Security Token Regulations: The RWA Compliance Playbook Across Jurisdictions
A practical, jurisdiction-by-jurisdiction guide to launching a compliant RWA: baseline disclosures, the US exemption menu, the extra gauntlet yield-bearing tokens face, and how MiCA and offshore hubs change the math.
Executive Summary
Tokenization has an engineering problem that is not really an engineering problem. The hardest part of launching a Real World Asset is not minting the token: it is choosing the right exemption, writing the right disclosures, enforcing the right transfer restrictions, and doing all of it in the right jurisdiction. A tokenized security is a security. US regulators confirmed in early 2026 that on-chain packaging does not change that classification. This finale of our 12-week RWA Market Series turns that principle into a working playbook. It covers the baseline disclosures every compliant RWA needs, the US exemption menu (Reg D, Reg S, Reg A+, Reg CF) with current thresholds, the heavier gauntlet yield-bearing instruments face, and a jurisdictional read across the US, the EU under MiCA, Switzerland, and the main offshore hubs. The conclusion: compliance is the product, not the paperwork.
Key Takeaways
- A tokenized security is a security under US federal law: SEC staff confirmed in January 2026 that classification does not change whether ownership data sits on-chain or off-chain, so issuers must register or qualify for an exemption.
- The US exemption menu has four main doors: Reg D 506(c) (unlimited raise, accredited investors only), Reg S (offshore, non-US persons), Reg A+ Tier 2 (up to $75M, retail allowed), and Reg CF (up to $5M in a rolling 12-month window).
- Yield-bearing tokens face a heavier regulatory load than non-yielding ones: the GENIUS Act bars payment stablecoins from paying interest, while yield-bearing instruments are typically treated as securities with transfer restrictions.
- MiCA is a residual regime: tokens that qualify as transferable securities or fund units stay under MiFID II and the Prospectus Regulation, while asset-referenced tokens (ART) and e-money tokens (EMT) fall inside MiCA itself.
- Jurisdiction and distribution are separate problems: an offshore domicile like Cayman or the BVI holds the vehicle but does not solve the question of who you can legally sell to in each investor’s home country.
Introduction: Why the Playbook Matters Now
The RWA market is no longer a thought experiment. On-chain value excluding stablecoins reached $33.5B on the canonical tracker in mid-2026, roughly 4x early 2025, led by tokenized Treasuries and private credit, with tokenized equities emerging as the fastest-growing new category. That growth is now colliding with a maturing rulebook. The quiet reality, which Stobox has watched play out across more than 100 issuance projects since 2018, is that most tokenization efforts stall not on smart-contract bugs but on compliance architecture: the exemption that was never properly selected, the disclosure that was never written, the transfer restriction that was never coded.
The stakes rose further in September 2026. On September 17, 2026, the SEC approved a temporary, conditional exemption, the Innovation Exemption, to allow limited trading of tokenized stocks on Tokenized Securities Venues (TSVs). That signals a regulator building a path rather than relying on enforcement. But a path is not a free pass. This playbook is the capstone to a 12-week series that moved from macro validation to execution. The macro case is settled. What remains is doing it correctly.
What Disclosures Does a Compliant RWA Need?
Every compliant RWA starts with the same baseline: a clear statement of who issues the token, where the issuer is domiciled, how large the supply is, and who the initial holders are. These are the first questions any regulator, investor, or auditor asks.
The reason is structural. The closest thing issuers have to direct guidance is a joint SEC staff statement in January 2026, which confirms that a tokenized security is a security under federal law, regardless of whether the ownership information is on-chain or off-chain. Once that is accepted, the disclosure obligations of traditional securities law apply. The token is a wrapper; the legal substance underneath is unchanged.
A workable baseline disclosure package answers four questions precisely:
| Disclosure element | What it must establish | Why regulators care |
|---|---|---|
| Who issues | The legal issuing entity and its directors | Liability and accountability attach to a real party |
| Where domiciled | Jurisdiction of incorporation and governing law | Determines which regime applies and where disputes resolve |
| Supply caps | Total token supply, dilution terms, mint authority | Prevents undisclosed dilution of holders |
| Initial holders | Founder, treasury, and insider allocations | Reveals concentration and potential conflicts |
Get these wrong and no exemption saves the offering. Get them right and the rest of the playbook has a foundation. This is the first stage of becoming investment-ready: structured, verified, investor-grade information, which is precisely the problem Stobox Cabinet is built to organize before a single token is issued.
