The difference between utility and security tokens is not all as clear as some regulators make out, argue researchers for the Oxford University Law blog