Phase 8: Define the Security Token Offering (STO) Framework

Decide whether the offering is registered or exempt, select the regulator or exemption, assign an ISIN, choose a settlement stablecoin, set sale parameters, execute a Security Token Purchase Agreement, and obtain legal verification before going live.

The Security Token Offering (STO) framework defines how the offering will be conducted, who can participate, and under what terms. It is the layer that meets regulatory requirements, protects investors, and gives the raise the credibility institutions look for before they commit capital.

In this phase you set the formal parameters of the offering and establish its compliance footing. You specify the registration status — whether the offering is registered, exempt, or conducted under a specific regulatory framework — and record the regulator or exemption you rely on. You assign an ISIN for market recognition, select the stablecoin used for settlement, and define the commercial parameters: offering size, pricing, investor eligibility, caps, lockup, and duration. Finally, you attach the Security Token Purchase Agreement and obtain legal verification confirming the structure has been reviewed by qualified counsel. Together these steps make the offering transparent, defensible, and ready to go live through Stobox Compass. This page is educational reference, not legal advice — confirm every position with qualified securities counsel in each relevant jurisdiction.

Registered vs. Exempt Offerings

As founders, asset owners, and family offices explore ways to raise capital through tokenized securities, the regulatory pathway becomes decisive. The legal structure behind how securities are offered materially affects fundraising success, compliance obligations, cost, and investor reach. There are two primary routes: registered offerings and exempt offerings. Both involve offering financial instruments to investors, but their regulatory requirements, investor eligibility, and legal implications differ greatly.

What Is a Registered Offering?

A registered offering is one where a company offers securities to the public and must formally register the offering with the relevant national securities regulator — such as the U.S. Securities and Exchange Commission (SEC), the European Securities and Markets Authority (ESMA), or an equivalent body. This is the legal pathway behind Initial Public Offerings (IPOs) and large-scale security token offerings available to the general investing public, including retail investors.

Key characteristics:

• Full disclosure: the issuer must prepare a comprehensive prospectus or offering memorandum covering detailed financials, risk disclosures, governance, business plans, and use of proceeds.
• Regulatory review: the prospectus must be reviewed and approved by the securities regulator before any public solicitation.
• Ongoing obligations: issuers must meet continuing reporting requirements, including periodic financials, annual audits, and material-event disclosures.

Benefits:

• Access to a larger pool of investors, including retail.
• Ability to list on public exchanges or regulated marketplaces.
• Increased transparency and credibility.

Challenges:

• High cost from legal, auditing, and underwriting fees.
• Time-consuming and process-intensive.
• Subject to complex compliance and reporting requirements after the offering.

What Is an Exempt Offering?

An exempt offering, often called a private placement, lets a company raise capital without registering the offering with the securities regulator. Instead, the issuer relies on a legal exemption that permits securities to be offered under specific conditions. This route is especially popular for early-stage companies, tokenized projects, and international offerings where speed and cost-efficiency matter.

Common exemptions:

• Regulation D (Rule 506(b) / 506(c)) — U.S. offerings to accredited investors.
• Regulation S — offerings made outside the United States.
• Regulation A+ — a lighter form of public registration, with investment limits and simplified filings (Tier 1 up to $20M, Tier 2 up to $75M over 12 months).
• EU prospectus exemptions — small offerings below the applicable threshold (EU-wide mandatory exemption at €1M over 12 months; member states may raise it up to €8M, with €5M or €8M common).

Key features:

• No full prospectus is required, though a private placement memorandum is often prepared.
• Marketing is restricted or permitted only under strict conditions.
• Securities are usually subject to resale restrictions, such as lockup periods or holding time.

Benefits:

• Lower cost and faster execution.
• Greater privacy for the issuer (less public disclosure).
• Suitable for targeted investor groups such as family offices, VCs, or institutions.

Challenges:

• Cannot broadly market to the general public (unless using certain exemptions such as Reg A+ or 506(c)).
• Investor base is limited, often excluding retail investors.
• Reduced liquidity from transfer restrictions.

Comparing the Two Approaches

Strategic Considerations for Tokenized Assets

When issuing tokenized securities, the choice between a registered and an exempt offering depends on several factors:

• Target investor base: to raise from a global retail audience, a registered offering or Reg A+ may be necessary; to focus on qualified investors, an exemption such as Reg D or Reg S may fit better.
• Timeline and budget: if speed and cost-efficiency are critical, an exempt offering provides a faster route to market.
• Jurisdictional reach: some exemptions, such as Reg S, enable international fundraising without triggering U.S. registration.
• Liquidity goals: registered offerings typically provide faster access to secondary-market trading, whereas exempt offerings may face liquidity constraints.

