---
title: "What Is a Security Token? Definition, Rights and EU Rules"
url: "https://hokenfi.com/en/what-is-a-security-token/"
site: HokenFi
published: "2026-08-13T22:56:54+00:00"
modified: "2026-08-13T22:58:14+00:00"
language: en-US
author: "Jesús Sánchez Fernández"
description: "A security token is a share, bond or fund unit recorded on a distributed ledger: same rights, same law, new rails. EU rules, issuance and myths."
section: "Home > Uncategorized > What Is a Security Token? Definition, Rights and EU Rules"
---

# What Is a Security Token? Definition, Rights and EU Rules

A security token is a financial instrument, such as a share, a bond or a fund unit, represented on distributed ledger technology. The rights it carries and the law that governs them are the same as for any conventional security. What changes is the infrastructure used to register and transfer the instrument.

Most confusion around the term comes from ignoring one half of that definition. Some descriptions treat every blockchain asset as a new category with its own rules. Others assume the technology moves the instrument outside securities law. Both readings fail in the EU, where classification follows the rights attached to the instrument, not the label on the website ([Directive 2014/65/EU, MiFID II](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32014L0065)).

## What makes a token a security

The test is substance over form. A token qualifies as a financial instrument when the rights it grants match a category in Annex I, Section C of MiFID II: transferable securities such as shares and bonds, money-market instruments, units in collective investment undertakings, or derivatives. Whether the issuer calls it a governance token, a membership pass or a digital collectible is irrelevant. What counts is what the holder can claim, from whom, and under which conditions ([Directive 2014/65/EU, Annex I](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32014L0065)).

ESMA confirmed this approach in its guidelines on the qualification of crypto-assets as financial instruments, published as a final report in December 2024, with the guidelines applying from March 2025. Supervisors assess each token case by case, looking at the actual rights and obligations rather than the technical wrapper ([ESMA75-453128700-1323](https://www.esma.europa.eu/document/final-report-guidelines-conditions-and-criteria-qualification-crypto-assets-financial)).

A working rule for issuers: if the token gives its holder a share of profits, a claim to repayment, or rights over a pooled investment managed by others, plan for securities law from the start. In Spain, that framework is Law 6/2023, which expressly allows financial instruments to be represented on distributed ledgers; we cover the national rules in our guide to [security token regulation in Spain](https://hokenfi.com/en/security-token-regulation-spain/) ([Law 6/2023](https://www.boe.es/eli/es/l/2023/03/17/6/con)).

## Security token vs utility token vs other crypto-assets

EU law splits the field into two regimes. Financial instruments follow MiFID II, the Prospectus Regulation and national securities law. Crypto-assets that are not financial instruments follow MiCA. The boundary is written into MiCA itself: the regulation does not apply to crypto-assets that qualify as financial instruments ([Regulation (EU) 2023/1114, Article 2(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114)).

|  | Security token | Utility token | Other MiCA crypto-assets |
| --- | --- | --- | --- |
| **What the holder gets** | Rights of a share, bond or fund unit: profits, repayment, voting where provided | Access to a product or service of the issuer | A claim or use linked to referenced value, for example asset-referenced or e-money tokens |
| **Framework** | MiFID II, Prospectus Regulation, national securities law (Law 6/2023 in Spain) | MiCA, if not a financial instrument in substance | MiCA |
| **Supervisor in Spain** | CNMV | CNMV | CNMV or Banco de España, depending on the token type |
| **Disclosure document** | Approved prospectus or a defined exemption | Crypto-asset white paper | White paper or authorisation, depending on the token type |
| **Registration** | DLT register kept under an ERIR (Law 6/2023) | No securities register | No securities register |

The table is a starting point, not a verdict. A token marketed as “utility” that in substance distributes profits or promises repayment will be treated as a financial instrument, whatever its white paper says. Hybrid cases exist and are assessed individually under the ESMA guidelines. If the classification is doubtful, obtain a legal opinion before the offer opens, not after the supervisor asks questions.

## How security tokens are issued legally in the EU

A compliant issuance has two regulatory layers: disclosure and registration.

