Initial Coin Offering (ICO) vs. Security Token Offering (STO) in 2019

The buzz­word for alter­na­tive fundrais­ing has been ICO for a “long time” —  “long” in rela­tion to the short lived tech­ni­cal world we are all work­ing in. In actu­al terms, the hype last­ed less than 2 years. There has been plen­ty of good and bad news around the ICO, very recent­ly a lot more bad than good news.

From good to bad in a very short amount of time. The new buzz­word, as it appears, is STO, which is also fund rais­ing, also on the blockchain but that’s about it what the two have in com­mon.

In this arti­cle, from a “Mal­tese per­spec­tive”, I am try­ing to deci­pher and com­pare the two in all detail. Dr. Wern­er & Part­ner is advis­ing clients on both options:  

On the ICO as (future) VFA agents and on the STO as con­sul­tants, lawyers and legal project man­agers.

ICO vs STO — Doing most of the job yourself vs. relying on third parties

To com­pare ICO and STO in one arti­cle is dif­fi­cult, as the two appear to be close and are in a way but they still fol­low very dif­fer­ent laws and prin­ci­ples.

It’s like trav­el­ling from point A to B by car or by air­plane.

Ulti­mate­ly you just want to be at point B. But where­as you can dri­ve the car (most prob­a­bly) your­self and need noth­ing more than some plan­ning, GPS nav­i­ga­tion, a lot of cof­fee and enough mon­ey for gas, com­pared to trav­el­ling by plane, it is a very dif­fer­ent expe­ri­ence.

Going some­where by flight you need to rely (most of the time) on third par­ties like, pilots, air­lines, air­ports, secu­ri­ty per­son­nel, flight atten­dants and more. Fly­ing can be a lot more effec­tive but your role is a lot more pas­sive com­pared to dri­ving with your car.

Sure­ly you can make your own pilot licence and buy your own pri­vate jet, but in 99.9% of the cas­es, you will not do that.

Very sim­i­lar with STO’s: You can obtain your own finan­cial / invest­ment / bank / fund licence but for 99% of all cas­es you would rely heav­i­ly on third (reg­u­lat­ed) par­ties.

See a sum­ma­ry of the points in the fol­low­ing video and a detailed analy­sis fol­lowed there under:


Mit dem Laden des Videos akzep­tieren Sie die Daten­schutzerk­lärung von YouTube.
Mehr erfahren

Video laden

ICO in Malta 2019: This is what is going to happen

With the intro­duc­tion of the “cryp­to laws or reg­u­la­tions” in Novem­ber 2018, includ­ing the “Vir­tu­al Finan­cial Assets Act”, Mal­ta was the first coun­try glob­al­ly to tack­le the issuance of new cryp­tocur­ren­cy in a reg­u­lat­ed fash­ion. The law mak­ers clear­ly picked up on the mas­sive amount of fraud that had been trou­bling reg­u­la­tors, investors, par­tic­i­pants, banks, search engines and social media plat­forms — and forged a reg­u­la­tion that would cater for the com­plete life cycle of new­ly issued token or vir­tu­al finan­cial asset.

This step ini­tial­ly was received with great opti­mism and com­pa­nies came swarm­ing on to the Mal­tese islands.

When the laws and more impor­tant­ly the reg­u­la­tions and rules got pub­lished, it appears there have been some mood set­backs com­pared to the ini­tial “wow” fac­tor and some of the ini­tial prospects lost inter­est.

The reg­u­la­tion is strict and at first glance not easy on the eyes. It is not for everyone’s taste and sure­ly not in everyone’s finan­cial reach or bet­ter: Not in everyone’s finan­cial will. Where­as some of the poten­tial token issuers might gen­er­al­ly have the funds to cater for the array of expens­es that tag along with a Mal­tese ICO, they sim­ply do not want to effort it, and deem it unnec­es­sary for now. Pos­si­bly still in com­par­i­son with the appar­ent eas­i­er options out there.

Why an ICO in Malta? Why bother?

