What Are Security Tokens? Definition, Howey Test and Rules

A security token is a share, bond, fund interest or other security whose ownership record is kept, in whole or in part, on a blockchain. The SEC’s staff put it this way in its 28 January 2026 statement: a tokenized security is a financial instrument within the legal definition of “security” that is “formatted as or represented by a crypto asset.” The token changes how ownership is recorded and transferred. It does not change the fact that the instrument is a security, so the same registration, exemption, disclosure and resale rules apply as they would on paper.

This guide covers the definition, the Howey test, security tokens versus utility tokens, how transfer restrictions work on-chain, the US and EU rules, and what tokenization does not change. Stobox is not a broker-dealer, investment adviser, custodian or law firm; this is general information, not legal or investment advice.

Key takeaways

• A security token is a security first and a token second. SEC Commissioner Hester Peirce, 9 July 2025: “Tokenized securities are still securities.”
• Whether a token is a security in the US turns on the securities-law definition and, for novel arrangements, the three-part Howey test from 1946 (328 U.S. 293).
• On 17 March 2026 the SEC sorted crypto assets into five categories; only “digital securities” are securities in every case.
• In the US most security tokens are sold under an exemption: Reg D 506(b) or 506(c), Reg CF up to $5,000,000 in 12 months, Reg A Tier 2 up to $75,000,000, or Reg S offshore.
• Transfer rules live in the token contract. ERC-3643 and ERC-7943 both make an ineligible transfer fail on-chain.
• Tokenization does not create liquidity or shorten holding periods: Rule 144 still requires 6 months or 1 year before most resales of restricted securities.

What is a security token?

A security token is a regulated financial instrument, such as equity, debt, a fund unit or a revenue-share right, where the register of who owns what is maintained on one or more blockchains. The legal claim sits in the offering documents and the issuer’s charter. The token is the record of that claim and the tool for moving it.

The SEC staff statement of 28 January 2026 describes two families. In the first, the issuer (or its agent) tokenizes its own security, so a transfer of the token is a transfer on the official securityholder register. In the second, a third party unaffiliated with the issuer creates a token linked to someone else’s security, either as a custodial entitlement or as a synthetic instrument. The staff notes that holders of third-party tokens “may be exposed to risks with respect to the third party, such as bankruptcy.”

Commissioner Peirce made the same point in her statement “Enchanting, but Not Magical” (9 July 2025): the same legal requirements apply to on-chain and off-chain versions of an instrument, and the technology does not change the nature of the underlying asset.

For scale: tokenized real-world assets, excluding stablecoins, held about $33.5B of on-chain value in July 2026 by rwa.xyz’s count, as compiled in the State of RWA 2026 report.

What is the primary purpose of security tokens?

The primary purpose of a security token is to keep a security’s ownership record on a shared ledger and to enforce its transfer rules in code, so that issuing, transferring and servicing the security needs fewer manual reconciliations. It is an administrative and settlement tool for a regulated instrument, not a way around securities law.

In practice that means three things:

1. One register. The cap table or unitholder register is the token ledger, reconciled with off-chain investor records.
2. Rules that travel with the asset. Eligibility, lock-ups and jurisdiction limits are checked on every transfer, not after it.
3. Programmable servicing. Distributions, corporate actions and reporting can be run from the same record.

How do you know if a token is a security? The Howey test

In US law, “security” covers named instruments such as stock, bonds and notes, plus the catch-all “investment contract.” A token that represents stock is a security because stock is. For anything less conventional, courts and the SEC apply the test from SEC v. W.J. Howey Co., 328 U.S. 293, decided on 27 May 1946 in a case about units of a Florida citrus grove sold with a cultivation contract.

The Court defined an investment contract as a scheme where a person “invests his money in a common enterprise and is led to expect profits solely from the efforts of the promoter or a third party.” It added that form does not matter: it is “immaterial” whether interests are evidenced by formal certificates or by other means. That is why a blockchain format has never taken an instrument outside the test.

