Security Token Regulations Demystified (2026 Update)

A quick history lesson: from ICO to STO

Back in 2017, blockchain fundraising looked like the Wild West. Projects with a whitepaper and a Telegram group raised tens of millions of dollars in a single week — no product, no team, sometimes not even a real idea. Predictably, most of it went to zero.

The problem wasn't blockchain. It was that most of those "utility tokens" were, legally speaking, securities wearing a costume. Run them through the Howey Test — the 1946 US Supreme Court standard that asks whether someone invested money in a common enterprise expecting profit from someone else's effort — and the disguise falls apart fast.

The industry's answer was refreshingly unoriginal: stop pretending, and issue the tokens as securities. That's a Security Token Offering (STO) — real ownership, real shareholder rights, on a blockchain rail. Same legal substance as a share certificate, minus the paperwork and the geography problem. Dividends, governance votes, even board elections can run through smart contracts instead of a registrar's spreadsheet.

None of that removes the hard part: the law.

The one rule that hasn't changed: double compliance

Founders planning an STO usually ask the wrong first question — "which jurisdiction is friendliest?" — before asking the one that actually matters: where are my investors?

A company can incorporate in the Cayman Islands, the BVI, or Wyoming and still owe compliance to the US SEC, EU regulators, or Singapore's MAS the moment it solicits investors there. Jurisdiction of issuance and jurisdiction of the investor are two separate legal problems, and you need to solve both. This is still, in 2026, the single most misunderstood part of structuring an STO.

STO regulations in the United States

The SEC is famously strict, but its exemption menu is generous — and several of the dollar caps have grown considerably since 2020.

Regulation Crowdfunding (Reg CF) — the ceiling was raised from $1.07 million to $5 million per 12-month period, following the SEC's 2021 amendments. Non-accredited investors can participate, and tokens are locked from secondary trading for 12 months.

Regulation D — the workhorse exemption for private placements, still in three flavours:

• Rule 506(b): unlimited raise, no general solicitation, up to 35 non-accredited "sophisticated" investors alongside accredited ones.
• Rule 506(c): same unlimited raise, general solicitation allowed, but accredited investors only.
• Rule 504: the SEC doubled this cap too — from $5 million to $10 million per year, effective March 2021 — with general solicitation permitted under certain conditions.

All Reg D tokens carry resale restrictions.

Regulation A+ — the "mini-IPO" exemption, for startups with two years of audited financials. Tier 1 stays capped at $20 million with no investor accreditation requirement. Tier 2's ceiling was raised from $50 million to $75 million in 2021, with a cap on how much non-accredited investors can put in. Reg A+ tokens, unlike the others above, trade freely on secondary markets.

Regulation S — the exemption for raising capital outside the US, with no dollar cap and no accreditation requirement. Any company — American or not — can file for a Reg S exemption, and it's worth doing even if you never plan to touch a US investor: the SEC claims jurisdiction over any offering where even one US person ends up holding tokens, so Reg S functions as cheap insurance.

Setting up in Delaware remains the default for founders planning a US-facing raise — see our Delaware C-Corp package for what's included.

What could change: the CLARITY Act

Everything above describes the rules as they stand. There's a bill in Congress that could redraw part of the map.

The Digital Asset Market CLARITY Act would build the US's first real market-structure framework for crypto — splitting jurisdiction so that tokens tied to a sufficiently decentralised network get regulated as "digital commodities" by the CFTC, while everything still closely tied to an issuer's efforts stays with the SEC as a security. It's the question this whole article keeps circling back to — is this a security? — getting an actual statutory answer instead of a facts-and-circumstances test decided case by case.

Where it stands as of early August 2026: the House passed it in July 2025 (294–134, with over 70 Democrats crossing the aisle), and the Senate Banking Committee advanced its own version 15–9 in May 2026. But it has no floor vote scheduled, and Senate Majority Leader John Thune has said he doesn't expect one before the chamber's August recess. Prediction markets had this near-certain a few months ago — Polymarket priced 2026 passage at 82% at one point — and by July 30 that had fallen to 28%. If it doesn't move before recess, the next realistic window is mid-September.

