What Is an Sto (Security Token Offering)?

If you are thinking about raising funds through blockchain, the first trap is assuming every token sale is just a tech project rather than a regulated financial product. The second is copying overseas token launch terms without checking New Zealand securities law. The third is treating privacy, marketing and investor communications as an afterthought, even though those issues can create real compliance problems before you raise a dollar.

A security token offering, or STO, can look modern and digital, but the legal questions are familiar. Are you offering a security? Are you dealing with retail or wholesale investors? What disclosure rules apply? What do your token terms actually give holders, and do your marketing claims line up with that?

This guide answers what an STO is, when it may be regulated in New Zealand, where founders often get caught, and what to sort out before you spend money on setup, launch documents and investor outreach.

Overview

An STO is a fundraising model where a business issues blockchain-based tokens that represent rights or interests with security-like features, such as ownership, repayment rights, profit participation or other investment entitlements. In New Zealand, the legal treatment usually depends on what the token does in substance, not the label attached to it.

For many businesses, the real question is not whether the token uses blockchain. The real question is whether the token is a regulated financial product, and if so, what disclosure, licensing, governance, privacy and marketing obligations follow.

• Work out exactly what rights the token holder receives, including voting, repayment, revenue share, dividend-style returns or conversion rights.
• Check whether the token is likely to be treated as a debt security, equity security, managed investment product, derivative or another regulated financial product.
• Identify whether you are targeting retail investors, wholesale investors, or a narrower exempt class.
• Review your offer documents, website claims, white paper and pitch materials for Financial Markets Conduct Act and Fair Trading Act risk.
• Put written terms in place covering token functionality, transfer restrictions, investor eligibility, risk disclosures and dispute handling.
• Check your privacy position if you are collecting identity documents, wallet information, contact details or onboarding data.
• Consider anti-money laundering and customer due diligence issues if your structure, activities or counterparties bring those obligations into play.
• Make sure your company structure, governance settings and intellectual property ownership are sorted before launch.

What What Is an Sto Security Token Offering Means For New Zealand Businesses

An STO is usually a capital raising method that gives investors a digital token tied to legal rights, rather than a simple utility token used only to access a platform or service. For New Zealand businesses, that means the token sale may fall within mainstream financial markets regulation even if the technology is new.

A security token often sits somewhere between a conventional investment product and a software-based record of rights. The token may represent shares, debt, profit participation, asset-backed interests, or rights to future returns. Some projects also build transferability or smart contract features into the token, but those technical features do not decide the legal position on their own.

Why the legal character of the token matters

The main risk is misclassifying the token. Founders sometimes say a token is not a security because it is called a token, because it is issued on-chain, or because it will have platform utility later. None of those points settle the issue.

New Zealand regulators and courts generally look at substance over form. If investors contribute money or value in expectation of returns, ownership rights, repayment, governance rights or income linked to the business or assets, the token may well be a financial product.

That matters because different legal obligations can follow, including disclosure requirements, restrictions on how the offer is made, fair dealing obligations, governance obligations and licensing-style questions depending on the structure.

Common forms an STO can take

An STO can be structured in different ways. The legal answer depends on the rights attached to the token and the commercial arrangement behind it.

• A token representing shares or share-like rights in a company.
• A token giving holders repayment and interest-like returns, similar to debt instruments.
• A token tied to pooled assets or pooled investment returns.
• A token giving rights to a share of revenue, profits or asset performance.
• A token that can convert into another security on defined terms.

This is where founders often get caught. A token can have mixed features. It may look like software from the product side and like an investment from the legal side.

How STOs differ from ICOs and ordinary capital raising

An initial coin offering, or ICO, was commonly used as a broader label for token fundraising, especially during earlier crypto market cycles. Some ICOs involved utility tokens, some involved security-like features, and many sat in uncertain territory.

An STO is narrower. It usually refers to a token sale where the token is intended to represent an investment interest or other rights that make securities regulation relevant. In practical terms, STOs are often marketed as a more compliant or regulated form of token fundraising.

Compared with a standard share issue or debt raise, an STO uses blockchain infrastructure for issuance, transfer or recordkeeping. But it does not escape ordinary legal questions about disclosure, investor rights, governance, privacy and misleading statements.

What law may be relevant in New Zealand

The exact framework depends on the offer, but New Zealand businesses commonly need to think about several legal areas at once.