What Is the US Exemption Menu for Security Tokens?
In the US, a security token offering must either register with the SEC or fit inside an exemption. Four exemptions do nearly all the work: Reg D, Reg S, Reg A+, and Reg CF. Each trades off who can invest, how much you can raise, and how much disclosure you must publish.
The dominant choice is Regulation D. Reg D includes three rules: Rule 504 (up to $10 million), Rule 506(b) (unlimited, no general solicitation), and Rule 506(c) (unlimited, general solicitation permitted). For token offerings that want to advertise, Rule 506(c) is the standard, but Rule 506(c) requires all investors to be verified accredited investors. The filing burden is light: a brief Form D notice within 15 days of the first sale, with no SEC review or qualification required.
Regulation S handles the offshore case. Regulation S provides a safe harbor for offers and sales of securities that occur outside the United States. For tokens, which can technically reach any wallet, that safe harbor has teeth. In practice, compliance typically requires geo-fencing mechanisms, IP address screening, contractual representations from purchasers regarding their non-US status, and smart contract transfer restrictions that prevent tokens from reaching US-flagged wallet addresses during the distribution period.
Regulation A+ is the path to retail at scale. Regulation A+ lets a private company raise up to $75 million in a 12-month period from both accredited and non-accredited investors without a full IPO registration. The tradeoff is disclosure and time: it requires a qualified Form 1-A and ongoing reporting. Regulation CF is the smallest door. It allows companies to raise up to $5 million in a 12-month period through a registered funding portal or broker-dealer. The SEC has clarified that the $5 million cap uses a rolling 12-month calculation measured from the date of each closing, not from the filing or launch date.
The Exemption Decision Matrix
| Exemption | Raise cap (12 mo.) | Who can invest | General solicitation | Key filing |
|---|---|---|---|---|
| Reg D 506(c) | Unlimited | Accredited only (verified) | Permitted | Form D |
| Reg S | N/A (offshore) | Non-US persons | No US directed selling | None (safe harbor) |
| Reg A+ Tier 2 | $75M | Accredited + non-accredited | Permitted | Form 1-A |
| Reg CF | $5M | Accredited + non-accredited | Via portal only | Form C |
On raise caps, Reg D is unlimited, Reg A+ is $75 million, and Reg CF is $5 million; on advertising, Reg D 506(b) prohibits general solicitation while Reg A+ and Reg CF permit public marketing. Many sophisticated RWA offerings stack exemptions: a Reg D tranche for US accredited investors running in parallel with a Reg S tranche for non-US buyers. That is the engineering Raisable is designed to prepare, before the offering ever goes live.
Why Do Yield-Bearing Assets Face a Harder Gauntlet?
Yield-bearing tokens face more regulatory friction than non-yielding ones because the moment a token promises a return, it collides with securities law, investment-company rules, and, in the stablecoin context, an outright ban on paying interest.
The cleanest illustration is the stablecoin line. Under the GENIUS Act, Section 4(a)(11) prohibits payment stablecoin issuers from paying interest, yield, or rewards directly to holders, reinforcing the separation between payment stablecoins and yield-bearing instruments. The SEC drew the same boundary earlier: in April 2025, its Division of Corporation Finance clarified that dollar-backed, non-yielding stablecoins are not securities, and explicitly excluded yield-bearing stablecoins from that safe harbor.
That exclusion is the whole point. Yield-bearing stablecoins occupy a regulatory gray zone: they function like stablecoins but are typically classified as securities, which restricts who can hold and transfer them. The economic engine behind these products makes the classification unavoidable. Yield-bearing instruments, whether returns come from Treasury yields, funding-rate arbitrage, or DeFi lending, trigger securities regulations, investment-adviser rules, and prudential standards never designed for 24/7 global blockchain markets.
