25 September 2023

Secondary market: understanding security token regulations

Since the 2008 crisis and the emergence of bitcoin, the financial world has undergone profound transformations, at least in its various practices. New asset genres were born, adopted at the time by a handful of avant-gardists, and now embraced by a wider public. Bitcoin has renewed the way we do business.

At the forefront of the development of crypto markets is blockchain. It is the source of the “tokenized” economy. The “tokenization” of financial assets is the process of registering digital assets, and the rights attached to them, on a shared electronic recording device (DEEP or Distributed Ledger Technology, DLT), i.e. on a blockchain.

These crypto-assets can take on different characteristics, which means they can be organized into two broad categories: on the one hand, there’s crypto-currency and, on the other, other tokens. Once again, a distinction can be made between :

  • Utility tokens , which grant a right of use to their owner; or
  • Security tokens, which are similar to financial securities.

The first, usually issued through an ICO(Initial Coin Offering), have the primary function of providing access to a service or product offered by the ICO-issuing company. As their name suggests, utility tokens have a specific use.

The latter, issued by an STO(Security Token Offering) in particular, represent shares in the issuing company and entitle their owners to dividends. They reproduce financial rights, or the political rights of a financial entity, and are therefore comparable to financial securities.

These three categories of tokens – “currency tokens”, “usage tokens” and “security tokens” – have no precisely defined boundaries, and do not prevent the creation of hybrids[1].

They can then be traded on marketplaces, their value being assessed differently according to their nature. The value of security tokens is directly linked to the valuation of the company that issued them, while that of utility tokens is linked to the actual demand for these tokens.

Faced with the emergence of these new marketplaces, a number of issues have arisen, notably in terms of regulation, security and volatility… and they have become the norm. Legislators – first in France with the Pacte law, then in Europe with the MiCA regulation – have provided a framework for the issuance of utility tokens, while leaving the regime for security tokens attached to that of financial securities. But while the ICO stage can be legally apprehended, the same cannot be said of the trading stage, which takes place either bilaterally or via platforms[2].

These platforms are proving to be a source of concern for public authorities. Firstly, various scandals (such as the fall of Terra or the bankruptcy of FTX) have shaken the crypto universe, but have not, for all that, dampened the development prospects of these markets, which remain immense. Secondly, while security tokens can be assimilated to financial securities, it would be difficult for platforms to fall under the MiFID2 regime: such a classification would entail obligations.

In practice, security tokens are traded on platforms that are not market infrastructures and that operate with blockchain technology … the whole system is bathed in a legal vacuum that escapes the regulator’s control.

Faced with this reality, a pilot scheme, supported by European Regulation (EU) no. 2022/858 of May 30, 2022, came into force on March 23, 2023[3]. Regulating only security tokens, the aim of the pilot scheme is to enable financial market players and regulators to experiment with blockchain technology within a secure framework that ensures “investor protection, financial market integrity and financial stability”.

This raises the question of how the business of crypto-asset trading platforms will evolve, first under the prism of French legislation. (I), then with regard to this new pilot scheme (II).

I. The fate of the secondary market for security tokens in France

Tokens are becoming increasingly important: ICOs and STOs are multiplying, more and more investors are taking an interest in the subject, and there is a plethora of trading on dedicated platforms. (A). Faced with this situation, and in line with the innovations introduced by the legislator, the Autorité des Marchés Financiers (AMF) has taken a close look at this phenomenon and has worked to regulate trading in these digital assets. (B).

A. The rise of security tokens in the crypto ecosystem

1. What is the purpose of a security token?

As we briefly explained in the introduction, a security token is a category of digital token issued on a blockchain that represents ownership, or part ownership, of a tangible financial asset such as, for example, a business or real estate. It is therefore an investment opportunity, but does not necessarily bring any particular use to its owner. Anyone acquiring a security token does so in the hope of capitalizing on its value. A security token could therefore be assimilated to a financial security, and in particular represent an equity security (a share) or a debt security (a bond).

The benefits:

For the company issuing them via an STO, security tokens represent a highly effective instrument for raising funds from retail investors. The tokens generated in this way can be linked to shares in the company, giving them voting rights, dividend rights or information rights. “The shareholder”, meanwhile, benefits from true transparency and automatic, immediate execution of contract terms thanks to blockchain technology.

