The definition that matters
A security token offering, usually abbreviated to STO, is the offering of a tokenized instrument that, because of its legal characteristics, qualifies as a financial instrument — a security — under the applicable framework. The qualification comes from the rights attached to the instrument and from the legal structure that creates them, not from the fact that it is recorded on a distributed ledger. Distributed-ledger technology is a way of recording and administering an instrument; it is not what makes an interest a security.
It follows that security token is not a synonym for tokenized asset or RWA token. Not every tokenized real-world asset is a security token offering. Tokenized real assets can embody very different legal structures — including civil-law co-ownership rights in a physical object — and whether any given instrument qualifies as a financial instrument depends on the concrete rights and the structure, not on the tokenization.
This is why European regulators describe tokenization in functional terms rather than as a new asset class. ESMA’s framing in the context of the EU DLT Pilot Regime is the digital representation of financial instruments on DLT, or the issuance of traditional asset classes in tokenized form.1 The Bank for International Settlements and the OECD use the same construction: a digital representation of a traditional asset or of a claim on it.23 Nothing in that description removes the instrument from securities law.
The rights and the legal structure decide, not the vocabulary or the technology. Where the instrument meets the definition of a transferable security, the offering is a securities offering; the ledger is the record, not the exemption.
STO, ICO and utility token: why the distinction is legal, not technical
The initial coin offerings of the previous cycle were frequently presented as sales of access or usage rights, positioned outside the perimeter of securities regulation. Some were later analysed as having sold what were, in substance, investment instruments. The vocabulary did not decide the question; the rights and the legal structure did. The converse also holds: not every token carrying an economic feature is automatically a security.
European law addresses the boundary by scope rather than by label. Regulation (EU) 2023/1114 on markets in crypto-assets, known as MiCA, provides in Article 2(4) that it does not apply to crypto-assets that qualify as financial instruments, and it also leaves outside its scope other categories already governed by existing legislation.45 MiCA is therefore not the general regulation of all tokenization. Where an instrument qualifies as a financial instrument, the traditional framework applies — prospectus rules, MiFID II conduct and distribution rules, market-abuse rules. Where it does not, MiCA or another regime may be relevant. The qualification has to be made on the concrete characteristics of the instrument and under the applicable law.
ESMA has published Guidelines on the conditions and criteria for the qualification of crypto-assets as financial instruments, ref. ESMA75453128700-1323, in its final report of 17 December 2024.8 The approach set out there is deliberately case-by-case, technology-neutral and expressly not one-size-fits-all: the same technical form can accompany instruments with entirely different legal natures, so the analysis follows the substance of the rights.
For an investor, the useful question about any tokenized offering is therefore documentary: how has the instrument been legally characterised under the applicable framework, and on which rights and characteristics does that analysis rest? A serious file explains the characterisation in writing and shows the legal reasoning behind it.
Which characteristics point towards a financial instrument
Article 4(1)(44) of MiFID II defines transferable securities as classes of securities which are negotiable on the capital market, and lists categories including shares and other securities equivalent to shares, bonds and other forms of securitized debt, and any other securities giving the right to acquire or sell such securities.5 The starting point of the analysis is therefore the combination of two elements:
- Negotiability on the capital market, as required by the definition itself.
- Membership of one of the listed categories: shares and equivalents; bonds and other forms of securitized debt; other securities giving a right to acquire or sell such securities.
Features such as standardisation into fungible units of a single issue, or contractual transferability, can be descriptively useful when reading a structure, but they are not autonomous legal tests and should not be treated as such.
The analysis applies MiFID II together with the national law transposing it and the specific circumstances of the instrument, which is why characterisation is a structuring question to be settled before an offering opens rather than afterwards. The ESMA Guidelines are intended to support a more convergent approach across the Union.8
How an STO is offered lawfully in the European Union
Where an instrument qualifies as a transferable security, Regulation (EU) 2017/1129 requires a prospectus approved by the competent authority for an offer of securities to the public or an admission to trading on a regulated market, subject to the exemptions it provides.6 An offering conducted without an approved prospectus must fall within the conditions of the relevant exemption and remain within them throughout, which shapes how it may be communicated and to whom it may be addressed.
It helps to keep three distinct levels apart rather than treating them as alternatives on the same plane.
- The nature of the instrument or product. What has been created and how it is legally characterised — equity, debt or securitized debt, a fund interest, a contractual participation, or an interest of another nature — under the applicable framework.
- The prospectus and offering regime. Whether an approved prospectus is required, or whether the offering relies on an available exemption and continues to satisfy its conditions.