Issuers respond by choosing a legal form that matches the burden they can carry. The tokenized-treasury market shows the spread clearly: USDY from Ondo is structured as a tokenized note through a BVI SPV, offered under Reg S to non-US persons only, while Franklin’s BENJI is a registered 1940-Act government money market fund open to retail from $20. Same underlying asset, radically different compliance overhead. One issuer avoids US investors entirely; the other accepts full investment-company registration to reach them. The lesson for any RWA with a coupon or a NAV that ticks up: expect the heavier gauntlet, and design for it from day one.
How Do Regulations Differ Across Jurisdictions?
The core question every jurisdiction answers differently is simple: is this tokenized RWA a security, and if so, under which regime? The US routes almost everything through securities law via the Howey test. The EU uses MiCA as a residual regime. Switzerland grants tokens the same legal standing as traditional securities. The offshore hubs hold the vehicle but not the distribution.
In the EU, the first move is classification. Tokens that qualify as transferable securities, deposits, or fund units stay under MiFID II, the Prospectus Regulation, or UCITS/AIFMD, and ESMA’s guidance frames MiCA as a residual regime, not a replacement for securities law. MiCA’s own categories cover what is left. A token referencing a single official currency is an e-money token (EMT, Title IV); one referencing multiple currencies, a basket, or a commodity is an asset-referenced token (ART, Title III). The practical takeaway: a tokenized money market fund share is typically a MiFID II financial instrument, while a stablecoin-style claim on a basket of assets is an ART under MiCA. ART authorization is demanding. It triggers a white paper approved by the home competent authority, an own-funds requirement of the higher of EUR 350,000 or 2 percent of average reserves, segregated reserves, and ongoing redemption obligations. Tellingly, as at 01 September 2026, 39 EMTs had been issued under MiCA and zero ARTs authorized under Title III : a signal of how steep that particular path has proven.
Switzerland offers legal certainty through a different mechanism. The DLT Act introduced registered uncertificated securities (DLT securities) into the Swiss Code of Obligations, making tokenized rights legally equivalent to traditional certificates, so owning the token is legally the same as owning the share or stake it represents. The infrastructure is live: in March 2025, FINMA granted the first DLT trading facility licence to BX Digital AG, a subsidiary of BX Swiss, enabling regulated institutions to trade and settle DLT securities on Ethereum with fiat settlement integrated via Swiss Interbank Clearing.
Offshore hubs play a narrower role than many founders assume. A Cayman or BVI vehicle is a domicile, not a distribution licence. As one jurisdictional review puts it plainly, Cayman or the BVI hold the vehicle; they do not solve distribution into your investors’ jurisdictions, which is a separate piece of work. This is why offshore tokenized equities have leaned on Reg S: third-party issuers of tokenized US publicly registered equities are offering abroad, for example in the Abu Dhabi Global Market or Jersey, typically in reliance on Regulation S.
The 5 Stages of Becoming a Tokenization-Ready Company
This maps the entire playbook to the three-stage Stobox narrative: build intelligence, become capital-market ready, then tokenize.
| Stage | What it means | Compliance focus |
|---|---|---|
| 1. Intelligence | Structure verified, investor-grade company data | Baseline disclosures: issuer, domicile, supply, holders |
| 2. Digital transformation | Make data and processes audit-ready | Recordkeeping, cap-table integrity |
| 3. Legal preparation | Select jurisdiction and legal form of the asset | Security vs non-security; US / EU / Swiss / offshore |
| 4. Capital strategy | Choose the exemption and investor base | Reg D / S / A+ / CF; accredited vs retail; yield load |
| 5. Tokenization | Issue with compliance encoded on-chain | Transfer restrictions, geo-fencing, lifecycle controls |
Definition: What Is a Compliant Security Token?
A compliant security token is a digital representation of an ownership or debt claim in a real asset, issued under a valid securities exemption or registration, with investor-eligibility and transfer rules enforced directly in the token’s infrastructure. The economic substance determines the legal classification; the blockchain only changes how the instrument settles and transfers. Permissioned token standards exist precisely for this: standards such as ERC-3643 help enforce investor eligibility, transfer restrictions, and regulatory controls directly within the blockchain infrastructure. Stobox backs the complementary ERC-7943 (uRWA) universal interface and operates alongside ERC-3643.
How to Act on This
The playbook changes depending on who you are. Here is the direct read by reader type.