Security tokens can also be issued by the company as bonds. In this case, the company raises funds and the investor becomes its creditor.

Security tokens can then be traded on exchange platforms. This makes it easier for investors to buy and sell these digital assets than traditional stocks or bonds.


The growing use of STOs and security tokens is making it difficult to keep track of all the different projects. It’s hard to spot a good opportunity from a scam, or simply from a miscalculation.

2. Security tokens treated as financial instruments

Due to their diverse forms and numerical nature, the qualification of these tokens has proved a thorny issue. While the U.S. relies on the Howey test to provide an answer, French lawmakers have opted for a legal approach to tokens.

The Howey test in the United States :

To determine whether a transaction qualifies as a security , the U.S. Securities and Exchange Commission (SEC) applies the Howey test. This is an evaluation grid established by the Supreme Court justices in the 1946 SEC vs. W.J. Howey Co. case, consisting of three elements:

  1. There has to be an investment of money,
  2. In a joint venture,
  3. By investors who expect profits from the efforts of the issuing company or third parties.

As soon as these three criteria are met, the transaction must be considered as an offer of securities.

This test has thus been applied to numerous cases involving crypto-asset offerings in order to determine whether the tokens concerned should be considered as shares, bonds or other types of assets.

Equation with a financial security in France :

In France, the legislator has chosen to treat security tokens as financial securities.

What is a financial security in law?

Like financial contracts, financial securities are financial instruments. The notion of financial instrument is of prime importance in financial law, as it is the basis on which financial instrument markets, investment services, investment service providers and public offerings of financial securities can be defined.

The law does not set out a general definition of financial securities, but rather a list. Article L. 211-1, II of the French Monetary and Financial Code stipulates that they include :

” 1. Equity securities issued by joint stock companies ;

2. Debt securities ;

3. Units or shares in collective investment schemes.

So, despite their diversity, financial securities are all subject to the same legal regime: they must be registered in an account, they are transferred by negotiation and they can be pledged[4].

Faced with the emergence of the crypto phenomenon, France quickly sought to grasp the subject of blockchain and did so through various ordinances, notably that of December 8, 2017. Legislation has been adapted to allow the representation and transmission of certain financial securities via a shared electronic recording device (DEEP, or DLT)[5].

Thus, article L. 211-3 al.2 of the French Monetary and Financial Code specifies that the registration of an asset in a blockchain is equivalent to registration in a traditional securities account. Article L. 211-20 VII of the French Monetary and Financial Code provides for the possibility of pledging securities registered in a DEEP.

Only crypto-assets legally qualified as financial securities are covered here. Other digital assets ( utility tokens), meanwhile, are governed by the 2019 Pacte law.

However, the 2017 Ordinance restricts its scope to certain tokens, namely negotiable debt securities, units or shares in collective investment schemes, equity securities issued by joint stock companies and debt securities other than negotiable debt securities, on condition that they are not traded on a trading platform.

Thus, equity and debt securities admitted to trading on a multilateral trading facility are subject to the European Regulation on Central Securities Depositories[6]. They must therefore be registered in an account with a central securities depository. For listed securities, it is not possible to register exclusively on blockchain.

As a result, security tokens cannot be listed, which places a significant limit on their liquidity[7].

Against this backdrop, the Autorité des Marchés Financiers has taken up the issue and highlighted the restrictive nature of the European Central Securities Depository Regulation for the crypto ecosystem.

B. The position of the Autorité des marchés financiers in favor of a legal framework for the trading of security tokens

In March 2020, the Autorité des marchés financiers (AMF) published a report entitled “État des lieux et analyse relative à l’application de la réglementation financière aux security tokens”. She then noticed a slowdown in ICOs in favor of STOs, and listed the various projects that had been completed or were in the process of being launched.

As far as the secondary market is concerned, we note that few security token trading platforms are yet operational, but numerous projects are under development, some of them led by major institutional players (such as Société Générale’s Forge project). And yet, despite the growing interest in security tokens, few public authorities have taken a position on establishing an applicable legal framework.

The AMF has therefore carried out an analysis of the extent to which financial regulations can be applied to security tokens (which are, legally speaking, financial instruments), with a particular focus on secondary markets.