Disclosure follows the Prospectus Regulation. A public offer of securities requires a prospectus approved by a national supervisor unless an exemption applies. The usual exemptions are offers addressed only to qualified investors, offers to fewer than 150 retail investors per member state, and offers below the size threshold. Since 5 June 2026, that threshold stands at 12 million euros over 12 months, with a member state option to set it at 5 million ([Regulation (EU) 2017/1129](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32017R1129), as amended by the [Listing Act, Regulation (EU) 2024/2809](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2809)).

An approved prospectus travels. Once one supervisor approves it, the issuer can extend the offer across the EU through a notification procedure, without a second approval (Regulation (EU) 2017/1129, Articles 24 and 25).

Registration answers a different question: which record of ownership does the law recognise. Spain created a dedicated figure for this, the ERIR, the entity responsible for recording and registering DLT-represented securities, in practice the digital registrar of the issuance. Appointing one is required by Article 8 of Law 6/2023, and the regime is developed in Royal Decree 814/2023. The first ERIR, URSUS-3 Capital, A.V., was authorised in November 2024. We explain the figure and its duties in [what an ERIR is](https://hokenfi.com/en/what-is-an-erir/) ([Royal Decree 814/2023](https://www.boe.es/buscar/act.php?id=BOE-A-2023-22764)).

Secondary trading on DLT market infrastructures runs on a separate track, the EU DLT Pilot Regime, which lets authorised operators run trading and settlement systems for tokenized instruments ([Regulation (EU) 2022/858](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R0858)). Other member states operate their own registration regimes, Germany with the eWpG for electronic securities and France with its DEEP framework among them. The mechanics differ by country; the principle does not. For the wider map, see our overview of [asset tokenization in Europe](https://hokenfi.com/en/asset-tokenization-in-europe/), and for the Spanish procedure step by step, [how to issue a security token in Spain](https://hokenfi.com/en/how-to-issue-a-security-token-in-spain/).

## What buyers actually get

A properly issued security token gives its holder the same claims as the underlying instrument. A tokenized share carries economic rights and, where the bylaws provide, voting rights. A tokenized bond carries repayment and interest under the terms of the issue. A tokenized fund unit carries participation in the vehicle’s results. These claims are enforceable against the issuer under company and securities law, and the DLT register determines who the legitimate holder is at any moment.

The holder also gets a supervised environment: an approved disclosure document or a defined exemption, a register kept under the legal responsibility of an ERIR, and a national supervisor to complain to. What the holder does not get is any assurance of performance. A security token can lose value exactly like the share or bond it is.

## Common misconceptions

### “The token is the right”

It is not. The token is the registered representation of the right; the source of the right is the issuance documents and the law under which the instrument was created. If the ledger’s technology failed, the holder’s claim against the issuer would survive, because it never lived in the code. That is why EU and Spanish law regulate who keeps the register, rather than which database engine the register runs on.

### “Tokenization creates liquidity”

By itself, it does not. Liquidity needs willing buyers and a venue where they can trade legally. DLT lowers friction in registration and settlement and can reduce minimum tickets, and none of that produces demand. An issuer that needs a secondary market has to plan one, through an authorised venue or a DLT Pilot infrastructure, and describe it honestly in the offer documents.

### “Blockchain means lighter regulation”

The opposite is closer to the truth. A security token faces the full weight of securities law plus specific rules on DLT representation. What the technology changes is the operational layer: registration, settlement and corporate actions can run with less manual reconciliation. The legal obligations stay intact, and the supervisor stays the same.

The useful question for an issuer is not whether a token sounds innovative. It is whether the rights it grants make it a financial instrument, because that answer fixes the budget, the calendar and the partners the project needs.

**Whether your token is a security decides your calendar, your budget and your partners.** Run the [2-minute issuance assessment](https://hokenfi.com/diagnostico-de-emision/) or [request a proposal](https://hokenfi.com/solicita-propuesta/).

*This content is educational. It is not legal, tax or investment advice. Always check the current version of each rule on BOE and EUR-Lex.*