STO projects that fail almost never fail because of the smart contract: they fail because of the order. The usual mistakes are misclassifying the token, choosing a corporate vehicle that cannot issue what is intended, leaving documentation until the end, and assuming liquidity that no one has organized.
You are about to launch an STO and you don't want to stumble over what everyone else stumbles over. An STO (security token offering: you sell securities that live inside a token) looks like a technology problem. It isn't. It's a legal problem with a technical layer on top. Issuers who fail almost never fail because of the smart contract. They fail because of the order in which they make decisions, the corporate form they choose, and confusing deadlines that don't affect them with their own deadlines.
This guide walks through the common mistakes when launching an STO in Spain and how to avoid them. Each mistake has its correction next to it. Read it before signing anything.
Why almost all errors come from the same place
The root mistake is starting with technology and leaving the law for later. If you misclassify the security or choose a corporate form that cannot tokenize, the cleanest smart contract in the world won't save you. First the law, then the token.
A security token in Spain is not a marketing whim. It is a transferable security represented through distributed ledger systems, and it is governed by Ley 6/2023 del Mercado de Valores y de los Servicios de Inversión (LMVSI), not by MiCA. The MiCA regulation itself steps aside: it excludes crypto-assets that are financial instruments from its scope (Regulation (EU) 2023/1114, art. 2(4)). In plain terms: if what you issue is a security, the framework is the usual one, with tokens on top.
What it means for you: before choosing a chain, standard, or provider, classify the legal right underneath. That decision shapes everything else. If you have doubts about whether your asset is a security or not, start with security token vs utility token.
The most common mistakes
1. Starting with technology before legal classification
You choose the blockchain, the token standard, and the provider. Then you call the lawyer. That order costs you money and time, because legal classification can overturn technical decisions you thought were settled.
How you avoid it: reverse the order. First classify what you are issuing and under what regime. A security token is governed by the LMVSI; MiCA leaves it out precisely because it is a financial instrument (Regulation (EU) 2023/1114, art. 2(4)). The law rules, technology obeys.
2. Using an SL to tokenize equity
You want to tokenize the ownership interest in your company and your company is a limited liability company. You can't. The ownership interests of an SL cannot be represented by certificates or transferable securities or be called shares (art. 92.2 de la Ley de Sociedades de Capital). Tokenizing equity of an SL directly clashes with that prohibition.
How you avoid it: use a public limited company (SA) or a special purpose vehicle (SPV) incorporated for the issuance. An SA can represent its shares in a way compatible with tokenization. If your operating company is an SL, set up the SPV that holds the asset and issue from there.
3. Confusing the MiCA deadline of 1 July 2026 with your own deadline
You have read that a MiCA period expires on 1 July 2026 and you put it in your calendar as if it were yours. It isn't. That deadline affects the transitional regime for crypto-asset service providers (CASP), not the issuer of a security token, which is not even under MiCA.
How you avoid it: separate what affects you from what doesn't. Your securities issuance is governed by the LMVSI and securities market regulations. The MiCA CASP calendar is a different matter. Confusing them leads you to rush when you shouldn't or to relax when you should.
4. Leaving the ERIR until the end
The ERIR (entity responsible for registration and recording: the digital notary of your tokenized security registry) is the piece that certifies who holds what. Many issuers leave it until the end, as a formality. It is just the opposite: it is the bottleneck.
As of 2026, Ursus-3 Capital was the first ERIR authorized in Spain (November 2024). If you plan your STO counting on the ERIR being resolved in a week at the end, you run into a bottleneck. The figure is provided for in the LMVSI (art. 8) and developed by Real Decreto 814/2023.
How you avoid it: treat the ERIR as a critical dependency from day one. Talk to it before closing the technical design, not after. Chain your calendar to its availability, not the other way around.
5. Targeting retail investors without a prospectus or warnings
You open the offer to the general public and forget the prospectus. When you sell securities to retail investors, the default rule is a prospectus approved by the CNMV, unless an exemption fits (Regulation (EU) 2017/1129, art. 1.4). And advertising material for crypto-assets aimed at investors in Spain is governed by Regulation (EU) 2023/1114 (MiCA), which since 28 December 2024 replaces the repealed CNMV Circular 1/2022. If what you issue is a transferable security, you do not fall under MiCA: MiFID II conduct rules and the LMVSI apply to you.
How you avoid it: decide early who you sell to. If it is only to qualified investors or below an exemption threshold, document it. If you open to retail investors, budget for the prospectus and warnings from the start. It is not an extra added at the end.
6. Promising secondary liquidity that the market does not offer
In the presentation you say the token will be liquid, that it can be sold whenever you want, that there will be a market. Tokenizing does not by itself create a secondary market. An illiquid asset that is tokenized remains illiquid. Promising liquidity that does not exist is a reputational problem and, depending on how you say it, also a problem with the supervisor.
