U.S. Security Token Offering Compliance Guide | RGYS · mtl8.com
This guide outlines the U.S. federal and state framework for security token offerings (STOs), principal offering exemptions, issuer and intermediary responsibilities, token recordkeeping and trading, disclosure, resales, acquisitions, and ongoing obligations. Securities status and registration triggers depend on the specific arrangement and actual conduct. This guide is not legal, tax, or investment advice.
1. STO Basics and Regulatory Entry Point
A security token offering (STO) is an arrangement in which securities interests are issued, recorded, or transferred using blockchain or another digital ledger. A token may represent equity, debt, fund interests, or other securities rights. Using a blockchain does not displace securities-law requirements for offerings, sales, brokerage, trading, or recordkeeping. A securities offering must be registered or qualify for an available registration exemption.[1][2]
The United States does not have one general “STO license” covering every activity. An issuer must identify its offering basis; persons soliciting or executing securities transactions for others, operating a securities trading venue, or meeting the statutory definition of transfer agent may face separate registration requirements. Duties turn on each participant’s role and conduct, not just the product label.[10][13][14]
2. Regulators and Legal Framework
The SEC oversees federal securities offerings, disclosure, and market intermediaries. FINRA, as a self-regulatory organization, supervises its broker-dealer members and participates in new-member review. State securities regulators may still require state registration, an exemption filing, or notice filings. A federal exemption does not automatically remove state antifraud authority, notice filings, or fees.[2][3][4][11]
Potentially relevant authorities include the Securities Acts of 1933 and 1934, Regulations D, A, S, and Crowdfunding, and—depending on the structure—the Investment Company Act, Investment Advisers Act, and state law. SEC staff webpages and FAQs are not statutory text when presented as staff guidance; applicable statutes, rules, and transaction-specific facts control.[1][6][7][15]
3. Securities Status and Howey Analysis
Whether a digital asset is an investment contract is generally analyzed under Howey: whether there is an investment of money in a common enterprise with a reasonable expectation of profits derived from the significant managerial or entrepreneurial efforts of others. The analysis considers economic reality, offering communications, distribution, rights, and the issuer’s continuing promises—not merely the token’s technology or name.[1]
This is a fact-specific legal determination; tokens are not categorically securities or non-securities. The SEC staff framework expressly represents staff views, is not a Commission rule, and does not replace existing law or precedent. U.S. securities counsel should separately analyze the offering, secondary trading, and related services, documenting the rationale and supporting materials.[1]
4. Principal Offering and Registration-Exemption Paths
Regulation D Rule 506(b) has no federal offering cap, permits sales to an unlimited number of accredited investors and up to 35 non-accredited investors, but prohibits general solicitation. Participating non-accredited investors must meet the applicable sophistication standard and receive required disclosure. Rule 506(c) permits general solicitation, but every purchaser must be accredited and the issuer must take reasonable steps to verify that status. Rule 506 securities are generally restricted securities.[3][4]
Regulation A has a 12-month cap of $20 million for Tier 1 and $75 million for Tier 2. Regulation Crowdfunding has a $5 million aggregate cap in a 12-month period and must be conducted online through an SEC-registered broker-dealer or funding portal. Regulation S covers qualifying offshore transactions; it is not a blanket exemption from U.S. or local-country law. Select the path based on eligibility, amount, solicitation, disclosure, and resale plans.[6][7][8]
5. Issuer Eligibility and Entity Structure
The issuer should have a clear equity or debt basis, organizational documents authorizing the issuance, traceable assets and cash flows, and defined tokenholder rights. The state of incorporation does not itself determine whether a securities offering is exempt; corporate law, securities law, tax, and investor locations may each affect the structure. Regulation A has issuer-eligibility limits and is available only to companies organized in and principally doing business in the United States or Canada.[6]
If a token represents a fund interest, analyze whether the issuer is an investment company and whether an exclusion or exemption is available; providing securities investment advice to others may also raise investment-adviser registration questions. An SPV, fund manager, or separated issuing entity does not resolve these questions by label alone. U.S. counsel and tax advisers should review the issuer, fund, manager, service-provider, and foreign-parent relationships.[1][6]
6. Management, Control Persons, and Compliance Governance
The issuer should establish board oversight, authorization controls, conflict management, recordkeeping, and escalation procedures. Rule 506 issuers must assess bad-actor disqualification, and other pathways may impose similar eligibility restrictions or adverse-history review. The identity, background, and history of directors, officers, major owners, promoters, and control persons should be consistent across filings and disclosure.[3][4][6]
