What is a security token?

A security token is a blockchain token that the law treats as a security, either because it represents a share, a bond, a fund unit or another listed instrument, or because the way it is sold makes it an investment contract. The word describes a legal status, not a technology: the same token standard can carry a regulated share or a loyalty point, and it is the rights and the sale, not the code, that decide which one you hold.

That status is decided jurisdiction by jurisdiction. This article walks through the two tests a professional meets most often, the investment contract test in the United States and the financial instrument test in the European Union, then what being a security changes in practice. It is general information, not legal or investment advice, and other countries apply their own definitions.

What makes a token a security token?

A token is a security token when it falls inside the legal definition of a security in the place where it is offered or traded. Two routes lead there: the token represents an instrument that the statute already lists, such as a share or a bond, or the token is sold in an arrangement that the law treats as an investment.

The first route is the simple one. If a company records its shares as tokens, the tokens are shares. The SEC put this in one sentence in its 2026 interpretation on crypto assets: a security is a security regardless of whether it is issued, or otherwise represented, offchain or onchain. The Commission calls such a token a digital security, commonly known as a tokenized security: a financial instrument listed in the definition of "security" that is formatted as or represented by a crypto asset. ESMA states the same idea for the European Union as technological neutrality: tokenising a financial instrument does not change its classification.

The second route is the one that causes disputes. A token that looks like a product, a pass or a currency can still be sold in a way that makes the sale an investment: buyers hand over money, the money is pooled into a venture, and the buyers count on the promoter's work to produce a return. In the United States this is the investment contract analysis. The SEC's interpretation then separates two things: the asset itself may be a non-security crypto asset, while the arrangement it is sold under is an investment contract, which is a security.

How does the Howey test decide the question in the United States?

In the United States, a token sale is an investment contract, and therefore a security, when a person invests money in a common enterprise and reasonably expects profits to be derived from the efforts of others. That is the test of SEC v. W.J. Howey Co., a Supreme Court decision about orange groves, as the SEC restates it in its 2026 interpretation on crypto assets.

The definition of "security" sits in section 2(a)(1) of the Securities Act of 1933, and the Commission notes that the definition in the Securities Exchange Act is essentially identical. The list names stocks, notes, bonds and many other instruments, and it also names the "investment contract", the open category that Howey defines. The interpretation recalls the three elements:

• An investment of money. The buyer gives up something of value to acquire the token.
• In a common enterprise. The buyers' fortunes are tied to the venture.
• With an expectation of profits from the efforts of others. According to the interpretation, the efforts that count are essential managerial efforts which affect the failure or success of the enterprise. Administrative and ministerial tasks do not.

Where a token is not a security by nature, the question becomes what the issuer said when selling it. The SEC's reading is that a non-security crypto asset becomes subject to an investment contract when the issuer induces an investment of money in a common enterprise with representations or promises of essential managerial efforts that purchasers would reasonably expect to produce profits. Those representations have to be conveyed before or at the time of the sale. Statements by unaffiliated third parties generally do not count unless the issuer authorised them.

The same reasoning means an investment contract can end. The interpretation says a non-security crypto asset separates from the investment contract when purchasers can no longer reasonably expect the issuer's essential managerial efforts to remain connected to it, for example once the issuer has fulfilled its promises, or has publicly abandoned them.

One point of status matters if you rely on older material. The 2026 document is an interpretation by the Commission itself, joined by the CFTC, and it supersedes the SEC staff's 2019 framework for investment contract analysis of digital assets. Howey itself remains a court-made test that courts apply to the facts in front of them.

How does the European Union decide whether a token is a financial instrument?

In the European Union, a token is a security token when it qualifies as a financial instrument under MiFID II, the directive on markets in financial instruments. A token that qualifies falls under the Union's financial markets legislation and outside MiCA, the regulation on markets in crypto-assets.

The two texts are built to fit together. MiCA defines a crypto-asset broadly, as a digital representation of a value or of a right that is able to be transferred and stored electronically. Its Article 2(4) then lists what the regulation does not cover, and the first item is financial instruments. For the meaning of "financial instrument", MiCA points to Article 4(1), point (15), of MiFID II, which refers to the list in Annex I, Section C of that directive: transferable securities, money-market instruments, units in collective investment undertakings, derivatives and emission allowances. The MiFID II definition expressly includes such instruments issued by means of distributed ledger technology.

MiCA asked ESMA, the European Securities and Markets Authority, to issue guidelines on when a crypto-asset counts as a financial instrument. ESMA's 2024 guidelines set two principles, substance over form and technological neutrality, and give a three-part reading of the category that most tokens are tested against, the transferable security. A crypto-asset is a transferable security only if it meets all three criteria together:

• It is not an instrument of payment. A token used primarily as a medium of exchange is outside the category.
• It belongs to a class. The tokens come from the same issuer, are interchangeable, and confer rights equivalent to those of securities such as shares or bonds.
• It is negotiable on the capital market. The token is capable of being transferred or traded. ESMA considers the abstract possibility generally sufficient, even without a specific market or during a temporary lock-up, and says that restrictions on transfer are assessed case by case.