How you avoid it: describe the real liquidity. If there is no operating secondary trading platform for your token, say so. Talk about what the token actually does (registry, fractionalization, automation of certain rights), not about a market you do not control.
7. Smart contract without an audit or without defining what prevails
You deploy the contract and take for granted that the code is the law. Two problems. One: if the contract has a flaw and you have not audited it, the flaw is yours and your investors'. Two: when the code and the legal contract say different things, someone must have decided beforehand which prevails.
How you avoid it: audit the smart contract before issuing. And put in writing, in the legal documentation, that the legal contract prevails over the code in case of discrepancy. The token represents the right; it does not replace it.
8. Misclassifying the token: selling as utility what is a security
You label your token as utility (use or access token) to bypass securities regulation. If by its characteristics it confers economic or political rights typical of a security, it is a security, whatever you call it. The label does not change the regime; substance does.
How you avoid it: analyze what rights the token actually confers. If it gives profit participation, voting rights, debt or something comparable to a security, treat it as a security and apply the LMVSI. To distinguish it well, review security token vs utility token.
Checklist before launching your STO
Review this before opening the offer:
- I have qualified the right underlying the token before choosing the technology.
- The issuing vehicle is a SA or an SPV, not a SL intending to tokenize equity.
- I know which deadlines affect me (LMVSI) and which do not (MiCA CASP timetable).
- I have contacted the ERIR at the start and my calendar depends on its availability.
- I am clear about my investor base and, if I sell to retail investors, I have planned for a prospectus and warnings.
- I describe the real liquidity of the token, without promising a secondary market that does not exist.
- The smart contract is audited and the documentation says that the legal contract prevails over the code.
- The token is qualified by its substance, not by a convenient label.
What to do now
If you are going to launch an STO, this is the sensible order. First, qualify the asset and the token with the security token vs utility token guide. Second, understand the full issuance path in Spain with how to issue a security token in Spain. Third, if you still doubt the conceptual basis, review what asset tokenization is. And to resolve individual terms, you have the glossary.
Frequently asked questions
Is my STO governed by MiCA or by the LMVSI?
By the LMVSI. If what you issue is a transferable security, MiCA expressly excludes it from its scope because it is a financial instrument (Regulation (EU) 2023/1114, art. 2(4)). The applicable framework is that of the securities market, with tokens as a form of representation.
Can I tokenize the ownership interests of my limited liability company?
No, not as equity. The interests of an SL cannot be represented by certificates or transferable securities (art. 92.2 of the Ley de Sociedades de Capital). To tokenize equity you need a public limited company or an SPV created for the issuance.
Does the MiCA deadline of 1 July 2026 apply to me as an issuer?
No, if you issue security tokens. That deadline belongs to the transitional regime for crypto-asset service providers (CASP). Your issuance of securities is not under MiCA, so that deadline is not yours.
Why is the ERIR a bottleneck?
Because as of 2026 Ursus-3 Capital was the first authorized ERIR in Spain, and it is the entity that certifies the registration of your tokenized security (LMVSI, art. 8; Real Decreto 814/2023). If you leave it for the end, you hit a bottleneck. Contact it early.
Do I need a prospectus for my STO?
It depends on who you sell to. If you target retail investors, the default rule is a prospectus approved by the CNMV, unless an exemption applies (Regulation (EU) 2017/1129, art. 1.4). And advertising of crypto-assets aimed at investors in Spain is governed by Regulation (EU) 2023/1114 (MiCA), after the repeal of CNMV Circular 1/2022 on 28 December 2024. If the token is a transferable security, the framework is MiFID II and the LMVSI.
Does tokenizing my asset make it liquid?
Not on its own. Tokenizing allows registration, fractionalization and automation of certain rights, but it does not create a secondary market. A tokenized illiquid asset remains illiquid if there is no trading platform to support it.
Notice
Informational content. It does not constitute legal, tax or investment advice. HokenFi is a software and infrastructure provider; it does not provide regulated services. Check the current version of the rules cited in the BOE and EUR-Lex.
Cited regulations
- Ley 6/2023, de 17 de marzo, de los Mercados de Valores y de los Servicios de Inversión (LMVSI), art. 8.
- Real Decreto 814/2023, implementing the LMVSI, applicable to the registration of securities through distributed ledger systems.
- Real Decreto Legislativo 1/2010, which approves the consolidated text of the Ley de Sociedades de Capital, art. 92.2.
- Regulation (EU) 2023/1114 (MiCA), art. 2(4).
- Regulation (EU) 2017/1129 (Prospectus Regulation), art. 1.4.
- CNMV Circular 1/2024, BOE-A-2024-27149, which repeals Circular 1/2022 on advertising of crypto-assets with effect from 28 December 2024.
