An ICO development company writes the smart contracts and tools for a token sale, from the token itself to vesting and claims. This guide explains what ICO development covers, which US and EU rules apply in 2026, the main sale formats, the cost drivers and the questions to ask before you hire a firm.
What ICO development covers
An initial coin offering (ICO) is a sale of new tokens by the project that issues them. The sale today usually runs through smart contracts and often uses a launchpad, a liquidity bootstrapping pool or a DEX listing. The code is a small part of the project, and the legal structure, the token design and the accuracy of the disclosures decide whether the sale works or ends in enforcement action.
An ICO development company usually builds the parts in this table.
| Component | Purpose | Main risks |
|---|---|---|
| Token contract | ERC-20 or an equivalent token with a fixed or capped supply | Hidden mint or blacklist functions, admin keys held by one person |
| Sale contract | Accepts payment and assigns tokens to buyers | Price or cap bugs, reentrancy, rounding errors |
| Allowlist and KYC | Limits the sale to eligible buyers | Leaks of personal data, checks that buyers can bypass |
| Vesting contracts | Locks team, investor and buyer tokens for set periods | Misuse of revoke rights, wrong math for the cliff (the period before any tokens unlock) |
| Claim contract | Sends purchased tokens to buyers, often with Merkle proofs | Double claims, a wrong Merkle root |
| Liquidity setup | Seeds a DEX pool at launch | Bots that buy in the first block, LP tokens left unlocked |
| Sale dashboard | Shows buyers their allocation, vesting and claims | Wrong figures shown to buyers |
The legal opinion, the offering structure and the white paper's legal review come from a securities lawyer, not from the development firm.
ICO rules in the US and the EU in 2026
Most ICOs of 2017 and 2018 were unregistered securities offerings, as judged by the SEC under the Howey test. Under that test, a buyer who invests money in a common enterprise and expects profit from the work of others holds an investment contract, which is a security.
US policy changed in 2026. On March 17, 2026, the SEC published an interpretation that sorts crypto assets into digital commodities, digital collectibles, digital tools, stablecoins and digital securities. The interpretation says most crypto assets are not securities in themselves, but a token can still be sold as part of an investment contract, and that contract can end once the issuer delivers or stops the promised work.
On August 18, 2026, the SEC proposed Regulation Crypto Assets, which is not yet in force. The table lists its main parts next to the routes that apply today.
| Route | Status in October 2026 | Main terms |
|---|---|---|
| Regulation D | In force | Private sale, mainly to accredited investors |
| Regulation S | In force | Sale to buyers outside the US |
| Regulation A, Tier 2 | In force | Up to $75 million in 12 months, with an SEC-qualified offering statement |
| Regulation Crowdfunding | In force | Up to $5 million in 12 months, through a registered portal or broker-dealer |
| Regulation Crypto Assets, first exemption | Proposed | A one-time raise of up to $5 million over four years, with narrative disclosure |
| Regulation Crypto Assets, second exemption | Proposed | Up to $75 million in each 12 months, with financial statements and ongoing reports |
The proposal also contains a safe harbor: a crypto asset would no longer count as part of an investment contract once the issuer completes or permanently stops its promised managerial work. Congress has not passed a market structure law. The CLARITY Act passed the House in July 2025, but a Senate vote to start debate failed in September 2026.
In the EU, MiCA covers public offers of crypto-assets that are not financial instruments. The offeror writes a crypto-asset white paper with set contents, notifies the national authority before publication and is liable for misleading statements in the white paper. Small offers are exempt, for example offers to fewer than 150 people in each member state or offers below €1 million over 12 months. Stablecoins fall under separate MiCA titles with authorization and reserve rules. If the token is a security, a security token offering follows the securities route instead.
ICO sale formats
| Format | How it works | Main weakness |
|---|---|---|
| Fixed price with caps | Every buyer pays one price up to a per-wallet and total cap | Bots and gas wars take allocation when demand is high |
| Dutch auction | The price starts high and falls until demand meets supply | Buyers must understand the mechanism |
| Liquidity bootstrapping pool | The pool starts with a high price that falls over time; buying pushes the price back up | The price path can confuse buyers |
| Launchpad allocation | A third-party platform runs KYC and assigns allocation by staking or lottery | The launchpad takes fees and sets its own rules |
| Exchange-run sale (IEO) | An exchange reviews the project and sells the token to its users | Listing terms and fees are set by the exchange |
The launchpad development guide and the Ethereum IDO launchpad guide cover launchpad sales, and the IEO guide covers exchange-run sales.
Tokenomics and supply
Most failed token sales did not fail because of contract bugs. The usual causes were tokens that unlocked faster than demand grew, or a token that had no use except trading. A token plan should show the circulating supply month by month, with every vesting schedule included, and compare that supply with a realistic estimate of use.
Promises of price support, exchange listings or returns are a warning sign, and regulators also treat them as evidence of an investment contract. The DeFi token development guide covers utility and supply design.
How to evaluate an ICO development company
- Ask for prior contracts onchain. Verified source code on a block explorer shows the firm's work, and a portfolio page does not.
- Check the libraries. The firm should build on audited libraries such as OpenZeppelin Contracts, not custom token code.
- Ask who audits the work. An independent firm should audit the sale contracts, and the developer should never audit its own code.
- Agree on key management. Write down who holds admin keys and treasury multisig keys, and when admin roles move behind a timelock or are removed.
- Keep legal work with lawyers. A development firm that offers "compliance included" without named lawyers is a warning sign.
- Reject guaranteed outcomes. Avoid firms that sell guaranteed listings, market making for price support or marketing packages that promise returns.
- Get the code and the deploy scripts. The service agreement should give you full ownership of the repository, tests and deployment scripts.
ICO development cost drivers
A standard token, vesting contract and sale contract on audited libraries takes one or two developers a few weeks, plus an audit. These choices add time and cost:
- Custom auction logic instead of a fixed price.
- Sales on several chains at once.
- KYC built into the sale flow.
- A custom buyer dashboard and claim portal.
- More than one audit round after fixes.
Legal work, white paper preparation and exchange or launchpad onboarding often cost more than the code and take longer. Ask each firm for a fixed scope with separate prices for build, audit fixes and post-launch support.
Frequently asked questions
What does an ICO development company do?
An ICO development company writes and tests the token, sale, vesting and claim contracts and sets up launch liquidity. It does not replace the lawyer who structures the offering.
Is an ICO legal in 2026?
An ICO can be legal when it uses a valid route, such as a US securities exemption or the MiCA white paper process in the EU. A public sale of investment-like tokens without registration or an exemption remains high-risk. The SEC's Regulation Crypto Assets is still a proposal.
What is the difference between an ICO, IDO and IEO?
In an ICO, the issuer sells the tokens directly. An IDO runs through a decentralized launchpad or DEX. An IEO runs on a centralized exchange that reviews the project first.
Do I need an audit for a simple sale contract?
Yes. A sale contract holds buyer funds at the moment when attackers watch a project most closely.
Can geoblocking keep US buyers out?
Geoblocking reduces the risk but does not remove it, because regulators look at who bought the token and how the sale was marketed.