For most tokenization projects the exempt route is the starting point, especially when targeting professional investors in a private-placement structure. Registered offerings tend to be a later-stage strategy for projects aiming to unlock retail access and public-market trading. Jurisdiction-specific detail lives in the Stobox guides.

STO Classifications

The issuer must determine whether the STO will be conducted as a registered offering or under a regulatory exemption. This decision shapes the entire compliance strategy — who can invest, how the token can be promoted, what disclosures are required, and how tokens may be traded after the sale.

Objective: select the STO framework that ensures regulatory compliance, aligns with your investor base, and supports your marketing and liquidity goals.

Registered Security Token Offering

A registered offering is reviewed and approved by a national financial regulator (e.g. SEC, FCA, BaFin, FINMA).

Key characteristics:

• Requires full submission of a prospectus or offering memorandum.
• Allows participation by both retail and institutional investors.
• Enables public marketing and advertising.
• Requires ongoing reporting and financial disclosures.
• Suitable for larger, mass-market, or institutional offerings.

Examples of registered offerings:

• SEC Regulation A+ or S-1 (USA)
• FCA-authorized prospectuses (UK)
• MiFID II / EU Prospectus Regulation
• FINMA-registered public offerings (Switzerland)

Exempt Security Token Offering

An exempt offering qualifies under specific legal exemptions and does not require full registration, but imposes restrictions.

Key characteristics:

• Restricted to accredited, institutional, or qualified investors.
• No public solicitation or mass marketing allowed.
• May require investor verification and self-certification.
• Subject to resale restrictions or lockup periods (e.g. 12 months under Rule 144 in the US).
• Lower cost and faster launch, ideal for private placements.

Examples of exempt offerings:

• Regulation D, Rule 506(c) (USA) — accredited investors only
• Regulation S (USA) — offshore investors only
• Small Offers Exemption (EU/UK)
• Qualified Investor Exemption (Switzerland)

Key Differences Between Registered and Exempt STOs

How to Choose the Right Framework

• Where are your investors located? Offering to retail investors in the US or EU may require a registered offering.
• What kind of investors are you targeting? Raising from institutions or accredited investors only may make an exemption ideal.
• Do you want to publicly promote the STO? Only registered offerings allow general solicitation.
• Do you want flexibility in secondary trading? Registered offerings often provide smoother access to regulated exchanges.
• Do you have the legal resources to manage a full registration process? If not, exemptions may be faster and more cost-effective.

Issuer Action Items

1. Determine offering type: registered or exempt.
2. Select jurisdiction and regulator (e.g. SEC, FCA, FINMA, BaFin).
3. Document the framework in your Token Issuance Specification (TIS), Terms of Use, and whitepaper.
4. Comply with all requirements: investor verification, marketing rules, and filing obligations.

Conclusion: Ensuring Compliance

Selecting the correct STO framework ensures legal compliance and avoidance of enforcement action, clear rules for investor participation, a suitable marketing and distribution plan, sound planning for liquidity and secondary trading, and strong regulatory positioning and investor confidence.

Under MiCA, the EU’s markets-in-crypto-assets regime became fully applicable to CASPs from 30 December 2024 (ART/EMT stablecoin provisions from 30 June 2024); most tokenized securities remain governed by the existing prospectus and MiFID II framework rather than MiCA itself. Stobox and its legal partners can support STO framework selection, including exemption analysis, jurisdiction strategy, and regulatory filings.

Determining the Registration Status of the Offering

Determining whether your STO requires full registration or qualifies for an exemption is essential to compliance, investor eligibility, and marketability. This decision dictates who can invest, how the offering can be promoted, and the regulatory obligations the issuer must fulfill. If the offering is registered, it must be formally approved by a recognized financial regulator before tokens are sold. If it qualifies for an exemption, the issuer must adhere to specific conditions — investor-type restrictions, marketing limitations, and filing requirements. Recording this decision clearly ensures legal transparency and regulatory alignment throughout the token’s lifecycle.