At the negotiation stage, there are few regulatory hurdles to overcome. Either an investment services provider (ISP) license is required, for the provision of certain investment services; or a multilateral trading facility (MTF) or organized trading facility (OTF) license must be obtained, for the operation of a trading platform within the meaning of MiFID. Only platforms for which a manager is identified can benefit from this approval, which excludes decentralized platforms.

In addition, the settlement of certain security tokens poses greater difficulties. Unlisted tokens are captured by the 2017 ordinance, allowing them to be issued and transmitted on the blockchain. On the other hand, for tokens listed on a trading platform within the meaning of MiFID, the regulations do not allow settlement-delivery entirely on the blockchain.

Several legal obstacles have been identified, such as the need to identify a blockchain manager acting as a securities settlement system (which necessarily rules out the use of public blockchains), the requirement for intermediation by a credit institution or investment firm for individuals to access settlement (whereas crypto-asset platforms operate by direct access), the recognition of ownership at the level of account holders (and not as a result of the registration of security tokens in blockchain), or the obligation to settle securities in cash, central or commercial currency (quid settlement in tokens).

To overcome these difficulties, the AMF is therefore proposing to create a Europe-wide “Digital Laboratory” enabling the various national authorities to set aside certain requirements imposed by EU law due to their incompatibility with the blockchain environment. In return, the entity benefiting from this exemption would be subject to increased supervision by the competent national authority. The AMF asserts that such a system would make it possible to suspend regulatory obstacles to the emergence and development of security token market infrastructure.

This proposal was heard, as on May 30, 2022, European Regulation (EU) 2022/858 was adopted, creating a pilot scheme for market infrastructures to experiment with blockchain technology.

II. The future of the secondary market for security tokens with the implementation of the pilot scheme

The pilot scheme came into effect on March 23, 2023 for a period of 3 years, which may be extended for a further 3 years. At the end of these 3, or 6, years of experimentation, it should be possible to draw up proposals for a suitable European regulatory framework.

A. The purpose of the pilot scheme

1. The objectives of the pilot scheme

The aim of this pilot scheme is to enable financial market players and regulators to experiment with blockchain technology within a secure framework that ensures investor protection, financial market integrity and financial stability. In other words, the aim is to develop a regulatory framework that supports innovation within market infrastructures, while at the same time providing various safeguards that concern both investors and financial markets. For the European Union, it is vital to preserve competition so that the pilot scheme can benefit both existing infrastructures and new platforms, which will have to obtain DLT market infrastructure status.

2. Assets covered by the pilot plan

The pilot scheme concerns only security tokens admitted to trading or registered on a DLT market infrastructure, namely :

  • Shares whose issuer has a market capitalization of less than 500 million euros
  • Bonds, debt securities or money-market instruments with an issue volume of less than one billion euros, except those incorporating a derivative instrument or presenting a structure that makes understanding the risk complex for the customer, and bonds from small issuers whose market capitalization does not exceed 200 million euros at the time of issue;
  • Units and shares in UCITS with a market value of less than 500 million euros.

In addition, to ensure financial stability, the total market value of all financial instruments admitted to trading or registered on a DLT market infrastructure must not exceed €6 billion at the time of admission or registration. If this value subsequently reaches €9 billion, the DLT market infrastructure operator must implement the transition strategy.

3. Players targeted by the pilot scheme

The pilot scheme creates a new DLT market infrastructure status, which is divided into 3 categories:

  • 1°/ The multilateral trading facility (MTF DLT), which admits only DLT financial instruments to trading, i.e. the investment firm or market undertaking that has received specific authorization from the competent national regulator;
  • 2°/ The DLT settlement system (SR DLT), which settles transactions in DLT financial instruments against payment or delivery, and which must be operated by a central securities depository (CSD);
  • 3°/ The DLT trading and settlement system (SNR DLT), a new player authorized to provide the services of both a multilateral trading facility and a securities settlement system, but only for DLT financial instruments (in other words, this dual status is not authorized for conventional securities).

This new DLT infrastructure status will not prevent traditional financial market infrastructures from developing activities and services related to the trading and post-trading of crypto-assets.

