A security token offering (STO) is a sale of blockchain tokens that are securities in law: shares, bonds, fund units or other investment rights, recorded wholly or partly on a blockchain. Recording a security on a blockchain does not change its legal status. In the US, the staff of three SEC divisions said this plainly on 28 January 2026: a token that represents a security is still a security, and the federal securities laws apply in the usual way. So an STO must either be registered with the regulator or fit an exemption, just like a conventional share or bond sale. The latest US development came on 18 August 2026, when the SEC proposed "Regulation Crypto Assets", a separate fundraising regime for certain crypto token sales. Its comment period closed on 20 October 2026.
The short definition
The SEC staff statement of 28 January 2026 describes a tokenized security as "a financial instrument enumerated in the definition of 'security'" that is formatted as, or represented by, a crypto asset, with its ownership record kept wholly or partly on a crypto network. An STO is the primary sale of such tokens to investors.
The staff stated the core principle this way: the format "does not affect application of the federal securities laws". Their example was that stock is an "equity security" under the Securities Act and the Exchange Act "regardless of its format".
Three models of tokenized security
The staff statement (28 January 2026) sorts tokenized securities into two categories by who creates the token: issuer-sponsored and third-party-sponsored. The third-party category splits into two models, custodial and synthetic, which gives three models in all. The difference decides what the holder actually owns, so it matters to any STO buyer.
Issued by the company itself
The issuer, or its agent such as a transfer agent, issues the security in token form and records holders on a blockchain, sometimes alongside off-chain records. In a variant, the security is issued off-chain and holders receive a token that only triggers transfers on the issuer's books. In that variant the token carries none of the security's rights.
Custodial tokens from a third party
A firm unaffiliated with the issuer holds the real security and issues a token, such as a tokenized security entitlement, that "evidences the holder's ownership interest" in it. The staff note that holders take on third-party risks, such as that firm's bankruptcy, which direct holders do not face.
Synthetic tokens from a third party
A third party issues its own instrument, such as a linked security or a security-based swap, that only tracks the underlying security. The staff statement says a linked security "is not an obligation of the issuer of the referenced security". A security-based swap "typically does not convey to the holder any equity, voting, information, or other rights". Its legal treatment depends on "the economic reality of the instrument rather than the name given to the instrument".
Before buying a token marketed as a share or a bond, find out which of these three models it uses. Two tokens linked to the same company can carry very different rights.
STO vs ICO: the real difference
Many token sales during the 2017–2018 ICO wave called their tokens "utility tokens" to avoid securities rules. That label does not decide anything. In the US, the test is still SEC v. W.J. Howey Co. (decided 27 May 1946). Under it, an investment contract is "a contract, transaction or scheme whereby a person invests his money in a common enterprise and is led to expect profits solely from the efforts of the promoter or a third party." A token sale that meets this test is a securities offering, whatever the issuer calls it.
The difference is therefore about compliance, not technology:
| STO | ICO (as commonly run) | |
|---|---|---|
| What the token is | A security by design: equity, debt, fund units or similar | Often marketed as a utility or access token |
| Legal route | Registration or a named exemption | Often launched without either; if the token is an investment contract, the sale is an unregistered securities offering |
| Who can buy | Depends on the exemption (see below) | Usually open to the public |
| Holder rights | Defined by the security, though they vary by token model | Usually none beyond using the token |
Which US route is this STO using, and can you buy in it?
Start with the legal route named in the offering, then answer whether you are an accredited investor. The result shows what the SEC rules in this article allow for that route.
Which legal route does the offering's documentation name?
- Rule 506(b) of Regulation D → next question
- Rule 506(c) of Regulation D → next question
- Regulation A, Regulation Crowdfunding or full SEC registration → These routes allow sales to the general public
- Regulation S (a sale outside the United States) → An offshore sale with US resale limits
- No registration or exemption is named → No legal route is named
Do you pass one of the SEC's three accredited-investor tests for individuals? These are net worth over $1 million, alone or with a spouse or partner, not counting your primary residence; income over $200,000, or $300,000 jointly, in each of the prior two years, with the same expected this year; or a Series 7, 65 or 82 licence in good standing.
- Yes, I pass at least one test → Rule 506(b) allows accredited buyers
- No, I pass none of them → Only a few places for non-accredited buyers
Do you pass one of the SEC's three accredited-investor tests for individuals? These are net worth over $1 million, alone or with a spouse or partner, not counting your primary residence; income over $200,000, or $300,000 jointly, in each of the prior two years, with the same expected this year; or a Series 7, 65 or 82 licence in good standing.
- Yes, I pass at least one test → Expect your status to be verified
- No, I pass none of them → This route is closed to you
Rule 506(b) allows sales to an unlimited number of accredited investors. The offering may not use general solicitation. Before buying, check the token model and the rights the token carries.