The rights are what the guidelines look at. A token representing an ownership stake with share-like rights, such as dividends, a share of liquidation proceeds and votes on company decisions, should be treated as a security with the features of a share. Governance rights limited to technical or operational matters, such as a protocol upgrade or a fee change, are not equivalent to shareholder votes. A token that mixes features is assessed in order: where it has the characteristics of a financial instrument, ESMA says those characteristics take precedence.

Classification is the responsibility of the person making the offer or seeking admission to trading, and a national competent authority may challenge it.

How does a security token differ from a utility token, a payment token and a stablecoin?

A security token gives its holder a financial claim, such as a share of profits, a debt repayment or a fund interest, while a utility token gives access to a service, a payment token serves as a medium of exchange and a stablecoin aims to hold a stable value. Regulators classify by that function, and the four words are market vocabulary that the statutes only partly use.

The table sets the four against the vocabulary each regulator uses. A single token can move between rows depending on its rights and the way it is sold.

One detail behind the table deserves attention. ESMA notes that a token giving access to services without a financial return comparable to a financial instrument is not a transferable security, even if people buy it hoping its price will rise. The United States reaches the question from the other side: a digital tool is not a security, yet the sale of it can still be an investment contract if the issuer's promises make it one.

What changes once a token is a security?

Once a token is a security, the offer, the buyers, the resale and the firms that handle it all fall under securities law. The practical consequences group under five headings: registration or exemption, who may buy, transfer restrictions, intermediaries and disclosure.

Registration or exemption. In the United States, every offer and sale of a security must be registered with the SEC unless an exemption applies, and the SEC staff's 2026 statement on tokenized securities repeats that this holds regardless of format. Most token issuers rely on an exemption. The SEC's own description of Rule 506(b), the most used private placement rule, gives the pattern: an unlimited amount may be raised, no general solicitation or advertising is allowed, sales may go to an unlimited number of accredited investors and to no more than 35 non-accredited investors in any 90-calendar day period, and a notice on Form D is filed within 15 days after the first sale. Rule 506(c) allows the issuer to solicit broadly, provided all purchasers are accredited investors and the issuer takes reasonable steps to verify that status.

Who may buy. The exemption chosen sets the investor base. A token sold under a private placement rule can only reach the investors that rule admits, and the issuer has to be able to show who each buyer is. A security token is therefore nearly always tied to an identity check before the first purchase.

Transfer restrictions. Buyers in a Rule 506 offering receive what the SEC calls restricted securities: they cannot simply be resold to the public. The conditions and waiting periods for resale in the United States form a subject of their own; the point here is that the restriction follows the security from holder to holder, so every later transfer has to be checked against it.

Intermediaries. Securities law regulates the firms that sell, trade and safekeep securities as well as the issuer. A venue that lists a security token, a firm that places it and a firm that holds it for clients each need to look at the authorisation or registration their activity requires in the jurisdiction concerned. For the European Union, ESMA notes that a crypto-asset qualifying as a financial instrument is likely to be subject to a comprehensive suite of Union financial regulation, including MiFID II, the prospectus and market abuse rules and the central securities depositories regulation.

Disclosure. A registered offering carries a full disclosure document. An exempt one usually carries less mandatory disclosure, but the issuer remains responsible for what it tells investors. Holders also keep the rights of the instrument itself, which is where the token terms matter most: the SEC's interpretation warns that the rights of the holder of a digital security may differ materially from those of the underlying security, including economic and voting rights.

How are the restrictions enforced in the token itself?

A security token usually enforces its restrictions in its own smart contract: the contract checks who the sender and the receiver are before it lets a transfer go through, and refuses the transfer if a rule is not met. Tokens built this way are called permissioned tokens, in contrast to an ordinary token that moves between any two addresses.

The clearest public description of the mechanism is ERC-3643, a finalised Ethereum standard that presents itself as a standard for security tokens. As the standard reads, the token remains compatible with ERC-20, the common fungible token interface, but its transfer functions run eligibility and compliance checks before any token moves. Each investor is represented by an onchain identity contract that holds signed claims from claim issuers the token's owner trusts, and an identity registry links each wallet address to that identity and to a country code. The sequence below follows the text of the standard.

The standard also gives the issuer's appointed agents powers that an ordinary token does not have. They can freeze a wallet or part of a balance, pause the token, mint and burn, force a transfer, and move tokens from a lost wallet to a new one, with a history of recovered tokens kept onchain. These functions exist because an issuer of securities has to be able to follow a court order, correct an error and restore a holder who has lost access; a buyer should read who holds them.

