Security tokens
Security token platform: how compliant tokens are issued and run
A security token platform is software for issuing and running tokens that represent securities, such as equity, debt, fund units or revenue rights, with investor verification and transfer rules built in. On Libertum’s T-Suite, regulated tokens use ERC-3643 (T-REX) on EVM chains, CIP-113 on Cardano or authorised XRP Ledger tokens, so transfers are checked on-chain.
Last updated:
Educational content, not legal advice. Whether a token is a security, and what an offering needs, depends on the law of each jurisdiction and on how the instrument is structured. Work with your own counsel.
What is a security token?
A security token is a digital token that represents a financial instrument or a right to an asset: a share in a company, a debt claim, a unit in a fund, a fraction of a property or a share of revenue. What makes it a security token is not the technology but the legal nature of what it represents, and that is decided by the law of the jurisdiction where it is issued and offered.
Because securities usually come with rules about who may hold them, how much and when they may be transferred, a security token needs those rules enforced. The most robust approach is to enforce them in the token itself, so a transfer to an unverified or ineligible wallet simply fails. That is what standards such as ERC-3643 and CIP-113 do.
What is the difference between a security token and a utility token?
A utility token gives access to a product or service; a security token represents an investment. In practice the boundary is legal, not technical, and the same instrument can be classified differently in different countries. The technical difference that matters on a platform is how transfers are controlled.
| Security token | Utility token | |
|---|---|---|
| Represents | An investment: equity, debt, fund units, revenue or asset rights | Access to a product, service or network |
| Who can hold it | Usually only verified, eligible investors | Usually anyone |
| Typical standard on Libertum | ERC-3643 (T-REX), CIP-113, XRPL authorised issued currency or XLS-33 MPT with authorisation | ERC-20, CIP-20 or a plain XRPL issued currency |
| Where rules are enforced | On-chain, on every transfer, plus platform checks | At platform level only (KYC at the marketplace) |
Whether a particular token is a security is a legal question for your counsel. See tokenization regulation for the frameworks involved.
What is an STO (security token offering)?
A security token offering (STO) is the sale of security tokens to investors, typically in a primary raise. Depending on the jurisdiction, an offering may need registration, an exemption, an offering document, investor-category limits or a licensed intermediary. Those requirements depend on the law of each country where the tokens are offered and on how the instrument is structured, so there is no single STO rulebook.
On Libertum, the issuer runs the offering in T-Suite: verified investors subscribe, sign the investor agreement where one is required, pay by card, bank wire or stablecoin, and receive tokens as orders settle. Libertum provides the technology. It does not decide whether your token is a security, and issuers obtain their own authorisations with their own counsel.
Libertum, S.A. de C.V. holds an El Salvador Digital Asset Service Provider (DASP) licence from the CNAD, registry entry PSAD-0094. It covers custody, exchange and transfer of USDT and USDC and the receipt and transmission of client orders, in El Salvador only. It does not authorise issuance and does not cover the structuring, promotion or management of investment products. See Licences.
What is ERC-3643 (T-REX)?
ERC-3643, also called T-REX (Token for Regulated EXchanges), is an Ethereum standard for permissioned tokens. It was originally developed by Tokeny SA and is now an ERC. It embeds compliance in the transfer logic: every transfer checks the sender’s frozen status, the receiver’s identity verification and a chain of compliance modules before any tokens move. A T-REX deployment is a suite of six core contracts:
- Token: the ERC-20-compatible token whose transfer function enforces compliance.
- Identity Registry: maps wallet addresses to identity contracts and tracks claim status.
- Identity Registry Storage: the identity data layer, which several tokens can share.
- Trusted Issuers Registry: the approved claim issuers, such as KYC providers and accreditation attesters.
- Claim Topics Registry: the claims this token requires, such as KYC-verified, country or accredited.
- Modular Compliance: the controller that chains the compliance modules every transfer must pass.
Libertum deploys the whole suite plus the compliance modules you choose (Country Allow, Country Restrict, Supply Limit, Max Balance, Hold Time) in a single transaction through the TREXFactory. ERC-3643 is live on Libertum on Base, Ethereum, Polygon and Arbitrum mainnets.
Who controls a security token, and can it be frozen or recovered?
ERC-3643 separates two kinds of authority. The Owner is the only role that can change compliance modules, change the identity registry or transfer ownership, so it is usually a hardware wallet or multi-sig held by the issuer. Agents are operational wallets that can mint, burn, pause, freeze, force-transfer and recover; routine work such as minting at order settlement is typically delegated to Libertum’s relayer while the issuer keeps owner powers.
- Freeze: a full freeze stops a wallet sending or receiving; a partial freeze locks a specific quantity.
- Forced transfer: moves tokens regardless of the sender’s frozen status, but the receiver must still pass verification.
- Recovery: moves all tokens from a lost wallet to a new one and re-links the new wallet to the same identity.
- On Cardano, CIP-113 with Libertum’s modules supports the equivalent freeze, unfreeze, seize and force-transfer actions.
Can you issue security tokens on Cardano or the XRP Ledger?
Yes. CIP-113 (Programmable Tokens) is the Cardano counterpart to ERC-3643: transfer rules are enforced by on-chain scripts. Libertum’s integration has been live on Cardano mainnet since 5 October 2026 on the Cardano Foundation’s canonical CIP-113 deployment, and Libertum adds its own on-chain modules: a KYC list with claim topics, country allow and restrict lists, lock-up, pause, supply and per-holder caps, and partial freezes.