Rule 506(b) allows no more than 35 non-accredited investors in any 90-day period, and the offering may not use general solicitation.
Rule 506(c) allows general solicitation, but every buyer must be accredited and the issuer must take reasonable steps to verify this.
Under Rule 506(c) every buyer must be accredited, so an investor who passes none of the tests cannot buy in this route.
Regulation A Tier 1 allows up to $20 million and Tier 2 up to $75 million in a 12-month period, and Tier 2 limits how much non-accredited investors may put in. Regulation Crowdfunding allows up to $5 million, sold through a registered broker-dealer or funding portal. Full registration also allows sales to the public.
Regulation S covers offers and sales that take place outside the United States. Securities bought offshore can be resold into the US only if they are registered or another exemption applies.
An STO must be registered or fit an exemption. If the token is an investment contract under the Howey test and neither applies, the sale is an unregistered securities offering, whatever the issuer calls the token.
This covers US routes and the individual accredited-investor tests only. It does not check EU rules, Tier 2 investment limits, the token model, holder rights or whether a specific offering is genuine, and it is not legal or investment advice.
US routes for an STO
The SEC's small-business pages list these main exemptions. A full registration is also possible.
- Rule 506(b), Regulation D: no general solicitation. Sales to an unlimited number of accredited investors and no more than 35 non-accredited investors in any 90-day period.
- Rule 506(c), Regulation D: general solicitation is allowed. Every buyer must be accredited, and the issuer must take reasonable steps to verify this.
- Regulation A: Tier 1 allows up to $20 million and Tier 2 up to $75 million in a 12-month period. Tier 2 limits how much non-accredited investors may put in, and Tier 2 offerings do not have to be registered or qualified with state securities regulators.
- Regulation Crowdfunding: up to $5 million, sold through a registered broker-dealer or funding portal.
- Regulation S: offers and sales that take place outside the United States fall outside the registration requirement of Section 5 of the Securities Act (Rules 901–905). Securities bought offshore can be resold into the US only if they are registered or another exemption applies.
Who counts as an accredited investor
For individuals, the SEC sets three tests: net worth over $1 million, alone or jointly with a spouse or partner, not counting the primary residence; or income over $200,000, or $300,000 jointly, in each of the prior two years with the same expected this year; or a Series 7, 65 or 82 licence in good standing.
STOs are not limited to wealthy investors. The 506 routes are for accredited buyers, while Regulation A, crowdfunding and full registration all allow sales to the general public.
What changed in 2026 in the US
- 28 January 2026: the staff statement on tokenized securities from the SEC's Divisions of Corporation Finance, Investment Management, and Trading and Markets, described above. It is a staff view, not a Commission rule, and it gives no new relief.
- 18 August 2026: the SEC proposed "Regulation Crypto Assets" (Release No. 33-11434; 34-106150; file S7-2026-27), published in the Federal Register on 21 August 2026. It would create a "tailored offering regime for certain investment contracts involving crypto assets", with two exemptions from registration: up to $5 million over a four-year period, and up to $75 million in each 12-month period. It also proposes a conditional safe harbor from the "investment contract" definition. The antifraud and antimanipulation provisions would still apply. Comments were due by 20 October 2026, and the SEC lists it as a proposed rule.
The proposal targets crypto tokens sold under investment contracts, not tokenized shares or bonds. For token sales, though, it would create a third legal route next to "register as an STO" and "argue the token is not a security".
The EU: two separate regimes
- MiCA (Regulation (EU) 2023/1114) governs crypto-assets, but Article 2(4)(a) excludes crypto-assets that qualify as financial instruments. A security token therefore falls under existing securities law (MiFID II and related rules), not MiCA. ESMA guidelines on when a crypto-asset counts as a financial instrument have applied since 18 May 2025. They look at substance over form, so the label on a token does not decide its status.
- DLT Pilot Regime (Regulation (EU) 2022/858), applicable since 23 March 2023, lets market infrastructures seek exemptions from some rules so they can trade and settle financial instruments on distributed ledgers. It caps eligible instruments by market value: shares under €500 million, bonds under €1 billion, UCITS units under €500 million. A single DLT infrastructure's total is capped at €6 billion.
What to check before buying a security token
- Legal route: which registration or exemption the offering uses, and whether you are eligible.
- Token model: issued by the company itself, a custodial token from a third party, or a synthetic token. This decides whether you hold the security, a claim on a custodian, or only price exposure.
- Rights: voting, dividends or coupons, information rights, and what happens if the token platform or custodian fails.
- Transfer limits: exempt offerings can restrict resale. For example, Regulation S securities can come back into the US only under registration or another exemption.
- Jurisdiction: in the EU, whether the token is a financial instrument, which takes it outside MiCA.
This article covers US and EU rules only and is general information, not legal, tax or investment advice.