For a registered broker-dealer, FINRA’s application process generally calls for at least two qualified principals and a Financial Operations Professional (FinOp), with a waiver potentially available in appropriate cases. Exams, registrations, and responsibilities depend on the firm’s activities and FINRA rules. Naming a “compliance officer” does not replace written procedures, training, independent oversight, or implementation.[11]
7. Broker-Dealer Registration and FINRA Membership
Operating in the business of buying or selling securities for others, finding investors, negotiating or executing transactions, operating a securities platform, handling others’ securities or funds, or receiving compensation based on transaction size or completion are important broker-dealer registration indicators. An issuer selling its own securities is generally not automatically a broker, but placement, matching, repurchases, or effectively operating a market may change the analysis. Obtain legal advice before paying transaction-based sales compensation or beginning sales.[10]
Registration generally involves Form BD with the SEC, FINRA membership through a New Member Application (NMA), and applicable state and individual registrations. FINRA reviews the business plan, capital and finances, personnel, supervisory procedures, operations, and systems against its admission standards. Net capital depends on SEC Rule 15c3-1 and the firm’s activities, custody, and customer-asset handling; there is no single capital amount for every STO business.[10][11]
8. ATS and Secondary-Trading Arrangements
An ATS is a system for securities trading; it is not a “token license” or an automatic national-securities-exchange status. An ATS operator must register as a broker-dealer, become a FINRA member, and comply with applicable rules. Regulation ATS notice or reporting obligations also apply, with Form ATS or Form ATS-N depending on the system and securities. Before launch, define access, order handling, transaction disclosure, records, and clearing and settlement.[13][15]
An ATS listing or connection does not mean the security is registered, guarantee buyers, or remove investor-eligibility, resale, antifraud, or state-law requirements. Custody and settlement of digital-asset securities must satisfy broker-dealer financial-responsibility requirements. SEC Trading and Markets staff FAQs represent staff views, not Commission rules; recheck interpretations, systems, and rules before launch or material changes.[9][13][15]
9. Transfer Agents and Securityholder Records
Typical transfer-agent functions include recording changes in security ownership, maintaining issuer securityholder records, issuing or cancelling certificates, and distributing dividends. A transfer agent must register with its appropriate regulatory agency before performing covered functions for a qualifying security; the regulator may be the SEC or a banking agency depending on the institution. SEC registration generally uses Form TA-1, and registered agents have continuing recordkeeping and reporting obligations.[14]
Whether a service is transfer-agent activity depends on the actual service, security, and statutory definitions; not every digital ledger or token issuer automatically must register. SEC staff FAQs state that a registered transfer agent may use DLT as its master securityholder file or part of it if all other federal recordkeeping, reporting, examination, and retention requirements are met. This is not a technology-based waiver.[14][15]
10. Token Technology and Smart-Contract Controls
Technical design should accurately implement the securities terms: holder eligibility, transfer restrictions, lockups or compliance periods, voting and distribution rights, freezes and recovery, lost keys, forks or upgrades, and the relationship between on-chain records and the official securityholder register. Smart contracts can enforce allowlists or restrictions, but code does not determine securities status or make an otherwise unlawful transfer lawful.[1][9][15]
Federal securities rules do not require every STO to use one blockchain, token standard, or commercial audit certification. Apply risk-based code review, independent security testing, segregation of privileges, change approvals, disaster recovery, backups, and incident response. Ensure logs, balances, and personal data meet applicable recordkeeping and privacy requirements. A DLT-based official register must still satisfy applicable transfer-agent rules.[14][15]
11. Disclosure, Investor Eligibility, and Antifraud
An exempt offering is not exempt from antifraud obligations. Offering materials, websites, presentations, white papers, on-chain voting information, and sales communications must not make material misstatements or omit facts needed to make statements not misleading. Disclosure should address the issuer and control persons, use of proceeds, rights and risks, financial position, valuation, related-party transactions, technology and custody risks, transfer restrictions, fees, and conflicts.[1][6][7][18]
Rule 506(c) requires reasonable steps to verify every purchaser’s accredited-investor status. Common individual tests include annual income above $200,000 in each of the prior two years (or above $300,000 with a spouse or spousal equivalent, with a reasonable expectation for the current year), or net worth above $1 million excluding the primary residence and specified secured debt; certain financial credentials also qualify. Rule 506(b) permits up to 35 eligible non-accredited investors, subject to added disclosure and financial-information requirements.[3][4][18]
