Is Your Token a Security? Howey, the 2026 SEC-CFTC Taxonomy & the Innovation Exemption

Introduction

A token that tracks a US share price can be the share itself, a claim on a custodian, or a stranger's debt. Only the first two qualify for the on-chain trading venues the Securities and Exchange Commission (SEC) exempted in September 2026 (SEC Release 34-106402, 2026). That order closed a year of rapid change. A staff statement in January mapped tokenized securities, a joint release with the Commodity Futures Trading Commission (CFTC) in March sorted every crypto asset into five categories, and a September order opened a narrow trading lane. Congress, meanwhile, left the CLARITY Act stalled after a 49-50 Senate vote. This guide applies the Howey test to tokenized funds, treasuries, gold, real estate and stocks, then walks through each 2026 document in order, with the limits that matter to a buyer.

What Is the Difference Between a Security Token and a Utility Token in 2026?

Neither "security token" nor "utility token" appears in the SEC's 2026 classification documents. The March 2026 release sorts crypto assets by what they confer on the holder (SEC Release 33-11412, 2026). In its terms, a security token is a digital security, a utility token is a digital tool or digital commodity, and either can still travel inside an investment contract.

Old Labels, New Categories

The March 2026 interpretation by the Securities and Exchange Commission (SEC), with guidance from the Commodity Futures Trading Commission (CFTC), sorts crypto assets into five categories (SEC Release 33-11412, 2026). Digital commodities, digital collectibles and digital tools "are not themselves securities." Whether a stablecoin is a security depends on its features. Digital securities are always securities. A utility token that works as a ticket, membership or credential is a digital tool. A network token used to pay fees and secure a blockchain, such as ETH or SOL, is a digital commodity. A security token is a digital security: a share, bond, note or other instrument named in the statutory definition, recorded on a blockchain.

Why the Label Decides Nothing

The name a project gives its token carries no legal weight. The release quotes the Supreme Court: securities law turns on "the economic realities underlying a transaction, and not the name appended thereto" (SEC Release 33-11412, 2026). Two consequences follow for anyone weighing a security token vs utility token. First, a token with working utility can still be sold under an investment contract when the issuer promises managerial work that buyers expect to profit from. The token itself stays a non-security, but the sale becomes a securities transaction. Second, a digital security stays a security when it adds perks such as access rights; the release says non-financial benefits do not take it outside the definition.

Data current as of October 2026.

The category tells a reader where to start, and the Howey test settles the cases that sit between categories.

How Do the Three Howey Prongs Decide Whether a Token Is a Security?

Howey asks whether a buyer invested money in a common enterprise and expected profits from the efforts of others (SEC v. W.J. Howey Co., 1946). All three elements must be present. For most real-world asset (RWA) tokens the test is a second step, because shares, notes and fund units are securities by name first.

Money and a Common Enterprise

The first prong is the easiest to meet. In an August 2026 New York case over two launchpad tokens, the court accepted payment in SOL as an investment (Aguilar v. Baton Corp., S.D.N.Y. 2026). It dismissed the securities claims on the second prong instead. The second prong asks whether buyers' fortunes are tied together, classically by pooling their money. The March 2026 release takes a firm position here. The Commission "concludes and clarifies" that the common enterprise element must be satisfied, and it sets aside its own 2004 view in In re Barkate (SEC Release 33-11412, 2026). A pooled fund or a property company that collects rent for all holders meets this prong easily.

Efforts of Others and Issuer Promises

The third prong asks whose work drives the return. Courts look for "essential managerial efforts" that decide success or failure, and they exclude administrative or ministerial tasks (SEC Release 33-11412, 2026). The 2026 release ties this prong to what the issuer says. An investment contract forms when the issuer induces purchases with promises of such efforts, conveyed before or at the sale. Whitepapers, websites, regulatory filings and official social media accounts all count as issuer channels. Statements by unaffiliated fans do not count unless the issuer authorises them. Detailed roadmaps with milestones, funding and named personnel likely create a reasonable expectation of profit, the release says. Vague promises with no business plan behind them are weak evidence.