The argu­ment here might be, that the ICO as a fundrais­ing mod­el has been per­vert­ed by too many and we are still com­par­ing the cur­rent cli­mate with the cli­max of 2017. The argu­ment might also be, that only a frac­tion of such ICOs should have ever been launched in the first place and this frac­tion would not have shied away from a robust frame­work and from the required efforts. And that the rest, even with good inten­tions, should not use an ICO any­way.

In any case, with the com­ing mass adop­tion of cryp­to cur­ren­cy and with big­ger play­ers, such as banks to join the par­ty, an ICO with a “stamp” from Mal­ta, will sure­ly be per­ceived as “high stan­dard, high reg­u­la­tion, dili­gent, legit­i­mate or sim­i­lar”.

It is my view that there is no way around a reg­u­lat­ed ICO in the future. And Mal­ta offers plen­ty of reg­u­la­tion.

How an ICO is regulated in Malta

In Mal­ta, we have “invent­ed” a new class of assets, the VIRTUAL FINANCIAL ASSET (“VFA”).  This is basi­cal­ly more than a pure util­i­ty token and less than a secu­ri­ty token. Most ICO’s as we know them would fall in the def­i­n­i­tion of a VFA.

Any com­pa­ny issu­ing a new VFA will have to fol­low the VFA reg­u­la­tion, con­sist­ing of laws, reg­u­la­tions and rules.

You find an overview of the “VFA Frame­work” here: Click me!

The reg­u­la­tion in Mal­ta fol­lows the exist­ing back bone of finan­cial super­vi­sion loose­ly but there are many unique bits and pieces.

Apart from a com­plete own­er and own­er­ship “screen­ing”, the issu­ing com­pa­ny needs to adhere to a num­ber of poli­cies and pro­ce­dures. Those poli­cies share affin­i­ty with the “nor­mal” finan­cial world. For exam­ple you find poli­cies that deal with insid­er deal­ing or trad­ing, sen­si­tive infor­ma­tion, refund to investors and more.

Great empha­sis is also giv­en to the white paper and its con­tents — to an extent that cer­tain ele­ments, just like in a prospec­tus must to be includ­ed.

Apart from those inter­nal con­trol and good gov­er­nance aspects, there is also an ele­ment of con­stant exter­nal “super­vi­sion” or “con­trol”, name­ly the “Board of Func­tionar­ies”. This is a group of pro­fes­sion­als that remain in close prox­im­i­ty to the ICO at all times and which / who col­lec­tive­ly and /or indi­vid­u­al­ly exe­cute anoth­er lay­er of dili­gence.

There is:

  1. A Cus­to­di­an
  2. A exter­nal audi­tor
  3. A sys­tems audi­tor
  4. A VFA Agent and
  5. A mon­ey laun­der­ing report­ing offi­cer

Retail vs Non Retail ICO Malta

ICO com­pa­nies will have to make sure to iden­ti­fy and cat­e­go­rize their investors in two main groups:

  1. Retail investors
  2. Non retail / pro­fes­sion­al / expe­ri­enced investors

Such cat­e­gori­sa­tion is based on a self dec­la­ra­tion by the investor, mean­ing, the ICO will need, for every investor who wants to be treat­ed as “non retail”, to obtain a dec­la­ra­tion that he / she / it has suf­fi­cient knowl­edge / expe­ri­ence and finan­cial resources to be clas­si­fied as “non retail”.

That of course is sim­pli­fied, but you get the idea.

It is not as trou­ble­some as the “Reg D” com­pli­ance from the USA

Why the dif­fer­en­ti­a­tion? There a is max­i­mum amount of invest­ment per retail investor per ICO per year.  This amount is fixed at 5000 EUR. There­fore, for any investor who wants to invest more, you need the above men­tioned dec­la­ra­tion.

Your Malta ICO on crypto currency exchanges

There is some good news for once. Since the reg­u­la­tion around the issuance of a VFA in Mal­ta is so strict, I am not lean­ing myself too much out of the win­dow when I say: Any exchange will list it. Or even more, want to list it.

