Security Token vs Utility Token: Regulation, Howey Test & Classification in 2026

The security token versus utility token question is the first fork in the road for any token project, and it is decided by substance, not by what the whitepaper calls the asset. A regulator looks past the name to the economic reality. If holders reasonably expect a return generated by the work of a promoter or team, the token behaves like a security and is treated as one. If holders acquire the token to use a live product or service, it behaves like a utility.

That single classification then drives everything downstream: which regulator has authority, which licence you apply for, what you must disclose, and how the token can legally be marketed and traded. Getting it wrong means applying for the wrong authorisation and facing enforcement. Our broader explainer on what crypto regulation is and how it works sets the wider context for where these rules sit.

The two leading frameworks approach the same question differently. The United States applies the judge-made Howey test and, since March 2026, a coordinated SEC and CFTC taxonomy. The European Union uses MiCA for crypto-assets that are not financial instruments, while pushing security tokens out into MiFID II. The rest of this guide works through each in turn.

The Howey test comes from the 1946 US Supreme Court decision in SEC v. W.J. Howey Co. It defines an investment contract, and therefore a security, as an arrangement with four elements. There must be an investment of money, in a common enterprise, with a reasonable expectation of profits, derived from the efforts of others. If all four are present, the asset is a security under US federal law regardless of how it is packaged.

The SEC applied this test to tokens in its 2019 Framework for Investment Contract Analysis of Digital Assets, published by its FinHub innovation unit. For tokens, the first prong is almost always met, because buyers pay fiat or another digital asset for the token. The common enterprise prong is usually satisfied where investor funds are pooled and fortunes rise and fall together. The decisive question is the fourth prong: does the holder expect profit from the entrepreneurial or managerial efforts of a central team?

Factors weighing toward a security include an active development team essential to the network's success, marketing that emphasises price appreciation, a token that is not yet usable, and supply managed to support the price. Factors weighing toward a utility include a fully functional and decentralised network, a token used to access a good or service today, and pricing tied to usage rather than speculation. The framework also accepts that a token sold as a security can later cease to be one as a network matures, which is why the SEC has stated that Bitcoin and Ether are not securities.

The clearest way to see the distinction is to set the two side by side across the dimensions that actually matter for a licensing decision: the regulator, the test, the EU treatment, the type of offering, and typical examples. The table below summarises how each classification plays out in the two largest crypto markets.

For years the US lacked a clear line between the Securities and Exchange Commission and the Commodity Futures Trading Commission. That changed in March 2026. The two agencies signed a memorandum of understanding on overlapping jurisdiction on 11 March 2026, and on 17 March 2026 issued a joint interpretation on the application of federal securities laws to crypto assets. Our US crypto regulation overview tracks how this fits the broader American framework.

The interpretation introduces a five-part taxonomy: digital commodities, digital collectibles, digital tools, payment stablecoins, and digital securities. Only digital securities fall fully within SEC jurisdiction and the full securities regime. The interpretation expressly named 18 major crypto assets as digital commodities, including Bitcoin, Ether, Solana, Cardano, XRP, Litecoin, and Dogecoin, placing them under CFTC oversight with lighter requirements such as reduced disclosure and simpler custody.

For token issuers the practical message is direct. A token that passes the Howey test as an investment contract is a digital security under the SEC, while a token used as a network commodity falls to the CFTC. Payment stablecoins sit in their own category, tied to compliance with the GENIUS Act enacted in July 2025. Separate market-structure legislation continued to advance through Congress during 2025 and 2026, so the boundary is still settling, but the security versus utility line is now far clearer than it was.

The European Union takes a different route to the same answer. MiCA, Regulation (EU) 2023/1114, governs crypto-assets that are not financial instruments. It sorts them into three categories: asset-referenced tokens, which reference a basket or non-fiat values; e-money tokens, which are pegged to a single fiat currency; and other crypto-assets, the residual bucket that captures most utility, governance, and platform tokens. Our EU crypto regulation guide covers how MiCA licensing works in detail.

Security tokens never enter MiCA at all. Article 2(4)(a) of MiCA carves out crypto-assets that qualify as financial instruments under MiFID II, so a tokenized share or bond is regulated under MiFID II and the Prospectus Regulation, the same framework that governs traditional securities. For hybrid assets that share features with a financial instrument, the MiFID II qualification prevails over MiCA. This is the EU equivalent of the security token category.

To make the line workable, ESMA published guidelines on 19 March 2025 on when a crypto-asset qualifies as a financial instrument. For a transferable security, three cumulative criteria apply: the token is not a payment instrument, it belongs to a class of interchangeable securities issued by the same issuer, and it is negotiable on the capital market. ESMA applies a substance-over-form approach, so an asset with the economic function of a security is regulated as one. Note too that stablecoins, covered in our guide to stablecoin regulation, sit in the ART and EMT categories rather than being utility or security tokens.

Classification is not an academic label; it changes what you legally must do. A security token triggers the full securities regime. The offering needs registration with a regulator, a prospectus, or a valid exemption, plus investor disclosures. Trading and custody must run through licensed intermediaries, and the issuer carries anti-fraud liability. A security token offering, or STO, is the regulated counterpart to the unregistered initial coin offerings of the previous cycle.

A utility token works within the lighter crypto regime. In the EU that means publishing a MiCA white paper and operating through an authorised crypto-asset service provider rather than filing a securities prospectus. In the US a non-security commodity token answers to the CFTC rather than the SEC. The compliance burden, the cost, and the time to market are all materially lower than for a security token, which is precisely why classification is contested.

The downside of getting it wrong is severe. Issuing or trading a security token without authorisation exposes a firm to regulatory enforcement, fines, rescission claims from investors, and in some jurisdictions criminal liability. Counterparties and banks also de-risk away from projects with unresolved classification. The prudent path is to settle the classification, and the licence that follows from it, before any token reaches the market.

Classifying a token is a structured analysis, not a guess. The five steps below describe the workflow we run before any client launches, and the same logic underpins what a regulator will expect to see in your application. Our crypto licensing service runs this end to end as part of an engagement.