Why founders should care regardless of the outcome: CLARITY wouldn't touch the exemptions above — Reg CF, Reg D, Reg A+, and Reg S would still govern how you raise the money in the first place. What it would change is what happens after your token is live and your network matures. A token that starts life as a security under one of those exemptions could, in principle, graduate into CFTC-regulated "digital commodity" status once the network is decentralised enough — something today's law has no clean mechanism for. That's a meaningfully lighter compliance load on the other side of a successful raise. Worth watching, not worth planning around until it's actually signed.

STO regulations in offshore jurisdictions

The pitch is obvious: no securities law to comply with, no filing requirements, no local tax. The catch hasn't changed either — a BVI or Cayman entity soliciting a US, EU, or Singaporean investor still owes compliance to that investor's regulator. The offshore wrapper only removes obligations where the money isn't coming from.

In practice, most large STOs use the offshore entity as a temporary raising vehicle, then move funds into a foundation in a more established jurisdiction once the round closes. Very few projects settle there long-term — and that's still true in 2026.

BVI and Cayman remain the two most-used token-issuance wrappers we set up — see BVI Limited Company and Cayman Islands ELC.

STO regulations in the EU — now genuinely simpler

This is the section that most needed an update.

The old regime let each EU member state set its own prospectus-exemption threshold, anywhere from €1 million to €8 million — which is why Malta, Estonia, and Lithuania became the go-to STO jurisdictions; their thresholds happened to be the most generous.

That patchwork is gone. Under the EU Listing Act (Regulation (EU) 2024/2809), which enters into application on 5 June 2026, the Prospectus Regulation now sets a single €12 million exemption threshold across the bloc (member states may instead opt for a lower €5 million threshold), and the old €1 million minimum floor has been scrapped entirely — the rules now apply from the first euro raised. Once cleared, an offering can solicit investors across all 27 member states under one regulatory passport.

One more thing worth clarifying, because it trips up a lot of founders: MiCA does not regulate security tokens. The EU's Markets in Crypto-Assets Regulation, which came into force in 2024, deliberately excludes any crypto-asset that already qualifies as a financial instrument under MiFID II — and a security token, by definition, is exactly that. If your token represents equity, debt, or a fund interest, you're dealing with MiFID II and the Prospectus Regulation, not MiCA. The two regimes are mutually exclusive; a token is never regulated under both.

Malta remains our most-requested EU entity for this use case — see the Malta Limited Company package.

STO regulations in Asia

Singapore remains the region's most STO-friendly jurisdiction, and it just updated its rulebook. In November 2025, the Monetary Authority of Singapore replaced its 2020 Guide on Digital Token Offerings with a new Guide on the Tokenisation of Capital Markets Products. The underlying approach hasn't changed — MAS is technology-neutral, so a tokenised share is regulated exactly like a paper share under the Securities and Futures Act — but the new guide reflects five years of market maturity and gives clearer answers on prospectus exemptions and intermediary obligations. As before, the constraint isn't Singapore's rules; it's Singapore's size. Solicit a US or EU investor and you're back to complying with their regulator, not just MAS.

Our Singapore Limited Company package covers formation end to end.

China still bans STOs outright, and that hasn't moved an inch since 2020.

South Korea, on the other hand, just did something significant: in January 2026, its National Assembly passed amendments to the Capital Markets Act and the Electronic Securities Act that formally legalise tokenised securities — covering equity, debt, and investment contracts on distributed ledgers. Implementation sits with the Financial Services Commission, and the framework takes effect in January 2027 after a one-year preparation window. Worth watching, not yet actionable.

Getting an STO off the ground

The mechanics of tokenised securities haven't changed since 2020 — real ownership, programmable rights, fewer borders. What has changed is the map: US dollar caps roughly doubled, the EU traded twenty-seven different thresholds for one, Singapore modernised its guidance, South Korea went from bystander to lawmaker, and Washington is (slowly) working on a rulebook that could reshape what happens after launch.

None of this replaces legal advice specific to your raise and your investor base. If you're structuring an STO, talk to us before you pick a jurisdiction — not after.

Book a free consultation with the Otonomos team to talk through the right structure for your STO.