SFC Regulation of Initial Coin Offerings (ICOs): Determining Whether Digital Tokens Are Securities

The Securities and Futures Commission (SFC) has not relaxed its stance on Initial Coin Offerings (ICOs) entering 2025. A single token classified as a “security” under Hong Kong law triggers the full suite of licensing, prospectus, and conduct requirements under the Securities and Futures Ordinance (Cap. 571). The collapse of several unregulated token issuers in late 2024, coupled with the SFC’s October 2024 circular on virtual asset trading platforms, has sharpened enforcement focus on promoters who structure offerings to evade securities classification. For any entity planning to raise capital via digital tokens in or from Hong Kong, the threshold question is binary: is the token a “security” or not? The answer determines whether the issuer faces criminal liability or operates within a regulated framework. This article sets out the SFC’s legal test for classifying digital tokens under Hong Kong law, the procedural steps for assessment, and the consequences of misclassification.

The Legal Framework for Token Classification

The SFC’s authority to regulate digital tokens derives from the definition of “securities” in Schedule 1 of the Securities and Futures Ordinance (Cap. 571). The legislation provides that “securities” includes shares, debentures, and interests in a collective investment scheme. The SFC’s 2017 Statement on Initial Coin Offerings and its subsequent 2019 guidance clarify that these traditional definitions apply to digital tokens where the economic substance matches the statutory description.

Step 1: Does the Token Represent an Interest in a Collective Investment Scheme?

The SFC applies the three-part test for a collective investment scheme (CIS) under Section 104 of Cap. 571. The court procedure is to examine whether the arrangement involves: (a) an invitation to contribute money or other assets; (b) pooling of contributions to enable participants to share profits or returns; and (c) management of the pooled assets by the operator or a third party.

A token that grants holders a share of project revenue, a right to receive dividends, or a proportional claim on the issuer’s profits will likely satisfy the CIS test. The SFC’s 2019 guidance cites the example of a token that entitles holders to a percentage of the issuer’s future earnings from a specific business venture. The legislation provides that profit-sharing arrangements, even if structured as “utility” rights, fall within the CIS definition if the economic substance is investment in a common enterprise.

Step 2: Does the Token Constitute a Share or Debenture?

Schedule 1 of Cap. 571 defines “shares” as interests in the share capital of a corporation. The legislation provides that a token representing an equity stake in a company — including voting rights, dividend rights, or residual claims on liquidation — is a share regardless of the technology used to record ownership.

“Debentures” under Schedule 1 include any instrument creating or acknowledging a debt. A token that promises repayment of principal with interest, or that grants the holder a right to redeem the token at a fixed value, is a debenture. The SFC’s 2023 enforcement action against an unlicensed platform that issued “stablecoin” tokens with a guaranteed redemption value demonstrates this principle in practice.

The Functional Test: Substance Over Form

The SFC applies a functional test that examines the rights and obligations attached to the token, not the label used by the issuer. The court procedure is to look through the technical structure to the economic reality.

Utility Tokens vs. Security Tokens: The SFC’s Distinction

The SFC’s 2019 guidance explicitly states that a token marketed as a “utility token” may still be a security if the primary purpose of the purchase is investment. The legislation provides that the decisive factor is whether the token holder expects to profit from the efforts of the promoter or a third party.

A token that grants access to a product or service — such as storage space, computing power, or platform usage — may be a genuine utility token if the value is derived from consumption, not appreciation. The SFC’s 2017 statement gives the example of a token that can only be used to pay for services on a specific platform and has no secondary market trading. That token is unlikely to be a security.

However, a token that can be traded on a secondary market, that is marketed with promises of price appreciation, or that is sold to the public in a fundraising round, will be scrutinised as a potential security. The SFC’s 2024 circular on virtual asset trading platforms confirmed that platforms listing tokens with security characteristics must be licensed under Type 1 (dealing in securities) and Type 7 (automated trading services) regulated activities.