For seven years the SEC’s reference for this analysis was its staff “Framework for ‘Investment Contract’ Analysis of Digital Assets” of 3 April 2019. That page is now marked withdrawn and superseded by a Commission interpretation of 17 March 2026 (Release No. 33-11412, effective 23 March 2026). The interpretation sorts crypto assets into five categories: digital commodities, digital collectibles, digital tools, stablecoins and digital securities. Only digital securities are securities in every case, though any non-security asset can still be sold subject to an investment contract.

Announcing it, SEC Chairman Paul S. Atkins said the interpretation recognizes “that most crypto assets are not themselves securities” (SEC press release 2026-30). Tokenized shares, bonds and fund units sit on the other side of that line.

Security token vs utility token

A utility token gives access to a product or network. A security token gives a financial claim on an issuer or asset. The label a project chooses does not decide it; the rights, the marketing and the economic reality do. The March 2026 release says a digital security “does not fall outside of the definition” just because it also carries non-financial benefits.

A side-by-side with examples is in security token vs utility token.

How do security tokens work on-chain?

A plain ERC-20 token moves to any address that receives it. A security token cannot, because an exemption may limit who can buy, when they can resell and in which country. Security token standards add a compliance check to every transfer. A typical flow:

1. Investor verification. The investor completes KYC and AML checks and, where the exemption needs it, accreditation. Third-party KYC typically costs $2–$8 per investor (Tokenization Cost Index).
2. Eligibility on-chain. The result is linked to the investor’s wallet: an identity registry in ERC-3643, or an implementation-chosen source such as an attestation under ERC-7943.
3. Pre-transfer check. Before tokens move, the contract asks whether sender, receiver and amount pass the rules (ERC-7943 exposes this as canTransfer).
4. Enforce or revert. An ineligible transfer fails on-chain; no off-chain clean-up is needed.
5. Enforcement actions. The issuer or its agent can freeze tokens and make forced transfers, for example to recover tokens from a lost wallet or carry out a legally required transfer.

Two Ethereum standards, both at Final status on eips.ethereum.org, define these mechanics:

The ERC-3643 text states the requirement directly: security tokens “cannot be permissionless like utility tokens.” Stobox issues tokens primarily on Base with ERC-7943 transfer rules and is one of the backers of ERC-7943, which reached Final status in May 2026. The trade-offs are in ERC-3643 vs ERC-7943 and the ERC-7943 explainer.

US exemptions used for security token offerings

Every offer and sale of a security in the US must be registered with the SEC unless an exemption applies, and the January 2026 staff statement confirms this holds “regardless of its format.” Most private issuers of security tokens use one of these:

Reg D and Reg S can run side by side in one raise, for US and non-US investors. The choice is compared in Reg D vs Reg S vs Reg CF vs Reg A and the US tokenization guide.

How security tokens are treated in the EU

In the EU a security token is a financial instrument under MiFID II. Since the DLT Pilot Regulation (EU) 2022/858, Article 4(1)(15) of MiFID II defines financial instruments as those in Annex I, Section C, “including such instruments issued by means of distributed ledger technology.” Member states had to transpose that change by 23 March 2023.

MiCA, the EU crypto-asset regulation, does not apply. Regulation (EU) 2023/1114, Article 2(4)(a), excludes crypto-assets that qualify as financial instruments. A tokenized share or bond is therefore offered under the Prospectus Regulation and traded through MiFID II venues, including DLT market infrastructures under the Pilot Regime. Those infrastructures can admit shares of issuers valued under EUR 500 million and bonds with an issue size under EUR 1 billion, capped at EUR 6 billion in total. Thresholds and national regimes are in the EU tokenization guide.