In addition, to ensure the smooth development of these DLT infrastructures, operators may be exempted from certain obligations normally applicable to market infrastructures. These exemptions may be granted by national authorities (in France, the AMF) at the request of the players concerned. Nevertheless, these exemptions are accompanied by compensatory measures put in place by national authorities, which may be applied systematically or remain optional, at the discretion of the authority, depending on the specific case of the infrastructure requesting the exemption.

B. Pilot scheme obligations

In addition to exemption situations, DLT market infrastructures must cooperate closely with the competent authorities and the European Securities and Markets Authority (ESMA). They are also subject to specific obligations.

They must draw up detailed business plans describing how they will provide their services and carry out their activities, as well as documentation defining their operating rules.

They are obliged to set or document the rules that apply to the operation of the blockchain technology they use.

They are required to publish clear information on their website about their operating rules, services and activities, including the type of blockchain they use.

They ensure that all IT and cybersecurity arrangements linked to the use of blockchain technology are proportionate to the nature, size and complexity of their activities. These systems must guarantee that their services and activities are continuous, transparent, reliable and secure. They must also ensure data integrity, security and confidentiality.

They are obliged to separate assets held on behalf of third parties from those held for their own account.

They ensure that the funds, collateral and DLT financial instruments they hold are protected against the risks of unauthorized access, piracy, damage, loss, cyber-attack, theft, fraud, negligence or other serious personal failings. In the event of loss, the DLT market infrastructure operator will be liable for the value of the lost asset, unless it can demonstrate force majeure.

They guarantee investor protection, and establish mechanisms for handling claims and procedures for compensation or recourse in the event of investor loss.

Finally, they must adopt a transition strategy in the event of a switch from DLT market infrastructure activities to traditional market infrastructure activities. As mentioned above, this requirement applies if the market value threshold of all DLT financial instruments admitted to or registered on the DLT market infrastructure exceeds €9 billion. This may also be necessary if a specific authorization or exemption is withdrawn or suspended, or in the event of voluntary or involuntary cessation of their activities.

C. Positioning the pilot scheme within the broader vision of the ” digital finance package

The EU’s strategy for framing crypto-asset markets extends beyond the pilot scheme. Indeed, the European legislator is seeking to establish a framework that supports the development of these markets, simplifies the tokenization of traditional financial assets and makes the use of blockchain technology accessible to enable the deployment of digital finance, while building an environment that protects investors and the stability and integrity of markets.

To make up the Digital Finance Package, four proposals were presented in September 2020: three regulations and one directive.

The pilot scheme regulation is the first of these.

The second is the MiCA regulation, the purpose of which is to regulate crypto-assets that do not qualify as financial securities, and therefore do not fall within the scope of the pilot scheme.

The third is the DORA regulation, which comes into force on January 17, 2025. Its scope is broader than just crypto-asset markets, as it aims to enable the financial sector to remain resilient in the event of serious operational disruptions or cyber-attacks.

Finally, this DORA regulation is accompanied by Directive (EU) 2022/2556, which amends several directives, including MiFID2, and deals exclusively with issues of digital operational resilience[8].

[1] “La distinction des tokens et des titres financiers”, Pauline Pailler, Revue de Droit bancaire et financier n°3, mai-juin 2020, dossier 10.

[2 ] “What secondary markets for security tokens ? “Pauline Pailler, Revue de Droit bancaire et financier No. 2, March-April 2020

[3 ] Regulation (EU) 2022/858 of the European Parliament and of the Council of May 30, 2022 on a pilot scheme for market infrastructures based on distributed ledger technology, and amending Regulations (EU) No 600/2014 and (EU) No 909/2014 and Directive 2014/65/EU.

[4] “Titre financier” Dalloz guidance sheet, August 2022

[5] “Blockchain” Dalloz guidance sheet, June 2023

[6 ] Regulation (EU) No 909/2014 of the European Parliament and of the Council of July 23, 2014 on improving securities settlement in the European Union and on central securities depositories.

[7] “Le règlement européen sur le Régime Pilote : l’innovation règlementaire pour les infrastructures de marché en blockchain face au défi de sa mise en œuvre”, Matthieu Lucchesi and Bastien Raisse, Revue de Droit bancaire et financier No. 5, September-October 2022, study 10

[8] “Digital finance and crypto-asset markets: is Europe at the forefront?”, Julien Granotier, Revue Droit des sociétés, No. 2, February 2023

Don’t be shy.
Share our article.