As a general rule you are ruled by your country of residence and by your countries of exploitation.
That is: if you are from Spain and are selling/distributing tokens to France and Spain, you must take into account laws from Spain and from France.
If you restrict your exploitation to some countries only, the rule is to avoid to infringe any of the laws of the exploitation areas AND that of your country of residence.
If you, as normally done, do not restrict your exploitation to some countries only (i.e. you want to sell tokens to all the world) you have to take into account the rules of your country of residence AND at least all the laws which pretend to have the extraterritoriality as founding rule, the main being the USA law. This is the main reason for some “this ICO cannot be subscribed by USA citizen. If you are a USA citizen...” that you can find in some manifestos. But if you do not restrict ACTIVELY the involved persons, it is a poor guard against USA authorities and SEC in particular.
Hoping this can help.