State Blue Sky Laws and Security Token Offerings

State securities laws — commonly called “blue sky laws” after early judicial descriptions of speculative offerings selling “patches of blue sky” — add a layer of compliance on top of federal securities regulation for security token offerings. While federal preemption under NSMIA (the National Securities Markets Improvement Act of 1996) significantly reduces the state compliance burden for Reg D 506 and Reg A+ Tier 2 offerings, issuers must still navigate state notice filing requirements, and non-preempted offerings face the full weight of 50+ separate state regulatory regimes. With Reg D 506(c) accounting for 78% of all security token offering filings within a $2.15 trillion total Reg D market, and STO issuance growing from $5.6 billion in 2024 to $6.66 billion in 2025, blue sky compliance is an unavoidable component of offering planning for the expanding tokenized securities market.

Federal Preemption Framework

Covered Securities (Preempted from State Registration)

Section 18 of the Securities Act, as amended by NSMIA, preempts state registration and qualification requirements for “covered securities.” The following categories are relevant to security token offerings:

Reg D Rule 506 offerings. Both 506(b) and 506(c) securities are “covered securities” under Section 18(b)(4)(D). States cannot require registration, merit review, or qualification for these offerings. However, states retain the authority to require notice filings and collect fees.

Reg A+ Tier 2 offerings. Securities offered under Reg A+ Tier 2 are covered securities under Section 18(b)(4)(C). States cannot impose registration requirements but may require notice filings.

Securities listed on national exchanges. Not currently applicable to security tokens, as no security tokens are listed on national securities exchanges (NYSE, Nasdaq). ATS platforms are not national exchanges.

Non-Covered Securities (Subject to State Registration)

Reg A+ Tier 1 offerings. Securities offered under Reg A+ Tier 1 are not covered securities. Issuers must register or qualify in each state where they offer or sell tokens. This is the primary reason that over 92% of digital asset Reg A+ filings use Tier 2.

Rule 504 offerings. Rule 504 offerings (up to $10 million) are not preempted and must comply with state blue sky laws in each state where securities are offered or sold.

Intrastate offerings. Securities offered exclusively within a single state under Rule 147 or 147A are subject to that state’s blue sky laws.

State Notice Filing Requirements

Even for preempted offerings, most states require notice filings and fees. The mechanics vary by state:

Filing Deadlines

Filing Fees

State filing fees for Reg D notice filings range from $0 to $750+:

A security token offering with investors in all 50 states plus DC can incur $5,000-$15,000 in aggregate state filing fees. This is a standard cost included in the offering timeline budget.

Required Documents

Most state notice filings require:

• Copy of Form D as filed with the SEC.
• Consent to service of process (Form U-2 or state-specific form).
• Filing fee.
• State-specific cover page or supplemental form.

Some states additionally require: a copy of the PPM or subscription agreement, a disclosure of the identities of all investors in that state, or a summary of offering terms.

State Enforcement Authority

Preemption limits state registration requirements — but it does not limit state antifraud authority. Every state retains the power to investigate and prosecute fraudulent securities offerings, regardless of federal exemption status. This means:

Antifraud jurisdiction. State securities regulators (typically the state’s Secretary of State or Attorney General securities division) can bring enforcement actions against security token issuers for fraud, material misrepresentation, or omission of material facts — even for preempted Reg D 506 offerings.

Failure to file. State regulators can impose penalties for failure to make required notice filings. Several states have brought enforcement actions against token issuers that filed federal Form D but neglected state notice filings, resulting in fines ranging from $1,000 to $25,000 per state.

Investor complaints. State regulators receive and investigate investor complaints. A pattern of investor complaints can trigger a state investigation even if the federal offering exemption is properly maintained.

State Digital Asset-Specific Laws

Several states have enacted digital asset-specific securities legislation that affects security token offerings:

Wyoming. Wyoming’s Digital Asset Act (2019) and subsequent amendments create a favorable framework for digital assets, including recognition of digital asset property rights, custody definitions, and a sandbox for fintech companies. Wyoming’s approach has attracted numerous blockchain companies to incorporate in the state — 15% of digital security Form D issuers are incorporated in Wyoming.

Texas. The Texas State Securities Board has been active in both facilitating compliant digital asset offerings and enforcing against fraudulent ones. Texas issued emergency cease-and-desist orders against multiple unregistered crypto offerings between 2018 and 2022.

New York. The New York BitLicense (NYDFS) imposes additional requirements on companies engaged in digital asset business activities in New York. While the BitLicense is primarily aimed at money transmission (not securities), its broad definition of “virtual currency business activity” can capture aspects of security token platform operations.

Colorado. Colorado enacted a Digital Token Act in 2019 that exempts certain token sales from state securities registration — one of the first attempts to create a state-level safe harbor for token offerings. The exemption applies to tokens with a “primarily consumptive” purpose and does not cover security tokens.

Practical Compliance Strategies

For Reg D 506(c) Token Offerings

1. File federal Form D within 15 days of first sale.
2. Identify states where investors reside using KYC data collected during accredited investor verification.
3. File state notice filings in each identified state within the required deadline.
4. Budget $5,000-$15,000 for state filing fees.
5. Use a state notice filing service (e.g., through the broker-dealer or legal counsel) to manage multi-state filings efficiently.
6. File additional state notices as new investors in additional states subscribe during the offering.