- The distribution and intermediation rules. Who may market or place the instrument, to whom, and under which authorization and conduct obligations.
A securitisation vehicle or a fund structure sits at the first level. It does not replace the analysis at the second or third: the prospectus position and the distribution rules still have to be examined on their own terms.
Each route implies a different distribution model. An exempt qualified-investor offering cannot be advertised as though it were a public one; eligibility checks, onboarding and record-keeping are part of the structure rather than administrative friction added to it. Where an issue is placed or advised on by a regulated firm, MiFID II conduct, suitability and product-governance obligations apply to that firm.5
Reading an STO the way a professional reads it
A tokenized offering can be assessed with the same discipline as any private-market instrument. The sequence below reflects how these files are normally reviewed.
- Identify the instrument. Equity, debt, note, fund interest or contractual participation — and the issuing entity, its jurisdiction and its regulatory status.
- Identify the characterisation and the regime. How the instrument has been legally characterised under the applicable framework and on what basis; then the prospectus position, any exemption relied on, and the applicable distribution rules.
- Read the rights. Income, ranking, voting, information rights, and what happens on default, insolvency or wind-down.
- Locate the asset. What the vehicle actually holds, how it was valued, by whom, and how often that valuation is refreshed.
- Locate the record. The authoritative register, the role of the ledger, and the continuity arrangements.
- Understand the exit. Transfer restrictions, eligible buyers, redemption terms if any, and the realistic route and horizon to liquidity.
- Understand the costs. Structuring, administration, custody, audit and any performance-linked fees, and how they affect net outcomes.
Where any of these cannot be answered from the documents, the answer is not the technology. It is a gap in the file.
Frequently asked questions
- What is a security token offering (STO)?
- It is the offering of a tokenized instrument that qualifies as a financial instrument — for example shares, bonds or other securitized debt, or a fund interest — under the applicable framework. The rights of the holder come from the legal documents and the structure, not from the token. Whether a given tokenized instrument is a security depends on its specific characteristics; tokenization alone does not determine the classification.
- How does an STO differ from an ICO?
- The difference is legal rather than technical. An STO concerns an instrument characterised as a financial instrument, so securities law applies, including prospectus, conduct and market-abuse rules where relevant. Initial coin offerings were typically presented as sales of non-financial crypto-assets, though the substance of the rights decided the question in each case. Under Article 2(4) of MiCA, the Regulation does not apply to crypto-assets that qualify as financial instruments, so the analysis of the specific instrument comes first.
- Are security token offerings legal in Europe?
- There is no single answer that covers every case: lawfulness depends on the specific instrument and on compliance with the rules applicable to it. Where the instrument is a transferable security, that normally involves either an approved prospectus or a valid exemption under the Prospectus Regulation, the product rules of any authorized or supervised structure used, and the conduct and authorization obligations of any regulated firm involved in the placement.
- Does an STO require a prospectus?
- Not necessarily. Where the instrument is a transferable security, the Prospectus Regulation requires an approved prospectus for an offer of securities to the public or an admission to trading on a regulated market, subject to the exemptions it contains. An offering relying on an exemption must fall within its conditions and remain within them, which restricts how and to whom it may be offered.
- Does the token prove legal ownership of the security?
- Only where the applicable law and the governing documents provide for it. In many structures the authoritative record remains a shareholder register, an issue account, a custody account or a note register, and the token mirrors it. The documentation should state the hierarchy of records explicitly.
- Can anyone invest in a security token offering?
- Frequently not. Where an offering relies on a qualified-investor exemption, participation is limited to investors meeting the applicable eligibility criteria, and transfers may be restricted by lock-ups, consent rights, jurisdictional limits or technical whitelisting.
- Does tokenization make a security liquid?
- No. It can make transfers and administration more efficient, but liquidity requires eligible buyers, price discovery, settlement and market depth. The redemption terms and market characteristics of the underlying instrument are unchanged.
Editorial conclusion
The interest of a security token offering is not that it is digital. It is that a familiar instrument can be issued, recorded and administered with more precision and a clearer audit trail. Everything that determined the quality of the investment before tokenization — the asset, the legal claim, the governance, the valuation and the exit — determines it still. Read the offering as a securities file, and the technology takes its proper place: useful, subordinate, and no substitute for analysis.
This guide is educational and general in nature. It describes how security token offerings are commonly structured and regulated in the European Union and does not constitute legal, tax or investment advice, a recommendation, or an offer or solicitation to subscribe for any instrument. Regulatory treatment depends on the specific instrument, the issuer and the jurisdiction, and can change. Any investment decision should be based on the governing legal documents and appropriate professional advice.