Security Token vs Utility Token: Which Do You Need?

Neither, as the question is usually posed. Both regimes that matter to a token issuer have moved off that binary, and what replaced it is narrower and more uncomfortable: what did you promise, to whom, and in which transaction.

Howey tests a transaction, not an object

The 1946 case involved orange groves in Florida, sold as plots alongside a service contract to cultivate them. Four elements: an investment of money, in a common enterprise, with an expectation of profit, derived from the managerial efforts of others. The land was not a security. The arrangement around it was.

That distinction survived into crypto intact, and gets lost in most writing on token classification.

The SEC made it explicit on 17 March 2026, in a Commission-level interpretive release joined by the CFTC. It sets out five categories: digital commodities, digital collectibles, digital tools, payment stablecoins, and digital securities. Four sit outside the securities regime. It lists 18 assets currently treated as digital commodities, including BTC, ETH, SOL and XRP. It then states that a non-security crypto asset may still be sold pursuant to an investment contract, including in secondary markets. Asset and transaction get classified separately: your token can be a digital commodity while your sale of it is still a securities offering.

ESMA reaches similar ground by a different road. MiCA excludes anything qualifying as a MiFID II financial instrument from its scope entirely, and ESMA's classification guidelines apply substance over form. A token marketed as a utility token is a financial instrument if it performs an investment function, is transferable, trades, and carries market risk. What you called it in the whitepaper is not an input.

Security tokens: expensive, and sometimes correct

A digital security under the SEC taxonomy, or a financial instrument under MiFID II, is a regulated product wearing a new format. Registration or an exemption, licensed intermediaries, custody rules, disclosure obligations, transfer restrictions enforced at the holder level.

Tokenized bonds, money market fund shares and equity land here by design, which is fine, because their issuers wanted a financial product. We cover the mechanics in Real-World Asset Tokenization: Complete Guide for Businesses.

The constraint that surprises people is transferability. A compliant security token needs whitelisted holders and permissioned transfers. If your protocol depends on the token moving freely between anonymous participants, this route does not merely cost more, it removes the thing you were building.

Utility tokens: when it actually is one

The SEC's language is useful here because it is unusually concrete. A digital commodity derives value from the programmatic operation of a functional system and from supply and demand, rather than from an expectation of profit from the essential managerial efforts of others. The release then names a disqualifier: a crypto asset is not a digital commodity if it has intrinsic economic properties such as generating passive yield or conveying rights to future income, profits, or assets of a business enterprise.

That excludes a large share of what launched between 2020 and 2022.

Under MiCA, a genuine utility token with no economic rights falls into Title II as an "other crypto-asset". You publish a white paper, notify your national competent authority, follow the marketing rules, and carry liability for misleading statements. Considerably lighter than a prospectus, and not nothing.

The grey zone, which is where most tokens live

ESMA's guidelines address hybrid tokens specifically, because hybrids are the normal case rather than the exception. Governance rights bundled with fee share. Access rights bundled with staking yield. A payment function plus a burn tied to protocol revenue. A discount on protocol fees that scales with holdings.

The EU approach resolves these by dominant characteristics, weighted toward the stricter regime. If any component makes the token a financial instrument, MiFID II applies and MiCA falls away. Governance tokens carrying partial revenue rights are the reliable trigger, which is worth knowing before you design one.

What getting it wrong costs

In the US: an unregistered offering, rescission rights for purchasers, disgorgement, civil penalties, potential personal liability for control persons. In the EU: an offer made without a compliant notified white paper, or without the MiFID authorisation you turned out to need, with the national authority able to suspend it. In Poland that is the KNF.

Delisting usually arrives first. Venues act on risk assessments rather than rulings, and a token an exchange thinks might be a security stops trading there while the question is still open. Losing your primary liquidity venue is not a legal problem you settle later.

Designing to avoid an accidental classification

Fact-specific enough that anyone offering a clean answer without reading your documents is guessing. The factors that recur:

• Ship functionality before distribution. A token that already does something has a purpose other than resale.

• Never promise price appreciation. Whitepapers, X posts, Discord AMAs and investor decks are all evidence.

• Avoid yield that accrues for holding. Rewards for work, such as validation or liquidity provision, sit differently from rewards for possession.

• Do not tie token value to company revenue. Fee share is the shortest path to "rights to future income".

• Decentralise the managerial efforts that actually matter, in substance rather than in a governance forum nobody uses.