Enumerated Instruments Come First

Howey is the test for novel or irregular instruments, not for every security. The statute lists stock, bonds, notes and other common instruments, plus any "receipt for" them (SEC Release 33-11412, 2026). A tokenized share is tested as stock under the Supreme Court's Landreth Timber factors: dividends, negotiability, pledging, proportional votes and the capacity to appreciate. A token that is the issuer's promise to repay is a note, and notes are presumed to be securities under Reves v. Ernst & Young (1990). Howey itself held it "immaterial" whether an investment is evidenced by formal certificates or by nominal interests in physical assets (SEC v. W.J. Howey Co., 1946). The Howey test for tokenization matters most where no named instrument fits.

Applied to the tokens sold as RWAs, those rules settle most products long before the hard Howey questions arise.

How Does Howey Apply to Tokenized Funds, Treasuries, Gold and Real Estate?

Most tokenized treasuries and funds are fund shares or notes, so they are securities without a Howey analysis. Howey decides the two classes that are less obvious: commodity tokens such as tokenized gold, and fractional real estate, which repeats Howey's own facts.

Fund Shares and Treasury Tokens

A tokenized treasury product is rarely a tokenized Treasury bill. It is a share in a fund that holds bills, or a note backed by them. BlackRock's USD Institutional Digital Liquidity Fund (BUIDL) is a British Virgin Islands fund sold under Rule 506(c) of Regulation D. It also relies on the qualified-purchaser exclusion in Section 3(c)(7) of the Investment Company Act, according to its Form D (SEC EDGAR, 2026). Franklin Templeton's OnChain U.S. Government Money Fund is a registered money market fund. Its transfer agent "maintains the official record of share ownership" through a blockchain-integrated system (Franklin Templeton prospectus, 2026). Both are securities because they are fund interests. The token changes the share register, not the legal analysis.

Gold and Commodity Tokens

Tokenized gold is the clearest gap in the 2026 grid. The release names five categories and states that some crypto assets fit none of them (SEC Release 33-11412, 2026). PAX Gold (PAXG) is typical: each token equals one fine troy ounce of gold. Holders own fractions of London Good Delivery bars held on a segregated basis for their benefit (Paxos PAXG terms, 2026). No pool earns a return and no manager's work drives the price, which follows gold. The release's reasoning on redeemable wrapped tokens points the same way: a pure receipt involves no enterprise and no managerial efforts. That is an inference by analogy, not an SEC ruling on gold. A gold token paying yield from leased metal adds exactly the efforts Howey looks for.

Fractional Real Estate

Fractional property tokens repeat the facts of Howey. In 1946, buyers took narrow strips of a citrus grove plus a service contract that left cultivation and marketing to the seller. The Supreme Court found an investment contract (SEC v. W.J. Howey Co., 1946). The 2026 release draws the same line. Selling a whole grove to one active owner "might have been a real estate sale", while subdivision plus central management made the plots securities (SEC Release 33-11412, 2026). A token serving as the title record for a whole house sits closer to a digital tool, since the release lists title instruments in that category. RealT, by contrast, sold houses as equity in single-property companies under Rule 506(c), according to its Form D filings (SEC EDGAR, 2022). The company announced a voluntary liquidation in July 2026, a reminder that the property layer, not the token, carries the risk.

Data current as of October 2026.

Tokenized stock is the one class where the same ticker can hide three different securities.

Is a Tokenized Stock the Same Security as the Share Behind It?

Only when the issuer tokenizes it. SEC staff described three structures in January 2026 (SEC staff statement, 2026). Issuer-sponsored tokens are the share, third-party custodial tokens are entitlements to a share in custody, and synthetic tokens are the third party's own security. Each gives the holder a different claim.