Other permissioned designs exist, and this article describes only the one read for it. Two limits apply to all of them. The code enforces the rules it was given, so a wrongly configured rule is enforced as strictly as a correct one. And the code does not replace the law: a transfer that the contract allows can still breach a resale restriction that was never encoded.

Native issuance or a tokenized version of an existing security: what is the difference?

A natively issued security token is the security: the issuer's ownership record is the token ledger. A tokenized representation is a token that points to a security held or issued somewhere else, and the holder's rights then depend on who created the token and on what terms.

The SEC staff's 2026 statement on tokenized securities sorts the market into two categories and several models.

In the issuer-sponsored category, the issuer or its agent tokenizes its own security. In one model, distributed ledger technology is integrated into the system that records owners, so that a transfer of the token produces a transfer on the master securityholder file. In the other, the master file stays offchain and the token carries no rights of its own: moving it notifies the issuer or its agent to update the offchain record. The staff adds that format does not change how the securities laws apply, and that a tokenized version may be treated as the same class as the traditional one when its character and the holders' rights are substantially similar.

In the third-party category, someone unaffiliated with the issuer creates the token. A custodial model has the third party hold the underlying security and issue a token evidencing the holder's interest in it. A synthetic model has the third party issue its own instrument that tracks a referenced security: a linked security, which is an obligation of the third party and gives no rights against the referenced issuer, or a security-based swap in token form, which the statement says typically gives no equity, voting or information rights and which faces extra limits on sales to persons who are not eligible contract participants.

With a third-party token, the staff notes, the holder may bear risks that a direct holder would not, such as the bankruptcy of the third party. Before you treat a token as "the share" or "the bond", establish which model it is and whose obligation it is.

How do the tests apply to two fictional tokens?

Applied to two invented tokens, the tests give opposite answers: a token that shares the income of a managed business is a security in both jurisdictions, and a prepaid credit for a working service is not. Both tokens below are fiction, with illustrative figures; they describe no real issuer and promise no return.

The Quayside token. A sponsor sets up a company to buy and lease a warehouse. It sells 60,000 tokens at $100 each, raising $6,000,000. Each token gives a pro rata right to the company's net income after a management fee of 20% kept by the sponsor, which finds tenants, negotiates leases and maintains the building. In an illustrative year the net income is $540,000: the sponsor keeps $108,000 and $432,000 is distributed, which is $7.20 per token. A holder of 250 tokens paid $25,000 and receives $1,800.

The Berthpass credit. A software company runs a live freight booking service. It sells 2,000,000 credits at $0.50 each, $1,000,000 in total. One credit pays for one booking, the service charges $0.50 per booking to customers who pay by card, and the credit carries no right to revenue, no vote and no redemption for cash. A freight forwarder buys 4,000 credits for $2,000 and uses 400 a month, so the purchase lasts ten months.

Now change one fact. Suppose the software company had sold 5,000,000 credits at $0.20 before the service existed, also raising $1,000,000, telling buyers that it would build the product with the money, that credits would later cost $0.50 and that it would arrange a listing. The price is 60% below the announced one, nothing can be consumed yet, and the buyers' gain depends on the company carrying out its promises. In the United States, those representations of essential managerial efforts, made at the time of sale, are what the SEC's interpretation treats as bringing a non-security crypto asset under an investment contract. The credit has not changed; the sale has. In the European Union the analysis stays on the rights attached to the token, which is why ESMA says an expectation of price appreciation alone does not make an access token a transferable security. The same facts can therefore land differently on each side of the Atlantic.

Classification therefore follows the rights, the promises and the moment of the sale, and ESMA recommends reassessing a hybrid token as its features evolve.

What should you check before you issue, buy or handle a security token?

Before you issue, buy or handle a token that may be a security, check five things: the legal classification in each jurisdiction involved, the offering route, the rights attached, the transfer rules and who keeps the definitive record.

• Classification. Ask for the written analysis: which test was applied, in which jurisdictions, and by whom. A token offered in several countries needs an answer for each.
• Offering route. Identify the registration or the exemption relied on, and what it requires of buyers. This tells you who may hold the token and whether you are one of them.
• Rights. Read the token terms next to the instrument they refer to. Check income, voting, information and redemption rights, and whether the token is the security itself, a claim on a custodian or a synthetic instrument issued by a third party.
• Transfer rules. Find out which restrictions are encoded in the contract and which exist only in the legal documents, who can freeze, force or recover tokens, and what the procedure is.
• The record. Establish whether the token ledger is the register of holders or a mirror of an offchain one, and who is responsible for keeping it.