In finance, a security token is a share, a bond or a fund unit issued and recorded on a blockchain or another distributed ledger. It carries the same rights, and falls under the same securities law, as the traditional instrument. What changes is the infrastructure used to register and transfer it, not what the investor owns.
¿Prefieres leerlo en español? Leer en español: qué es un security token
Two different things are called “security token”
Search for the term and half the results describe something else. In IT security, a security token is a device or a piece of software that proves who you are: a key fob that shows a one-time code, a USB key, an authenticator app or a session token issued after login. It protects access to an account. It gives no ownership rights and has no market value.
In finance, a security token is an investment instrument. It represents a claim on a company, a debt or a pool of assets, and it is regulated as a security. The two meanings share a word and nothing else.
| Authentication token (IT security) | Security token (finance) | |
|---|---|---|
| What it is | A credential: hardware key, one-time code generator, authenticator app, session token | A financial instrument (share, bond, fund unit) recorded on a distributed ledger |
| What it does | Proves identity and grants access | Gives economic and, where provided, voting rights |
| Rules that apply | Cybersecurity and data protection rules | Securities law: offer, disclosure, registration and supervision |
The rest of this guide covers the financial meaning only.
What makes a token a security
The test is substance over form. A token qualifies as a financial instrument when the rights it grants match a category in Annex I, Section C of MiFID II: transferable securities such as shares and bonds, money-market instruments, units in collective investment undertakings, or derivatives. Whether the issuer calls it a governance token, a membership pass or a digital collectible is irrelevant. What counts is what the holder can claim, from whom, and under which conditions (Directive 2014/65/EU, MiFID II).
ESMA set out the EU-wide test in its Guidelines on the conditions and criteria for the qualification of crypto-assets as financial instruments (ESMA75453128700-1323), applicable since 18 May 2025. The first guideline is explicit: the technological format is not a determining factor, and tokenised financial instruments remain financial instruments for all regulatory purposes. Supervisors look at the actual rights and obligations, not at the technical wrapper.
A working rule for issuers: if the token gives its holder a share of profits, a claim to repayment, or rights over a pooled investment managed by others, plan for securities law from the start. In Spain, that framework is Law 6/2023, which expressly allows financial instruments to be represented on distributed ledgers (Law 6/2023). The national rules are covered in our guide to security token regulation in Spain.
Types of security tokens
Security tokens are not a new asset class. They are the existing classes in a new type of register. Four types cover almost every issuance.
| Type | What the holder gets | Typical issuer | What to check first |
|---|---|---|---|
| Equity tokens | Shares: dividends, votes where the bylaws provide, a share of liquidation proceeds | Companies raising capital, from start-ups to mid-caps | Corporate form: in Spain only a sociedad anónima can represent its shares as negotiable securities |
| Debt tokens | Bonds and notes: interest and repayment on fixed terms | Companies, project vehicles, public and supranational issuers | Ranking, security package and whether the offer size requires a prospectus |
| Fund units | A proportional share of a portfolio managed by a third party | Asset managers, including money market funds | Fund law (UCITS or AIFMD rules) applies on top of securities law |
| Real estate tokens | Equity or debt of a vehicle that owns or finances a property | Developers, real estate funds, family offices | The token is a claim on the vehicle, not a direct title to the building |
Real estate is the most marketed category and the most misunderstood. In the usual structure a special purpose vehicle holds the property or the loan, and investors subscribe its shares or bonds in token form. Their rights come from the vehicle’s documents, which is why the structure deserves more attention than the blockchain. We explain the structures in tokenized real estate.
Examples of security tokens
Public, third-party issuances show what the instrument looks like in practice. They are listed as market context only: they are not recommendations and not HokenFi projects.