• Financial markets law, especially whether the token is a financial product and whether disclosure obligations apply under the Financial Markets Conduct Act 2013.
• Fair Trading Act obligations, especially around misleading or unsubstantiated claims in marketing, white papers and investor presentations.
• Company law and governance, including how the issuing entity is set up and what authority directors have to issue rights.
• Privacy law, especially where onboarding collects personal information, identity documents and transaction records.
• Anti-money laundering and countering financing of terrorism obligations, where relevant to the business model, transaction flow or regulated activities.
• Contract law, because investor rights still need to be documented clearly even if they are reflected in code.
• Intellectual property law, including ownership of the platform, code, branding and token-related materials.

For founders, the practical takeaway is simple. An STO is not just a software launch. It is usually a regulated fundraising exercise wrapped in technology.

When This Issue Comes Up

The STO question usually comes up when a business wants to raise capital in a way that feels faster, more global or more flexible than traditional fundraising. It also appears when founders already have a token concept and need to know whether they are building a product token, an investment product, or a mix of both.

Before you issue tokens to investors

If you are preparing a white paper, term sheet or waitlist page, you are already in the zone where legal characterisation matters. Founders often leave legal review until after they have promoted the offer, drafted tokenomics and spoken with prospective investors. That can create expensive rework.

Before you spend money on setup, check whether your proposed rights point toward a regulated financial product. Changing the structure early is usually far easier than fixing investor documents after the market has seen them.

When a platform token starts looking like an investment

Many businesses begin with a utility story. The token might be pitched as access to a network, service credits or ecosystem participation. Later, the project adds resale potential, buy-back mechanics, revenue share, governance rights or statements about future value.

That is a common turning point. Once the commercial reality starts to sound like an investment opportunity, the token may move closer to security treatment. Marketing language can also affect risk, especially if promotional material focuses on returns, scarcity or price growth.

When overseas fundraising models are copied into New Zealand

Another common founder moment is borrowing an offshore token structure, especially from Australia, Singapore, the UK or the US. The documents may be polished, but they may not fit New Zealand law, local disclosure settings or your actual company structure.

Terms copied from overseas often contain the wrong investor categories, the wrong legal assumptions about securities law, or generic disclaimers that do not match what is being offered. This is especially risky before you sign platform agreements, appoint advisers or publish offering material.

When dealing with retail participation

The compliance position often becomes more sensitive if the offer is made broadly to the public or to non-professional investors. A business that only had wholesale backers in mind may accidentally drift into a wider offer through social media, website messaging or referral campaigns.

That matters because the distinction between retail and wholesale participation can affect disclosure and offer settings. A broad online launch can easily create issues if access controls, eligibility checks and communications are not designed carefully.

When collecting investor information and onboarding data

An STO often involves collecting names, emails, identification documents, wallet addresses, payment details and residency information. That raises privacy questions straight away.

Businesses sometimes focus heavily on token engineering and forget the basic data questions, such as:

• what personal information is being collected,
• why it is needed,
• how it will be stored,
• who it will be shared with, and
• how long it will be kept.

If your onboarding process includes third party verification providers, offshore hosting, analytics tools or wallet screening tools, those arrangements should be reviewed before launch.

Practical Steps And Common Mistakes

The best STO planning starts with legal substance, not branding. Founders should map the rights, the audience, the offer pathway and the operational setup before publishing a white paper or taking expressions of interest.

1. Define the token rights in plain English

If you cannot explain the token clearly in a one-page summary, the structure is probably not ready. The summary should state what the holder receives, what they do not receive, when rights arise, whether rights can change, and who controls the system.

Your internal checklist should cover:

• whether the token gives equity, debt, revenue share or governance rights,
• whether there is any promise of repayment or return,
• whether holders rely on your team to generate value,
• whether tokens are transferable or restricted, and
• what happens if the project changes direction, pauses or fails.

A common mistake is relying on vague tokenomics diagrams instead of legal descriptions. Investors, advisers and regulators need more than a chart.

2. Match the structure to the right legal treatment

Once the rights are clear, the next step is testing the likely legal category. That analysis should happen before you sign launch platform terms or announce dates.

The right category may affect:

• whether a product disclosure statement or other regulated disclosure is needed,
• whether an exclusion or exemption is being relied on,
• whether investor eligibility checks are necessary, and
• what ongoing governance or reporting expectations may apply.

This is not just a paperwork issue. It shapes how the whole raise is designed.

3. Align the website, white paper and investor deck

Marketing claims are one of the fastest ways a project creates legal risk. Founders often put cautious legal language in formal terms, then use far more aggressive claims in social posts, webinars or pitch decks.

Those materials should tell the same story. Statements about likely returns, future exchange listings, guaranteed utility, regulatory status or scarcity should be checked carefully. Under fair trading rules, businesses can get into trouble for misleading or unsubstantiated representations even if a disclaimer appears elsewhere.

