An STO is a regulated capital-markets activity, not a marketing label. Whether something is an STO turns on whether the token is a "security" under the Securities and Futures Ordinance - the same statute that governs paper shares, bonds and fund units. Hong Kong applies a strict substance-over-form test: the blockchain wrapper is irrelevant; the rights the token confers are everything.
The starting point is the definition of "securities" in section 1 of Schedule 1 to the SFO (Cap. 571). In simplified form, "securities" includes:
A "collective investment scheme" is the practical catch-all for crypto. The four limbs broadly mirror a Howey-style analysis:
If a token meets all four limbs, it is an interest in a CIS, and therefore a "security" under the SFO.
The SFC's first formal pronouncement on tokenised offerings is the Statement on Security Token Offerings dated 28 March 2019. The Statement's core message is unambiguous: Security Tokens are likely to be "securities" under the SFO, and any party marketing or distributing them, or operating a platform on which they trade, must be appropriately licensed - typically Type 1 (dealing in securities).
The Statement defines Security Tokens as "digital representations of ownership of assets (e.g., gold or real estate) or economic rights (e.g., a share of profits or revenue) utilising blockchain technology."
On 2 November 2023, the SFC issued two paired circulars during Hong Kong FinTech Week that materially modernised the framework:
These superseded the 2019 position that treated all security tokens as "complex products" available only to professional investors. The SFC now formally adopts a "see-through approach": tokenised securities are "fundamentally traditional securities with a tokenisation wrapper", so the existing legal and regulatory regime for the underlying security continues to apply, plus additional expectations on the tokenisation layer (smart-contract risk, cyber-security, ownership records, custody, disclosure of tokenisation arrangements).
In plain terms, in Hong Kong:
A "tokenised security" is a security wrapped in distributed-ledger technology - the underlying right (a bond coupon, a fund interest, an equity stake) is the same; only the registry/settlement layer changes. The same SFO regime applies, with extra regulatory expectations on the tokenisation infrastructure.
The clearest precedent is the HKSAR Government's HK$800 million tokenised green bond issued in February 2023 under "Project Evergreen" - the world's first government-issued tokenised green bond, cleared through the HKMA's Central Moneymarkets Unit. Reasoning: the token represents a beneficial interest in a debenture, which is a "security".
A token representing legal or beneficial ownership of shares in a company is a "security" by direct application of the SFO. Wrapping a share in a smart contract does not change the underlying right.
Following the 2 November 2023 circular, an SFC-authorised retail fund may be tokenised at the primary level. The tokenised unit is still a unit in the fund - i.e. an interest in a CIS.
Tokens that entitle holders to a share of revenue, profit or other economic return from a project or enterprise. These tick all four CIS limbs (pooled, managed, expectation of return).
Where holders exercise governance over a managed enterprise and receive distributions out of the enterprise's profits, this is functionally a share or CIS interest.
Pooled property held by an operator/trustee, rental income distributed pro rata to holders - a textbook CIS.
Automating cashflow does not change the legal characterisation. If the token entitles the holder to economic returns from a managed pool, it is a security.
In every case the test is the same: pooled assets + managed by another + holder has expectation of profit/return tied to that management = CIS interest = security.
These tokens generally fall outside the STO regime - but most still trigger Hong Kong's separate VASP regime under AMLO and can only be traded on SFC-licensed VATPs.
Tokens whose only function is to grant access to a software platform, network or service, with no profit expectation. Caveat: the utility must be genuine and currently usable. If the platform is not built and the token is sold on the basis of future appreciation, the SFC will look through it as an investment.
Treated as virtual assets, not securities. They do not represent any issuer's promise to pay or share profits. Trading is regulated under the SFC's dual VATP/VASP regime.
Fiat-Referenced Stablecoins (FRS) are regulated under the Stablecoins Ordinance (in force 1 Aug 2025) administered by the HKMA - 100% reserve, par redemption, segregation. They are deliberately carved out of the SFO securities regime.
Case-by-case. A pure voting token over open-source protocol parameters, with no profit distribution, is unlikely to be a security. A governance token that distributes protocol revenue is likely a CIS interest.
Genuine 1-of-1 digital art or collectibles, with no fractionalisation and no yield, are generally not securities. Caveat: fractionalised NFTs, NFTs with rental/royalty/yield streams, or NFTs sold as part of a managed pool flip into CIS / security territory.
No issuer obligation, no pooled enterprise, no profit share - typically not a security. Still a virtual asset for VASP/VATP purposes.
This is where most enforcement risk lives. The SFC explicitly looks past labels.
The practical rule: if the holder's economic outcome depends predominantly on the efforts of others managing pooled property, expect "security" treatment.
In Hong Kong, "security token" is not a technology question, it is a rights question. If the token gives the holder a debt claim, an equity-like interest, a fund unit, or a share in pooled, managed returns, it is a security under the SFO and any offering is an STO - subject to the same prospectus, licensing and conduct rules as a traditional capital-markets transaction, with additional SFC expectations on the tokenisation layer. If the token confers only access to a service, or is a pure cryptocurrency, NFT collectible or fiat-referenced stablecoin, it sits in one of Hong Kong's parallel regimes (VATP/VASP, the Stablecoins Ordinance), not the STO regime.