| Issuer and date | Instrument | What it shows |
|---|---|---|
| European Investment Bank, April 2021 | EUR 100 million two-year digital bond issued on the Ethereum public blockchain with Goldman Sachs, Santander and Société Générale, in a project selected by Banque de France for its central bank digital currency experiments | A supranational issuer can place a bond natively on a public blockchain |
| Siemens, February 2023 | EUR 60 million one-year digital bond on the Polygon public blockchain, issued under Germany’s Electronic Securities Act (eWpG) | A corporate bond can be issued without a paper global certificate or central clearing, under national law |
| BlackRock, March 2024 | BUIDL, the USD Institutional Digital Liquidity Fund: tokenized fund shares launched on Ethereum through Securitize, open to qualified investors | Large asset managers use tokenized fund units for dollar liquidity products |
| Dianelum (Spain), February 2025 | EUR 5 million tokenized debt issuance with URSUS-3 Capital as registrar (ERIR), reported by the press as the first under Spain’s Law 6/2023 circuit | The Spanish registration route has been used end to end |
None of these examples proves that tokenization makes an issuer better or an investment safer. They prove that the legal form works: the bonds were bonds and the fund shares were fund shares, with the ledger acting as the register.
Security token vs utility token vs other crypto-assets
EU law splits the field into two regimes. Financial instruments follow MiFID II, the Prospectus Regulation and national securities law. Crypto-assets that are not financial instruments follow MiCA. The boundary is written into MiCA itself: the regulation does not apply to crypto-assets that qualify as financial instruments (Regulation (EU) 2023/1114, Article 2(4)).
| Security token | Utility token | Stablecoins (ART, EMT) | |
|---|---|---|---|
| What the holder gets | Rights of a share, bond or fund unit | Access to a product or service of the issuer | A claim linked to a referenced value, such as an official currency |
| Framework | MiFID II, Prospectus Regulation, national law (Law 6/2023 in Spain) | MiCA, if it is not a financial instrument in substance | MiCA |
| Disclosure document | Approved prospectus or a defined exemption | Crypto-asset white paper | White paper plus authorisation, depending on the type |
| Register in Spain | DLT register kept under an ERIR | No securities register | No securities register |
The table is a starting point, not a verdict. A token marketed as “utility” that in substance distributes profits or promises repayment will be treated as a financial instrument, whatever its white paper says. ESMA’s guidelines add that when a hybrid token shows features of a financial instrument, that nature takes precedence. We walk through the full test in MiCA vs MiFID II: how to classify a token.
Benefits and risks
Tokenization changes the operating layer of a security. That brings real gains for issuers and a set of risks that the marketing rarely mentions.
What it can improve
- Register and settlement. Transfers update the register directly, which reduces reconciliation between registrar, custodian and paying agent.
- Corporate actions. Coupons, dividends and votes can run against the register with less manual work.
- Smaller tickets. A lower cost per investor makes smaller minimum investments viable, within the limits of the offer regime.
- Cross-border reach. In the EU, an approved prospectus can be passported, and a digital register makes investors in several countries easier to administer.
What it does not fix
- Classification risk. A token designed without legal analysis may turn out to be a security, and an unauthorised offer of securities carries sanctions.
- Liquidity. Tokenization does not create buyers. Without an authorised venue, investors may have to hold until maturity.
- Technology and custody. Lost keys, smart contract errors and network dependency are real risks. Spanish law answers them by making the registrar responsible for the register, including a contingency plan (Royal Decree 814/2023).
- Market risk. A token is worth what the underlying share, bond or fund is worth, and it can lose value like any security.
One misconception sits under all of these: the token is not the right. It is the registered representation of a right created by the issuance documents and by company and securities law. If the technology failed, the holder’s claim against the issuer would survive, which is why the law regulates who keeps the register rather than which database it runs on.
Security token rules: United States vs EU and Spain
Many readers of this page compare the US and European regimes. Both reach the same conclusion: a token is a security when the instrument behind it is a security. They get there by different routes.
| United States | EU and Spain | |
|---|---|---|
| Supervisor | Securities and Exchange Commission (SEC) | ESMA sets EU-wide criteria; national supervisors apply them (the CNMV in Spain) |
| How a security is identified | A statutory list (stocks, bonds, notes and others). For other arrangements, the Howey test from SEC v. W.J. Howey Co. (1946): an investment of money in a common enterprise with an expectation of profits from the efforts of others | The financial instrument categories of MiFID II Annex I, applied substance over form under the ESMA guidelines |
| Position on tokenization | SEC staff statement of 28 January 2026: tokenized securities are still securities | ESMA Guideline 1: tokenised financial instruments remain financial instruments for all regulatory purposes |
| Public offer | Registration under the Securities Act of 1933, or an exemption such as Regulation D, Regulation A or Regulation S | Approved prospectus, or an exemption, including offers below EUR 12 million over 12 months since 5 June 2026 |
| Who keeps the register | The issuer or an SEC-registered transfer agent | In Spain, an ERIR for securities represented on DLT |
For an issuer in Latin America or the US looking at Europe, the practical differences are the register and the passport. Spain requires a registrar figure that the US does not have; see what an ERIR is, and compare it with the US role of a transfer agent. In exchange, a prospectus approved in one member state opens the other EU markets.
