Understanding Security Tokens
Not all tokens are created equal. While cryptocurrencies like Bitcoin and Ethereum are considered commodities by most regulators, security tokens represent investment contracts subject to securities laws. Understanding this distinction is critical—getting it wrong can result in millions in fines, criminal prosecution, and the shutdown of your project.
⚠️ Critical: The Howey Test
In the United States, the Howey Test (established by the Supreme Court in 1946) determines whether an asset is a security. An investment is a security if it involves:
- An investment of money
- In a common enterprise
- With an expectation of profits
- Derived from the efforts of others
Most tokenized real-world assets meet all four criteria and are therefore securities. This triggers registration requirements with the SEC unless an exemption applies.
Security Token vs. Utility Token vs. Commodity
| Type | Purpose | Regulation | Examples |
|---|---|---|---|
| Security Token | Investment contract, represents ownership or debt | SEC registration required (or exemption) | Tokenized real estate, equity tokens, debt tokens |
| Utility Token | Access to a product or service | May avoid securities laws if truly functional | Filecoin (storage), BAT (browser rewards) |
| Commodity | Store of value, medium of exchange | CFTC oversight (commodities laws) | Bitcoin, Ethereum (per SEC/CFTC statements) |
The ERC-1400 Security Token Standard
While ERC-20 enabled the ICO boom of 2017, it lacks critical features needed for regulatory compliance. ERC-1400 was developed by Polymath in 2018 to fill this gap, providing a standardized framework for compliant security tokens on Ethereum.
Core Features of ERC-1400
1. Transfer Restrictions
Unlike ERC-20 tokens (which anyone can transfer to anyone), ERC-1400 allows issuers to enforce rules:
- KYC/AML Requirements: Only whitelisted addresses can receive tokens
- Jurisdiction Restrictions: Block transfers to sanctioned countries
- Lock-up Periods: Prevent transfers for 6-12 months (Reg D requirement)
- Maximum Ownership: Limit any single investor to 5% of supply
- Time-based Restrictions: Different rules for different investor classes
// ERC-1400 Transfer Validation
function canTransfer(address from, address to, uint256 amount)
public view returns (bool, bytes32) {
// Check if recipient is KYC verified
if (!kycProvider.isVerified(to)) {
return (false, "RECIPIENT_NOT_KYC");
}
// Check if lock-up period has passed
if (block.timestamp < lockupEndTime[from]) {
return (false, "TOKENS_LOCKED");
}
// Check if recipient's jurisdiction is allowed
if (kycProvider.getJurisdiction(to) == "US" && !accredited[to]) {
return (false, "US_INVESTOR_NOT_ACCREDITED");
}
// Check if transfer would exceed max ownership
uint256 newBalance = balanceOf[to] + amount;
if (newBalance > (totalSupply * maxOwnershipPercent / 100)) {
return (false, "EXCEEDS_MAX_OWNERSHIP");
}
return (true, "TRANSFER_ALLOWED");
}2. Document Management
Securities regulations require extensive disclosure documents (prospectus, offering circular, financial statements). ERC-1400 enables on-chain document storage:
- Document Hashes: IPFS or Arweave hashes stored on-chain for immutability
- Document Names: "Offering_Circular_2025.pdf", "Audited_Financials_Q4_2024.pdf"
- Document URIs: Links to full documents for investor review
- Versioning: Track document updates and ensure investors see latest version
3. Partitions (Token Tranches)
Complex offerings often have multiple investor classes with different rights. ERC-1400 supports partitions:
- Class A Common: Voting rights, no dividend preference
- Class B Preferred: 8% dividend preference, no voting rights
- Class C Restricted: Subject to 1-year lock-up, discounted price
Each partition has its own balance, transfer rules, and metadata—all managed within a single contract.
