stop being an ordinary crypto token and start to look like a security, meaning a financial investment product like a share or a bond. ESMA, the EU markets regulator, published guidance in December 2024 explaining how this line is drawn, and it looks at what rights the token actually gives people, not at what you call it. If your token crosses that line, you leave crypto rules behind and enter financial markets rules, which are far heavier and far more expensive to comply with.
So decide what rights your token will carry before you launch, not afterwards.
Part Three: The Very Small “Fully Decentralised” Escape Hatch
Now the favourite answer we hear: “MiCA does not apply to us, we are fully decentralised.”
There is something real behind this. MiCA says that where crypto services are provided in a fully decentralised way, with no middleman at all, they should not fall inside the rules. But notice two things.
First, this sentence appears in the introduction to the Regulation, not in the actual rules. In EU law that introduction helps courts and regulators interpret the rules, but it is not the same as a clear written exemption you can point to. It is a weaker foundation than most founders think.
Second, regulators read the word “fully” extremely strictly. Ask yourself honestly. Is there a company running the website that people actually use? Is there a development team pushing upgrades? Is there a foundation paying contributors? Is there a multisig wallet that a few people control and that can pause the whole protocol? If the answer to any of these is yes, then there is a middleman, and there is a very good chance that the middleman is you.
And if what your DAO offers to EU users looks like exchanging, holding, or arranging trades in crypto for other people, then you are looking at the licensing rules for crypto service providers. The transition period for those rules has now closed. It ended on 1 July 2026 at the latest, and several countries closed it much earlier than that. So there is no longer any waiting room.
“But we are a DAO” is not a legal defence. It is a description.
Part Four: Give Your DAO a Body
So what do serious projects actually do? They give the DAO a body.
The usual name for this is a legal wrapper. It simply means a real, registered organisation that sits around the DAO, or right beside it. No EU country has passed a dedicated DAO law yet, so founders borrow shapes that already exist and already work.
The foundation is the most popular choice, and the Dutch foundation, called a stichting, is the one you will hear about most often. Just outside the EU, the Swiss association has been the classic option for years. Inside the EEA, which is the EU plus Norway, Iceland and Liechtenstein, Liechtenstein offers flexible structures, and MiCA now applies there too.
A wrapper buys you three things.
- Protection for the people. The organisation takes the legal responsibility instead of your members personally. Your contributors stop being the crash barrier.
- A door to the real world. The organisation can sign contracts, open a bank account, hire people, pay suppliers, and file one clean set of tax returns instead of leaving a cross-border mystery for several tax authorities to argue about.
- Something that can sue and be sued. That sounds unappealing until you remember that the alternative is you, personally.
Larger projects often run a small stack. A foundation holds the treasury and the token. An operating company does the development and employs the team. And the DAO steers the whole thing through votes. Which shape fits you depends on what your DAO actually does, who pays whom, and where the people are. That is design work, not a template you download.
Part Five: Who Owns the Name, the Code, and the Treasury?
Now the question almost no DAO asks until the answer becomes expensive. Who owns your things?
The name and the logo. An EU trade mark must have an owner, and that owner has to be a person or a registered organisation. A loose group with no legal existence cannot be one. So right now, your DAO’s name and logo most likely belong to nobody. Worse, in the EU the trade mark generally goes to whoever files first, not to whoever used it first. That includes a copycat, a professional filer who registers names to sell them back, or the contributor who left on bad terms.
The code. Copyright in code belongs to the individual developers who wrote it, unless they have signed it over to an organisation in writing. Employment can change this for staff, but most DAO contributors are not employees. And an open source licence does not solve it. A licence gives people permission to use the code. It does not make the DAO the owner of anything.
The treasury. If no organisation owns the treasury, that does not make it invisible. It makes it undefined, and several tax authorities may each have their own view about who should be taxed on it and where.
The fix is simple in principle. Wrapper first, assets second. Set up the organisation, register the name and logo through it, get written transfers of the code and the artwork into it, and give the treasury a proper legal home. That tidy-up is exactly the work we do.
Conclusion
Are you building a DAO, or already running one that has no legal protection at all? Whether you need the structure designed, the token classified before launch, or the name registered before somebody else registers it, that is exactly what we do. The uncomfortable truth is that a DAO without a legal wrapper is not outside the law. It is simply inside a very old part of it, in the part written long before anyone imagined governance votes and multisig wallets, and in a part that offers your contributors no protection whatsoever. Choosing a structure is not a betrayal of decentralisation. It is the difference between a project that can hire, pay, contract, and defend itself, and a group of people quietly sharing unlimited personal risk.