How security tokens are issued legally in the EU
A compliant issuance has two regulatory layers: disclosure and registration.
Disclosure follows the Prospectus Regulation. A public offer of securities requires a prospectus approved by a national supervisor unless an exemption applies. The usual exemptions are offers addressed only to qualified investors, offers to fewer than 150 non-qualified investors per member state, and offers below the size threshold. Since 5 June 2026 that threshold is EUR 12 million over 12 months, with a member state option to set it at EUR 5 million, under the Listing Act (Regulation (EU) 2024/2809) amending Regulation (EU) 2017/1129. Spain’s adaptation is pending, according to the CNMV. An approved prospectus travels: the issuer can extend the offer across the EU through a notification procedure, without a second approval (Articles 24 and 25).
Registration answers a different question: which record of ownership the law recognises. In Spain, securities represented on DLT must be registered by an ERIR, the entity responsible for recording and registering them, as required by Article 8 of Law 6/2023 and developed in Royal Decree 814/2023. The first ERIR, URSUS-3 Capital, A.V., was authorised in November 2024. Secondary trading on DLT infrastructures runs under the EU DLT Pilot Regime (Regulation (EU) 2022/858). For the Spanish procedure step by step, read how to issue a security token in Spain.
The useful question for an issuer is not whether a token sounds innovative. It is whether the rights it grants make it a financial instrument, because that answer fixes the budget, the calendar and the partners the project needs.
Whether your token is a security decides your calendar, your budget and your partners. Take the 2-minute issuance assessment or request a proposal.
This content is educational. It is not legal, tax or investment advice. Check the current version of each rule on EUR-Lex and the relevant national gazettes.
HokenFi is a software and infrastructure provider; it does not provide regulated services (CASP, investment firm, financial advisor or ERIR). This article is for information only and is not financial or legal advice.
Frequently asked questions
What is a security token in finance?
In finance, a security token is a share, a bond or a fund unit issued and recorded on a blockchain or another distributed ledger. The holder has the same rights as with the traditional instrument, and the same securities law applies. It has nothing to do with the authentication tokens used for two-factor login, which share the name but are IT security credentials.
What is an example of a security token?
Public examples include the European Investment Bank's EUR 100 million digital bond on Ethereum (April 2021), Siemens' EUR 60 million digital bond on Polygon under German law (February 2023) and BlackRock's BUIDL tokenized fund (March 2024). In Spain, Dianelum's EUR 5 million tokenized debt issuance (February 2025) was registered with URSUS-3 Capital as ERIR.
Does MiCA regulate security tokens?
No. Article 2(4) of Regulation (EU) 2023/1114 excludes crypto-assets that qualify as financial instruments. Security tokens fall under MiFID II, the Prospectus Regulation and national securities law. In Spain that means Law 6/2023, CNMV supervision and registration by an ERIR under Royal Decree 814/2023. ESMA's qualification guidelines, applicable since 18 May 2025, set the test.
How does the Howey test apply to security tokens?
In the United States, shares, bonds and notes are securities by statute, tokenized or not. For other arrangements, the SEC and the courts apply the Howey test: an investment of money in a common enterprise with an expectation of profits from the efforts of others. In January 2026, SEC staff confirmed that tokenized securities are still securities under federal law.
What is the difference between a security token and a utility token?
The rights attached. A security token grants the rights of a financial instrument: profit participation, repayment or a share of a pooled investment. A utility token gives access to a product or service and, if it is not a financial instrument in substance, falls under MiCA. Labels do not decide the classification; supervisors assess the actual rights case by case.