If you are a CEO or founder: Start at stage one, not stage five. Fix your disclosures (who issues, where domiciled, supply caps, initial holders) before you think about chains or tokens. Decide early whether your asset carries yield, because that single fact dictates whether you face the heavier securities gauntlet. Then select one lead exemption and one investor base. Stobox Cabinet is the infrastructure layer for building that investor-ready foundation; Raisable is where the offering gets prepared and structured for modern capital markets.
If you are an asset owner: Your binding constraint is distribution, not domicile. An offshore SPV is cheap to form and does nothing to let you sell into a given investor’s home country. Map your target investors first, then choose the jurisdiction and exemption stack that legally reaches them. If retail access matters, Reg A+ or a registered fund wrapper, not a Reg S-only structure, is the honest path.
If you are an investor: Read the legal form, not the marketing. Two tokens with identical Treasury exposure can carry completely different protections depending on whether the issuer registered, used Reg S, or relied on a QP exemption. Ask who can hold, who can transfer, and what happens in insolvency. The glossary and learn resources are a starting point for decoding those structures.
The through-line of this 12-week series: tokenization is a legal and operational discipline first, and a technology second. The projects that scale are the ones that treat compliance as the product.
FAQ
What are security token regulations? Security token regulations are the securities laws that apply when a blockchain token represents an investment contract, equity, debt, or fund interest. Because a tokenized security is still a security, issuers must either register the offering or fit a valid exemption. The rules govern disclosures, who can invest, how tokens transfer, and secondary trading.
Is a tokenized security the same as a regular security? Yes, legally. SEC staff confirmed in January 2026 that a tokenized security is a security under federal law, regardless of whether the ownership information is on-chain or off-chain. The token changes settlement and transfer mechanics, not the legal classification of the underlying claim.
Which SEC exemption should a security token offering use? It depends on your raise size and investor base. Reg D has no raise cap but is limited to accredited investors; Reg A+ allows up to $75 million from accredited and non-accredited investors; Reg CF allows up to $5 million from anyone. Reg S covers offshore sales to non-US persons. Many issuers combine Reg D and Reg S.
Can companies raise from non-accredited investors with a security token? Yes, through Reg A+ or Reg CF. Regulation A+ lets a company raise up to $75 million in 12 months from both accredited and non-accredited investors. Reg CF permits non-accredited participation up to $5 million, but both require more disclosure and SEC-qualified filings than Reg D.
Why do yield-bearing tokens face more regulation? Because a promise of return typically makes an instrument a security and can trigger investment-company and adviser rules. Payment stablecoins are prohibited from paying yield, while tokenized Treasury products are classified as securities with transfer restrictions. Non-yielding, fully-backed tokens face a lighter path.
How does MiCA classify a tokenized RWA? MiCA is residual. A tokenized RWA is an asset-referenced token when it references a basket of assets and is not a financial instrument or e-money token, which triggers MiCA Title III obligations. If the token is a transferable security or fund unit, it stays under MiFID II and the Prospectus Regulation instead.
What is the difference between an ART and an EMT under MiCA?
An EMT references a single fiat currency, like USDC referencing the US dollar, and only EMIs and credit institutions can issue them; an ART references more than one currency, a basket of commodities, or a combination of assets.
EMT rules are stricter on issuance; ART rules are stricter on reserves and governance.
Does an offshore domicile solve compliance? No. An offshore vehicle in Cayman or the BVI holds the legal entity but does not grant permission to distribute into any particular investor’s country. These domiciles hold the vehicle; they do not solve distribution into your investors’ jurisdictions, which is a separate piece of work.
What did the SEC’s Innovation Exemption change?
On September 17, 2026, the SEC approved a temporary, conditional exemption allowing limited trading of tokenized stocks on Tokenized Securities Venues. It is a five-year, conditional framework for secondary on-chain trading of tokenized NMS stocks, not a blanket relief for issuing new tokenized securities, and it comes with volume caps, symbol limits, and issuer-notice conditions.
Why is Switzerland a common jurisdiction for tokenized securities? Because its law gives tokens direct legal standing. Swiss law recognizes a ledger-based security, introduced through the DLT reforms that came fully into force on 1 August 2021. Licensed DLT trading venues are operational, giving issuers legal certainty on custody, settlement, and insolvency treatment.