Issuer-Sponsored Shares

An issuer-sponsored token is the share in a different format. The issuer or its transfer agent links the blockchain to the master securityholder file, so a token transfer moves legal ownership of the stock (SEC staff statement, 2026). Galaxy Digital did this with its Class A common stock in September 2025. Superstate, its SEC-registered transfer agent, records ownership on Solana and updates the register as tokens move between approved holders (Galaxy Digital, 2025). Staff also described a looser version in which the token sits outside the register and only signals transfers to the agent. In both versions the federal securities laws apply unchanged. Every offer and sale must be registered or exempt, whatever the format.

The Third-Party Custodial Model

A third party can tokenize another company's stock without that company's involvement. In the custodial model, the third party holds the real share in custody. Its token evidences the holder's direct or indirect interest in that share, such as a security entitlement (SEC staff statement, 2026). Staff folded the "digital custodial receipt" into this model rather than treating it as a separate type. The token may or may not carry shareholder rights. Staff warned that holders face risks tied to the third party, "such as bankruptcy", that a direct shareholder would not. The innovation exemption admits custodial tokens to its venues only when they carry the same dividends, votes and liquidation rights as the share (SEC Release 34-106402, 2026).

The Third-Party Synthetic Model

A synthetic token is the third party's own security that tracks the share price. Staff named two forms: a linked security, such as a structured note, and a security-based swap (SEC staff statement, 2026). A linked security is "not an obligation of the issuer of the referenced security and confers no rights or benefits" from that company. xStocks match that description by their own account: each is "a bearer debt instrument classified as a tracker certificate", with no voting rights (xStocks, 2026). Security-based swap tokens carry a further restriction. They cannot be sold to anyone who is not an eligible contract participant unless a registration statement is effective and trades run on a national securities exchange.

Those three structures came from a staff document, and its legal weight differs sharply from what the Commission issued in March.

What Did the SEC Staff Statement on Tokenized Securities Say in January 2026?

On 28 January 2026, three SEC divisions published a Statement on Tokenized Securities that split them into issuer-sponsored and third-party types (SEC staff statement, 2026). It was the first official map of the field. It also carries no legal force, a limit the staff wrote into its own footnotes.

Two Categories, Four Models

The Divisions of Corporation Finance, Investment Management and Trading and Markets issued the statement jointly. It defines a tokenized security as an instrument named in the statutory definition of a security, recorded in whole or in part on a crypto network. Issuer-sponsored tokens come in two models: integrated into the master securityholder file, or kept off it and used only to instruct transfers (SEC staff statement, 2026). Third-party tokens come in two more, custodial and synthetic. Each model ends with the same reminder that format does not change the analysis. Stock remains an "equity security" whether it sits in a database or a wallet. The statement also flags a fund issue: issuing shares in several formats across several blockchains may raise multi-class questions under Section 18 of the Investment Company Act.

A Staff View With No Legal Force

A staff statement is advice, not law. Its footnote says it "is not a rule, regulation, guidance, or statement" of the Commission and "has no legal force or effect" (SEC staff statement, 2026). The Commission repeated that caveat when it cited the statement in its September 2026 exemptive order (SEC Release 34-106402, 2026). The March 2026 release differs in kind. It is the Commission's own interpretation, and the agency says it will administer the securities laws consistent with it, including in enforcement actions (SEC Release 33-11412, 2026). It adopted the staff's two-category split almost word for word: securities tokenized by or for their issuers, and securities tokenized by unaffiliated third parties. The staff map became Commission doctrine seven weeks later.

The March release reached well beyond tokenized securities.

What Are the Five Crypto Asset Categories in the March 2026 SEC-CFTC Release?

Release 33-11412, issued on 17 March 2026 and effective 23 March, sorts crypto assets into digital commodities, digital collectibles, digital tools, stablecoins and digital securities (SEC Release 33-11412, 2026). Three categories are not securities, one depends on the facts, and one is always securities. It remained the Commission's operative interpretation as of October 2026.