4. Forced Transfers
Regulators or courts may require the ability to seize or transfer tokens in cases of:
- Legal Judgments: Court order to transfer assets in divorce or bankruptcy
- Regulatory Actions: SEC or FINRA requiring token freeze or transfer
- Investor Death: Transfer to estate executor per legal documentation
- Fraud/Crime: Seizure of tokens linked to illicit activity
⚠️ Controversy: Centralization vs. Compliance
The ability to force transfers is controversial in the crypto community. It introduces centralization and trust assumptions (who controls the admin key?). However, it's often legally required for securities compliance. The WIA-FIN-008 standard recommends multi-signature admin keys with transparency logs.
SEC Regulatory Frameworks
In the United States, security tokens must either register with the SEC (a $1M+, 18-month process) or qualify for an exemption. The main exemptions used in tokenization are:
Regulation D (Reg D)
The most common exemption for private placements. Allows companies to raise unlimited capital from accredited investors without SEC registration.
Reg D 506(b)
- Investor Requirements: Unlimited accredited investors + up to 35 sophisticated non-accredited
- Offering Size: Unlimited
- General Solicitation: Prohibited (no public advertising)
- Disclosure: Minimal (Form D within 15 days of first sale)
- Lock-up Period: 6-12 months resale restriction
Reg D 506(c)
- Investor Requirements: Accredited investors only (must verify accreditation)
- Offering Size: Unlimited
- General Solicitation: Allowed (can advertise publicly)
- Disclosure: Form D + accreditation verification
- Lock-up Period: 6-12 months resale restriction
📊 Example: Reg D 506(c) STO
Scenario: Tokenizing a $50M commercial real estate portfolio
- Structure: Create Delaware LLC to hold properties
- Token Supply: 50,000,000 tokens at $1 each
- Minimum Investment: $10,000 (10,000 tokens)
- Accreditation: Require $1M net worth or $200K income proof
- Marketing: Can advertise on social media, crypto news sites
- Lock-up: 6-month transfer restriction
- Filing: File Form D with SEC within 15 days of first sale
Result: Raise $50M from 500 accredited investors globally in 30 days.
Regulation A+ (Reg A+)
Often called a "mini-IPO," Reg A+ allows companies to raise up to $75M from both accredited and non-accredited investors through a public offering.
Tier 1 ($20M max)
- Offering Circular: Required, but simpler than full S-1
- State Registration: Must comply with state blue sky laws
- Financial Reports: Audited financials required
- Ongoing Reporting: Annual and semi-annual reports
Tier 2 ($75M max)
- Offering Circular: Reviewed and qualified by SEC
- State Registration: Preempted (no state filings needed)
- Investment Limits: Non-accredited investors limited to 10% of income or net worth
- Ongoing Reporting: Quarterly, semi-annual, and annual reports (similar to public companies)
Advantage: Tokens are immediately tradeable (no lock-up period) and can be marketed to the general public.
Disadvantage: Expensive ($200K-$500K legal/compliance costs) and time-consuming (6-12 months).
Regulation S (Reg S)
Exempts securities offered and sold outside the United States from SEC registration. Popular for global offerings.
- Requirements: Offers and sales occur outside the US
- Investors: Non-US persons only
- Restrictions: Tokens cannot be resold to US investors for 6-12 months
- Disclosure: Minimal US disclosure requirements
Common Strategy: Combine Reg S (for international investors) with Reg D (for US accredited investors) in a dual offering.
Regulation Crowdfunding (Reg CF)
Allows non-accredited investors to participate in offerings up to $5M via SEC-registered crowdfunding platforms.
- Offering Size: $5M maximum per 12-month period
- Investment Limits: Based on investor's income/net worth (as low as $2,200/year)
- Platforms: Must use SEC-registered intermediaries (StartEngine, Republic, Wefunder)
- Disclosure: Form C, financial statements (CPA-reviewed or audited depending on size)
- Lock-up: 1-year resale restriction
Best for: Retail-focused offerings, community-driven projects, lower capital raises.
Know Your Customer (KYC) & Anti-Money Laundering (AML)
Regardless of the regulatory exemption used, all security token offerings must implement robust KYC/AML procedures to comply with the Bank Secrecy Act and USA PATRIOT Act.
