Security Token

When a token is a security in the EU. It is one if it fits the MiFID II definition of financial instrument (Article 4(1)(15) of Directive 2014/65/EU), which since March 23, 2023 expressly includes instruments issued by means of distributed ledger technology (wording introduced by Article 18 of Regulation (EU) 2022/858). The list is in Annex I, Section C: transferable securities, money market instruments, units in collective investment undertakings and derivatives, among others. Transferable securities are the classes of securities that are negotiable on the capital market, other than instruments of payment, such as shares and bonds (Article 4(1)(44)). MiCA does not apply to crypto-assets that qualify as financial instruments (Article 2(4)(a) of Regulation (EU) 2023/1114).

ESMA's test. ESMA's guidelines of March 19, 2025 (ESMA75453128700-1323) call for substance over form and technology neutrality. A crypto-asset is a transferable security if it meets three conditions at once: it is not an instrument of payment, it belongs to a "class" of securities (same issuer, interchangeable tokens with the same rights) and it is negotiable on the capital market (Guideline 2, paragraphs 13 to 18). For a first view, use our MiCA or MiFID II classifier.

In Spain. Transferable securities can be represented in DLT-based systems (Article 6(1) of Law 6/2023). The issuance needs an issuance document (Article 7), and the issuer appoints one or more entities responsible for registration and recording (ERIR) (Article 8(4)). If the securities are admitted to trading, that responsibility falls on the market infrastructure authorized by the CNMV (Article 8(5)).

Security token vs. utility token. MiCA defines a utility token as a crypto-asset that is only intended to provide access to a good or a service supplied by its issuer (Article 3(1)(9)). If the token gives rights typical of a security, such as dividends, interest or a share of the capital, the label does not matter: it is a financial instrument. Differences and examples in security token vs utility token.

In the U.S.: the Howey Test. A tokenized share or bond is still a security. For other tokens, the key test is whether there is an investment contract under the Howey Test (SEC v. W. J. Howey Co., 328 U.S. 293, decided May 27, 1946). On March 17, 2026 the SEC, together with the CFTC, issued Release No. 33-11412 (91 FR 13714), a Commission interpretation: it sorts crypto assets into five categories, of which digital securities are securities, and says a tokenized security is still a security, whether onchain or offchain (section III.E). SEC staff also distinguish securities tokenized by the issuer from those tokenized by third parties (Statement on Tokenized Securities, January 28, 2026, non-binding). If the token is a security, its offering needs SEC registration or an exemption, such as Regulation D, Regulation A or Regulation Crowdfunding.

Technical standards: ERC-3643 and ERC-1400. A security token usually needs to ensure that only identified, eligible investors can receive it. ERC-3643 (T-REX) is an Ethereum standard with "Final" status, created on July 9, 2021 and built on ERC-20: before each transfer it checks that the receiver is verified in an identity registry and that the transaction complies with the compliance rules, and it allows the token to be paused and balances to be frozen or recovered. ERC-1400 ("Security Token Standard") was proposed on September 13, 2018 in issue #1411 of the EIPs repository on GitHub, now closed, and it is not listed as an EIP on eips.ethereum.org. No standard makes an issuance legal: it only helps enforce on the token the restrictions the law requires.

Official sources: Directive 2014/65/EU (MiFID II), Article 4 and Annex I; Regulation (EU) 2023/1114 (MiCA), Arts. 2(4) and 3(1)(9); ESMA guidelines, March 19, 2025; Law 6/2023, Arts. 6 to 8 (BOE); 328 U.S. 293 (Library of Congress); Release No. 33-11412; Statement on Tokenized Securities; EIP-3643.

Framework verified as of October 13, 2026. At Unknown Gravity we build the platform, smart contracts and integrations for a security token issuance. In the EU we work with the client's legal counsel and with the ERIR or the authorized infrastructure; we are not an ERIR or a CASP. In the U.S. we work alongside the client's U.S. securities counsel and registered intermediaries (transfer agent, broker-dealer/ATS, funding portal); we are not a broker-dealer, funding portal, transfer agent, investment adviser or law firm. Talk to us.