The Five Categories

Each category is defined by what the token does and what it does not convey. Digital commodities draw their value from a functional network plus supply and demand; the release lists BTC, ETH, SOL, XRP and 12 others as examples. Digital collectibles, including meme coins and art non-fungible tokens (NFTs), carry cultural or entertainment value. Digital tools perform a practical function, such as a ticket, membership, credential or title instrument. None of these three conveys "rights to future income, profits, or assets" of a business. Stablecoins split by statute: payment stablecoins from permitted issuers fall outside the definition of security once the GENIUS Act takes effect (GENIUS Act, 2025). Digital securities are any statutory security in token form, whether issuer- or third-party-tokenized (SEC Release 33-11412, 2026). The release also replaces the staff's 2019 framework for analysing digital assets.

How Investment Contracts Attach and End

A non-security token can still travel inside an investment contract. One forms when an issuer induces purchases with promises of essential managerial efforts (SEC Release 33-11412, 2026). Secondary sales stay securities transactions while buyers reasonably expect those promises to remain attached to the token. The contract ends in two ways. Either the issuer completes the promised work and says so publicly, or it publicly and unambiguously abandons it. Separation does not erase past liability. An issuer that sold without registration or an exemption stays exposed to buyers' claims, and to anti-fraud liability for misstatements. The release encourages issuers to publish milestones, timelines and completion notices, which makes disclosure the exit route from securities status.

Wrapped Tokens and the CFTC

Wrapping means depositing an asset and receiving a one-for-one redeemable token, and the release treats it separately. A wrapped receipt for a non-security crypto asset is not a security, because the provider's role is administrative and no return is offered (SEC Release 33-11412, 2026). A wrapped receipt for a digital security is a security, since the statute covers any "receipt for" a security. The CFTC's part is shorter. It will administer the Commodity Exchange Act consistently with the interpretation. It also notes that any non-security crypto asset, other than a GENIUS payment stablecoin, can meet the statutory definition of a commodity. The release states that it alters neither agency's statutory authority, invites public comment, and reserves the Commission's right to revise its views (SEC Release 33-11412, 2026).

Data current as of October 2026.

Classification decides whether a tokenized stock is a security; the September order decides where one may trade.

What Does the SEC Innovation Exemption Permit, and What Does It Exclude?

Release 34-106402 of 17 September 2026 lets qualifying Tokenized Securities Venues run permissioned automated market maker (AMM) pools for tokenized stock without registering as exchanges (SEC Release 34-106402, 2026). It is trading relief for listed US equities only. It runs until 17 September 2031, and no venue had begun trading under it as of 2 October 2026.

What Qualifies and Where It Trades

Only tokenized national market system (NMS) stock qualifies: a US exchange-listed stock tokenized by its issuer or by an unaffiliated third party (SEC Release 34-106402, 2026). The order excludes any third-party token providing "synthetic exposure", naming linked securities and security-based swaps, and it excludes rights and warrants. A venue may pair the stock only with another tokenized stock, a non-security crypto asset such as a payment stablecoin, or a tokenized money market fund. Access is permissioned, for example through allow-listed wallets. The pool's smart contracts must be auditable, public and deployed on a public, permissionless blockchain. A second exemption spares liquidity providers using proprietary capital from registering as dealers. The order grants no relief under the Investment Company Act.

Caps, Notices and Issuer Objection

Tier 1 tokenized stocks are capped at 75 symbols and 0.25% of each stock's prior-month average daily volume (ADV); Tier 2 allows 250 symbols and 2.5% (SEC Release 34-106402, 2026). The tiers follow the Limit Up-Limit Down plan, and affiliated venues must count their volume together. A venue must be a US person, which brings it under US sanctions rules. It must post a public notice at least 30 calendar days before operating. Third-party tokens need more: written notice to the company, a 30-day wait, and no trading if the company objects within that window. Tokens must carry the share's dividends, votes and liquidation rights, with proxy materials passed through at no cost.