The “Efforts of Others” Criterion

The SFC adopts the US Supreme Court’s Howey test reasoning when assessing whether a token involves investment in the “efforts of others.” The court procedure is to ask whether the token holder relies on the promoter’s management, marketing, or technical development to generate returns.

A token issued by a start-up that retains control over the project’s roadmap, that holds the intellectual property rights, and that makes unilateral decisions about token supply and distribution will satisfy this criterion. The SFC’s 2022 enforcement action against an unlicensed ICO operator in Hong Kong (the “Blockchain Holdings” case) found that the issuer’s continued control over the project’s development meant token holders were passive investors.

Consequences of Misclassification

The penalties for issuing a security token without the required licence or prospectus are severe. The legislation provides that dealing in securities without a licence is a criminal offence under Section 114 of Cap. 571, carrying a maximum fine of HKD 5,000,000 and imprisonment for 7 years.

Licensing Requirements

If a token is classified as a security, the issuer must be licensed for Type 1 regulated activity (dealing in securities) under the SFC’s licensing regime. The issuer must also comply with the prospectus requirements under the Companies (Winding Up and Miscellaneous Provisions) Ordinance (Cap. 32) unless an exemption applies.

The SFC’s 2024 circular confirmed that any platform offering trading in security tokens must hold a Type 1 licence and a Type 7 licence for automated trading services. The application process requires submission of business plans, risk assessments, and compliance manuals. The SFC’s average processing time for Type 1 licence applications in 2024 was 18 weeks from submission of a complete application pack.

Prospectus Liability

Section 38 of Cap. 32 requires a registered prospectus for any offer of shares or debentures to the public. The legislation provides that an offer of security tokens to the Hong Kong public — including through websites accessible in Hong Kong — triggers the prospectus requirement unless the offer falls within an exemption, such as the “professional investor” exemption under Section 38A of Cap. 32.

The SFC’s 2023 enforcement action against an ICO issuer that distributed tokens to 200 Hong Kong residents without a prospectus resulted in a public reprimand and a requirement to repurchase tokens at the issue price. The SFC’s statement noted that the issuer had not relied on any available exemption.

Practical Steps for Token Issuers

The SFC expects issuers to conduct a formal legal assessment before launching any token offering. The following steps are based on the SFC’s published guidance and enforcement precedents.

Step 1: Document the Token’s Rights and Features

Prepare a written tokenomics document that sets out each right attached to the token, including: voting rights, profit-sharing rights, redemption rights, and any rights to receive assets or income. The SFC’s 2019 guidance recommends that issuers map each right against the definitions in Schedule 1 of Cap. 571.

Step 2: Assess Marketing and Distribution Channels

The SFC examines how the token is marketed and to whom. An offering targeted at the Hong Kong public — through social media, paid advertisements, or public events — increases the likelihood that the SFC will treat the token as a security. The legislation provides that an offer made to the public in Hong Kong triggers the prospectus requirement regardless of where the issuer is incorporated.

Step 3: Obtain Legal Advice on Classification

The SFC’s 2017 statement explicitly advises issuers to “seek legal advice” on whether their tokens constitute securities. The court procedure is to obtain a formal legal opinion from a Hong Kong solicitor with experience in securities regulation. The opinion should address each element of the CIS test and the share/debenture definition.

Actionable Takeaways

• Confirm whether your token confers any right to profits, dividends, or returns derived from the efforts of the issuer — if yes, assume it is a security until a legal opinion proves otherwise.
• File a Type 1 and Type 7 licence application with the SFC before offering any token that may be classified as a security; the SFC’s processing timeline is 18 weeks on average.
• Register a prospectus under Cap. 32 for any public offer of security tokens unless the offer is limited to professional investors under Section 38A.
• Document the token’s rights and features in a formal tokenomics paper before any marketing or distribution activity.
• Monitor the SFC’s enforcement actions and circulars for updates to the classification framework; the SFC updates its guidance as market practices evolve.

This does not constitute legal advice. Consult a solicitor for your specific case.