I thor­ough­ly believe, that the “stamp” of the Mal­tese reg­u­la­tion will be equal to a qual­i­ty seal. Very much like the well known “Made in Ger­many”, the ICO equiv­a­lent will be “Made in Mal­ta”.

As you might know, there are cur­rent­ly many cryp­to cur­ren­cy exchanges get­ting ready to get reg­u­lat­ed under the same VFA frame­work — those will sure­ly be more than hap­py to list any Mal­ta issued token from a reg­u­la­to­ry point of view.

Promotion of a Malta ICO

As stat­ed above, the reg­u­la­tion is fair­ly new, and was as such one of the first, if not the first in the world, a one of a kind. Oth­er coun­tries fol­low a sim­i­lar path — but noth­ing has been har­monised, there is not the one stan­dard or at least one direc­tion. Mal­ta wants to lead the charge, wants to pro­vide a stan­dard, a direc­tion.

There­fore, strict­ly speak­ing you would need to check coun­try by coun­try what the rules are. From a Mal­tese per­spec­tive, you can pro­mote wher­ev­er you want — apart from the very obvi­ous sanc­tioned coun­tries or sim­i­lar.

Since both is not real­ly prac­ti­cal, it is my view, that the nature and degree of the Mal­tese reg­u­la­tion will give  a Mal­tese ICO a huge cred­it in front of many reg­u­la­tors. I also believe that gen­er­al­ly with­in the EU / EEA a Mal­tese ICO should get the ben­e­fit of the doubt, also under the free­dom of ser­vice rule. It is how­ev­er not guar­an­teed and we can only encour­age clients to seek ade­quate advice before jump­ing to con­clu­sions.

The pro­mo­tion of an STO, in con­trast and inter­est­ing­ly enough, is a lot clear­er, as you can read here under:

STO Malta 2019: One possible way forward

STO — a definition

DISCLAIMER: The term STO (Secu­ri­ty Token Offer­ing) is nowhere defined offi­cial­ly, so it means some­thing else for every­one. In the con­text of this arti­cle, it shall mean and describe ONE pos­si­ble way on how to issue and dis­trib­ute a token, that, sim­i­lar to a share in a lim­it­ed com­pa­ny, con­tains the right to par­tic­i­pate in the prof­it of that com­pa­ny. You might want to com­pare it to an IPO.

Why third (regulated) parties anyway?

As stat­ed above, for an STO you need to rely on third par­ties. Why?

This is a valid ques­tion. When­ev­er you deal with “secu­ri­ties”, for exam­ple in the con­text of advis­ing, sell­ing, issu­ing, dis­trib­ut­ing, man­ag­ing or sim­i­lar, there are cur­rent laws and reg­u­la­tions in place to reg­u­late any­thing relat­ed.

And not only since yes­ter­day, but since decades.

Even if you deal with “tok­enized”  secu­ri­ties or “secu­ri­ty” tokens — it might have changed the tech­ni­cal shape but it remains a secu­ri­ty. And this is where the third par­ty comes into play: a com­pa­ny or per­son, licenced/authorised or reg­u­lat­ed to deal with secu­ri­ties.

In the EU/EEA and in any “nor­mal” coun­try sim­i­lar rules / laws exist. Coun­tries includ­ing USA, AUS, South Korea, Japan, South Africa, Switzer­land etc.

There­fore, when­ev­er you con­sid­er an STO, con­sid­er reg­u­la­tion.

Many com­pa­nies and providers I have seen,  seem to offer “turnkey STO” solu­tions. In some cas­es this might be the actu­al case, how­ev­er in most of the cas­es it’s tech­ni­cal ser­vice providers that might cater tech­ni­cal­ly for the aspects of a reg­u­lat­ed envi­ron­ment, how­ev­er one can still not just use their ser­vices and then start issu­ing secu­ri­ty tokens.


