What is a security token?

A security token is a digital token that functions as an investment instrument - conferring equity, debt, profit participation, or asset exposure in a way that makes it economically equivalent to a traditional security. The label on the token is irrelevant. Regulators globally have adopted a substance-over-form approach: if a token functions like a security, it is regulated like one, regardless of whether the issuer calls it a utility token, a governance token, or anything else.

Security tokens carry the heaviest regulatory burden of any token type. They also, structured correctly, offer something the other token categories cannot: the ability to offer token holders income, revenue flows, and control of assets. 

The market for tokenized securities - including tokenized bonds, tokenized fund units, and tokenized equity - is growing rapidly. BCG estimates that $9.4 trillion in assets will be tokenied by 2030; Standard Charters predicts $30 trillion

nancial instrument markets in the tens of billions. A huge opportunity awaits institutions, small asset issuers, and investors. 

Why security tokens matter now

Why Security Tokens Matter

Security tokens exist to solve a problem that has sat at the centre of global capital markets for decades: the best assets are inaccessible to most investors, and even to those who can access them, they are illiquid, expensive to transfer, and slow to settle.

Private equity, real estate, infrastructure, and private credit together represent the largest and highest-performing segment of investable assets globally. They are also among the most structurally inefficient. Minimum tickets can run to hundreds of thousands of dollars, and lock-up periods run to years. Secondary transfers require bilateral negotiation, legal documentation, and lengthy settlement processes. The result is that the assets with the strongest long-term return profiles are available only to the richest individuals and the largest institutional investors - and even they cannot easily reposition their exposure once committed.

Security tokens address each of these frictions directly. Fractional tokenization reduces minimum investment thresholds to whatever the issuer determines. On-chain settlement eliminates the two-day clearing cycle and the intermediary infrastructure behind it. Programmable smart contracts automate income distributions, enforce transfer restrictions, and execute corporate actions without manual processing. A tokenized bond can settle in minutes rather than days. A tokenized fund unit can transfer between counterparties without the bilateral negotiation that currently characterises secondary private fund markets.

The demand for this is real and quantifiable. The tokenized private credit market is the largest in segment; by  January 2026 it had reached over $18 billion, with 74% growth over the preceding twelve months. Tokenized Treasury bills -  the simplest expression of security tokenization - were worth $13 billion by April 2026. Big institutions - BlackRock, Apollo, Franklin Templeton, and HSBC etc - are piling in, an they are doing so because they believes efficiency gains are commercially significant and the investor demand is there.

The economic case for security tokenization is straightforward: it expands the market for the underlying asset. Fractional ownership means a $50 million commercial property or a $100 million private credit fund can be accessed by investors with $10,000, not just institutions with $10 million minimums. Secondary market transferability means investors are no longer locked in for seven years - they can exit into a liquid market when their circumstances change. And programmable distributions mean income flows automatically to token holders without the manual servicing infrastructure that makes private credit so expensive to operate at scale.

For asset managers, this translates into a larger and more diverse investor base, faster capital formation, and lower operational costs. For investors, it means access to asset classes - private credit yielding 8–12%, infrastructure, private real estate - that institutional lock-ups and high minimums previously put out of reach. 

How is a token classified as a security?

As the name suggests, security tokens are tokens that are deemed to be securities. The classification test varies by jurisdiction, but the core logic is consistent: substance over form, function over label. Below we take a quick look at the the approach in 4 countries:

The United States: The Howey Test

The Howey test, from the 1946 Supreme Court case SEC v. W.J. Howey Co., defines an "investment contract" — the category that captures most security tokens — as a transaction involving:

1. An investment of money
2. In a common enterprise
3. With an expectation of profits
4. Derived primarily from the efforts of others

The US regulatory position was substantially clarified by two documents in 2026. The SEC Staff Statement on Tokenized Securities (January 28, 2026) confirmed that "securities, however represented, remain securities" and that "economic reality trumps labels" — a tokenized share, bond, or fund unit is a security regardless of its on-chain format. The joint SEC-CFTC Interpretive Release (March 17, 2026) then introduced a formal five-part token taxonomy - digital commodities, digital collectibles, digital tools, stablecoins, and digital securities - establishing that tokens in the first four categories are generally not securities, while digital securities remain fully within the federal securities regime. Importantly, the Interpretive Release also clarified that a token initially sold as part of an investment contract does not remain a security indefinitely: once the issuer fulfils its promises and meaningful decentralisation occurs, the token can separate from that status.