KYC Requirements
Individual Investors
- Government ID: Passport, driver's license, or national ID card
- Proof of Address: Utility bill, bank statement (within 3 months)
- Selfie Verification: Liveness check to prevent fake IDs
- Tax Identification: SSN (US), NIN (UK), or equivalent
Institutional Investors
- Corporate Documents: Articles of incorporation, bylaws
- Beneficial Ownership: Identify individuals with 25%+ ownership
- Business License: Valid operating license in jurisdiction
- Financial Statements: Audited financials (for large investments)
AML Screening
Anti-money laundering checks verify investors are not:
- Politically Exposed Persons (PEPs): Government officials, family members
- Sanctioned Individuals: OFAC, UN, EU sanctions lists
- Criminal Activity: Watchlists for terrorism, fraud, drug trafficking
- High-Risk Jurisdictions: Countries with weak AML laws (e.g., North Korea, Iran)
// KYC/AML Verification Flow (WIA-FIN-008)
{
"@context": "https://wiastandards.com/asset-tokenization/v1",
"@type": "WIA-FIN-008/KYCVerification",
"investorId": "INV-2025-00123",
"verificationType": "INDIVIDUAL",
"documents": [
{
"type": "PASSPORT",
"documentNumber": "P12345678",
"country": "USA",
"expiryDate": "2030-06-15",
"verified": true,
"verifiedBy": "onfido",
"verifiedAt": "2025-01-15T10:30:00Z"
},
{
"type": "PROOF_OF_ADDRESS",
"documentType": "UTILITY_BILL",
"issueDate": "2024-12-20",
"verified": true
}
],
"amlScreening": {
"pepCheck": {
"status": "CLEAR",
"checkedAt": "2025-01-15T10:32:00Z"
},
"sanctionsCheck": {
"status": "CLEAR",
"listsChecked": ["OFAC", "UN", "EU"],
"checkedAt": "2025-01-15T10:32:00Z"
},
"adverseMediaCheck": {
"status": "CLEAR",
"sources": ["LexisNexis", "Dow Jones"],
"checkedAt": "2025-01-15T10:33:00Z"
}
},
"riskScore": 15,
"riskLevel": "LOW",
"approvalStatus": "APPROVED",
"approvedBy": "compliance-officer-001",
"approvedAt": "2025-01-15T11:00:00Z"
}Top KYC/AML Providers
| Provider | Strengths | Pricing | Integration |
|---|---|---|---|
| Onfido | Best-in-class ID verification, 195+ countries | $1-3 per check | REST API, SDK |
| Jumio | Real-time verification, liveness detection | $1-4 per check | REST API, SDK |
| Sumsub | Crypto-focused, AML screening included | $0.50-2 per check | REST API, webhook |
| Chainalysis | Blockchain forensics, transaction monitoring | Enterprise pricing | API, dashboard |
Investor Accreditation
For Reg D 506(c) offerings, issuers must take reasonable steps to verify that investors are accredited. The SEC defines an accredited investor as:
Individual Accreditation Criteria (any one)
- Income: $200K individual income (or $300K joint) in each of the last 2 years with expectation of same this year
- Net Worth: $1M+ net worth (excluding primary residence)
- Professional Certifications: Series 7, 65, or 82 license holder
- Knowledgeable Employee: Employee of the issuer with investment expertise
Entity Accreditation Criteria
- Assets: Entity with $5M+ in assets
- Insider-Owned: Entity owned entirely by accredited investors
- Institutional: Banks, insurance companies, RIAs, pension funds
Verification Methods
Income Verification
- IRS Form W-2 for the last 2 years
- IRS Form 1040 with supporting schedules
- Credit report (for income/employment verification)
- Written confirmation from CPA, attorney, or registered broker-dealer
Net Worth Verification
- Bank statements showing account balances
- Brokerage statements for investment accounts
- Appraisal reports for real estate (excluding primary residence)
- Business valuations for privately-held companies
- Consumer credit report showing assets and liabilities
💡 Automated Accreditation Verification
Platforms like VerifyInvestor, Parallel Markets, and North Capital provide automated accreditation verification via bank account linking (Plaid), income verification APIs, and third-party letters. Cost: $25-100 per verification.
