Bybit Fintech FZE, the Dubai arm of the Bybit crypto exchange, now holds a full licence from Dubai’s Virtual Assets Regulatory Authority (VARA) for exchange services, the company announced on Thursday 22 October 2026. VARA’s public register lists the licence as active, under reference VL/26/10/003, with an issue date of Tuesday 20 October. The Bybit Dubai license covers spot trading only.
Derivatives, the products on which Bybit built most of its global business, are not part of it. Neither is a start date. Bybit has not said when customers in Dubai will be able to trade, and according to Cointelegraph the exchange still has to complete VARA’s launch process before it can open the service.
We checked the register on 23 October at about 10:45 UTC and it showed the entry as active. The page had not always said so. CoinLaw reported on 22 October that, when it looked, the register still listed a Bybit Fintech FZE entry as “Pending”, under another reference, VL/24/08/001. The register does not explain the change, and we found no statement from VARA about it.
What the Bybit Dubai license covers, and what it leaves out
The register entry is short. It names “Bybit Fintech FZE (Bybit)”, a VASP (virtual asset service provider) licence, one licensed activity, Exchange Services, and a registration number with the UAE’s Capital Market Authority, CMA-VASP-1000000-0006. Cointelegraph, which also read the register, reports that the licence allows services to retail, qualified and institutional investors.
Bybit’s own press release, distributed through PR Newswire, describes the scope as spot trading. Derivatives do not appear among the licensed activities on the register, and the release treats them as a later step that would need further regulatory approval.
Peter Loo, Bybit’s chief legal and compliance officer, put the gap plainly in the release: “Derivatives are a major part of Bybit’s global trading business.” He said that “in time, we also hope to expand our licensed activities to include derivatives”, subject to the necessary regulatory approvals. “In time” is the only timing he gave. We found no press statement from VARA on the licence.
Co-founder and chief executive Ben Zhou spoke about the city rather than the product. “Dubai has made significant progress in building a regulatory environment for virtual assets,” he said in the release. The company says it has more than 80 million users worldwide.
Spot trading in Dubai is not live yet
A licence on the register does not mean an open order book. According to Cointelegraph, Bybit must still finish VARA’s launch process and meet its operational requirements before offering spot trading in Dubai. The company gave no launch date in its announcement.
A Bybit spokesperson told Cointelegraph that the entity’s previous in-principle approval from VARA was non-operational and did not allow it to serve customers in Dubai. The spokesperson declined to comment on how the new licence differs from the federal approval Bybit received in 2025, or on whether the earlier licence permitted services in Dubai.
That leaves several practical points open for anyone in Dubai who wants to use the service: when accounts can trade, which coins and trading pairs will be listed, what fees apply and whether VARA attached conditions to the licence. None of this is in the release or on the register page.
From in-principle approval to a full licence: four years of steps
Bybit has been working toward a Dubai licence since 2022, when VARA itself was created. The regulator says on its about page that it was set up in March 2022 under Law No. 4 of 2022. Bybit received an in-principle approval to operate in the UAE the same month, according to Finance Magnates.
The dates do not all line up across sources. Bybit’s release says the company established its international headquarters in Dubai in 2022; Finance Magnates reported in June 2023 that the move of the headquarters took place in April 2023. The table gives the steps as each source reports them.
| Date | Step | Source |
|---|---|---|
| March 2022 | In-principle approval to operate in the UAE | Finance Magnates |
| 2022 / April 2023 | International headquarters set up in Dubai (2022 per Bybit; April 2023 per Finance Magnates) | Bybit release, Finance Magnates |
| 27 June 2023 | VARA MVP preparatory licence for Bybit FinTech FZE announced, no trading services allowed | Finance Magnates |
| 21 August 2024 | VARA in-principle, non-operational approval for Exchange Services, reference IPA/24/08/001 | CoinLaw, citing a VARA register page |
| 9 October 2025 | Full Virtual Asset Platform Operator licence from the federal Securities and Commodities Authority (SCA) | Cointelegraph |
| 20 October 2026 | Full VARA VASP licence for Exchange Services issued, reference VL/26/10/003 | VARA public register |
| 22 October 2026 | Licence announced by Bybit | Bybit release via PR Newswire |
The 2023 preparatory licence was an early step in VARA’s process: under it, Finance Magnates wrote, Bybit could not provide crypto trading services. Zhou still called it “a significant milestone” at the time. The August 2024 in-principle approval is the stage at which, according to VARA’s description cited by CoinLaw, an applicant completes the remaining requirements for a full licence. It did not let Bybit open for Dubai customers either, as the spokesperson confirmed.
Two UAE licences, two Bybit companies
The October 2025 licence came from the SCA, the federal securities regulator of the United Arab Emirates, and is held by a different company, Bybit Virtual Asset Platform Operator LLC. Cointelegraph’s report on that approval did not say it covered Dubai.