12. Application and Offering Execution
A practical sequence is to complete business and securities classification, issuer eligibility, participant-role, and exemption analysis before preparing organizational and security terms, offering materials, financial information, risk disclosure, investor workflows, technical controls, and state-filing checklists. Regulation A requires an EDGAR-filed Form 1-A offering statement and qualification; Regulation Crowdfunding requires its disclosures and a qualified intermediary; Regulation D Form D is due within 15 days after first sale.[3][5][6][7]
If broker-dealer or ATS registration is also needed, run a separate application workstream for the business plan, finances and capital, key personnel, supervisory procedures, systems, and custody and settlement. FINRA requires applicants to meet its admission standards and to pre-fund fees, and may request additional material. Regulatory comments, structural complexity, audit timing, and vendor readiness affect the schedule; there is no single guaranteed overall approval period for every STO.[11][13]
13. Fees, Budget, and Banking Arrangements
Regulatory charges are only part of an STO budget. FINRA’s published new-member NMA application fee is tiered by applicant size and ranges from $7,500 to $55,000; an applicant intending to clear and carry has an additional $5,000 surcharge. The SEC charges no fee for Form D itself. State notices, individual registrations and exams, renewals, and other filings are additional and may change.[5][12]
U.S. counsel, audit and financial reporting, offering platforms, investor verification, custody, transfer records, smart-contract testing, insurance, banking, and annual compliance are project-specific costs; there is no official total cost for all STOs. Banks separately review customers, beneficial owners, source of funds, business models, and digital-asset risks. An exemption or registration does not guarantee an account, custody, or settlement services.[7][11][12][16]
14. BSA/AML, Custody, and Ongoing Reporting
BSA/AML duties depend on the regulated activity and the identity of the entity. A registered broker-dealer must maintain applicable written AML, customer-identification, and ongoing-monitoring controls. If an entity separately engages in virtual-currency exchange, transmission, or another MSB activity, federal FinCEN obligations must be assessed under the rules and facts. Issuing a security does not, by itself, automatically make every issuer an MSB or subject every issuer to an identical SAR or AML program.[16][17]
Ongoing reporting depends on the offering path and the entity’s role. Regulation A Tier 2 issuers generally file annual, semiannual, and current reports; Regulation D issuers address Form D notices and applicable state filings; Regulation Crowdfunding issuers have required offering disclosures and post-offering reporting. Registered intermediaries, ATSs, and transfer agents have separate recordkeeping, reporting, financial-responsibility, and examination requirements.[3][5][6][7][13][14]
15. Resale Restrictions, Token Transfers, and M&A
Exempt securities are commonly subject to resale conditions. Under Rule 144, a typical holding period for restricted securities is at least six months if the issuer is subject to Exchange Act reporting, or at least one year if it is not. Affiliate and control-person resales may also require current public information, volume and manner-of-sale limits, and Form 144 notice. Regulation Crowdfunding has a separate general one-year resale restriction, while Regulation S has category-specific distribution compliance requirements; these are not one universal “lockup.”[7][8][9]
A token can technically block unauthorized wallet transfers, but a whitelist does not by itself satisfy a securities resale exemption. Before acquiring or selling an issuer, ATS, broker-dealer, fund manager, or custodian, review control changes, FINRA Rule 1017 membership applications, contractual consents, regulatory filings, customer assets, unsettled trades, data and code ownership, and historical compliance. Transaction structure affects whether approval or advance notice is required.[9][11][13][14]
16. State Law, Cross-Border Offers, and Other Boundaries
For U.S. investors, verify federal offering exemptions and state Blue Sky filings separately. Rule 506 provides federal preemption from state registration or qualification, but states may still require notice filings and fees. Regulation A Tier 1 generally requires consideration of state qualification; Tier 2 has different treatment for state pre-offer registration or qualification. Regulation S requires an offshore transaction and other conditions, with resale restrictions depending on the security category; issuers must still assess investor-location laws and U.S. antifraud rules.[3][4][6][8]
Securities offering registration or exemptions, broker-dealer/ATS/transfer-agent registration, FinCEN MSB registration, and state money-transmitter licenses are distinct regimes. Each turns on activities, entity status, and jurisdiction; none substitutes for another. Receiving, exchanging, holding, or transmitting fiat or virtual currency may require separate state or federal analysis. Funds, advisers, and foreign issuers should also separately assess investment-company, adviser, tax, sanctions, and local offering rules. Check current primary law for regulatory developments.[1][10][14][17]