This is the first thing you should be look­ing for. In most cas­es, due to the strict reg­u­la­tion those ser­vice providers are under, they will either have their own tech­ni­cal ser­vice provider of choice, that the issuer / client will have to use or they will han­dle all the tech­ni­cal aspects in-house.

As most of the aspects of an STO are reg­u­lat­ed and ruled by laws, you have to be care­ful that you receive ade­quate legal advice. You are talk­ing secu­ri­ty laws in all shapes and forms so not any­one should and could advice on STOs.

At least from a cer­tain lev­el you will need a lawyer or legal team — a sim­ple “STO Advi­sor” or sim­i­lar role / posi­tion is not enough, the mat­ter is very com­plex.

The Dr Werner & Partner legal team — in the apex of the learning curve:

Our very own team of lawyers is con­tin­u­ous­ly learn­ing together with our clients and togeth­er with oth­er lawyers and togeth­er with the reg­u­la­tors, on a dai­ly basis about this very new top­ic.

MIFID 2 in the EU: In the EU the reg­u­la­to­ry frame­work or basis for invest­ment com­pa­nies or invest­ment ser­vices com­pa­nies is called MIFID, the “Mar­ket in Finan­cial Instru­ments Direc­tive”, in place since 2008. The cur­rent, updat­ed ver­sion is MiFID 2, in force since 2018. 

In Mal­ta this was trans­posed into domes­tic law accord­ing­ly.

One example how Dr Werner & Partner approaches STOs -

Tok­enized Invest­ment Cer­tifi­cates issued by a MiFID2 MTF deal­ing on own account.”

Wow, that’s a dif­fi­cult start. Let me explain with a prac­ti­cal exam­ple, as this is one very fre­quent­ly request­ed ser­vice:

A busi­ness or start up would like to attract invest­ment in order to scale it’s busi­ness, the busi­ness aims to issue tokens in return for the invest­ment. The token how­ev­er should have no util­i­ty val­ue, the busi­ness might not even have a blockchain busi­ness case.

The busi­ness only feels, that it could poten­tial­ly reach most of the investor thought a token fund raise.

The busi­ness would like investors to par­tic­i­pate in the prof­it of the busi­ness, plain and sim­ple.

In a nor­mal world, the busi­ness would now issue bonds or sell its shares or sim­i­lar. It could issue bonds and tok­enize those direct­ly but it could not tok­enize the shares or share cap­i­tal direct­ly.

I have seen one case in Switzer­land (where the reg­is­ter of shares for a lim­it­ed com­pa­ny is not pub­lic but only with the com­pa­ny itself, which makes it a lot eas­i­er), where a com­pa­ny man­aged to have the share cap­i­tal and reg­is­ter tok­enized, accept­ed by the local admin­is­tra­tion.  

Side note: I am ful­ly aware that of course you can pop any share on a blockchain and can trans­fer own­er­ship how­ev­er you please — but this is arti­cle is about achiev­ing this or a sim­i­lar result in a reg­u­lat­ed, offi­cial, gov­ern­ment accept­ed fash­ion. As much as we are try­ing to lob­by the lat­ter with author­i­ties, cur­rent­ly we have to work with what is avail­able and in close to all of the cas­es you can­not tok­enize share cap­i­tal direct­ly.

Let’s go back to our exam­ple com­pa­ny:  How can you tok­enize some­thing sim­i­lar to a share of a com­pa­ny with­out tok­eniz­ing the share itself. Let’s analyse what you are actu­al­ly try­ing to achieve. You are sell­ing the right to par­tic­i­pate in the prof­its of your busi­ness.

A right is a con­tract, there­fore, let’s stress dear old wiki: “In finance, a deriv­a­tive is a con­tract that derives its val­ue from the per­for­mance of an under­ly­ing enti­ty.”

You see how close we are? It appears a deriv­a­tive could solve the prob­lem of sell­ing some­thing like a share or a bond which is not a share or bond.