Bybit’s list of service-restricted countries points the same way. When we checked it on 23 October, it carried one line specific to that company: in the case of Bybit Virtual Asset Platform Operator LLC, Dubai is restricted. Cointelegraph reads this as Dubai being excluded from what the SCA-licensed entity may serve. Bybit has not confirmed that reading, but it would explain why the Dubai route needed its own VARA licence.
VARA, DFSA and SCA: who licenses crypto firms in Dubai
Dubai has more than one financial regulator, which makes headlines about a “Dubai licence” easy to mix up. VARA says it regulates virtual assets across the emirate, on the mainland and in its free zones, except within the Dubai International Financial Centre (DIFC). The DIFC has its own regulator, the Dubai Financial Services Authority (DFSA).
The difference showed up on the same day. Robinhood announced on 22 October a DFSA authorization for its Middle East unit, which sits in the DIFC; we covered it in our report on Robinhood’s DFSA authorization in Dubai. Bybit’s licence comes from VARA and covers a company outside the DIFC. The SCA, for its part, works at federal level across the UAE.
So the useful question for a customer is which Bybit company holds the account. Each licence sits with one legal entity, and that entity’s terms decide which regulator stands behind it.
After the 2025 hack, a run of new licences
Bybit’s regulatory push follows the hack that still dominates its record. On 21 February 2025, about 401,000 ETH, worth roughly $1.4 billion to $1.5 billion at the time depending on the source, was taken from one of Bybit’s Ethereum cold wallets during a routine transfer. Investigators attributed the attack to North Korea’s Lazarus Group.
Within days Bybit had brought in about 446,870 ETH through loans, whale deposits and purchases, close to 88% of what was stolen, according to Lookonchain data cited by Cointelegraph. Bitget lent 40,000 ETH without interest or collateral, and Bybit returned it on 25 February. Only a small part of the stolen funds was frozen or recovered. The Block reported that exchanges helped freeze $42.89 million in one day, that mETH Protocol recovered 15,000 cmETH worth about $43 million, and that Tether froze 181,000 USDT. The episode remains the reference point for crypto security statistics; Hacken’s latest figures, in our piece on $1.18 billion stolen in the third quarter of 2026, describe that quarter as the worst since Bybit.
Since then the exchange has collected licences. In his October keynote, according to the release, Zhou said Bybit obtained five new licences and regulatory approvals in 2026, in the European Union, the Cayman Islands, Indonesia, South Africa and El Salvador. Dubai now joins that list, though only for spot.
Bybit allowed countries: what changes for EU and US readers
For readers in the European Union, nothing changes. Clients in the European Economic Area are served by Bybit EU, based in Vienna, which obtained a licence under the EU’s MiCA rules from Austria’s Financial Market Authority (FMA), as Cointelegraph reported on 29 May 2025. Under MiCA, that licence lets Bybit EU serve clients across the European Economic Area. The Dubai licence belongs to another company and does not touch that arrangement.
When we checked Bybit’s restricted-countries page on 23 October, it did not list France or Italy. French and Italian users who open an account through Bybit EU deal with a company supervised in Austria under MiCA, not with the Dubai entity. Our guide to the MiCA regulation explains what that licence requires and how passporting works. BingX took the same Vienna route, as we reported in our article on BingX’s Austrian MiCA licence.
In the United States, the answer is also unchanged. Bybit’s restricted-countries page excludes the United States, and a licence in Dubai does nothing to open the US market, where any crypto exchange serving residents answers to US federal and state rules.
For the Dubai market, the licence puts Bybit’s spot business under VARA’s rulebook. The larger part of what offshore exchanges sell, blockchain, dove gli utenti scambiano token direttamente dal proprio wallet senza affidare la custodia dei fondi a una società.">swap perpetui) sono derivati che replicano pool di un market maker automatico divergono, rispetto a tenere semplicemente gli stessi token. Diventa definitiva al prelievo.">il prezzo di un'attività con leva ma senza scadenza. Un funding tra long e short, regolato ogni poche ore, tiene il contratto vicino al prezzo spot o all'indice.">perpetual futures and other derivatives, remains outside Bybit’s Dubai licence for now. Our Bybit review covers the exchange’s fees, products and security record.
What is still unknown
- The launch date of spot trading for Dubai customers, which Bybit has not given.
- The coins, trading pairs and fees that will be offered under the VARA licence.
- Any conditions VARA attached to the licence; the regulator has published no statement about it.
- Whether Bybit’s earlier UAE licences allowed any service to Dubai residents; its spokesperson declined to comment.
- When, or whether, Bybit will apply for derivatives in Dubai; the release says only “in time”.
The next thing to watch is the end of VARA’s launch process for Bybit. Only after that can the company announce when Dubai customers can trade, and on which markets.