For Reg A+ Tier 2 Token Offerings

1. Federal preemption eliminates state registration — no state qualification required.
2. Some states require notice filings and fees (simpler than Reg D filings).
3. State antifraud authority still applies — offering circular disclosures must be accurate and complete.

For Reg A+ Tier 1 Token Offerings

1. Register or qualify in each state where tokens will be offered or sold.
2. Consider NASAA coordinated review program to streamline multi-state filing.
3. Budget $50,000-$150,000 for state blue sky compliance.
4. Allow 2-4 additional months for state review beyond SEC qualification timeline.
5. Prepare for merit review in approximately 15 states that apply “fair, just, and equitable” standards.

State Enforcement Activity

While federal preemption shields most security token offerings from state registration requirements, state regulators remain active in enforcement:

State cease-and-desist actions. State securities regulators have issued over 200 cease-and-desist orders against crypto-related offerings since 2017. NASAA’s “Operation Cryptosweep” in 2018 resulted in 70 enforcement actions across 40 states, targeting offerings that failed to comply with both federal and state registration requirements.

State fraud actions. Even for federally preempted offerings, state regulators retain authority to bring fraud actions. Material misrepresentations or omissions in Reg D 506(c) or Reg A+ offerings can trigger state enforcement regardless of federal preemption status.

Broker-dealer state licensing. Broker-dealers distributing security tokens must maintain state registrations (or claim applicable exemptions) in each state where they solicit investors. FINRA membership provides a basis for state registration through the Central Registration Depository (CRD) system, but state-specific filing requirements vary.

State enforcement coordination with the SEC. State securities regulators frequently coordinate enforcement with the SEC through NASAA. The SEC brought 125 cryptocurrency-related enforcement actions between 2021 and 2024 according to Cornerstone Research — many triggering parallel state actions. When the SEC files an enforcement action against a token issuer for federal securities violations, state regulators may simultaneously file parallel state actions for failure to make required notice filings. This dual-enforcement exposure means that blue sky non-compliance creates two layers of regulatory risk — federal enforcement risk for the substantive securities violation and state enforcement risk for the notice filing failure. Token issuers using platforms like Securitize or tZERO should confirm that state filing obligations are being tracked and met by either the platform or the issuer’s legal counsel.

Emerging State Regulatory Trends

Several states have established or are developing digital asset-specific regulatory frameworks that interact with blue sky requirements:

Wyoming’s comprehensive framework. Wyoming has enacted over 30 digital asset-related laws since 2018, creating one of the most comprehensive state-level regulatory frameworks in the country. Wyoming’s Special Purpose Depository Institution (SPDI) charter allows banks to provide custody services for digital assets, and the state’s property law recognizes digital assets as personal property. For security token issuers, Wyoming incorporation provides favorable blue sky treatment for in-state offerings while not affecting federal preemption for interstate offerings under Reg D 506.

Uniform Securities Act updates. NASAA has been working on model provisions to address digital assets within the Uniform Securities Act framework. These model provisions, if adopted by states, would provide more consistent treatment of security token offerings across jurisdictions, reducing the compliance variation that currently exists. As of early 2026, approximately 15 states have adopted some form of digital asset-specific guidance within their blue sky frameworks.

State sandbox programs. Several states — including Arizona, Nevada, Utah, and West Virginia — have established regulatory sandbox programs that provide temporary exemptions from certain state licensing requirements for innovative financial products, including security token offerings. These sandboxes typically last 24 months and allow issuers to test token offerings with limited numbers of state residents before seeking full compliance. While sandbox participation does not affect federal requirements, it can reduce the state-level compliance burden for issuers testing market demand before committing to a full offering.

Federal Legislative Developments Affecting Blue Sky Compliance

Several federal legislative initiatives under consideration in 2025-2026 could reshape the interaction between federal and state securities regulation for digital assets:

GENIUS Act. The stablecoin framework legislation advancing through Congress in early 2026 would establish federal standards for stablecoin issuers that preempt certain state money transmitter requirements. While not directly addressing securities blue sky laws, the GENIUS Act’s federal preemption model could serve as a template for future digital asset legislation that expands federal preemption of state securities registration for compliant token offerings.

FIT21 Act. The Financial Innovation and Technology for the 21st Century Act would create a dual SEC-CFTC regulatory framework with a certification process for tokens transitioning from securities to commodities. If enacted, tokens that achieve “digital commodity” status through the certification process would no longer be subject to state blue sky securities requirements — creating a powerful incentive for token issuers to pursue the certification pathway.

SEC Crypto Task Force guidance. The Task Force’s six roundtables through Q1 2026 — including discussions on trading, custody, and tokenization — have addressed how existing federal frameworks interact with state regulation. The March 2026 SEC-CFTC joint token taxonomy guidance provides initial classification standards that could influence state regulators’ treatment of digital assets. The December 11, 2025 SEC no-action letter allowing the DTC to operate tokenization services on permissionless blockchains may further integrate tokenized securities into existing federal preemption frameworks, as DTC-settled securities benefit from established federal preemption rules.

For the Reg D 506(c) framework, see our comprehensive guide. For Reg A+ Tier 1 vs. Tier 2 comparison, see our analysis. For the offering timeline incorporating blue sky compliance, see our checklist. For Form D filing requirements that trigger state notice obligations, see our guide. For enforcement context including state actions, see our tracker. For NASAA’s coordinated review program, see NASAA Regulation A Coordinated Review.