There­fore the answer to the ques­tion

Who can cre­ate and sell deriv­a­tives in Mal­ta / the EU?”

is the same answer to th ques­tion:

Who can issue and list an STO in Mal­ta / the EU?”

The answer:


This means: If the busi­ness engages such bro­ker, man­dat­ing it to issue/emit a deriv­a­tive that derives its val­ue from the per­for­mance / prof­it of the under­ly­ing entity/business and if such bro­ker lists/ sells  such deriv­a­tive on it’s plat­form, the “sec­ondary mar­ket”, then we have already one part of the task cov­ered.

But so far we are still in the ana­logue world, so far no token has been issued.

Find the right bro­ker, and it will tok­enize the deriv­a­tive / the prof­it par­tic­i­pa­tion in your com­pa­ny for you and it will list that token on it’s plat­form, the sec­ondary mar­ket.

Here is where the STO starts:

The gen­er­al pub­lic can reg­is­ter an account with the bro­ker and can buy a token that con­tains a frac­tion of the prof­it rights of the com­pa­ny. The gen­er­al pub­lic can trade this token on the broker’s plat­form or any oth­er ade­quate­ly licenced bro­ker, that allows trad­ing of secu­ri­ty token (not many cur­rent­ly).

As you can see, this is a very homo­gene, nar­row­ly reg­u­lat­ed play­ing field, so any ser­vice provider offer­ing “com­pli­ant STO turnkey solu­tions” either has a sim­i­lar licence or is in fact a ser­vice provider for bro­kers, and not for the final client.

Don’t be put off by the idea that you have to reg­is­ter an account with a bro­ker, hav­ing thought that this is the blockchain and you trans­fer how­ev­er and when­ev­er you want. Very sim­i­lar to “nor­mal” secu­ri­ties, shares, bonds, deriv­a­tives, CFDs etc you can trade those only on reg­u­lat­ed enti­ties, and you would have to reg­is­ter accounts with those as well.

If you or I like this or not or if you think this is against the very idea of blockchain: You sure­ly have a point, but it is what it is.

White listing of wallets and smart contract compliance

Assume our deriv­a­tive has been put onto the blockchain / into a token. While reg­is­ter­ing your account with the bro­ker, the mag­ic of blockchain starts to unfold:

Any wal­let on which the par­tic­i­pant would like to receive the secu­ri­ty token will have to be white list­ed with the bro­ker. This means “K Y C’ed” (Know your client), mean­ing the bro­ker will take your pass­port, address etc and will “link” this to your wal­let. Like this, the bro­ker makes sure, that the investor is who he says he/she is.

But more impor­tant­ly, when the token is trans­ferred to the investors wal­lets, there is also a smart con­tract deployed.  Such smart con­tract will only allow you to trans­fer the token to a wal­let that has been white list­ed before­hand.

That means, and that is quite bril­liant, the token can nev­er be trans­ferred to a wal­let that has not been whitelist­ed for this STO. Mean­ing, if for exam­ple, STOs are for­bid­den in Chi­na or you want to exclude North Korea, this is all being catered for by the smart con­tract deployed. By the bro­ker.

For a rea­son: Since the bro­ker is the issuer, a reg­u­lat­ed enti­ty, of course it will make sure that every­thing is super com­pli­ant, oth­er­wise this could back­fire and jeop­ar­dize the licence (which by the way takes about 2 years to get) of our bro­ker.

Promotion / Marketing of the STO

The emi­tent / Issuer of the token is the bro­ker with all respon­si­bil­i­ties that come with an invest­ment ser­vice licence. This means, the client can­not pro­mote the STO as the client pleas­es. This can­not be high­light­ed enough.

Under most secu­ri­ty laws it is not only impor­tant that and where the actu­al issuance and dis­tri­b­u­tion is reg­u­lat­ed but also the who, where and by whom pro­mo­tion and solic­i­ta­tion is per­formed.

This is where sud­den­ly a lot of grey areas appear and it los­es a lot of the clar­i­ty. This is not par­tic­u­lar­ly affin to the STO but a gen­er­al issue of pro­mot­ing finan­cial / invest­ment ser­vices or prod­ucts.