The European Union: MiFID II

In the EU, security tokens are classified as transferable securities under MiFID II if they grant homogeneous economic rights - dividends, profit sharing, interest, liquidation claims - and are capable of being traded on organised markets. Crucially, MiCA explicitly excludes tokens that qualify as MiFID II financial instruments from its scope. This means security tokens in the EU are not governed by MiCA but by the existing EU securities law framework: MiFID II for the investment services around them, and the Prospectus Regulation for their public offering.

ESMA's March 2025 guidelines provide detailed criteria for how crypto-assets should be assessed as potential financial instruments, establishing that the regulatory analysis begins by assessing the token's inherent attributes — not the issuer's characterisation of it.

The UK

In the UK, the classification analysis under FSMA 2000 turns on whether the token constitutes a "specified investment" as defined in the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001. Tokens conferring rights analogous to shares - voting rights, dividends, a residual claim on assets - are likely to be classified as shares or equity securities. Tokens conferring fixed income rights with a defined redemption claim are likely to be classified as debt securities or debentures. Tokens representing interests in collective investment schemes are classified accordingly.

The UK follows the same substance-over-form approach as the US and EU: the label is irrelevant and the economic substance of the rights conferred is the test. One feature of UK law worth noting for structuring purposes: the Property (Digital Assets etc) Act 2025, which received Royal Assent in December 2025, enables cryptoassets as a distinct category of personal property under English law. This provides the legal foundation for token holders to assert proprietary claims over their tokens - not just contractual claims against the issuer — which strengthens enforcement rights and insolvency protections for holders of tokenized securities structured under English law. For RWA tokenization projects where English law governs the token terms, this is a meaningful structural development

The BVI

In the BVI, the relevant analysis is whether the token constitutes an "investment" under the Securities and Investment Business Act (SIBA). A token conferring equity-like rights, profit participation, or income entitlement against an asset is likely to qualify. The BVI framework is notable for one specific structural advantage: SIBA Schedule 2 excludes from the definition of investment business the issuance, redemption, and repurchase by a company of its own debentures. A BVI SPV can therefore issue tokenized debt instruments - bonds, notes, debentures with defined income and fixed-price redemption - without that activity constituting regulated investment business, even though the token itself is a SIBA investment. This is useful and underused.

Types of Security Tokens

Security tokens take several forms, each with its own structural and regulatory characteristics:

Equity tokens confer fractional ownership of a company or an economic interest equivalent to equity - voting rights, dividend entitlements, or a residual claim on assets. They are the most straightforward security token to classify and the most regulated to issue.

Debt tokens represent a tokenized debt obligation — a bond, note, or debenture with defined coupon payments and a redemption right at par or at a defined price. In the BVI, as noted above, a company's issuance of its own tokenized debt falls within the SIBA debenture exclusion, removing the investment business licensing requirement for the issuer itself.

Fund interest tokens represent fractional interests in a pooled investment vehicle — a tokenized fund unit, a tokenized LP interest, or a tokenized share class in a closed-ended vehicle. These are typically classified as collective investment scheme interests or fund units under the applicable securities law and require fund regulatory analysis alongside token analysis.

Asset-referenced security tokens - sometimes called RWA tokens. Most RWA tokens in practice are structured as security tokens - tokenized equity, debt, or fund interests - because the underlying assets are financial in nature. However, tokens representing direct claims on physical assets (commodities, collectibles) or functioning as payment instruments (stablecoins) may fall outside securities regulation under certain structures. The analysis turns on whether the token confers rights that meet the jurisdiction's securities definition, not on whether the underlying asset is real-world.

What does proper security token structuring look like?

Security tokens cannot be issued by simply deploying a smart contract and marketing to investors. The compliance architecture is substantive:

Issuing entity. A purpose-built SPV, incorporated in a jurisdiction with appropriate regulatory recognition. The BVI is a very common offshore choice. For EU-facing issuances, a Luxembourg or Malta entity is often recommended. For UAE-facing issuances, VARA ARVA licensing is necessary.

Offering documentation. A full prospectus is required for public offerings of transferable securities in most major markets. Prospectus exemptions - for qualified investors, for offers above minimum ticket thresholds, or for sub-threshold raise sizes - can reduce this requirement significantly. Token issuers will therefore often structure their issuance so that it is under certain value thresholds, offered to limited sets of investors, or only offered to certain qualified investors.  

Licensed intermediaries. In most jurisdictions, the distribution, custody, and secondary trading of security tokens must be facilitated by licensed investment firms, custodians, and trading venues. The issuer may not need a licence for the issuance itself, but the infrastructure around the token typically requires multiple licensed parties.