If the Offering Is Registered

Record that the offering is registered and identify the regulatory body under whose authority it is approved. Common regulators include:

• European Securities and Markets Authority (ESMA)
• European Commission (EC)
• Federal Financial Supervisory Authority (BaFin)
• Autorité des Marchés Financiers (AMF)
• Commissione Nazionale per le Società e la Borsa (CONSOB)
• Comisión Nacional del Mercado de Valores (CNMV)
• Securities and Exchange Commission (SEC)
• Financial Industry Regulatory Authority (FINRA)
• Commodity Futures Trading Commission (CFTC)
• Financial Market Supervisory Authority (FINMA)
• BVI Financial Services Commission (FSC)
• Gibraltar Financial Services Commission (GFSC)
• Financial Market Authority (FMA)

If the Offering Is Exempt

Record that the offering is exempt and identify the exemption relied upon. Typical exemptions include:

• US: Regulation D
• US: Regulation S
• US: Regulation A Tier 1
• US: Regulation A Tier 2
• EU: Qualified Investors Exemption
• EU: Small Offers Exemption
• CH: Qualified Investors Exemption
• CH: Small Offers Exemption
• UK: Qualified Investor Exemption
• UK: Small Offers Exemption

Each exemption carries its own conditions on investor type, offer size, and marketing. Small-offer thresholds vary by jurisdiction — the EU-wide mandatory prospectus exemption is €1M over 12 months, which member states may raise up to €8M, while Switzerland permits up to CHF 8M over 12 months under FinSA and the UK sets its thresholds under the FSMA and UK Prospectus rules. Confirm the exact conditions with qualified securities counsel before relying on any exemption.

Note: Whichever route applies, upload your supporting document — a prospectus for registered offerings, or a private placement memorandum (PPM) for exempt offerings.

Assigning an ISIN

As Security Token Offerings integrate with traditional financial markets, standardization becomes essential. One of the key elements in achieving global market recognition and legitimacy is assigning an International Securities Identification Number (ISIN) to the security token.

An ISIN is a 12-character alphanumeric code that uniquely identifies a specific security — just like traditional stocks, bonds, and financial instruments. It is globally recognized and assigned by authorized National Numbering Agencies (NNAs) under the ISO 6166 standard. For tokenized securities, an ISIN bridges blockchain-based assets and traditional markets, enabling institutional adoption, regulatory tracking, and secondary-market trading.

Why an ISIN Matters for STOs

• Unique identifier for securities. Every stock, bond, or security in the traditional market has an ISIN so it can be recognized, tracked, and traded globally. For example, the ISIN for Apple Inc. stock is US0378331005; a tokenized share or real-estate asset can carry an ISIN in the same way.
• Regulatory recognition and compliance. Most financial regulators require ISINs for reporting and compliance, helping meet global standards and improving compatibility with existing financial systems.
• Investor trust and market credibility. Institutional and retail investors are familiar with ISINs, making tokenized securities more recognizable and reducing friction when integrating with investment platforms, banks, and brokerage firms.
• Secondary-market trading. Many regulated exchanges and platforms require an ISIN before listing a security token. A tokenized bond with an ISIN can be listed on both traditional exchanges and regulated digital-asset markets, increasing liquidity.
• Tax reporting and compliance. ISINs help authorities and institutions track transactions and ownership, simplifying investor tax filings and capital-gains calculations.

How to Obtain an ISIN for an STO

1. Identify the issuing country. ISINs are assigned based on the jurisdiction where the security token is issued; the first two characters are the country code (e.g. US for the United States, GB for the United Kingdom, CH for Switzerland).
2. Apply through a National Numbering Agency (NNA). Each country has an official NNA responsible for assigning ISINs — for example CUSIP Global Services (CGS) in the U.S., the European Central Securities Depositories in the EU, and London Stock Exchange (LSE) ISIN Services in the UK.
3. Submit STO and security details. Required information typically includes issuer details (company name, registration number, jurisdiction), security-token details (asset type, rights, compliance classification), and smart-contract information where applicable.
4. Approval and registration. Once assigned, the ISIN is registered in global financial databases, allowing the STO to be tracked like any other traditional security.

Assigning an ISIN transforms a security token from a niche blockchain asset into a recognized financial instrument, smoothing institutional adoption, secondary-market trading, and regulatory compliance.

Stablecoin Selection and Settlement

One of the most important operational decisions in the offering is selecting a stablecoin for settlement. Stablecoins are digital assets pegged to traditional currencies such as the US dollar or euro, providing price stability while enabling seamless on-chain transactions. When an investor buys tokenized assets, payment is made in the selected stablecoin, and the transaction is cleared and recorded on a single blockchain ledger — transparent, secure, and efficient. In Stobox Compass, settlement is non-custodial: funds move directly from the investor to the issuer’s treasury, and Stobox never takes a percentage of the raise.