What security tokens do not change

Tokenization improves the record and the plumbing. The legal and economic facts of the instrument stay as they were:

• Liquidity is not created by the token. A buyer still has to exist and be eligible. Most private-company tokens trade thinly or not at all; the evidence is in the security token liquidity guide.
• Holding periods still apply. Securities sold under Reg D are restricted and “cannot be resold without registration under the Act or an exemption therefrom” (Rule 502(d)). Under Rule 144 the minimum holding period is six months if the issuer has been SEC-reporting for at least 90 days, and one year if it has not. Under Reg S Category 3, equity of a non-reporting issuer cannot go to US persons during a one-year distribution compliance period.
• Rights come from the documents, not the code. Voting, dividends and liquidation preference are set by the charter and offering terms. The March 2026 release warns that a token holder’s rights “may be materially different” from those of the underlying security.
• Disclosure duties stay the same. Commissioner Peirce notes that distributors of tokenized securities must consider their disclosure obligations under the federal securities laws. Code does not replace an offering memorandum.
• Counterparty risk does not disappear. With third-party tokens, the holder depends on the custodian or sponsor. See what happens if the platform disappears.

How a security token is issued

The Stobox Tokenization Framework splits the work into 8 phases and 48 steps. In outline:

1. Structure. Decide what the token represents and which entity issues it: an operating company, an SPV or a fund. Entity formation runs from $110 in Delaware to about $4,000 in the Cayman Islands.
2. Choose the exemption. Reg D, Reg S, Reg CF or Reg A in the US, or a prospectus exemption in the EU.
3. Draft the documents. Offering memorandum, subscription agreement and token terms. With a mint-only platform, this legal work typically costs $50,000–$200,000+.
4. Deploy the token. Pick a chain and a standard, and encode eligibility and lock-up rules.
5. Onboard investors. KYC, AML and accreditation, linked to wallets.
6. Service the security. Keep the register, run distributions and handle transfers and corporate actions for the life of the instrument.

A typical timeline is 3–6 months. Stobox charges flat fees, never a percentage of the raise; going fully on-chain with Compass costs $1,248 ($499 asset mint plus $749 contract deploy). Full ranges are in the Tokenization Cost Index and on pricing, and the equity walk-through is in how to tokenize company equity. Since 2018 Stobox has worked with 100+ clients in 20+ jurisdictions, with $305M+ in assets structured and supported; examples are in the case studies.

Questions, answered

What is a security token in simple terms?

It is a regulated investment, such as a share, bond or fund unit, whose ownership is recorded on a blockchain. The token is the record and the transfer tool; the investor’s rights come from the legal documents behind it, and securities law applies in full.

What is the primary purpose of security tokens?

To keep a security’s ownership register on a shared ledger and enforce its transfer rules automatically. That cuts manual reconciliation in issuance, transfers and distributions. It does not change the instrument’s legal status.

How do security tokens work?

Investors are verified off-chain, their eligibility is linked to their wallets, and the token contract checks every transfer against that eligibility and the offering’s rules. Transfers that fail the check revert. Standards such as ERC-3643 and ERC-7943 define these checks, plus freeze and forced-transfer functions.

Are security tokens regulated by the SEC?

Yes. The SEC staff’s January 2026 statement says the format of a security “does not affect application of the federal securities laws.” Every offer and sale must be registered with the SEC or fit an exemption.

Is a security token the same as a cryptocurrency?

No. Under the SEC’s March 2026 interpretation, digital commodities, collectibles and tools are not securities in themselves, while digital securities are always securities. A security token is a digital security; most cryptocurrencies are not.

Can security tokens be traded freely?

No. Transfers are limited to eligible investors, and restricted securities face holding periods: six months or one year under Rule 144, depending on whether the issuer reports to the SEC. Secondary trading, where it exists, happens on regulated venues or peer-to-peer between eligible wallets.

Do security tokens make an investment more liquid?

Not by themselves. They can make transfers cheaper and faster once a buyer exists, but they do not create buyers. Most private-company tokens trade rarely.

Does MiCA apply to security tokens in the EU?

No. MiCA excludes crypto-assets that qualify as financial instruments. Security tokens fall under MiFID II, the Prospectus Regulation and, for DLT trading venues, the DLT Pilot Regime.

A security token is a security with a better register. If you are weighing whether your asset or company is ready to issue one, the readiness score takes about eight minutes, needs no email and shows where the structural gaps are before you spend on legal work.