Transfer Restrictions & Lock-up Periods
Securities sold under Reg D are restricted securities and cannot be freely resold. The typical lock-up period is:
- Reg D 506(b/c): 6-12 months (Rule 144 holding period)
- Reg S: 6 months for issuers with SEC reporting, 12 months for non-reporting
- Reg CF: 12 months
- Reg A+: None (freely tradeable immediately)
Rule 144 Resale Conditions
After the holding period, restricted securities can be resold under Rule 144 if:
- Holding Period: 6 months for SEC-reporting companies, 12 months for non-reporting
- Current Information: Issuer has filed all required SEC reports
- Volume Limits: Affiliates limited to 1% of outstanding shares per 3 months
- Ordinary Brokerage: Sales through normal broker transactions (no solicitation)
- Notice Filing: Form 144 filed with SEC if selling 5,000+ shares or $50K+ value
ERC-3643 (T-REX): The European Alternative
While ERC-1400 dominates in the US, ERC-3643 (T-REX) is the preferred standard in Europe, designed specifically for regulatory compliance under EU regulations (MiFID II, GDPR).
Key Differences from ERC-1400
- Identity Registry: On-chain identity verification (ONCHAINID) with encrypted personal data
- Modular Compliance: Plug-and-play compliance modules for different jurisdictions
- GDPR Compliance: Right to be forgotten, data minimization, consent management
- Multi-Jurisdictional: Different rules for different investor countries
🌍 WIA-FIN-008 Supports Both Standards
The WIA-FIN-008 standard is agnostic to the underlying token implementation. Our data format and API specifications support both ERC-1400 (US-focused) and ERC-3643 (EU-focused), allowing issuers to deploy on the standard that best fits their regulatory environment.
Common Compliance Pitfalls
1. Treating Accredited Investor Self-Certification as Sufficient
Mistake: Accepting an investor's checkbox saying "I am accredited" without verification.
Consequence: If the investor is not actually accredited, the entire offering loses Reg D protection and becomes an illegal unregistered offering.
Solution: For 506(c), always verify accreditation through documentation or third-party services.
2. Allowing General Solicitation in Reg D 506(b)
Mistake: Posting about the offering on social media or advertising publicly when using 506(b).
Consequence: Offering loses exemption, becomes unregistered public offering.
Solution: Use 506(c) if you want to advertise publicly, or limit 506(b) to pre-existing relationships.
3. Inadequate Transfer Restrictions
Mistake: Allowing tokens to trade freely before the lock-up period expires.
Consequence: Violates Rule 144, creates secondary liability for issuer.
Solution: Implement smart contract transfer restrictions that enforce lock-up periods programmatically.
4. Missing Form D Filings
Mistake: Forgetting to file Form D with the SEC within 15 days of first sale.
Consequence: Late filings can result in loss of exemption in some states (blue sky laws).
Solution: Set calendar reminders, use legal counsel to ensure timely filings.
Building a Compliant Token
Putting it all together, a compliant security token requires:
- Smart Contract: ERC-1400 or ERC-3643 with transfer restrictions, document management, forced transfer capabilities
- KYC/AML Integration: Whitelist-only transfers verified through Onfido, Jumio, or Sumsub
- Accreditation Verification: For Reg D 506(c), verify through VerifyInvestor or manual document review
- Legal Documentation: Offering documents (PPM, subscription agreement), filed Form D
- Custody Solution: Institutional-grade key management (Fireblocks, BitGo, Anchorage)
- Trading Platform: ATS or security token exchange for secondary market liquidity
The WIA-FIN-008 standard provides a comprehensive framework for integrating all these components into a cohesive, compliant tokenization platform.
What's Next
In Chapter 3, we'll explore the WIA-FIN-008 standard in detail—its four-phase architecture, certification levels, and how it provides a complete roadmap from basic data structures to production-ready asset tokenization systems.