On the XRP Ledger, Libertum issues either an issued currency with authorised trust lines or an XLS-33 Multi-Purpose Token (MPT) with authorisation. Each offering has its own issuer account; before a holder’s first unit the platform issues an on-ledger credential, the holder opens the trust line or MPT holding and the issuer authorises it. A Permissioned Domain created at deployment limits secondary trading to credentialed holders. DEX trading of MPTs waits on the MPTokensV2 amendment. See XRPL.
Which token standard should you use for a security token?
Pick the standard by chain and by whether rules must be enforced on-chain. Compare all options on standard compliance or in the token standards guide.
| Standard | Live mainnets on Libertum | Compliance |
|---|---|---|
| ERC-3643 (T-REX) | Base, Ethereum, Polygon, Arbitrum | On-chain identity and compliance modules |
| CIP-113 | Cardano | On-chain programmable rules plus Libertum modules |
| XRPL issued currency, authorised trust lines | XRP Ledger | On-ledger authorisation and credentials |
| XLS-33 MPT with authorisation | XRP Ledger | On-ledger authorisation and credentials |
| ERC-20, ERC-721, CIP-20, plain XRPL issued currency | ERC-20: Base, Ethereum. ERC-721: Base. CIP-20: Cardano. XRPL | Platform level only |
Already issued a token elsewhere? Token Import brings it in as a read-only Mirror (cap table and history) for every supported standard. On EVM it can move to Operate once you grant roles or hand control to your organisation’s custodian wallet; Cardano and XRPL imports stay read-only.
How can investors verify a security token's smart contracts?
Every offering deployed on T-Suite is checked on-chain automatically and receives a signed Smart Contract Certificate from Libertum. It separates the rules the contract enforces on-chain from the controls the platform enforces off-chain, is signed with Ed25519, has its fingerprint anchored on the offering’s own chain and is re-checked nightly. Anyone can verify it publicly at /verify. Imported tokens are certified as observed, not deployed by Libertum.
The certificate is Libertum’s technology certificate. It is not a regulatory approval of the offering or its issuer, and not a certification for a public offering under El Salvador’s Digital Assets Issuance Law (LEAD). See Compliance.
Watch: signed, auditable investor agreements in T-Suite
See how an issuer turns on the agreement requirement, signs a template once, and how each investor signs with a one-time code at checkout, leaving an audit trail and a fingerprint of the exact document.
Transcript: Agreements demo
Every investment needs a signed agreement.
Yet subscription agreements are still emailed, printed, scanned and chased, and nobody is sure which version was signed.
In T-Suite, you start from agreement templates, ready to adapt to your offering.
When you create an offering, you switch on the investment agreement requirement.
You pick the template and sign it once, as the issuer. That master signature covers every investor who subscribes.
At checkout, the investor reads the agreement with their own details filled in, and signs it with a one-time code.
Every executed agreement lands on your dashboard: who signed, when, and for which order.
Each one carries a full audit trail and a fingerprint of the exact document, so you can prove what was signed.
Investors keep their signed copies in their own agreements library.
For funds, asset managers and fund administrators: make every investment executed and auditable. Book a demo at libertum.io.
Related
- ERC-3643 (T-REX) The permissioned EVM standard in detail
- CIP-113 Programmable, compliance-native tokens on Cardano
- XRPL Authorised issued currencies and XLS-33 MPTs
- Standard compliance How each standard enforces rules
- T-Suite Issue, run and service tokenized offerings
- Fund tokenization Tokenized fund units with Funds
- How to tokenize an asset The nine phases, step by step
- Tokenization cost Libertum plans and fees
- Funds Tokenized fund units for fund administrators
- Plans and pricing The live plan page
Security token FAQ
Is T-REX the same as ERC-3643?
Yes. T-REX (Token for Regulated EXchanges) is the original name of the framework, developed by Tokeny SA, that became the ERC-3643 standard. On Libertum it is deployed as the six-contract T-REX suite plus the compliance modules each offering selects, on Base, Ethereum, Polygon and Arbitrum mainnets.
Does Libertum decide whether my token is a security?
No. Classification depends on the law of each jurisdiction where the token is offered and on how the instrument is structured, so it is a question for your own counsel. Libertum provides the technology, and its El Salvador DASP licence does not authorise issuance or cover structuring or promoting investment products.
Can I run an STO on Libertum?
You can run a primary raise for a security token in T-Suite: verified investors subscribe, sign agreements where required and pay by card, wire or stablecoin. Any registration, exemption or licence the offering needs in your jurisdictions is your responsibility, obtained with your own counsel.
What happens if an investor loses access to their wallet?
On ERC-3643 an agent can run a recovery: all tokens move atomically from the lost wallet to a new one, and the new wallet is re-linked to the same verified identity. By default this is initiated by the transfer agent, and your policy can require dual control.
Can security tokens trade on a secondary market?
Two whitelisted investors can transfer peer-to-peer, and every transfer must still pass the token’s compliance modules. Libertum’s P2P order book is live on Base mainnet only, with a USD 25 listing fee paid by the seller and a 0.5% trade fee paid by the buyer.
Is the Smart Contract Certificate a regulatory approval?
No. It records the results of Libertum’s automated technical checks at the time stated and can be verified publicly. It is not a regulatory approval of the offering or its issuer, and not a certification for a public offering under El Salvador’s LEAD.
Issue a compliant security token
See ERC-3643, CIP-113 and authorised XRPL tokens running in T-Suite, from investor verification to on-chain transfer rules.