Available Stablecoin Options

When tokenizing an asset, you select which stablecoin will be used for transactions and settlement. The available options are:

• USDC (USD Coin) — pegged to the US dollar (1 USDC = 1 USD), issued by Circle, a regulated fintech based in the U.S. Best for issuers that prefer a highly regulated, transparent USD-backed stablecoin.
• EURC (Euro Coin) — pegged to the euro (1 EURC = 1 EUR), issued by Circle, the same company behind USDC. Best for businesses operating in the Eurozone that want to settle in EUR.
• EURS (Stasis Euro) — pegged to the euro (1 EURS = 1 EUR), issued by Stasis, a European fintech firm. An alternative euro-denominated settlement option for Eurozone businesses.

How the Settlement Process Works

When an investor purchases tokenized assets, payment is made in the selected stablecoin. The transaction then proceeds as follows:

1. Verified on the blockchain — ensuring security and immutability.
2. Cleared on a single ledger — the system records the transaction on the chosen network (Base, Arbitrum, or Canton).
3. Token transfer completed — the stablecoin payment is received and the corresponding tokenized asset is transferred to the investor.

Tip: This process eliminates intermediaries, reducing costs and enabling real-time settlement.

Note: On-chain transactions require gas fees (a network commission) paid in the network’s native token — for example ETH on Base and Arbitrum. Stobox issues security tokens primarily on Base (the primary settlement layer), with Arbitrum and Canton also supported; Compass Lite raises run on Arbitrum One today. Because Base is OP-stack and portable, no single chain is a hard point of failure. On-chain transaction records can be inspected on the network’s block explorer (e.g. Basescan or Arbiscan).

Finalizing Stablecoin Selection

The right stablecoin depends on your business’s currency preference (USD or EUR) and the regulatory-compliance considerations in your jurisdiction.

Defining STO Offering Parameters

Defining the STO’s offering parameters establishes clear terms around the token sale — funding goals, pricing, currency, caps, and duration. These elements form the foundation of the offering and ensure a structured approach to capital raising. Clear parameters also shape the token’s economic model, align investor expectations, and inform the design and compliance of the smart contracts issued through Stobox Compass.

Accepted Payment Methods

The stablecoins accepted for investor payment during the offering — for example USDC and EURC — as selected in the settlement step above.

Number of STO Rounds

Derived automatically by the platform from your offering configuration; it reflects how many rounds the offering comprises rather than a value you set directly.

STO Round Name

A label identifying the round, useful when an offering runs in multiple stages (for example, an early “Acme Founders Round” followed by a general round).

STO Round Status

Maintained automatically by the platform to reflect the round’s current state in its lifecycle (for example draft, live, or closed).

Start Date and End Date

The dates on which the round opens and closes to investors — for example a start of 12/25/2025 and an end of 12/25/2026. These dates can be edited before the offering is validated; after validation they are locked.

Security Token Price

The price per token for the offering. You may set a custom price here; standard pricing options derive from the token economics established in Phase 4.

Select the Sale Option That Best Suits Your Project

Choose how tokens are supplied to the sale:

• Token sale from the initially minted supply. For example, if the initial supply is 300,000 tokens, the number of tokens for sale is at most 300,000.
• Token sale from unminted supply (tokens minted upon payment). For example, if the total supply is 1,000,000 tokens and the initial supply is 300,000 tokens, up to 700,000 remain to be minted — because 300,000 have already been minted and held as the company’s reserve.
• Both options — a combination of minted and to-be-minted supply.

Offering Allocation Amount

The total number of tokens made available for sale in the round, consistent with the sale option selected above.

Minimum Investment Size

Define the minimum amount an investor may commit — for example $50.

Note: The minimum investment may be constrained by applicable regulations and the terms of your chosen exemption.

Lockup Period

The holding period during which investors cannot transfer their tokens after purchase. Standard options are 3 months, 6 months, or 12 months, or a custom period you specify. Lockups often follow from the exemption you rely on (for example, resale restrictions under Rule 144 in the US).

Hard Cap and Soft Cap

• Hard cap — the maximum the offering will accept, for example $2,500,000.
• Soft cap — the minimum needed for the offering to proceed, for example $500,000.

Note: If the soft cap is not reached, issuers typically refund investors.

Security Token Purchase Agreement

The Security Token Purchase Agreement (STPA) is a legally binding contract that sets out the terms and conditions under which an investor purchases security tokens from the issuer. It is analogous to a traditional investment agreement but tailored to blockchain-based digital securities, governing the transaction and defining the rights and obligations of both the issuer and the investor.