What the Exemption Does Not Do

The order creates no new way to sell tokens. It states that no primary issuance or initial offerings may occur on a venue, and every offer and sale still needs registration or an exemption (SEC Release 34-106402, 2026). It opens no trading in tokenized bonds or private shares; tokenized money market funds appear only as the other side of a pair. Offshore tracker certificates fall under the synthetic exclusion, so the order does not bring them to US venues. A companion guide on who can buy tokenized stocks ↗ covers which buyers may hold them. Open decentralized finance (DeFi) pools stay outside it, because access must be permissioned. Because notice must come at least 30 days before trading, no venue can operate under the order before 17 October 2026.

Data current as of October 2026.

Every one of those conditions is agency-made, because Congress declined to write its own.

What Happens to Token Classification Now That the CLARITY Act Has Stalled?

No statute changed. The Senate rejected cloture on the CLARITY Act 49-50 on 15 September 2026 (US Senate, 2026). US token classification still rests on Howey, the March interpretation and the September order. Only the GENIUS Act stablecoin carve-out is written into law, and it was not yet in force as of October 2026.

The Cloture Vote and the GENIUS Act

The CLARITY Act, H.R. 3633, passed the House 294-134 in July 2025 (Congress.gov, 2025). Its Senate title describes a system for the SEC and CFTC to regulate offers and sales of digital commodities. On 15 September 2026, a motion to invoke cloture on proceeding to the bill drew 49 yeas and 50 nays, short of the three-fifths required (US Senate, 2026). The bill was not law as of 2 October 2026. The GENIUS Act, Public Law 119-27, is law. It excludes payment stablecoins issued by permitted issuers from the definition of a security and bars those issuers from paying holders interest or yield. It takes effect on the earlier of 18 January 2027 or 120 days after final regulations (SEC Release 33-11412, 2026).

Agency Rules Can Be Revised

An interpretation and an exemptive order are easier to change than a statute. The March release says the Commission "may refine, revise, or expand" its views based on public comment (SEC Release 33-11412, 2026). The September order lets the Commission modify its length or any condition under Section 36 of the Securities Exchange Act (SEC Release 34-106402, 2026). The August 2026 Regulation Crypto Assets proposal would add two offering exemptions and an investment-contract safe harbor (91 FR 54510, 2026). It remained a proposal as of October 2026, with comments due by 20 October 2026. Its "covered investment contract" requires that the crypto asset is not a security, so tokenized securities gain nothing. The release also states that it does not replace Howey, "which is binding legal precedent", so courts keep applying the Supreme Court's test in private suits. A token classed as a digital commodity today rests on the current Commission's reading, and a venue's relief rests on an order whose conditions can move before 2031.

Without a statute, the classification of any single token has to be read from that token's own documents.

How Can an Investor Check Whether a Specific Token Is a Security?

Four questions settle most cases, and the answers sit in public filings rather than on a token's website. A buyer needs to know what the token legally conveys, who owes the holder anything, which 2026 category fits, and which registration or exemption covered the sale. Documents that cannot answer those four questions are a warning in themselves.

Four Questions for Any Token

Start with ownership. A token that is a share, note or fund unit is a security by name, and the 2026 categories confirm it as a digital security. Next, identify the obligor. If the token is a claim on a third party rather than on the company, the holder carries that third party's credit and bankruptcy risk (SEC staff statement, 2026). Then test the non-security categories: commodity, collectible or tool. Finally, ask how the token was sold. Even a non-security token sold with promises of managerial work is a securities transaction until those promises are fulfilled or abandoned (SEC Release 33-11412, 2026). Offering exemptions such as Regulation D, Regulation S and Regulation A+ ↗ each carry their own buyer limits, which a companion guide explains.