KYC/AML. Comprehensive investor verification is mandatory, with the standard more demanding than for utility or governance token issuances because the investor base is subject to more detailed qualification requirements.

Legal opinions. Regulated trading venues and institutional investors require legal opinions confirming the token's classification and the legality of the offering and distribution in relevant jurisdictions.

See our token issuance use case page and our BVI RWA tokenization guide for jurisdiction-specific structural detail.

FAQ

Can I issue a security token without a prospectus? In many circumstances, yes. Public offerings of transferable securities in the EU below the applicable national threshold (€12 million under the updated EU Listing Act, though some member states apply lower thresholds - Malta, for instance, applies €5 million), or offers exclusively to qualified investors, or offers with a minimum ticket above €100,000, are all exempt from the Prospectus Regulation's requirements. In the BVI, no prospectus requirement exists if the tokens are not being offered to the wider public. Proper legal analysis of the applicable exemptions in each investor market is essential.

What is the difference between a security token and a tokenized security? The terms are often used interchangeably but there is a useful distinction. A tokenized security is a traditional security - a share, bond, or fund unit - whose record of ownership has been moved onto a blockchain. The instrument is an existing security type; only the infrastructure has changed. A security token is a native digital instrument that is classified as a security because of the rights it confers, but which was designed as a blockchain instrument from the outset. In regulatory terms, the analysis is identical: tokenized securities are still securities.

Is a tokenized bond the same as a debenture under BVI law? Yes, structurally. A tokenized bond structured as a debt obligation of the issuing BVI company - with defined interest payments and a fixed redemption commitment - will typically constitute a debenture under the BVI Business Companies Act, which defines debentures broadly to include bonds, notes, and instruments creating or acknowledging indebtedness. Where that is the case, the SIBA Schedule 2 exclusion applies to the issuer's own issuance and redemption activities, removing the investment business licensing requirement for those functions. The exclusion does not extend to hybrid instruments that blend debt and equity characteristics.

Can security tokens be listed on standard crypto exchanges? Generally not without specific arrangements. Most major centralised exchanges are not licensed securities trading venues and cannot list regulated security tokens to retail investors without triggering securities law obligations in each relevant jurisdiction. Security tokens are typically traded on regulated alternative trading systems, licensed digital securities exchanges, or through bilateral OTC mechanisms between qualified investors. The EU's DLT Pilot Regime has created a pathway for regulated on-chain trading infrastructure for security tokens; six DLT market infrastructures are now authorised under this regime.How do I distribute the RWA tokens I plan to issue? Most RWA token distribution today is primary issuance through gated platforms rather than exchange trading - and for security-like tokens, exchange listing is not currently an available day-one option.

Primary distribution runs through regulated issuance platforms - firms like Securitize, Tokeny, or  Brickken. Investors subscribe through a KYC/AML-gated portal and receive tokens on whitelisted addresses. This is functionally a private placement with on-chain settlement. For most private credit and real estate structures, the exit mechanism is redemption with the issuer rather than secondary sale — plan for this from the outset.

Secondary distribution is fragmented and asset-class dependent. Tokenized Treasuries and large money market tokens circulate as DeFi collateral on Aave, Morpho, and Uniswap. Tokenized equities trade 24/7 on Ondo Global Markets and Backed/xStocks. Regulated ATS venues - tZERO, INX, Mercury RWA - provide compliance-gated order books for security tokens, though volumes remain limited. Standard crypto exchanges do not currently list regulated security tokens, though Kraken and OKX are building toward it.

How long does it take to issue a security token? Significantly longer than a utility or governance token. The timeline depends on the jurisdiction, the offering structure, and whether prospectus exemptions apply. A BVI-structured private placement to qualified investors, using prospectus exemptions in relevant markets, can typically be completed in six to twelve weeks from instruction. A fully regulated public offering - with a prospectus approved by a competent authority, licensed distribution infrastructure, and regulated custody arrangements - takes six months to a year or more.

This article is for informational purposes only and does not constitute legal or financial advice. Security token classification and issuance requirements vary significantly by jurisdiction, token structure, and investor base. Always seek qualified legal advice before issuing a token.

[BRAND NAME] advises web3 founders and international counsel on security token structuring, SPV formation, and RWA tokenization across the BVI, UAE, Malta, and EU.

Structuring a security token or tokenized asset issuance? Book a consultation with our team — security token structuring is where getting the details right matters most.