This document is a good starting point to see which UTM and other features require which license.
To explicitly comment on the services you mentioned:
VPN (IPsec, SSL-) has no licensing requirements attached to it in FortiOS, these are built-in features that will work for as long as the unit is functional. Note that some SSL-VPN features are restricted to the EMS-managed FortiClients, but this is a matter of FortiClient/EMS licensing, not FortiOS directly.
SD-WAN itself does not require any license, but it is worth mentioning that updates to Application Control and ISDB databases requires at least the baseline FortiCare contract. As a consequence, if you are actively using these databases in your SD-WAN rules to steer traffic, then one could argue that SD-WAN can have an indirect dependency on this license.
[ corrections always welcome ]