For this arti­cle and in our con­text, since the bro­ker is MiFID 2 reg­u­lat­ed, you are fair­ly safe to say that, with­in a cer­tain scope and only by the bro­ker itself, a reg­u­lat­ed inter­me­di­ary and / or in direct liai­son with the bro­ker:

Distribution and solicitation for and to EU/ EEA based investors works. Even for retail investors.

Every­thing out­side is on a case to case basis, how­ev­er a MIFID 2 license enjoys are cer­tain strong  rep­u­ta­tion, so you do not need from to start from zero when you want to pro­mote some­where out­side the EU/EEA.

The issue with the liquidity

Since this STO as described in the arti­cle is with­in the mer­its of MIFID 2, the full array of investor pro­tec­tion will have to be regard­ed, most impor­tant­ly, if the STO is tar­get­ing “retail investors”.

Retail is every investor who is not pro­fes­sion­al.

Put sim­ply, your aver­age joe, under 100k EUR invest­ment, with no or lit­tle own invest­ment or trad­ing expe­ri­ence is a retail investor. Cer­tain cri­te­ria have to be regard­ed and cer­tain process­es will have to be fol­lowed before the bro­ker can onboard such retail client.

Equal­ly impor­tant, once the investor has paid and has received the token: He or she needs to be able to give it back, liq­ui­date the invest­ment in a very short amount of time. You can­not lock up retail investor as you can lock up non retail investors. This is very impor­tant for STOs being done as described here: Investors buy a finan­cial prod­uct not a share itself.

There­fore, be pre­pared that the bro­ker will require a cer­tain amount of cash from the STO under his con­trol, in order to pay out exit­ing retail investors. This is very impor­tant for the cash flow cal­cu­la­tion.

Liq­uid­i­ty how­ev­er is also an impor­tant com­mer­cial aspect, as no bro­ker likes an emp­ty mar­ket­place.

Exchanges and trading of a security token

As briefly explained above, any secu­ri­ty includ­ing tok­enized secu­ri­ty can only be trad­ed on a ade­quate­ly reg­u­lat­ed enti­ty — ade­quate­ly with­in the EU means a MIFID 2 reg­u­lat­ed enti­ty or else­where in the world (exam­ples):  “trad­ing venue”, “bro­ker deal­er”, “secu­ri­ties exchange”, “alter­na­tive trad­ing sys­tem”.

Not even in Mal­ta, not even with a VFA licence (the cryp­to licence), a secu­ri­ty token can be list­ed.

Gen­er­al­ly speak­ing, every such reg­u­lat­ed plat­form can list secu­ri­ties token how­ev­er not every bro­ker might want to, or might have the tech­ni­cal abil­i­ties or the autho­ri­sa­tion from the reg­u­la­tor — the cur­rent play­ers are very lim­it­ed.



If you are ready to take the next steps for your fundrais­ing via tokens:  We can advise you on the right way and we’ll walk this way with togeth­er with you.

Con­tact us to find out more about ICOs and STOs in Mal­ta.


About Philipp Sauerborn

In 2005, Philipp Sauer­born joined the firm of St. Matthew in Lon­don, one of the lead­ing Ger­man account­ing firms in Eng­land renowned for its exper­tise in cor­po­rate, com­mer­cial and tax law, as a depart­ment head. After three years, he was a part­ner and man­ag­ing direc­tor.
Towards the end of 2011, he decid­ed to move to Mal­ta, where he first worked at inter­na­tion­al law firms and con­sul­tan­cies in an employed and con­sult­ing capac­i­ty. Since the begin­ning of 2013, he has been a senior employ­ee at Dr. Wern­er & Part­ner. Mr. Sauer­born is cur­rent­ly com­plet­ing his ADIT ‑Advanced Diplo­ma in Inter­na­tion­al Tax.

View All Posts

Leave a Reply

Your email address will not be published.