A practical content review should cover:

• taglines and headlines,
• token value statements,
• roadmap promises,
• references to investor demand,
• descriptions of legal status, and
• comparisons with shares, bonds or other investments.

4. Put proper contracts behind the token

Code does not replace contracts. Even where smart contracts automate issue or transfer mechanics, the legal relationship with token holders still needs written terms.

Depending on the offer, documents may include:

• token terms and conditions,
• subscription or application terms,
• investor representations and acknowledgments,
• risk disclosures,
• platform terms of use,
• privacy policy or collection notice for onboarding and communications, and
• supplier agreements with key platform or verification providers.

A common mistake is assuming a white paper does all the legal work. It usually does not. White papers are often descriptive and promotional. They are not always drafted as binding legal documents.

5. Sort out privacy before onboarding starts

If you are collecting personal information, you need a clear privacy position from day one. New Zealand businesses should think about what the Privacy Act 2020 requires in practice, including transparency about collection and use.

Before you launch online, review:

• what information is mandatory,
• whether all requested data is actually necessary,
• how consent and notices are handled,
• where data is stored,
• whether any provider is based offshore, and
• how access and correction requests will be managed.

Projects using blockchain also need to think carefully about permanence. If personal information is written on-chain, changing or deleting it can be difficult or impossible. That design issue should be addressed early.

6. Check AML and investor verification settings

Not every token project will have the same anti-money laundering exposure, but many founders assume this area can be ignored until later. That is risky if your model involves financial services, fiat handling, exchange pathways or regulated counterparties.

You may need to assess customer due diligence, source of funds questions, sanctions screening, suspicious activity processes and recordkeeping. The exact obligations depend on the business model and service chain, so the structure matters.

7. Get the entity, governance and IP house in order

Investors will look past the token and ask basic company questions. Who is issuing the token? Who owns the code? Who controls treasury assets? What approvals have the directors given? Is the cap table clean?

Before you spend money on setup, tidy the foundation documents and records. That may include:

• company incorporation and Companies Office details,
• shareholder arrangements,
• director approvals,
• contractor and developer IP assignments,
• brand protection, including trade mark review, and
• service agreements with key suppliers and platform partners.

Founders sometimes focus on launch branding but forget who legally owns the brand, codebase or smart contract outputs. That can become a major issue in due diligence.

Common mistakes founders make with STOs

Most problems show up because the legal work starts too late or because the project team treats compliance as a bolt-on. The usual errors include:

• calling the token a utility token without analysing the rights attached to it,
• making public claims about token value or returns too early,
• using offshore templates that do not fit New Zealand law,
• failing to separate retail and wholesale offer settings,
• collecting more personal information than necessary,
• publishing a white paper before contract terms are settled, and
• assuming smart contract logic is enough to define legal rights.

Getting these basics right early can save a lot of cost and reputation damage later.

FAQs

Is an STO legal in New Zealand?

An STO can be legal in New Zealand, but legality depends on how it is structured and offered. The key issue is whether the token is a regulated financial product and whether the offer complies with the relevant rules.

Is every token sale a security token offering?

No. Some tokens are designed only for access or utility, although even those can drift into security territory if the rights or marketing make them look like investments. Labels alone do not decide the legal answer.

Do I need a disclosure document for an STO?

Possibly. If the token is a financial product and the offer is made in a way that triggers New Zealand disclosure obligations, formal disclosure may be required unless an exclusion or exemption applies. The answer depends on the structure and the audience.

Does a white paper count as the legal contract?

Usually not on its own. A white paper may explain the project, but businesses generally also need clear contractual terms covering subscriptions, token rights, risks, transfer restrictions and investor acknowledgments.

Why does privacy matter in an STO?

Privacy matters because STOs often collect investor identity data, wallet details, contact information and transaction records. If you collect personal information, you need lawful collection practices, clear notices and sensible storage and access controls.

Key Takeaways

• An STO is a token-based fundraising model where the token carries investment-style or security-like rights.
• In New Zealand, the legal treatment depends on the substance of the rights and the way the offer is made, not just the technology or label.
• Founders should assess financial markets law, fair trading rules, privacy obligations, contracts, AML exposure and company governance before launch.
• White papers and marketing material need to match the legal structure and avoid exaggerated or misleading claims.
• Clear token terms, investor documents, privacy settings and ownership of IP should be sorted before you sign contracts or publish the offer.

If your business is dealing with what is an sto security token offering and wants help with token terms, investor disclosure, privacy compliance, and marketing review, you can reach us on 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.