Where the Answers Are Filed

SEC filings hold most of the evidence. Private offerings appear on the SEC's EDGAR database as Form D notices, which name the exemption claimed; BUIDL's lists Rule 506(c) and Section 3(c)(7) (SEC EDGAR, 2026). Registered funds file prospectuses describing how shares are recorded, as Franklin Templeton does for its blockchain-integrated register. Issuer-sponsored stock tokens name the transfer agent; Galaxy's announcement, filed with the SEC, names Superstate. Third-party tokens publish offering documents, and the instrument type sits near the front. A tracker certificate or structured note is the third party's own debt, not the share. Venues using the innovation exemption must post public notices on their websites and keep every revised version online (SEC Release 34-106402, 2026).

FAQ

?Is a governance token a security under the 2026 SEC framework?

Not by default. The March 2026 release describes governance tokens, which let holders vote on upgrades or treasury spending, as one form of digital commodity when tied to a functional network. That description assumes no passive yield and no right to future income or profits. A token that also shares protocol fees or profits with holders falls outside it, and an issuer's promises of managerial work can still place a governance token inside an investment contract.

?What can buyers do if a token sale should have been registered and was not?

Section 12(a)(1) of the Securities Act lets a buyer sue the seller to recover the price paid, with interest, or for damages if the buyer has already sold. Section 13 sets a one-year deadline from the violation (15 U.S.C. 77l, 77m). The March 2026 release confirms these rights survive even after a token later separates from its investment contract. Anti-fraud claims for misstatements also remain available.

?How does the US treatment of tokenized securities compare with the EU's MiCA approach?

Both reach the same outcome by different routes ↗. In the US, the March 2026 release states that a security is a security whether it sits on-chain or off-chain. In the EU, Article 2(4)(a) of the Markets in Crypto-Assets Regulation (MiCA) excludes crypto-assets that qualify as financial instruments ↗. Tokenized shares, bonds and fund units therefore fall under MiFID II, the Prospectus Regulation and the distributed ledger technology (DLT) Pilot Regime instead of MiCA.

?Are NFTs securities under the March 2026 SEC-CFTC release?

Most are not. The release classes art, music, game items and meme-inspired tokens as digital collectibles, which are not securities, and names CryptoPunks and Chromie Squiggles as examples. Creator royalties on resale do not change that result. The exception is fractionalization: selling fractional interests in a single collectible may be an offer of an investment contract, the same logic that applies to fractional artwork offline.

?Are yield-bearing stablecoins treated as securities in the US?

They can be. The GENIUS Act removes payment stablecoins issued by permitted issuers from the definition of a security once it takes effect, and it bars those issuers from paying holders interest or yield (GENIUS Act, 2025). Stablecoins outside that statutory category, including tokens that pay a return, are securities or not depending on their facts (SEC Release 33-11412, 2026). A dollar token that pays holders a yield from managed reserves resembles a fund share or note.

?Do state securities laws still apply to tokenized securities?

Yes. The SEC staff statement of January 2026 notes that both federal and state law govern the parties and transactions involved in tokenizing securities. It points to Article 8 of the Uniform Commercial Code for how transfers take effect. State law decides questions such as whether a token transfer passes legal title to a share or entitlement. Federal classification under Howey or the 2026 release does not displace those state rules.

?Can US residents buy tokenized stocks that are issued offshore?

Usually not directly. Products such as xStocks are tracker certificates distributed in Europe under a prospectus approved in Liechtenstein, not registered with the SEC (xStocks, 2026). Offerings made outside the United States under Regulation S restrict sales back into the US. The innovation exemption does not change this, because synthetic tokens are excluded from it.

?Is a wrapped token the same thing as a tokenized security?

No. A wrapped token is a one-for-one, redeemable receipt for an asset held by a custodian or a bridge. The March 2026 release treats a wrapped receipt for a non-security crypto asset, such as bitcoin, as not a security when it offers no return and the deposit stays locked. A wrapped receipt for a tokenized security is itself a security, because the statutory definition covers any receipt for a security. Wrapping changes the chain an asset moves on, not its legal status.

References / Sources