Why It Is Necessary

Legal framework and regulatory compliance. The STPA ensures the token sale complies with applicable laws — securities laws, anti-money laundering (AML) rules, and Know Your Customer (KYC) requirements. Where security tokens are treated as regulated financial instruments, the STPA acts as a formal record of the sale, making the offering legally defensible and audit-ready.

Clear definition of terms. It specifies the key investment terms, including:

• Token price and payment methods
• Allocation and delivery schedule
• Lockup periods or transfer restrictions
• Investor rights (e.g. profit sharing, voting, redemption)

This clarity prevents future disputes by ensuring both parties are aligned from the start.

Protection for Both Parties

The STPA offers legal protection for issuers and investors alike:

• For the issuer, it ensures investors agree to all terms, assume appropriate risk, and commit capital under defined conditions.
• For investors, it confirms their entitlement to the rights and benefits associated with the tokens and provides recourse if the issuer fails to meet its obligations.

It also typically includes risk disclosures, supporting informed investment decisions and fulfilling regulatory transparency requirements.

Alignment With the Token’s Legal Nature

Security tokens often represent ownership, debt, profit-sharing, or other regulated financial rights. The STPA provides the legal anchor for those rights. Without it, the token exists only on-chain, with no enforceable connection to the real-world asset or agreement — which undermines the purpose of tokenization.

Lifecycle Support and Auditability

Throughout the token’s life — resale, transfers, corporate actions, and exit events — the STPA serves as the reference point for what was agreed at issuance. It supports audits, investor reporting, and legal reviews, making it a vital part of a compliant and scalable tokenized ecosystem.

In short, the STPA is foundational to any serious tokenization project. It turns a blockchain transaction into a legally recognized investment, supports compliance, builds investor trust, and provides clarity, structure, and protection for all parties. Skipping it exposes the project to legal risk, undermines credibility, and can lead to regulatory penalties or investor disputes.

Legal Verification of the Offering

Legal verification of a token offering is a critical step confirming that your STO complies with applicable laws and regulations. It is not a formality — it provides the legal foundation for issuing digital securities and protects both issuer and investors throughout the token’s lifecycle.

Ensures Regulatory Compliance

Different jurisdictions treat token offerings differently — some classify them as securities, others as utility tokens, each with distinct implications. Legal verification confirms:

• Whether the token qualifies as a regulated security
• Which licenses, exemptions, or filings are needed
• What investor protections and disclosure requirements apply

Important: Without proper legal classification and documentation, an offering may violate securities laws, which can carry serious civil and, in some jurisdictions, criminal liability.

Defines Investor Rights and Legal Structure

Legal review defines what rights the token grants (e.g. equity, dividends, voting, revenue share), the legal relationship between token holders and the issuing company, and whether the smart contracts reflect enforceable terms. This gives clarity to investors, regulators, and partners, reducing ambiguity and potential disputes.

Builds Trust and Investor Confidence

Investors — especially institutional ones — need assurance that the token is legally valid, properly structured, and compliant with their local laws. Legal verification demonstrates that the project has been thoroughly vetted and professionally managed, boosting confidence and credibility in the market.

Supports Global Fundraising

STOs often attract cross-border investors. Legal verification ensures compliance with international securities laws, proper handling of tax, data-privacy, and AML obligations, and investor-onboarding (KYC) processes consistent with global standards.

Enables Long-Term Scalability and Liquidity

Verified offerings can list on regulated secondary markets, access broader investment pools, and be reused in future fundraising rounds without starting from scratch.

Important: Legal clarity underpins secondary trading, dividends, exits, and corporate actions — unlocking the full potential of tokenized assets.

Recording Verification

Confirm whether the offering has been legally verified and, where it has, record your legal provider’s name. This links the offering to the counsel who reviewed it and completes the compliance record.

Legal verification transforms a digital token into a legally sound, market-ready investment product. It protects the project from legal risk, enhances transparency, satisfies regulators, and opens the door to broader investor participation.

Going Live

With the framework defined — registration status recorded, ISIN assigned, settlement stablecoin and network selected, sale parameters set, the Security Token Purchase Agreement executed, and legal verification in place — the offering is ready to launch. From here the raise runs through Stobox Compass, non-custodially and on software terms only: investors are onboarded and verified on-chain, funds settle directly into your treasury, and every position is enforced at the token’s transfer layer. This is the moment the structured, documented, legally verified asset becomes a live, compliant Security Token Offering. When you are ready to run it, the Stobox suite — Intelligence, Raisable, and Compass — carries you from preparation to a raise that is open for investment.